[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Mon Oct 26 22:17:30 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ba0bd6aa by Moritz Muehlenhoff at 2026-10-26T23:16:22+01:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -803,6 +803,7 @@ CVE-2026-116197 (Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a
NOT-FOR-US: Edgeless Systems Contrast
CVE-2026-116196 (Rclone before v1.75.2 contains a credential exposure vulnerability in ...)
- rclone 1.75.2-1
+ [trixie] - rclone <no-dsa> (Minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-gpw7-77cq-9f72
CVE-2026-116195 (Rclone before 1.75.2 contains a path traversal vulnerability in the lo ...)
- rclone <not-affected> (Incomplete fix never released in a Debian unstable version)
@@ -810,6 +811,7 @@ CVE-2026-116195 (Rclone before 1.75.2 contains a path traversal vulnerability in
NOTE: CVE exists because of an incomplete fix for CVE-2026-71313
CVE-2026-116194 (Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery ...)
- rclone 1.75.2-1
+ [trixie] - rclone <no-dsa> (Minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-hvpr-p4pv-4f46
CVE-2026-116193 (Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vul ...)
- rclone 1.75.2-1
@@ -818,18 +820,24 @@ CVE-2026-116193 (Rclone from 1.64.0 before 1.75.2 contains an authentication byp
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-gj73-fh6v-92fj
CVE-2026-116192 (rclone from 1.37 before 1.74.2 contains a server-side request forgery ...)
- rclone 1.75.2-1
+ [trixie] - rclone <no-dsa> (Minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-xqmq-v4wj-rw5m
CVE-2026-116191 (Rclone before 1.75.2 contains a path traversal vulnerability in serve ...)
- rclone 1.75.2-1
+ [trixie] - rclone <no-dsa> (Minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-44pm-2q5p-fm63
CVE-2026-116190 (rclone from v1.56.0 before v1.75.2 contains an information disclosure ...)
- rclone 1.75.2-1
+ [trixie] - rclone <no-dsa> (Minor issue)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-3rqf-7h69-gg5v
CVE-2026-116189 (rclone from 1.55.0 before 1.75.2 contains a signature verification byp ...)
- - rclone 1.75.2-1
+ - rclone 1.75.2-1 (unimportant)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-w33h-3qgq-8mv8
+ NOTE: Not relevant for rclone as packaged in Debian
CVE-2026-116188 (rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overf ...)
- rclone 1.75.2-1
+ [trixie] - rclone <not-affected> (Vulnerable code not present)
+ [bookworm] - rclone <not-affected> (Vulnerable code not present)
NOTE: https://github.com/rclone/rclone/security/advisories/GHSA-qjw8-8hmp-c3m6
CVE-2026-116187 (Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vu ...)
- rclone 1.75.2-1
@@ -4869,6 +4877,7 @@ CVE-2026-94423 (Net::LibSSH versions before 0.004 for Perl authenticate to an un
NOT-FOR-US: Net::LibSSH Perl module
CVE-2026-94140 (Rex versions through 1.16.1 for Perl accept an unknown SSH host key fo ...)
- rex <unfixed> (bug #1151676)
+ [trixie] - rex <no-dsa> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44533736/
CVE-2026-113811 (Algorithm::UrataniTakeda versions from 0.1.5 before 0.1.7 for Perl all ...)
NOT-FOR-US: Algorithm::UrataniTakeda Perl module
@@ -10189,8 +10198,10 @@ CVE-2026-110095 (fast-uri is a dependency-free RFC 3986 URI parser and serialize
NOTE: Embedded fast-uri used and provided as node-fast-uri, starting with forky
NOTE: https://github.com/fastify/fast-uri/security/advisories/GHSA-xhq7-xmqj-769h
CVE-2026-109831 (UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user o ...)
- - unrtf 0.21.13-1
+ - unrtf 0.21.13-1 (unimportant)
NOTE: https://savannah.gnu.org/news/?id=10925
+ NOTE: https://hg.savannah.gnu.org/hgweb/unrtf/rev/e2d3a5f8e9fe625e606be721fee3613b8282908c
+ NOTE: Crash in CLI tool, no security impact
CVE-2026-109444 (OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulner ...)
NOT-FOR-US: OpenSRE
CVE-2026-109443 (JoySafeter through 1.0.0 contains a remote code execution vulnerabilit ...)
