[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Oct 27 22:11:20 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
e3848cd9 by Moritz Muehlenhoff at 2026-10-27T23:10:22+01:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2848,6 +2848,7 @@ CVE-2026-XXXX [GHSA-pj59-fvjc-74pp: Quadratic parse-error bookkeeping, unescaped
NOTE: https://github.com/Masterminds/html5-php/security/advisories/GHSA-pj59-fvjc-74pp
CVE-2026-XXXX [GHSA-jmrh-hxvj-p42g: liblldpctl LLDP-MED CIVIC CA-element iterator over-read]
- lldpd 1.0.23-1
+ [trixie] - lldpd <no-dsa> (Minor issue)
NOTE: https://github.com/lldpd/lldpd/security/advisories/GHSA-jmrh-hxvj-p42g
NOTE: Fixed by: https://github.com/lldpd/lldpd/commit/587da0859d857ae2f615ea36c5f6b545f93a67df (1.0.23)
NOTE: Fixed by: https://github.com/lldpd/lldpd/commit/f39254f3ef3771103d4e5e54d9dfa9899c3eda39 (1.0.23)
@@ -3215,6 +3216,7 @@ CVE-2026-115923 (Backstage is an open framework for building developer portals.
NOT-FOR-US: Backstage
CVE-2026-115922 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed>
+ [trixie] - onnx <no-dsa> (Minor issue)
NOTE: https://github.com/onnx/onnx/security/advisories/GHSA-q69g-f4f5-v8m7
NOTE: https://github.com/onnx/onnx/pull/8033
NOTE: Fixed by: https://github.com/onnx/onnx/commit/dce5876d6cc6cc30157af7d26a752ef44976da8e (v1.23.0)
@@ -3223,16 +3225,19 @@ CVE-2026-115922 (Open Neural Network Exchange (ONNX) is an open standard for mac
NOTE: Fixed by: https://github.com/onnx/onnx/commit/8de2cf6aa47928e6515ac6d9e1a8b4758886a7df (v1.22.0)
CVE-2026-115921 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed>
+ [trixie] - onnx <no-dsa> (Minor issue)
NOTE: https://github.com/onnx/onnx/security/advisories/GHSA-m4pr-6v3c-6fgr
NOTE: https://github.com/onnx/onnx/pull/7916
NOTE: Fixed by: https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5 (v1.22.0)
CVE-2026-115920 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed>
+ [trixie] - onnx <no-dsa> (Minor issue)
NOTE: https://github.com/onnx/onnx/security/advisories/GHSA-6pwm-x34p-fvj2
NOTE: https://github.com/onnx/onnx/pull/7997
NOTE: Fixed by: https://github.com/onnx/onnx/commit/2ec288908952eea9dcf48d4b197915e1f72c6abf (v1.22.0)
CVE-2026-115919 (Open Neural Network Exchange (ONNX) is an open standard for machine le ...)
- onnx <unfixed>
+ [trixie] - onnx <no-dsa> (Minor issue)
NOTE: https://github.com/onnx/onnx/security/advisories/GHSA-48m4-24cq-37qf
NOTE: https://github.com/onnx/onnx/pull/7879
NOTE: Fixed by: https://github.com/onnx/onnx/commit/92e541266af5dd38cfa48aeb92206f4268a066cd (v1.22.0)
@@ -3259,6 +3264,7 @@ CVE-2026-115910 (Python Social Auth is a social authentication and registration
NOTE: Fixed by: https://github.com/python-social-auth/social-core/commit/c2f2ae4663bef19ee8b07f2cf5a2344f9155d826 (6.2.0)
CVE-2026-115909 (zip is a zip library for Rust that supports reading and writing simple ...)
- rust-zip <unfixed> (bug #1152227)
+ [trixie] - rust-zip <no-dsa> (Minor issue)
NOTE: https://github.com/zip-rs/zip2/security/advisories/GHSA-q7v9-x93c-xqv3
NOTE: https://github.com/zip-rs/zip2/pull/984
NOTE: Fixed by: https://github.com/zip-rs/zip2/commit/a543a1fc8f3f3eef36f27bb137230295284cdb98 (v9.0.0)
@@ -3268,15 +3274,18 @@ CVE-2026-115908 (zip is a zip library for Rust that supports reading and writing
NOTE: Fixed by: https://github.com/zip-rs/zip2/commit/09c030eab56e8db8fb3c1c33f554407b30bad8fa (v9.0.0)
CVE-2026-115907 (zip is a zip library for Rust that supports reading and writing simple ...)
