[Git][security-tracker-team/security-tracker][master] python-git, tor, imagemagick DSAs
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Thu Oct 29 18:44:09 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
0dc49055 by Moritz Mühlenhoff at 2026-10-29T19:43:44+01:00
python-git, tor, imagemagick DSAs
- - - - -
3 changed files:
- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -9,6 +9,7 @@ CVE-2026-115642 [OSSA-2026-050: keystonemiddleware access_rules bypass via X-Ser
NOTE: https://security.openstack.org/ossa/OSSA-2026-050.html
CVE-2026-XXXX [TROVE-2026-072]
- tor 0.4.9.15-1
+ [trixie] - tor 0.4.9.15-0+deb13u1
NOTE: https://gitlab.torproject.org/tpo/core/tor/-/work_items/41456
NOTE: https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.9/ChangeLog
CVE-2026-116470
@@ -45582,7 +45583,6 @@ CVE-2026-102639 (MobilityDB version 1.3.0 and earlier contains an out-of-bounds
CVE-2026-102635 (ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitializ ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.33+dfsg1-1 (bug #1149974)
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-rvv7-5mh8-vcfc
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4 (7.1.2-32)
NOTE: Revert: https://github.com/ImageMagick/ImageMagick/commit/a0ca2c739c0216ff4efbd631d1ba7fd54dba1ff4 (7.1.2-32)
@@ -57289,7 +57289,6 @@ CVE-2026-93591 (SiYuan versions before 3.8.3 contain an SQL injection vulnerabil
NOT-FOR-US: SiYuan
CVE-2026-93590 (ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in ...)
- imagemagick 8:7.1.2.31+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
[bookworm] - imagemagick <not-affected> (vulnerable code introduced later)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/59046410c17e9421f0ad7b4bec478a892cf30c12 (7.1.2-31)
@@ -57297,21 +57296,18 @@ CVE-2026-93590 (ImageMagick before 7.1.2-31 contains a policy bypass vulnerabili
CVE-2026-93589 (ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/8f620237fe341e814430fe3621b867b0b615f446 (7.1.2-31)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/1e91833e30a88c104276dcfbc01bb68ac4528514 (6.9.13-56)
CVE-2026-93588 (ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL point ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-92rw-c5mw-27v4
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/c4b3c9039a1509e3e7869331773865b521a62f93 (7.1.2-31)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/3b124bb81d3c53ec7d2b46f5ea04c00c4b07b9b3 (6.9.13-56)
CVE-2026-93587 (ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy byp ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/d779ac52f92c3045ced59362b483bee25a3fc784 (7.1.2-31)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/b5da5eac006bae77c587a7c238e346c90ea52acd (7.1.2-31)
@@ -57320,7 +57316,6 @@ CVE-2026-93587 (ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a poli
CVE-2026-93586 (ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after- ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/282f455de5c80a7a0d1a713087db9c8fce344141 (7.1.2-31)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/4fe31106f41fa114945ceaf93226fb151ada0d19 (7.1.2-31)
@@ -78424,21 +78419,18 @@ CVE-2026-86426 (LibreNMS before 26.8.0 contains an authentication bypass vulnera
CVE-2026-86425 (ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1 (bug #1147176)
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-chf5-8rv9-gjqr
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/5bff96a5c8d0b3dafa4ad4fa7916db4cae72a11d (7.1.2-30)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/e006a69e03f3aff34e9a7af90a0793ec6d879b48 (6.9.13-55)
CVE-2026-86424 (ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-tim ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1 (bug #1147176)
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-9x6f-98x9-rx6g
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/a44ef50cc494253f7d9f0229bb25c064a8e2ae69 (7.1.2-30)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/0b47fb7e3d5650b2be88fd3a8c15096765970ce3 (6.9.13-55)
CVE-2026-86423 (ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1 (bug #1147176)
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-5m9j-96ff-j6qc
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/1d3e98913f6a8fa34b5a4180eadb9ed195b918a8 (7.1.2-30)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/ed44f0ba6e2ab57983a6d030c868d009514dc470 (6.9.13-55)
@@ -78448,14 +78440,12 @@ CVE-2026-86422 (ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use
CVE-2026-86421 (ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in th ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1 (bug #1147176)
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4jv7-q6xw-6f4x
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/c83153dfc128de8e7c538f879c532c7d36a75abb (7.1.2-30)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/d56cab9f2253373e57c2e77809ab12abbbbdd680 (6.9.13-55)
CVE-2026-86420 (ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.31+dfsg1-1 (bug #1147176)
- [trixie] - imagemagick <no-dsa> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4mwf-mggw-29vp
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/6ac07556a93b2de00c845cd535ca256f45a47154 (7.1.2-30)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/29f17f3fe5008fc56f00c1fbc96adf46169db245 (6.9.13-55)
@@ -120356,7 +120346,6 @@ CVE-2026-69149 (Angular is a development platform for building mobile and deskto
- angular.js <unfixed>
CVE-2026-69097 (GitPython before 3.1.53 fails to properly escape section names in git ...)
