[Git][security-tracker-team/security-tracker][authlib] 4 commits: Update CVE-2022-31246/electrum

Stefano Rivera (@stefanor) stefanor at debian.org
Wed Oct 28 08:24:43 GMT 2026 


Stefano Rivera pushed to branch authlib at Debian Security Tracker / security-tracker


Commits:
ab44a39d by Salvatore Bonaccorso at 2026-10-28T08:51:33+01:00
Update CVE-2022-31246/electrum

- - - - -
3e50b8ce by Salvatore Bonaccorso at 2026-10-28T09:06:20+01:00
Add CVE-2026-99100/linux

- - - - -
b01ec398 by Salvatore Bonaccorso at 2026-10-28T09:24:07+01:00
Add new chromium issues

- - - - -
7c16e488 by Stefano Rivera at 2026-10-28T08:24:39+00:00
Move CVE-2026-104056 to a new bug and add notes

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,5 +1,6 @@
 CVE-2026-99100 (In the Linux kernel, the following vulnerability has been resolved:  w ...)
-	TODO: check
+	- linux <unfixed>
+	NOTE: https://git.kernel.org/linus/db7b86bd97b380ece8fa39cfdd7502a9fd35e56f (7.3-rc6)
 CVE-2026-97045 (In childTextNodesAreLiteral, walking up the tree previously stopped at ...)
 	TODO: check
 CVE-2026-97019 (The AMP for WP \u2013 Accelerated Mobile Pages plugin for WordPress is ...)
@@ -91,109 +92,109 @@ CVE-2026-118371 (LibreSSL through 4.4.0 contains a CRLF injection vulnerability
 CVE-2026-118370 (libexpat through 2.9.0 contains a signed integer overflow vulnerabilit ...)
 	TODO: check
 CVE-2026-118359 (Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowe ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118358 (Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73  ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118357 (Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 a ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118356 (Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed  ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118355 (Improper input validation in Command in Google Chrome prior to 156.0.8 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118354 (Improper input validation in Skia in Google Chrome prior to 156.0.8078 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118353 (Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowe ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118352 (Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 all ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118351 (Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allo ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118350 (Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 all ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118349 (Memory corruption in Payments in Google Chrome prior to 156.0.8078.73  ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118348 (Improper input validation in Skia in Google Chrome prior to 156.0.8078 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118347 (Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 a ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118346 (Use after free in Compositing in Google Chrome prior to 156.0.8078.73  ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118345 (Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allow ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118344 (Use after free in Layout in Google Chrome prior to 156.0.8078.73 allow ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118343 (Improper input validation in ReadingList in Google Chrome prior to 156 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118342 (Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118341 (Use after free in Modularization in Google Chrome prior to 156.0.8078. ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118340 (Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allo ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118339 (Use after free in Animation in Google Chrome prior to 156.0.8078.73 al ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118338 (Use after free in Animation in Google Chrome prior to 156.0.8078.73 al ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118337 (Improper access control in Forms in Google Chrome prior to 156.0.8078. ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118336 (Improper input validation in Headless in Google Chrome prior to 156.0. ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118335 (Improper input validation in Metrics in Google Chrome on on Mac prior  ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118334 (Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118333 (Missing authorization in Video in Google Chrome prior to 156.0.8078.73 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118332 (Improper input validation in Compositing in Google Chrome prior to 156 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118331 (Improper input validation in FileAPI in Google Chrome prior to 156.0.8 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118330 (Use after free in Browser in Google Chrome on on Windows prior to 156. ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118329 (Improper input validation in ANGLE in Google Chrome on on Mac prior to ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118328 (Improper input validation in WebRTC in Google Chrome prior to 156.0.80 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118327 (Memory corruption in Media in Google Chrome prior to 156.0.8078.73 all ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118322 (Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 all ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118321 (Improper input validation in Core in Google Chrome on on Android prior ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118320 (Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowe ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118319 (Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allo ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118318 (Improper access control in V8 in Google Chrome prior to 156.0.8078.73  ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118317 (Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allo ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118316 (Improper input validation in V8 in Google Chrome prior to 156.0.8078.7 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118315 (Improper input validation in SVG in Google Chrome prior to 156.0.8078. ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118314 (Improper input validation in UI in Google Chrome on on Android prior t ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118313 (Use after free in Video in Google Chrome prior to 156.0.8078.73 allowe ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118312 (Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 all ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118311 (Memory corruption in Media in Google Chrome prior to 156.0.8078.73 all ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118310 (Improper input validation in Views in Google Chrome on on Windows prio ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118309 (Improper input validation in UI in Google Chrome on on Android prior t ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118308 (Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed  ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118307 (Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowe ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118306 (Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.7 ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118305 (Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73  ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118304 (Improper input validation in SVG in Google Chrome prior to 156.0.8078. ...)
-	TODO: check
+	- chromium <unfixed>
 CVE-2026-118276 (A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This ...)
 	TODO: check
 CVE-2026-118275 (A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affe ...)
@@ -38924,8 +38925,10 @@ CVE-2026-104058 (Podgrab contains a missing authentication vulnerability in whic
 CVE-2026-104057 (Podgrab contains an unauthenticated denial-of-service vulnerability ca ...)
 	NOT-FOR-US: Podgrab
 CVE-2026-104056 (Authlib version 1.7.2 and below contains a vulnerability where discove ...)
-	- python-authlib <unfixed> (bug #1151845)
+	- python-authlib <unfixed> (bug #1152333)
 	NOTE: https://uziii2208.github.io/post/cve-2026-104056/
+	NOTE: https://github.com/authlib/authlib/issues/967
+	NOTE: https://github.com/authlib/authlib/pull/948
 CVE-2026-104018 (An improper privilege management vulnerability (CWE-269) exists in the ...)
 	NOT-FOR-US: WindRiver
 CVE-2026-103923 (KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering ...)
@@ -594453,7 +594456,9 @@ CVE-2022-1807 (Multiple SQLi vulnerabilities in Webadmin allow for privilege esc
 CVE-2022-1806 (Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rt ...)
 	NOT-FOR-US: RTX
 CVE-2022-31246 (paymentrequest.py in Electrum before 4.2.2 allows a file:// URL in the ...)
-	NOT-FOR-US: Electrum
+	- electrum 4.3.2+dfsg1-1
+	NOTE: https://github.com/spesmilo/electrum/security/advisories/GHSA-4fh4-hx35-r355
+	NOTE: Fixed by: https://github.com/spesmilo/electrum/commit/b247aa5ffef0f9ef000772fcf9cd9c7141abded8 (4.2.2)
 CVE-2022-31245 (mailcow before 2022-05d allows a remote authenticated user to inject O ...)
 	NOT-FOR-US: mailcow
 CVE-2022-31244 (Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows f ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/231e4ec656757f8212d775fdbc6e4c361cbf2b8a...7c16e488ab662483af0a3d998d60473cec99da56

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/231e4ec656757f8212d775fdbc6e4c361cbf2b8a...7c16e488ab662483af0a3d998d60473cec99da56
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/ad503f18/attachment.htm>

More information about the debian-security-tracker-commits mailing list