[Git][security-tracker-team/security-tracker][master] Add CVE-2026-118375/llama.cpp

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
1c260640 by Salvatore Bonaccorso at 2026-10-28T11:17:51+01:00
Add CVE-2026-118375/llama.cpp

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -106,7 +106,9 @@ CVE-2026-118377 (mews/pos through 2.0.0 contains an insufficient verification of
 CVE-2026-118376 (WeKnora before 0.8.2 contains a server-side request forgery vulnerabil ...)
 	NOT-FOR-US: WeKnora
 CVE-2026-118375 (llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerab ...)
-	TODO: check
+	- llama.cpp <unfixed>
+	NOTE: https://github.com/ggml-org/llama.cpp/pull/30399
+	NOTE: Fixed by: https://github.com/ggml-org/llama.cpp/commit/9a0fde9967fa1a35b6e5dd1f47e1a3648b6fecc1
 CVE-2026-118374 (LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerab ...)
 	TODO: check
 CVE-2026-118373 (LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vul ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1c2606403964cd5f0da468eb2b30053805d7a054

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1c2606403964cd5f0da468eb2b30053805d7a054
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/24adfed5/attachment.htm>