[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Oct 28 14:28:10 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
2b19d860 by Moritz Muehlenhoff at 2026-10-28T15:24:24+01:00
trixie triage
- - - - -
3 changed files:
- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -248,10 +248,11 @@ CVE-2026-117610 (libexpat through 2.9.0 contains a NULL pointer dereference vuln
- expat <unfixed> (bug #1152343)
NOTE: https://github.com/libexpat/libexpat/pull/1444
CVE-2026-117609 (rtl_433 through 25.12 contains a stack-based buffer overflow vulnerabi ...)
- - rtl-433 <unfixed>
+ - rtl-433 <unfixed> (unimportant)
NOTE: https://github.com/merbanan/rtl_433/issues/3739
NOTE: https://github.com/merbanan/rtl_433/pull/3740
NOTE: Fixed by: https://github.com/merbanan/rtl_433/commit/f35183aaf1d2d905d422fd70bcae4eb7349d6186
+ NOTE: Crash in CLI tool, no security impact
CVE-2026-117608 (Assimp through 6.0.5 contains an integer overflow vulnerability in MD2 ...)
- assimp <unfixed>
NOTE: https://github.com/assimp/assimp/issues/6929
@@ -2683,6 +2684,7 @@ CVE-2026-116800 (WWBN AVideo before 29.5.0 contains a local file inclusion vulne
NOT-FOR-US: WWBN AVideo
CVE-2026-116748 (Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerabili ...)
- transmission 4.1.3+dfsg-1
+ [trixie] - transmission <no-dsa> (Minor issue)
NOTE: https://github.com/transmission/transmission/pull/8938
NOTE: Fixed by: https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e (4.1.3)
CVE-2026-116747 (Kener 3.0.0 before 4.1.10 contains an authentication bypass vulnerabil ...)
@@ -4002,12 +4004,14 @@ CVE-2026-105608 (HashiCorp Consul and Consul Enterprise are vulnerable to an aut
- consul <removed>
CVE-2026-104594 (libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM ...)
- libosmocore 1.14.2-1
+ [trixie] - libosmocore <no-dsa> (Minor issue)
NOTE: https://osmocom.org/issues/7050
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/8ba652bca2f28ec05ff5979846199e2c46657633 (1.14.2)
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/325ffb5204d7e1659ca2fec3b2f14c33b969ee71 (1.14.2)
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/afd18bf00147e17c495fc909ac4583b3bf734d53 (1.14.2)
CVE-2026-104593 (osmo-msc through 1.15.0 contains a stack-based buffer overflow in deco ...)
- osmo-msc 1.16.0+dfsg1-2
+ [trixie] - osmo-msc <no-dsa> (Minor issue)
NOTE: https://osmocom.org/issues/7058
NOTE: Fixed by: https://github.com/osmocom/osmo-msc/commit/cd347bbe5392d8170ab87140b2bfdac683058b09 (1.16.0)
CVE-2026-104592 (libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP ...)
@@ -7361,6 +7365,7 @@ CVE-2026-85683 (The Jane Menu WordPress plugin before 1.5.1 does not have any ca
NOT-FOR-US: WordPress plugin
CVE-2026-85518 (A flaw was found in OpenSCAP. When decomposing a Source DataStream (SD ...)
- openscap 1.4.6+dfsg-1
+ [trixie] - openscap <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478522
NOTE: Fixed by: https://github.com/OpenSCAP/openscap/commit/aa1d6471b14d4f765704b2768865067eca49067a (1.4.6)
CVE-2026-84924 (Improper Neutralization of Input During Web Page Generation ("Cross-si ...)
@@ -11106,9 +11111,9 @@ CVE-2026-101517 (Vulnerability in the Oracle Utilities Network Management System
CVE-2026-101516 (Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle Gr ...)
- openjdk-8 <unfixed> (bug #1151673)
- openjdk-11 <unfixed>
- - openjdk-17 <unfixed>
- - openjdk-21 <unfixed>
- - openjdk-25 <unfixed>
+ - openjdk-17 17.0.21+9-1
+ - openjdk-21 21.0.13+9-1
+ - openjdk-25 25.0.5+8-1
NOTE: https://openjdk.org/groups/vulnerability/advisories/2026-10-20
CVE-2026-101515 (Vulnerability in the Oracle WebLogic Server product of Oracle Fusion M ...)
NOT-FOR-US: Oracle
@@ -13228,8 +13233,11 @@ CVE-2026-101296 (A missing critical step in authentication vulnerability in Apac
NOTE: https://github.com/apache/tomcat/commit/42827afa4d073ac3d9f8b3cc81b857aa455bf1e6 (9.0.123)
CVE-2026-101201 (A malformed header in the binary file fed to QBinaryJson::fromBinaryDa ...)