- rust-zip <unfixed> (bug #1152227)
+ [trixie] - rust-zip <no-dsa> (Minor issue)
NOTE: https://github.com/zip-rs/zip2/security/advisories/GHSA-9hj8-73fh-9963
NOTE: https://github.com/zip-rs/zip2/pull/991
NOTE: Fixed by: https://github.com/zip-rs/zip2/commit/8b4991288b79ad11cce201c2d785d5baa795bd3e (v9.0.0)
CVE-2026-115906 (zip is a zip library for Rust that supports reading and writing simple ...)
- rust-zip <unfixed> (bug #1152227)
+ [trixie] - rust-zip <no-dsa> (Minor issue)
NOTE: https://github.com/zip-rs/zip2/security/advisories/GHSA-8hxf-qr8p-62x4
NOTE: Fixed by: https://github.com/zip-rs/zip2/commit/ec265db0b0602f8ffb9479327397bddefb7e2216 (v9.0.0)
CVE-2026-115905 (zip is a zip library for Rust that supports reading and writing simple ...)
- rust-zip <unfixed> (bug #1152227)
+ [trixie] - rust-zip <no-dsa> (Minor issue)
NOTE: https://github.com/zip-rs/zip2/security/advisories/GHSA-m665-v7pm-7grj
NOTE: Fixed by: https://github.com/zip-rs/zip2/commit/8068ab480ccf8daa7411424e365fcdbe6d09443e (v9.0.5)
CVE-2026-115804 (HashiCorp Consul and Consul Enterprise are vulnerable to an authorizat ...)
@@ -3527,6 +3536,7 @@ CVE-2026-99088 (In the Linux kernel, the following vulnerability has been resolv
NOTE: https://git.kernel.org/linus/3c6a4b11330fe424557538a98fca9f0a4c5bf313 (7.3-rc7)
CVE-2026-107891
- musl <unfixed> (bug #1152311)
+ [trixie] - musl <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/musl/2026/10/21/1
NOTE: https://git.musl-libc.org/cgit/musl/commit/?id=7813e9119eb5fe681b6750b8a033a0490bca0941
CVE-2026-116228 (A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. T ...)
@@ -4361,8 +4371,11 @@ CVE-2026-19741 (Zephyr's OpenThread integration defined CONFIG_OPENTHREAD_JOINER
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-16762 (An attacker able to supply a crafted XML document to an application us ...)
- qt6-base 6.11.2+dfsg-5
+ [trixie] - qt6-base <no-dsa> (Minor issue)
- qtbase-opensource-src <unfixed>
+ [trixie] - qtbase-opensource-src <no-dsa> (Minor issue)
- qtbase-opensource-src-gles <unfixed>
+ [trixie] - qtbase-opensource-src-gles <no-dsa> (Minor issue)
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-16762:
NOTE: Fixed by: https://github.com/qt/qtbase/commit/564db12e40089b946c2feaac2a029a0c56e6e588 (v6.11.2)
NOTE: Fixed by: https://github.com/qt/qtbase/commit/cd0f0803955a04b9d7e3a24d4e40f8405df2bba8 (v6.11.2)
@@ -4488,6 +4501,7 @@ CVE-2026-115723 (Snap7 through 1.4.3 contains an out-of-bounds write vulnerabili
NOT-FOR-US: Snap7
CVE-2026-115722 (RPly through 1.1.4 contains an improper array index validation vulnera ...)
- python-rply <unfixed>
+ [trixie] - python-rply <no-dsa> (Minor issue)
NOTE: https://github.com/diegonehab/rply/issues/10
CVE-2026-115657 (When used as an executor in either KNIME Server or KNIME Business Hub, ...)
NOT-FOR-US: KNIME
@@ -30950,6 +30964,7 @@ CVE-2026-107570 (heap OOB write in convert_file_from_to() via a crafted Content-
NOTE: Fixed by: https://gitlab.com/muttmua/mutt/-/commit/7752d93f26f8f1384905fad874afff5abb0f3e54 (mutt-2-4-3-rel)
CVE-2026-107565 (A flaw was found in luksmeta. A local attacker with administrative pri ...)
- luksmeta <unfixed> (bug #1150649)
+ [trixie] - luksmeta <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547930
NOTE: https://github.com/latchset/luksmeta/issues/18
NOTE: https://github.com/latchset/luksmeta/pull/19
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e3848cd9eba0d2d4c3c5538f7138ee50128ae72b
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e3848cd9eba0d2d4c3c5538f7138ee50128ae72b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/860a307d/attachment.htm>
More information about the debian-security-tracker-commits
mailing list