[Git][security-tracker-team/security-tracker][master] Reserve DLA-4864-1 for swupdate

[Carlos Henrique Lima Melara (@charles)]

Carlos Henrique Lima Melara pushed to branch master at Debian Security Tracker / security-tracker


Commits:
88e06d69 by Carlos Henrique Lima Melara at 2026-10-26T21:18:21-03:00
Reserve DLA-4864-1 for swupdate

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -166443,7 +166443,6 @@ CVE-2025-60477 (A NULL pointer dereference in the gf_filter_pid_resolve_file_tem
 CVE-2025-41259 (SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TO ...)
 	- swupdate 2026.05+dfsg-1
 	[trixie] - swupdate <no-dsa> (Minor issue)
-	[bookworm] - swupdate <no-dsa> (Minor issue)
 	[bullseye] - swupdate <postponed> (Minor issue)
 	NOTE: Fixed by: https://github.com/sbabic/swupdate/commit/f4bd64260e233e207354d68d572b1cbc3e63689d (2026.05)
 CVE-2025-15656 (Incorrect Privilege Assignment vulnerability in Mojoomla School Manage ...)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[26 Oct 2026] DLA-4864-1 swupdate - security update
+	{CVE-2025-41259 CVE-2026-109399}
+	[bookworm] - swupdate 2022.12+dfsg-4+deb12u3
 [26 Oct 2026] DLA-4863-1 thunderbird - security update
 	{CVE-2026-109705 CVE-2026-109706 CVE-2026-109707 CVE-2026-109708 CVE-2026-109709 CVE-2026-109710 CVE-2026-109711 CVE-2026-109712 CVE-2026-109713 CVE-2026-109715 CVE-2026-109716 CVE-2026-109717 CVE-2026-109718 CVE-2026-109719 CVE-2026-109720 CVE-2026-109721 CVE-2026-109722 CVE-2026-109723 CVE-2026-109724 CVE-2026-109725 CVE-2026-109726 CVE-2026-109727 CVE-2026-109728 CVE-2026-109729 CVE-2026-109730 CVE-2026-109731 CVE-2026-109732 CVE-2026-109733 CVE-2026-109734 CVE-2026-109736 CVE-2026-109737 CVE-2026-109738 CVE-2026-109741 CVE-2026-109742 CVE-2026-109743 CVE-2026-109744 CVE-2026-109745 CVE-2026-109751 CVE-2026-109752 CVE-2026-109753 CVE-2026-109754 CVE-2026-109756 CVE-2026-109757 CVE-2026-109759 CVE-2026-109760 CVE-2026-109762 CVE-2026-109763 CVE-2026-109764 CVE-2026-109765 CVE-2026-109766 CVE-2026-109767 CVE-2026-109770 CVE-2026-109775 CVE-2026-109776 CVE-2026-109777 CVE-2026-109778 CVE-2026-109781 CVE-2026-110249 CVE-2026-113470 CVE-2026-113866 CVE-2026-113867 CVE-2026-113868}
 	[bookworm] - thunderbird 1:153.5.1esr-1~deb12u1


=====================================
data/dla-needed.txt
=====================================
@@ -780,13 +780,6 @@ sssd
 strongswan (Simon Quigley)
   NOTE: 20260907: Added by Front-Desk (eamanu)
 --
-swupdate (charles)
-  NOTE: 20261013: Added by Front-Desk (charles/front-desk)
-  NOTE: 20261013: CVE-2026-109399 needs attetion, older ones are marked
-  NOTE: 20261013: postponed/minor (charles)
-  NOTE: 20261016: Maintainer provided a debdiff for bookworm (thanks Bastian!),
-  NOTE: 20261016: will prepare the upload. (charles)
---
 tesseract
   NOTE: 20260919: Added by Front-Desk (Beuc)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/88e06d69e2d002e202e754a247947d7344021ac8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/88e06d69e2d002e202e754a247947d7344021ac8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/ed4908c5/attachment.htm>