[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Mon Oct 26 19:58:57 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
89e14b6f by Moritz Muehlenhoff at 2026-10-26T20:58:29+01:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1011,23 +1011,28 @@ CVE-2026-116047 (A vulnerability has been found in Privoce Vocechat up to 0.9.12
NOT-FOR-US: Privoce Vocechat
CVE-2026-115825 (HTTP::Server::PSGI versions before 1.0056 for Perl allow a single requ ...)
- libplack-perl 1.0057-1 (bug #1152055)
+ [trixie] - libplack-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625163/
NOTE: Fixed by: https://github.com/plack/Plack/commit/11545871cadc5df1b744cebb429cfeb4ebc1069a (1.0056)
CVE-2026-115824 (Starman versions before 0.4019 for Perl allow memory exhaustion via un ...)
- starman 0.4019-1 (bug #1152054)
+ [trixie] - starman <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625161/
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/d789a02dbe5408ef5f7a4659078d0008dd84c308 (0.4019)
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf (0.4019)
CVE-2026-115823 (Starman versions before 0.4019 for Perl send response bodies for HEAD ...)
- starman 0.4019-1 (bug #1152054)
+ [trixie] - starman <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625160/
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/91c47c529cd1e100f938486896ea9083ec3ec7bf (0.4019)
CVE-2026-115822 (Starman versions before 0.4019 for Perl allow CPU exhaustion via quadr ...)
- starman 0.4019-1 (bug #1152054)
+ [trixie] - starman <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625157/
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/0f33f9b132b5e410d6cce722ff71988e22476acf (0.4019)
CVE-2026-115817 (Starman versions before 0.4019 for Perl allow a stalled request body t ...)
- starman 0.4019-1 (bug #1152054)
+ [trixie] - starman <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44625155/
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/89dffd3bdc9baa1cbe1b48a43615586ba2588558 (0.4019)
NOTE: Fixed by: https://github.com/miyagawa/Starman/commit/a30533c03051502d6b67cd48b3a95a61e129691b (0.4019)
@@ -1115,6 +1120,7 @@ CVE-2026-116015 (yudao-cloud through 2026.09 contains an insecure direct object
NOT-FOR-US: yudao-cloud
CVE-2026-116014 (open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataTy ...)
- open62541 <unfixed>
+ [trixie] - open62541 <no-dsa> (Minor issue)
NOTE: https://github.com/open62541/open62541/commit/0cf4806768c493bc6ccffcd4419da24153b970ec (v1.5.7)
CVE-2026-116013 (OpenResty lua-resty-dns before 0.24 contains an improper input validat ...)
- lua-nginx-dns <unfixed>
@@ -1532,6 +1538,7 @@ CVE-2026-115774 (Twisted is an event-based framework for internet applications,
NOTE: Fixed by: https://github.com/twisted/twisted/commit/3d125548bcbe955007cb97f480bb699a5e074741 (twisted-26.10.0rc1)
CVE-2026-115754 (serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scr ...)
- node-serialize-javascript 7.1.4+~5.0.4-1 (bug #1151937)
+ [trixie] - node-serialize-javascript <no-dsa> (Minor issue)
NOTE: https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-m5mm-p8h7-m29v
NOTE: https://github.com/yahoo/serialize-javascript/pull/235
NOTE: Fixed by: https://github.com/yahoo/serialize-javascript/commit/2864b3c6260a3bfd52d2db3e70d1a079de108a61 (v7.1.3)
@@ -1544,7 +1551,7 @@ CVE-2026-115750 (mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential
CVE-2026-115749 (hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0 ...)
NOT-FOR-US: hydra-ray-launcher
CVE-2026-115730 (i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUr ...)
- - node-i18next-http-backend <not-affected> ((Incomplte fix for CVE-2026-41691 and CVE-2026-105800 not appled)
+ - node-i18next-http-backend <not-affected> (Incomplete fix for CVE-2026-41691 and CVE-2026-105800 not applied)
NOTE: https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5
NOTE: Fixed by: https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7 (v4.0.3)
CVE-2026-115729 (@pdfme/common from 5.5.10 before 6.2.6 contains a server-side request ...)
@@ -3008,6 +3015,7 @@ CVE-2026-13411 (Mattermost versions 11.7.x <= 11.7.11 fail to validate null elem
- mattermost-server <itp> (bug #823556)
CVE-2026-115638 (OpenStack Ironic through 39.0.1 allows a denial of service via a confi ...)
- ironic <unfixed>
+ [trixie] - ironic <no-dsa> (Minor issue)
NOTE: https://bugs.launchpad.net/ironic/+bug/2171814
CVE-2026-115547 (An input validation issue in the Okta Access Gateway (OAG) Admin Conso ...)
NOT-FOR-US: Okta
@@ -3079,6 +3087,7 @@ CVE-2026-115450 (External Control of Assumed-Immutable Web Parameter (CWE-472) i
NOT-FOR-US: Ecommerce Template
CVE-2026-115449 (A flaw was found in libslirp. When handling ICMP echo requests, the re ...)