- python-git 3.1.61-1 (bug #1143602)
- [trixie] - python-git <no-dsa> (Minor issue)
NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-3rp5-jjmw-4wv2
NOTE: Fixed by: https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1 (3.1.53)
CVE-2026-69096 (OpenWrt luci-app-dockerman (LuCI master and openwrt-25.12 snapshots co ...)
@@ -122653,7 +122642,6 @@ CVE-2026-65975 (Pydantic AI is a Python agent framework for building application
CVE-2026-64685 (ImageMagick is free and open-source software used for editing and mani ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.27+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
[bullseye] - imagemagick <postponed> (minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7rgw-xg25-prjm
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/093f476e985d61557ea75ad0ef30d491dff816f3 (7.1.2-27)
@@ -122667,14 +122655,12 @@ CVE-2026-63118 (MCP Ruby SDK is the official Ruby SDK for Model Context Protocol
CVE-2026-62946 (ImageMagick is free and open-source software used for editing and mani ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.27+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
[bullseye] - imagemagick <postponed> (minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-h22j-f9xw-xjjm
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/538ad18f3a421d1dd9629baa747eebc137c32b67 (7.1.2-27)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/8018a5c3214ca9bf11a86c2816833dee920b1340 (6.9.13-52)
CVE-2026-62363 (ImageMagick is free and open-source software used for editing and mani ...)
- imagemagick 8:7.1.2.27+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
[bookworm] - imagemagick <not-affected> (vulnerable code introduced later)
[bullseye] - imagemagick <not-affected> (vulnerable code introduced later)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-422r-8c97-xcg4
@@ -122684,7 +122670,6 @@ CVE-2026-62363 (ImageMagick is free and open-source software used for editing an
CVE-2026-62343 (ImageMagick is free and open-source software used for editing and mani ...)
{DLA-4858-1}
- imagemagick 8:7.1.2.26+dfsg1-1
- [trixie] - imagemagick <no-dsa> (Minor issue)
[bullseye] - imagemagick <postponed> (minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-f5m7-cqgw-8hm7
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/9acf93f66b0f8495fa222e1a27c3db534cd78864 (7.1.2-26)
@@ -191409,14 +191394,12 @@ CVE-2026-44263 (Weblate is a web based localization tool. Prior to version 5.17.
- weblate <itp> (bug #745661)
CVE-2026-44244 (GitPython is a python library used to interact with Git repositories. ...)
- python-git 3.1.50-1
- [trixie] - python-git <no-dsa> (Minor issue)
NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-v87r-6q3f-2j67
NOTE: https://github.com/gitpython-developers/GitPython/pull/2137
NOTE: https://github.com/gitpython-developers/GitPython/commit/c417af469f9aa3da8dfef78f996c0fb8c5d1f4c2 (3.1.49)
NOTE: https://github.com/gitpython-developers/GitPython/commit/8e24503b42c1d63dd98e8b2e6a2f655bdd0821e3 (3.1.49)
CVE-2026-44243 (GitPython is a python library used to interact with Git repositories. ...)
- python-git 3.1.50-1
- [trixie] - python-git <no-dsa> (Minor issue)
NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-7545-fcxq-7j24
NOTE: https://github.com/gitpython-developers/GitPython/pull/2134
NOTE: Fixed by: https://github.com/gitpython-developers/GitPython/commit/25ba54dd3fb374b8fade7de4be1ac2ac84722190 (3.1.48)
@@ -197594,12 +197577,10 @@ CVE-2026-21023 (Insufficient verification of data authenticity in PackageManager
NOT-FOR-US: Samsung Mobile
CVE-2026-42215 (GitPython is a python library used to interact with Git repositories. ...)
- python-git 3.1.50-1 (bug #1135349)
- [trixie] - python-git <no-dsa> (Minor issue)
NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rpm5-65cw-6hj4
NOTE: Fixed by: https://github.com/gitpython-developers/GitPython/commit/0f68db0710f9125762fca5dbc2328593537ae923 (3.1.47)
CVE-2026-42284 (GitPython is a python library used to interact with Git repositories. ...)
