[Git][security-tracker-team/security-tracker][master] trixie triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Thu Oct 29 22:02:04 GMT 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
2e8ea0fd by Moritz Muehlenhoff at 2026-10-29T23:00:25+01:00
trixie triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1371,22 +1371,26 @@ CVE-2026-XXXX [GHSA-vj9g-4mg6-q9hw]
NOTE: https://github.com/amule-org/amule/security/advisories/GHSA-vj9g-4mg6-q9hw
CVE-2026-105031 (When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_ ...)
- qpid-proton <unfixed>
+ [trixie] - qpid-proton <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/28/22
NOTE: https://issues.apache.org/jira/browse/PROTON-2976
NOTE: https://github.com/apache/qpid-proton/commit/d793f97e4a2d0f960eda32724a2e867236468337 (0.41.1-rc1)
CVE-2026-105042 (A message body that is deeply nested and decoded by pn_message_body() ...)
- qpid-proton <unfixed>
+ [trixie] - qpid-proton <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/28/23
NOTE: https://issues.apache.org/jira/browse/PROTON-2976
NOTE: https://github.com/apache/qpid-proton/commit/d793f97e4a2d0f960eda32724a2e867236468337 (0.41.1-rc1)
CVE-2026-114230 (When dispatching SASL frames to authenticate the peer, Proton will als ...)
- qpid-proton <unfixed>
+ [trixie] - qpid-proton <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/28/24
NOTE: https://issues.apache.org/jira/browse/PROTON-2945
NOTE: https://github.com/apache/qpid-proton/commit/94e2df384a493cbb8a4870a40d90e08708e131eb (0.41.1-rc1)
NOTE: https://github.com/apache/qpid-proton/commit/b7fb4507bb233db10825e6ffd456086dedca22f6 (0.41.1-rc1)
CVE-2026-115942 (A misconfigured wildcard TLS certificate causes a stack read overflow. ...)
- qpid-proton <unfixed>
+ [trixie] - qpid-proton <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/28/25
NOTE: https://issues.apache.org/jira/browse/PROTON-2974
NOTE: https://github.com/apache/qpid-proton/commit/d65168bbef23cac2dda2fbef05cdc9aa6e71651e (0.41.1-rc1)
@@ -1506,6 +1510,7 @@ CVE-2026-59979 (YosemiteCrew provides organization-based service and task manage
NOT-FOR-US: YosemiteCrew
CVE-2026-59959 (SAIL is a cross-platform library for loading and saving images with su ...)
- sail 1.2.0-1
+ [trixie] - sail <no-dsa> (Minor issue)
NOTE: https://github.com/HappySeaFox/sail/security/advisories/GHSA-5g8g-g347-84m8
NOTE: Fixed by: https://github.com/HappySeaFox/sail/commit/495660135a4c62e416a1b357a4381dd30069229d (v1.0.2)
CVE-2026-59185 (identrail is a machine identity security platform for AWS, GitHub/OIDC ...)
@@ -3477,42 +3482,52 @@ CVE-2026-XXXX [GHSA-9vw2-f4vp-x7gf: PHPUnit vulnerable to code execution by othe
NOTE: https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-9vw2-f4vp-x7gf
CVE-2026-116273 (MIME::Parser versions before 5.521 for Perl set no limit on the number ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712323/
CVE-2026-116272 (MIME::Field::ParamVal versions before 5.521 for Perl do not flag a dup ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712325/
CVE-2026-116271 (MIME::Parser::FileUnder versions before 5.521 for Perl reuse a pre-cre ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712322/
CVE-2026-116270 (MIME::Words versions before 5.521 for Perl allow memory exhaustion via ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712320/
CVE-2026-116269 (MIME::Field::ParamVal versions before 5.521 for Perl turn an RFC 2231 ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712331/
CVE-2026-116268 (MIME::Field::ParamVal versions before 5.521 for Perl allow CPU exhaust ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712328/
CVE-2026-116267 (MIME::Parser versions before 5.521 for Perl allow memory exhaustion vi ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712333/
CVE-2026-116266 (MIME::Head versions from 5.518 before 5.521 for Perl decode a partly e ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712335/
CVE-2026-116265 (MIME::Field::ParamVal versions before 5.521 for Perl do not flag an am ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712330/
CVE-2026-116264 (MIME::Field::ParamVal versions before 5.521 for Perl allow one invalid ...)