- libslirp <unfixed>
+ [trixie] - libslirp <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2558916
NOTE: https://gitlab.freedesktop.org/slirp/libslirp/-/work_items/105
NOTE: Fixed by: https://gitlab.freedesktop.org/slirp/libslirp/-/commit/262c9be27bc79e16b369807b460be77e23c3d788
@@ -3293,6 +3302,7 @@ CVE-2026-114665 (Goploy 1.18.0 before 1.18.1 contains a link following vulnerabi
NOT-FOR-US: Goploy
CVE-2026-114655 (libmongocrypt builds requests to external key management services (AWS ...)
- libmongocrypt 1.21.1-1
+ [trixie] - libmongocrypt <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/MONGOCRYPT-963
NOTE: https://github.com/mongodb/libmongocrypt/security/advisories/GHSA-7mvq-mg47-m88j
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/a83b565593e906710a7d61121ac44ffc190eb21c (1.21.1)
@@ -4617,6 +4627,7 @@ CVE-2026-110369 (Deserialization of Untrusted Data vulnerability in GS Plugins W
NOT-FOR-US: WordPress plugin or theme
CVE-2026-110353 (HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to c ...)
- haproxy 3.2.26-1
+ [trixie] - haproxy <no-dsa> (Minor issue)
NOTE: https://git.haproxy.org/?p=haproxy.git;a=commit;h=cec63e95f62a7412484f1134f5aa227e5b7e1466 (v3.5-dev9)
NOTE: https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=31a657a0ea846a42fa3eac2409de88f0dce9e2af (v3.2.26)
NOTE: https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=e1672c9ca04c81b544a60e316eb2bb4af02381e1 (v3.0.30)
@@ -4988,12 +4999,15 @@ CVE-2026-92997 (The Click n Chat (Chat Widget Integration) WordPress plugin befo
NOT-FOR-US: WordPress plugin
CVE-2026-92824 (A flaw was found in libmodulemd. In the module stream v2 rpm-map emiss ...)
- libmodulemd <unfixed>
+ [trixie] - libmodulemd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478495
CVE-2026-92823 (A flaw was found in libmodulemd. In builds with rpmio support enabled, ...)
- libmodulemd <unfixed>
+ [trixie] - libmodulemd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478703
CVE-2026-92822 (A flaw was found in libmodulemd. When parsing module metadata, the xmd ...)
- libmodulemd <unfixed>
+ [trixie] - libmodulemd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2479002
CVE-2026-92559 (IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a rem ...)
NOT-FOR-US: IBM
@@ -9655,6 +9669,7 @@ CVE-2026-111761 (A2A Java SDK is the official Java SDK for the Agent2Agent (A2A)
NOT-FOR-US: A2A Java SDK
CVE-2026-111756 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
- node-follow-redirects 1.16.1+~1.14.4-1 (bug #1151931)
+ [trixie] - node-follow-redirects <no-dsa> (Minor issue)
NOTE: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-q3jh-wrc6-jgq8
NOTE: Fixed by: https://github.com/follow-redirects/follow-redirects/commit/9865ca45490e4d0f7b6944870318408344570aff (v1.16.1)
CVE-2026-111090 (A logic error exists in the signature verification routine resulting i ...)
@@ -10371,10 +10386,12 @@ CVE-2026-77395
NOTE: https://github.com/containerd/stargz-snapshotter/security/advisories/GHSA-6j84-h5gg-w3gr
CVE-2026-108518 (DBI versions before 1.656 for Perl crash via type confusion in dbi_pro ...)
- libdbi-perl 1.656-1 (bug #1151666)
+ [trixie] - libdbi-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44513047/
NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2 (1.656)
CVE-2026-111879 (DBI versions before 1.656 for Perl hang on a later open of a DBD::DBM ...)
- libdbi-perl 1.656-1 (bug #1151666)
+ [trixie] - libdbi-perl <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44513053/
NOTE: Fixed by: https://github.com/perl5-dbi/dbi/commit/99bbf2ab9d137e6f042a770bd3bbba3bc0b3a901 (1.656)
CVE-2026-111946 (Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclo ...)
@@ -10667,6 +10684,7 @@ CVE-2026-112368 (An uncontrolled recursion weakness in the BSON decoding logic o
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/01363996a93b33fea58c90f5e8d1eaea5e01eafd (2.5.5, 2.1.12, 1.21.12)
CVE-2026-112366 (Picomatch through 4.0.7 contains a regular expression denial of servic ...)
- node-anymatch <unfixed>
+ [trixie] - node-anymatch <no-dsa> (Minor issue)
NOTE: https://github.com/micromatch/picomatch/pull/194
NOTE: node-anymatch provides node-picomatch
CVE-2026-112363 (Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forge ...)
@@ -10939,6 +10957,7 @@ CVE-2026-111757 (Hono is a Web application framework that provides support for a
NOT-FOR-US: Hono
CVE-2026-111755 (follow-redirects is a Node.js HTTP and HTTPS client wrapper that autom ...)
