[Git][security-tracker-team/security-tracker][master] Revert "Mark bookworm as not-affected by CVE-2026-46469 + CVE-2026-46470"

[Santiago R.R. (@santiago)]

Santiago R.R. pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d38d88da by Santiago Ruano Rincón at 2026-10-25T15:25:54-03:00
Revert "Mark bookworm as not-affected by CVE-2026-46469 + CVE-2026-46470"

This reverts commit 976809e0550a5e57d72acce3aa3b62cd0cf8157a.

The division by zero crashes happen in qtdemux_parse_trak() and
qtdemux_audio_caps(), which are functions introduced prior to 1.25.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -178447,25 +178447,21 @@ CVE-2026-4029 (The Database Backup for WordPress plugin for WordPress is vulnera
 CVE-2026-46470 (An issue was discovered in GStreamer gst-plugins-good before 1.28.2. W ...)
 	{DSA-6318-1}
 	- gst-plugins-good1.0 1.28.2-1
-	[bookworm] - gst-plugins-good1.0 <not-affected> (Vulnerable code introduced later)
 	NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0018.html
 	NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11243
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/dbd4cb49e72836d2372de2d2043d28c7a7fce9c4 (1.28.2)
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/10fd1abfdb793641b4eb0454478e01fd74648d5c (1.28.2)
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/34418818730bc04e41f512e65331b3f206cb5eb9 (1.28.2)
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/dc7ab66ab23a054eaa942071cfb548d47fe4ca2f (1.28.2)
-	NOTE: Vulnerable code introduced in > 1.25, see https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8171
 CVE-2026-46469 (An issue was discovered in GStreamer gst-plugins-good before 1.28.2. W ...)
 	{DSA-6318-1}
 	- gst-plugins-good1.0 1.28.2-1
-	[bookworm] - gst-plugins-good1.0 <not-affected> (Vulnerable code introduced later)
 	NOTE: https://gstreamer.freedesktop.org/security/sa-2026-0018.html
 	NOTE: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11243
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/dbd4cb49e72836d2372de2d2043d28c7a7fce9c4 (1.28.2)
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/10fd1abfdb793641b4eb0454478e01fd74648d5c (1.28.2)
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/34418818730bc04e41f512e65331b3f206cb5eb9 (1.28.2)
 	NOTE: Fixed by: https://gitlab.freedesktop.org/gstreamer/gstreamer/-/commit/dc7ab66ab23a054eaa942071cfb548d47fe4ca2f (1.28.2)
-	NOTE: Vulnerable code introduced in > 1.25, see https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/8171
 CVE-2026-45448 (CWE-601 URL redirection to untrusted site ('open redirect'))
 	- ntopng <removed>
 CVE-2026-45375 (SiYuan is an open-source personal knowledge management system. Prior t ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d38d88da128ffef4f5d4667461bf2d9658af1649

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d38d88da128ffef4f5d4667461bf2d9658af1649
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261025/c0a304ac/attachment.htm>