[Git][security-tracker-team/security-tracker][master] 6 commits: lts: mark CVE-2026-95620/qt6-base as not affecting Bookworm

Tue Oct 27 23:48:29 GMT 2026


Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
81548713 by Daniel Leidert at 2026-10-28T00:46:40+01:00
lts: mark CVE-2026-95620/qt6-base as not affecting Bookworm

Vulnerable code not present.

- - - - -
aa2b3cf9 by Daniel Leidert at 2026-10-28T00:46:41+01:00
Add hint that fix for CVE-2026-113356 breaks plugins

The two plugins I found, so far, have not been packaged.
https://github.com/splitbrain/dokuwiki-plugin-bureaucracy/pull/360/changes
https://github.com/splitbrain/dokuwiki-plugin-gallery/commit/77384325dec07478d629522f2ac7b5ee047cd52f

But the person adressing the issue should be aware.

- - - - -
98bbe01c by Daniel Leidert at 2026-10-28T00:46:41+01:00
dla-needed: add dokuwiki with notes

- - - - -
ee0425b6 by Daniel Leidert at 2026-10-28T00:46:42+01:00
lts: add libcpanel-json-xs-perl to dla-needed

- - - - -
c4e0cbe1 by Daniel Leidert at 2026-10-28T00:46:43+01:00
lts: postpone CVE-2026-115327/libyang

very low popcon and no-dsa

- - - - -
94692e9f by Daniel Leidert at 2026-10-28T00:46:44+01:00
lts: postpone CVE-2026-113352/utox due to low popcon

The issue seems rather serious, but the package has only ~30 reported
installations in popcon. Maybe this should be revisited in the future.

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -4150,6 +4150,7 @@ CVE-2026-97352 (The News Kit Addons For Elementor WordPress plugin before 1.4.9
 CVE-2026-95620 (A use-after-free vulnerability in the Qt QNetworkAccessManager HTTP/2  ...)
 	- qt6-base <unfixed>
 	[trixie] - qt6-base <not-affected> (Vulnerable code not present)
+	[bookworm] - qt6-base <not-affected> (Vulnerable code not present)
 	NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-95620:
 	NOTE: Fixed by: https://github.com/qt/qtbase/commit/c4ae6491d473e36f34840a236c5fd0f4bc800558
 CVE-2026-94263 (The Advanced Custom Fields: Extended and Advanced Custom Fields: Exten ...)
@@ -6178,6 +6179,7 @@ CVE-2026-115328 (JSON-SCADA before 0.65-alpha contains an sql injection vulnerab
 CVE-2026-115327 (libyang through 6.4.13 contains an uninitialized pointer free vulnerab ...)
 	- libyang <unfixed>
 	[trixie] - libyang <no-dsa> (Minor issue)
+	[bookworm] - libyang <postponed> (Minor issue)
 	- libyang2 <removed>
 	NOTE: https://github.com/CESNET/libyang/issues/2595
 	NOTE: Fixed by: https://github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773
@@ -12419,6 +12421,7 @@ CVE-2026-113356 (DokuWiki before 2026-07-14c contains a PHP object injection vul
 	- dokuwiki 2026-07-14.c+dfsg-1
 	NOTE: https://github.com/dokuwiki/dokuwiki/issues/4752
 	NOTE: https://github.com/dokuwiki/dokuwiki/commit/1531802afb2ac3eea147a887600fa5750e74e681 (release-2026-07-14c)
+	NOTE: The fix breaks multiple plugins. Plugins packaged by the Debian project don't seem to be affected, though.
 CVE-2026-113355 (Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerab ...)
 	NOT-FOR-US: Chatwoot
 CVE-2026-113354 (Dockhand before 1.0.46 contains an arbitrary file read vulnerability t ...)
@@ -12427,6 +12430,7 @@ CVE-2026-113353 (LearnPress before 4.4.10 contains a missing authorization vulne
 	NOT-FOR-US: LearnPress
 CVE-2026-113352 (uTox through 0.18.1 contains a path traversal vulnerability that allow ...)
 	- utox <unfixed>
+	[bookworm] - utox <postponed> (Low popcon)
 	NOTE: https://github.com/uTox/uTox/issues/1587
 	NOTE: https://github.com/uTox/uTox/pull/1602
 	NOTE: https://github.com/uTox/uTox/pull/1603


=====================================
data/dla-needed.txt
=====================================
@@ -161,6 +161,13 @@ docker.io
   NOTE: 20250805: Added by Front-Desk (rouca)
   NOTE: 20260714: Also add for bookworm (Beuc/front-desk)
 --
+dokuwiki
+  NOTE: 20261027: Added by Front-Desk (dleidert)
+  NOTE: 20261027: Follow upcoming DSA and/or support secteam (dleidert/front-desk)
+  NOTE: 20261027: Be aware that the fix for CVE-2026-113356 breaks plugins (dleidert/front-desk)
+  NOTE: 20261027: None of the packaged plugins seems affected; but self-installed ones could be (dleidert/front-desk)
+  NOTE: 20261027: A note in the DLA should be added (dleidert/front-desk)
+--
 dovecot (guilhem)
   NOTE: 20260829: Added by Front-Desk (dleidert)
   NOTE: 20260829: Upcoming DSA (dleidert/front-desk)
@@ -318,6 +325,10 @@ ldap-account-manager
   NOTE: 20260725: Also add for bookworm (8.3); CVE-2026-27894 PDF-export LFI,
   NOTE: 20260725: unvalidated pdf_structure/pdf_font identical to bullseye. (utkarsh/front-desk)
 --
+libcpanel-json-xs-perl
+  NOTE: 20261027: Added by Front-Desk (dleidert)
+  NOTE: 20261027: Follow DSA and/or support secteam (dleidert/front-desk)
+--
 libcrypt-pbkdf2-perl
   NOTE: 20260612: Added by Front-Desk (rouca)
   NOTE: 20260613: you MUST follow #1139897 and coordinate (rouca/FD)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e3848cd9eba0d2d4c3c5538f7138ee50128ae72b...94692e9fa3e849476f3ca1e02d64e964c70201bd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e3848cd9eba0d2d4c3c5538f7138ee50128ae72b...94692e9fa3e849476f3ca1e02d64e964c70201bd
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261027/49033749/attachment-0001.htm>