- node-follow-redirects 1.16.1+~1.14.4-1 (bug #1151930)
+ [trixie] - node-follow-redirects <no-dsa> (Minor issue)
NOTE: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-8r9p-f939-6h3c
NOTE: Fixed by: https://github.com/follow-redirects/follow-redirects/commit/080a76d0e125b37bf81717368a61d5dc37aa56c8 (v1.16.1)
CVE-2026-111750 (AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...)
@@ -14777,6 +14796,7 @@ CVE-2026-104003 (The WP User Avatar / ProfilePress plugin for WordPress is vulne
NOT-FOR-US: WordPress plugin
CVE-2026-102941 (The package github.com/gomarkdown/markdown is a Go library for parsing ...)
- golang-github-gomarkdown-markdown 0.0~git20260725.8435af3-1
+ [trixie] - golang-github-gomarkdown-markdown <no-dsa> (Minor issue)
NOTE: https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7
NOTE: Fixed by: https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9
CVE-2026-102923 (SparkyFitness is a self-hosted, AI-powered health and fitness tracker ...)
@@ -20877,6 +20897,7 @@ CVE-2026-110453 (Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorr
NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-92x5-h528-wrmw
CVE-2026-110452 (The multi-user installer in Nix before 2.35.3 sets the ownership of st ...)
- nix <unfixed> (bug #1151197)
+ [trixie] - nix <no-dsa> (Minor issue)
NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-hf6w-2rg9-v84g
CVE-2026-110451 (Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sand ...)
@@ -20886,10 +20907,12 @@ CVE-2026-110451 (Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbe
NOTE: scripts/install-multi-user.sh is removed from the orig tarball since 2.16.1+dfsg-1
CVE-2026-110450 (Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via ...)
- nix <unfixed> (bug #1151197)
+ [trixie] - nix <no-dsa> (Minor issue)
NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-jwvx-xq5j-gc56
CVE-2026-110449 (Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and r ...)
- nix <unfixed> (bug #1151197)
+ [trixie] - nix <no-dsa> (Minor issue)
NOTE: https://discourse.nixos.org/t/security-advisory-for-nix-and-lix-october-2026/80547
NOTE: https://github.com/NixOS/nix/security/advisories/GHSA-25vp-6h23-hj3g
CVE-2026-110447 (Collabora Online Built-in CODE Server before 26.4.303 (richdocumentsco ...)
@@ -31492,7 +31515,7 @@ CVE-2026-105804 (Payload is a free and open source headless content management s
CVE-2026-105801 (openapi-python-client generates Python clients from OpenAPI documents. ...)
NOT-FOR-US: openapi-python-client
CVE-2026-105800 (i18next-http-backend is a backend layer for i18next that loads transla ...)
- - node-i18next-http-backend <not-affected> (Incomplte fix for CVE-2026-41691 not applied)
+ - node-i18next-http-backend <not-affected> (Incomplete fix for CVE-2026-41691 not applied)
NOTE: https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf
NOTE: Fixed by: https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85 (v4.0.2)
CVE-2026-105799 (LangChain is a framework for building LLM-powered applications. Prior ...)
@@ -48115,6 +48138,7 @@ CVE-2026-XXXX [GHSA-86ch-j429-fpr2: HEVC size limits can be skipped before decod
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-86ch-j429-fpr2
CVE-2026-XXXX [GHSA-vr5j-9r89-725x: CPU amplification in unci decode path surviving GHSA-24wx-9w62-c96w fix]
- libheif <unfixed>
+ [trixie] - libheif <no-dsa> (Minor issue)
NOTE: https://github.com/strukturag/libheif/security/advisories/GHSA-vr5j-9r89-725x
CVE-2026-XXXX [GHSA-hqpw-h8p6-22q9: Heap out-of-bounds read in the FFmpeg decoder plugin: input passed to av_parser_parse2() without padding]
- libheif 1.23.6-1
@@ -185291,6 +185315,7 @@ CVE-2026-41692 (i18nextify is a JavaScript library that adds website internation
NOT-FOR-US: Node i18nextify
CVE-2026-41691 (Copilot said: i18nextify is a JavaScript library that adds i18nextify ...)
- node-i18next-http-backend <unfixed> (bug #1150648)
+ [trixie] - node-i18next-http-backend <no-dsa> (Minor issue)
NOTE: https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g
NOTE: Fixed by: https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621 (v3.0.5)
NOTE: When fixing this issue make sure to make the fix complete and not open up CVE-2026-105800
=====================================
data/dsa-needed.txt
=====================================
@@ -59,6 +59,8 @@ freerdp3 (jmm)
gegl (jmm)
move to 0.4.72
--
+gimp
+--
graphicsmagick
--
gst-plugins-good1.0 (jmm)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89e14b6f2592aaddf88a5f99e54a15879e1c487f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89e14b6f2592aaddf88a5f99e54a15879e1c487f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261026/10b578ee/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list