@@ -15443,6 +15454,7 @@ CVE-2026-88794 (Enterprise Architect is vulnerable to XML External Entity (XXE)
NOT-FOR-US: Enterprise Architect
CVE-2026-88753 (A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extra ...)
- python-markdown2 <unfixed> (bug #1151085)
+ [trixie] - python-markdown2 <no-dsa> (Minor issue)
NOTE: https://gist.github.com/NanaSec/354b4188bbd7f4105008c7b8be49b0ba
CVE-2026-87029 (undici is an HTTP client library for Node.js. In versions 7.15.0 throu ...)
- node-undici 8.12.2+dfsg+~cs3.2.3-1
@@ -22768,6 +22780,7 @@ CVE-2026-105881 (Improper Neutralization of Input During Web Page Generation ('C
NOT-FOR-US: WordPress plugin or theme
CVE-2026-105460 (A flaw was found in BlueZ. An out-of-bounds read vulnerability exists ...)
- bluez <unfixed> (bug #1150900)
+ [trixie] - bluez <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2545923
NOTE: https://github.com/bluez/bluez/issues/2687
CVE-2026-105445 (An Incorrect Privilege Assignment vulnerability in Docker Hub's accoun ...)
@@ -27609,30 +27622,37 @@ CVE-2026-4894 (A vulnerability has been identified regarding insufficient valida
NOT-FOR-US: Frappe
CVE-2026-44038 (A global out-of-bounds read in the Huffman decoder of the bundled IJG ...)
- dcmtk <unfixed> (bug #1150506)
+ [trixie] - dcmtk <no-dsa> (Minor issue)
NOTE: https://support.dcmtk.org/redmine/issues/1221
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/d6ae1bc8d5b9ae9c7300013c8c85cc2ea0fd8cf5
CVE-2026-44037 (Uncontrolled mutual recursion between DcmJSONReader::parseDataSet(), D ...)
- dcmtk <unfixed> (bug #1150505)
+ [trixie] - dcmtk <no-dsa> (Minor issue)
NOTE: https://support.dcmtk.org/redmine/issues/1225
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/cf955e64c35a1e07ba10698f639d5dcdec53b9d7
CVE-2026-44036 (Uncontrolled mutual recursion between DcmXMLParseHelper::parseDataSet( ...)
- dcmtk <unfixed> (bug #1150504)
+ [trixie] - dcmtk <no-dsa> (Minor issue)
NOTE: https://support.dcmtk.org/redmine/issues/1224
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/87f256d73e30656a822bf7d76d1cf1d9bb693954
CVE-2026-44035 (Uncontrolled recursion in DcmDicomDir::moveRecordToTree() in dcmdata/l ...)
- dcmtk <unfixed> (bug #1150503)
+ [trixie] - dcmtk <no-dsa> (Minor issue)
NOTE: https://support.dcmtk.org/redmine/issues/1215
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/ca761f7f3dcaaddaa95be87cf5d736138d7c3a9f
CVE-2026-44034 (A heap-based out-of-bounds read in DcmRLECodecDecoder::decodeFrame() i ...)
- dcmtk <unfixed> (bug #1150502)
+ [trixie] - dcmtk <no-dsa> (Minor issue)
NOTE: https://support.dcmtk.org/redmine/issues/1213
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/45469f3c30037e9c7159290e4bb74cd7b3b9ef1d
CVE-2026-44033 (Uncontrolled recursion in XMLNode::ParseXMLElement() and XMLNode::empt ...)
- dcmtk <unfixed> (bug #1150501)
+ [trixie] - dcmtk <no-dsa> (Minor issue)
NOTE: https://support.dcmtk.org/redmine/issues/1214
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/d12e350e687530eb41e2b0c860aff4d8c04e5941
CVE-2026-44031 (Uncontrolled recursion in DcmSequenceOfItems::read() and DcmItem::read ...)
- dcmtk <unfixed> (bug #1150500)
+ [trixie] - dcmtk <no-dsa> (Minor issue)
NOTE: https://support.dcmtk.org/redmine/issues/1191
NOTE: Fixed by: https://github.com/DCMTK/dcmtk/commit/885ff0f10372bd589b5f44cea974f28a3964cb0f
CVE-2026-42698 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ba0bd6aab3b174e5088265083035086df2a4a74a
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ba0bd6aab3b174e5088265083035086df2a4a74a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261026/14562579/attachment.htm>
More information about the debian-security-tracker-commits
mailing list