[Git][security-tracker-team/security-tracker][master] 4 commits: lts: fix Bookworm mark for libyang2

[Daniel Leidert (@dleidert)]

Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c40b03e1 by Daniel Leidert at 2026-10-29T01:39:21+01:00
lts: fix Bookworm mark for libyang2

- - - - -
35c24025 by Daniel Leidert at 2026-10-29T02:27:28+01:00
Add patch link and commit introducing the issue for CVE-2026-7701/telegram-desktop

If my examination is correct, Debian is not affected because it does not ship
any of the vulnerable versions.

- - - - -
6e4661df by Daniel Leidert at 2026-10-29T02:28:38+01:00
lts: mark CVE-2026-94488/telegram-desktop as not affecting Bookworm

- - - - -
70408cdf by Daniel Leidert at 2026-10-29T02:35:06+01:00
lts: add telegram-desktop to dla-needed

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -8286,8 +8286,8 @@ CVE-2026-115328 (JSON-SCADA before 0.65-alpha contains an sql injection vulnerab
 CVE-2026-115327 (libyang through 6.4.13 contains an uninitialized pointer free vulnerab ...)
 	- libyang <unfixed>
 	[trixie] - libyang <no-dsa> (Minor issue)
-	[bookworm] - libyang <postponed> (Minor issue)
 	- libyang2 <removed>
+	[bookworm] - libyang2 <postponed> (Minor issue)
 	NOTE: https://github.com/CESNET/libyang/issues/2595
 	NOTE: Fixed by: https://github.com/CESNET/libyang/commit/927fce908774289a7d9c07fff5704c33965c9773
 CVE-2026-115326 (QloApps through 1.7.0 contains an insecure direct object reference vul ...)
@@ -55093,6 +55093,7 @@ CVE-2026-94489
 	REJECTED
 CVE-2026-94488 (Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The fi ...)
 	- telegram-desktop <unfixed> (bug #1150329)
+	[bookworm] - telegram-desktop <not-affected> (Vulnerable code introduced in v4.15.1)
 	NOTE: https://expatch.com/writeups/telegram-html-export-xss.html
 	NOTE: Introduced with: https://github.com/telegramdesktop/tdesktop/commit/52c779bffa8dde3c5c09826add2607328fae0924 (v4.15.1)
 	NOTE: Fixed by: https://github.com/telegramdesktop/tdesktop/commit/8457d13aa795fadf99c955d2a04f00ebc3c59df9 (v6.9.4)
@@ -194340,6 +194341,8 @@ CVE-2026-7702 (A vulnerability was detected in toeverything AFFiNE up to 0.26.3.
 CVE-2026-7701 (A security vulnerability has been detected in Telegram Desktop up to 6 ...)
 	- telegram-desktop <undetermined>
 	TODO: check upstream reports
+	NOTE: Fixed by: https://github.com/telegramdesktop/tdesktop/commit/4f8b3efa5c76da5e9fa2bc2d8c55b42315fffb9b (v6.7.6)
+	NOTE: Introduced by: https://github.com/telegramdesktop/tdesktop/commit/89e750a6aae2971fd19d2ea6c7b0edb3c708b054 (v6.5.0)
 CVE-2026-7700 (A weakness has been identified in langflow-ai langflow up to 1.10.2. T ...)
 	NOT-FOR-US: langflow-ai langflow
 CVE-2026-7699 (A security flaw has been discovered in Dromara MaxKey up to 3.5.13. Af ...)


=====================================
data/dla-needed.txt
=====================================
@@ -799,6 +799,10 @@ sssd
 strongswan (Simon Quigley)
   NOTE: 20260907: Added by Front-Desk (eamanu)
 --
+telegram-desktop
+  NOTE: 20261029: Added by Front-Desk (dleidert)
+  NOTE: 20261029: CVE-2026-107181 seems serious and should be addressed (dleidert/front-desk)
+--
 tesseract
   NOTE: 20260919: Added by Front-Desk (Beuc)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/434966ad65e2a321b8902c0a0020e86678459cb5...70408cdf7a3aa670c0e5ece0eb295b0bd966177c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/434966ad65e2a321b8902c0a0020e86678459cb5...70408cdf7a3aa670c0e5ece0eb295b0bd966177c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/21e565fd/attachment-0001.htm>