[Git][security-tracker-team/security-tracker][master] pdns, php-mongodb, openjdk-21, thunderbird DSAs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Oct 27 18:53:01 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
58f61f92 by Moritz Mühlenhoff at 2026-10-27T19:49:56+01:00
pdns, php-mongodb, openjdk-21, thunderbird DSAs
- - - - -
3 changed files:
- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -11819,7 +11819,6 @@ CVE-2026-112377 (CCC Attestation SIG attested-tls-poc through commit 731ca82 fai
NOT-FOR-US: CCC Attestation SIG attested-tls-poc
CVE-2026-112368 (An uncontrolled recursion weakness in the BSON decoding logic of the M ...)
- php-mongodb <unfixed> (bug #1151934)
- [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-276
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/795e914e6f7cc631a2f80c89aedcdd2a1df4ada9 (2.5.5, 2.1.12, 1.21.12)
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/01363996a93b33fea58c90f5e8d1eaea5e01eafd (2.5.5, 2.1.12, 1.21.12)
@@ -29322,7 +29321,6 @@ CVE-2026-106437 (The BSON buffer-reservation API in the MongoDB C Driver can rec
NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/b7f1f5742351741c068020196fd88f196551aad2 (1.30.13)
CVE-2026-106436 (The BSON encoder in the MongoDB PHP Driver does not check some return ...)
- php-mongodb <unfixed> (bug #1150514)
- [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-2739
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260 (2.5.4, 2.1.11, 1.21.11)
CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read outside a buff ...)
@@ -29345,7 +29343,6 @@ CVE-2026-106433 (Improper state management in MongoDB libmongocrypt can cause pr
NOTE: Fixed by: https://github.com/mongodb/libmongocrypt/commit/8bc580ea69eea13a932197221edf72830fbc38a1 (1.20.5)
CVE-2026-106432 (The BSON encoder in the MongoDB PHP Driver converts a string length to ...)
- php-mongodb <unfixed> (bug #1150514)
- [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-2741
NOTE: Fixed by: https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260 (2.5.4, 2.1.11, 1.21.11)
CVE-2026-106431 (An off-by-one error in the BSON bulk document writer in the MongoDB C ...)
=====================================
data/DSA/list
=====================================
@@ -1,3 +1,14 @@
+[27 Oct 2026] DSA-6590-1 thunderbird - regression update
+ [trixie] - thunderbird 1:153.5.1esr-1~deb13u2
+[27 Oct 2026] DSA-6589-1 php-mongodb - security update
+ {CVE-2026-106432 CVE-2026-106436 CVE-2026-112368}
+ [trixie] - php-mongodb 2.0.0-1+deb13u2
+[27 Oct 2026] DSA-6588-1 openjdk-21 - security update
+ {CVE-2026-83374 CVE-2026-83376 CVE-2026-83378 CVE-2026-83380 CVE-2026-83381 CVE-2026-83387 CVE-2026-83395 CVE-2026-83400 CVE-2026-87290 CVE-2026-87291 CVE-2026-87292 CVE-2026-87294 CVE-2026-87367 CVE-2026-91332 CVE-2026-91333 CVE-2026-91334 CVE-2026-91335 CVE-2026-91373 CVE-2026-91374 CVE-2026-91375 CVE-2026-91379 CVE-2026-91380 CVE-2026-91382 CVE-2026-91394 CVE-2026-91397 CVE-2026-91398 CVE-2026-91400 CVE-2026-91403 CVE-2026-91410 CVE-2026-91411 CVE-2026-91415 CVE-2026-91418 CVE-2026-91451 CVE-2026-91452 CVE-2026-91453 CVE-2026-91461 CVE-2026-91462 CVE-2026-91463 CVE-2026-91464 CVE-2026-91487}
+ [trixie] - openjdk-21 21.0.13+9-1~deb13u2
+[27 Oct 2026] DSA-6587-1 pdns - security update
+ {CVE-2026-73206}
+ [trixie] - pdns 4.9.18-0+deb13u1
[27 Oct 2026] DSA-6586-1 valkey - security update
{CVE-2026-23479 CVE-2026-23631 CVE-2026-25243 CVE-2026-56684 CVE-2026-63639 CVE-2026-82631 CVE-2026-82677}
[trixie] - valkey 8.1.1+dfsg1-3+deb13u3
=====================================
data/dsa-needed.txt
=====================================
@@ -125,8 +125,6 @@ nss (carnil)
--
openexr
--
-openjdk-21 (jmm)
---
openjdk-25 (jmm)
--
pacemaker
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/58f61f9246ac6683041b1ce913797f9b9db83b13
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/58f61f9246ac6683041b1ce913797f9b9db83b13
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/fa598e71/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list