- qt6-5compat <unfixed> (bug #1152312)
+ [trixie] - qt6-5compat <no-dsa> (Minor issue)
- qtbase-opensource-src <unfixed> (bug #1152313)
+ [trixie] - qtbase-opensource-src <no-dsa> (Minor issue)
- qtbase-opensource-src-gles <unfixed> (bug #1152314)
+ [trixie] - qtbase-opensource-src-gles <no-dsa> (Minor issue)
NOTE: https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-101201
NOTE: https://github.com/qt/qt5compat/commit/721ed576391211ca53ecdaaecf6dd41df7bc962e
NOTE: https://github.com/qt/qt5compat/commit/c0a495894d83a3c48055bd1e544f93147fc6ade1
@@ -17845,6 +17853,7 @@ CVE-2026-55836 (Open Zaak is an open-source data and services layer for Dutch ca
NOT-FOR-US: Open Zaak
CVE-2026-55543 (TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, a ...)
- tuxguitar <unfixed> (bug #1151103)
+ [trixie] - tuxguitar <no-dsa> (Minor issue)
NOTE: https://github.com/helge17/tuxguitar/security/advisories/GHSA-v66p-c82h-w3cq
NOTE: Fixed by: https://github.com/helge17/tuxguitar/commit/a7eef20e2e02ee454597d42c295327d9f098c636 (2.1.0)
CVE-2026-54657 (Open Zaak is an open-source data and services layer for Dutch case-ori ...)
@@ -28506,6 +28515,7 @@ CVE-2026-103061 (Improper Limitation of a Pathname to a Restricted Directory ('P
- gleam <itp> (bug #1103795)
CVE-2026-103060 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...)
- rebar3 3.27.3-1
+ [trixie] - rebar3 <no-dsa> (Minor issue)
NOTE: https://github.com/erlang/rebar3/security/advisories/GHSA-6ggr-r7mh-2mv8
NOTE: https://cna.erlef.org/cves/CVE-2026-103060.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-103060
=====================================
data/DSA/list
=====================================
@@ -4,7 +4,7 @@
{CVE-2026-106432 CVE-2026-106436 CVE-2026-112368}
[trixie] - php-mongodb 2.0.0-1+deb13u2
[27 Oct 2026] DSA-6588-1 openjdk-21 - security update
- {CVE-2026-83374 CVE-2026-83376 CVE-2026-83378 CVE-2026-83380 CVE-2026-83381 CVE-2026-83387 CVE-2026-83395 CVE-2026-83400 CVE-2026-87290 CVE-2026-87291 CVE-2026-87292 CVE-2026-87294 CVE-2026-87367 CVE-2026-91332 CVE-2026-91333 CVE-2026-91334 CVE-2026-91335 CVE-2026-91373 CVE-2026-91374 CVE-2026-91375 CVE-2026-91379 CVE-2026-91380 CVE-2026-91382 CVE-2026-91394 CVE-2026-91397 CVE-2026-91398 CVE-2026-91400 CVE-2026-91403 CVE-2026-91410 CVE-2026-91411 CVE-2026-91415 CVE-2026-91418 CVE-2026-91451 CVE-2026-91452 CVE-2026-91453 CVE-2026-91461 CVE-2026-91462 CVE-2026-91463 CVE-2026-91464 CVE-2026-91487}
+ {CVE-2026-83374 CVE-2026-83376 CVE-2026-83378 CVE-2026-83380 CVE-2026-83381 CVE-2026-83387 CVE-2026-83395 CVE-2026-83400 CVE-2026-87290 CVE-2026-87291 CVE-2026-87292 CVE-2026-87294 CVE-2026-87367 CVE-2026-91332 CVE-2026-91333 CVE-2026-91334 CVE-2026-91335 CVE-2026-91373 CVE-2026-91374 CVE-2026-91375 CVE-2026-91379 CVE-2026-91380 CVE-2026-91382 CVE-2026-91394 CVE-2026-91397 CVE-2026-91398 CVE-2026-91400 CVE-2026-91403 CVE-2026-91410 CVE-2026-91411 CVE-2026-91415 CVE-2026-91418 CVE-2026-91451 CVE-2026-91452 CVE-2026-91453 CVE-2026-91461 CVE-2026-91462 CVE-2026-91463 CVE-2026-91464 CVE-2026-91487 CVE-2026-101516}
[trixie] - openjdk-21 21.0.13+9-1~deb13u2
[27 Oct 2026] DSA-6587-1 pdns - security update
{CVE-2026-73206}
=====================================
data/dsa-needed.txt
=====================================
@@ -72,7 +72,7 @@ gst-plugins-good1.0 (jmm)
hplip
security patches first need to be isolated
--
-imagemagick
+imagemagick (jmm)
Bastien is planning to work on an update <YNf4K8RmS8Ky1Q4qpmlLig at debian.org>
--
jackson-databind
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2b19d86081daf97899a8cd92213f6b1774720cdc
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2b19d86081daf97899a8cd92213f6b1774720cdc
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/f13d1fa7/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list