- python-git 3.1.50-1 (bug #1135350)
- [trixie] - python-git <no-dsa> (Minor issue)
NOTE: https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-x2qx-6953-8485
NOTE: Fixed by: https://github.com/gitpython-developers/GitPython/pull/2130
NOTE: Fixed by: https://github.com/gitpython-developers/GitPython/commit/c9a26789d88b18f8b4620f37307df2976292d2a0 (3.1.47)
=====================================
data/DSA/list
=====================================
@@ -1,3 +1,11 @@
+[29 Oct 2026] DSA-6595-1 tor - security update
+ [trixie] - tor 0.4.9.15-0+deb13u1
+[29 Oct 2026] DSA-6594-1 python-git - security update
+ {CVE-2026-42215 CVE-2026-42284 CVE-2026-44243 CVE-2026-44244 CVE-2026-67322 CVE-2026-67323 CVE-2026-67324 CVE-2026-67325 CVE-2026-67326 CVE-2026-69097 CVE-2026-73619 CVE-2026-73620 CVE-2026-73621 CVE-2026-73622 CVE-2026-73623 CVE-2026-73624 CVE-2026-73625 CVE-2026-76217 CVE-2026-76218 CVE-2026-76219 CVE-2026-76220 CVE-2026-76221 CVE-2026-76222 CVE-2026-78675 CVE-2026-78676 CVE-2026-78677 CVE-2026-78678 CVE-2026-78679 CVE-2026-87817 CVE-2026-87818 CVE-2026-87819 CVE-2026-100689 CVE-2026-110855 CVE-2026-110856 CVE-2026-110857 CVE-2026-110858 CVE-2026-110860 CVE-2026-114145}
+ [trixie] - python-git 3.1.44-1+deb13u1
+[29 Oct 2026] DSA-6593-1 imagemagick - security update
+ {CVE-2026-62343 CVE-2026-62363 CVE-2026-62946 CVE-2026-64685 CVE-2026-86420 CVE-2026-86421 CVE-2026-86423 CVE-2026-86424 CVE-2026-86425 CVE-2026-93586 CVE-2026-93587 CVE-2026-93588 CVE-2026-93589 CVE-2026-93590 CVE-2026-102635 CVE-2026-106564 CVE-2026-106565 CVE-2026-106566 CVE-2026-106567 CVE-2026-106568 CVE-2026-106570 CVE-2026-106571 CVE-2026-106572 CVE-2026-106573 CVE-2026-106574 CVE-2026-106575 CVE-2026-106576 CVE-2026-106577 CVE-2026-106578 CVE-2026-106579 CVE-2026-106580 CVE-2026-107208 CVE-2026-107209 CVE-2026-107210 CVE-2026-109261 CVE-2026-116152}
+ [trixie] - imagemagick 8:7.1.1.43+dfsg1-1+deb13u13
[28 Oct 2026] DSA-6592-1 chromium - security update
{CVE-2026-118304 CVE-2026-118305 CVE-2026-118306 CVE-2026-118307 CVE-2026-118308 CVE-2026-118309 CVE-2026-118310 CVE-2026-118311 CVE-2026-118312 CVE-2026-118313 CVE-2026-118314 CVE-2026-118315 CVE-2026-118316 CVE-2026-118317 CVE-2026-118318 CVE-2026-118319 CVE-2026-118320 CVE-2026-118321 CVE-2026-118322 CVE-2026-118327 CVE-2026-118328 CVE-2026-118329 CVE-2026-118330 CVE-2026-118331 CVE-2026-118332 CVE-2026-118333 CVE-2026-118334 CVE-2026-118335 CVE-2026-118336 CVE-2026-118337 CVE-2026-118338 CVE-2026-118339 CVE-2026-118340 CVE-2026-118341 CVE-2026-118342 CVE-2026-118343 CVE-2026-118344 CVE-2026-118345 CVE-2026-118346 CVE-2026-118347 CVE-2026-118348 CVE-2026-118349 CVE-2026-118350 CVE-2026-118351 CVE-2026-118352 CVE-2026-118353 CVE-2026-118354 CVE-2026-118355 CVE-2026-118356 CVE-2026-118357 CVE-2026-118358 CVE-2026-118359}
[trixie] - chromium 156.0.8078.73-1~deb13u1
=====================================
data/dsa-needed.txt
=====================================
@@ -68,9 +68,6 @@ gst-plugins-good1.0 (jmm)
hplip
security patches first need to be isolated
--
-imagemagick (jmm)
- Bastien is planning to work on an update <YNf4K8RmS8Ky1Q4qpmlLig at debian.org>
---
jackson-databind
--
jetty9
@@ -144,9 +141,6 @@ python-authlib
--
python-django
--
-python-git (jmm)
- Emmanuel Arias is proposing to prepare an update for open issues
---
python-msgpack
Problems with autopkgtests, maintainer pinged and waiting for feedback
--
@@ -180,8 +174,6 @@ tomcat10
--
tomcat11
--
-tor
---
vim
Lee Garrett provided an update for review, <90276a53-99c9-4412-a26f-d84e87a8cb49 at rocketjump.eu>
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0dc4905557da613c6d9072c1fab14915d0e9b260
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0dc4905557da613c6d9072c1fab14915d0e9b260
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/4cf21cb4/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list