- libmime-tools-perl 5.522-1 (bug #1152317)
+ [trixie] - libmime-tools-perl <no-dsa> (Minor issue)
NOTE: https://metacpan.org/release/DSKOLL/MIME-tools-5.522/changes
NOTE: https://lists.security.metacpan.org/cve-announce/msg/44712337/
CVE-2026-XXXX [qbittorrent: unauthenticated memory exhaustion in the embedded tracker]
@@ -5086,6 +5101,7 @@ CVE-2026-117530 (In JetBrains Junie CLI before 26.8.17 command execution was pos
NOT-FOR-US: JetBrains
CVE-2026-117526 (A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by ...)
- node-redux-devtools <unfixed>
+ [trixie] - node-redux-devtools <no-dsa> (Minor issue)
NOTE: https://github.com/reduxjs/redux-devtools/issues/2125
CVE-2026-117516 (A weakness has been identified in oretnom23 php-travel-agency-system. ...)
NOT-FOR-US: oretnom23 php-travel-agency-system
@@ -5815,10 +5831,12 @@ CVE-2026-116744 (ntop nDPI through 6.0 contains an out-of-bounds read vulnerabil
NOTE: Fixed by: https://github.com/ntop/nDPI/commit/ca9d819151606377ac53305583fe819748c69be2
CVE-2026-116743 (libyal libmsiecf through 20260525 contains a double free vulnerability ...)
- libmsiecf <unfixed>
+ [trixie] - libmsiecf <no-dsa> (Minor issue)
NOTE: https://github.com/libyal/libmsiecf/issues/6
NOTE: https://github.com/libyal/libmsiecf/commit/a99a703d190d62f6c21b6225cf84ce80037e45d5
CVE-2026-116742 (HTSlib through 1.24 contains a heap out-of-bounds write and read vulne ...)
- htslib <unfixed>
+ [trixie] - htslib <no-dsa> (Minor issue)
NOTE: https://github.com/samtools/htslib/pull/2057
NOTE: Fixed by: https://github.com/samtools/htslib/commit/18dddf02bb2c0053b32acec427723555a24b2873 (1.25)
CVE-2026-116741 (Speex (libspeex) through 1.2.1 contains an out-of-bounds write vulnera ...)
@@ -7159,11 +7177,13 @@ CVE-2026-104593 (osmo-msc through 1.15.0 contains a stack-based buffer overflow
NOTE: Fixed by: https://github.com/osmocom/osmo-msc/commit/cd347bbe5392d8170ab87140b2bfdac683058b09 (1.16.0)
CVE-2026-104592 (libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP ...)
- libosmocore 1.14.2-1
+ [trixie] - libosmocore <no-dsa> (Minor issue)
NOTE: https://osmocom.org/issues/7053
NOTE: https://gerrit.osmocom.org/c/libosmocore/+/43215
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/1659b5874223934d5586e3e96b7d59f653c90ea6 (1.14.2)
CVE-2026-104591 (libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_com ...)
- libosmocore 1.14.2-1
+ [trixie] - libosmocore <no-dsa> (Minor issue)
NOTE: https://osmocom.org/issues/7052
NOTE: Fixed by: https://github.com/osmocom/libosmocore/commit/0b0f165106b7918435a47f8cb28c651228b8e4aa (1.14.2)
CVE-2026-103377 (A reflected Cross-Site Scripting (XSS) vulnerability has been identifi ...)
@@ -8224,18 +8244,21 @@ CVE-2026-115586 (virtualenv is a tool for creating isolated virtual python envir
NOTE: Fixed by: https://github.com/pypa/virtualenv/commit/3598e201f6f044e389136b2347a8a919ac03c5f4 (21.14.13)
CVE-2026-115585 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf <unfixed>
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-jr96-gvgh-j3r4
NOTE: https://github.com/py-pdf/pypdf/pull/4240
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/68a0e5046cc9e14a6c24a21a713f3c7fbde18b4b (6.21.2)
CVE-2026-115580 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf <unfixed>
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-gmh7-3g9r-mjh5
NOTE: https://github.com/py-pdf/pypdf/pull/4239
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/a3061e34b169d34478d520f5f049c53cfb1482b2 (6.21.2)
CVE-2026-115572 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
- pypdf <unfixed>
+ [trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-6c7f-9265-g8fw
NOTE: https://github.com/py-pdf/pypdf/pull/4240
@@ -10036,6 +10059,7 @@ CVE-2026-114609 (fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpd
NOTE: Fixed by: https://github.com/py-pdf/fpdf2/commit/6e23f610b7946e96e9a5dd0535dcbfbe7ac1397d (2.8.8)
CVE-2026-114608 (Pylint is a static code analyser for Python. From 0.15.2 until 4.0.9, ...)
- pylint <unfixed>
+ [trixie] - pylint <no-dsa> (Minor issue)
NOTE: https://github.com/pylint-dev/pylint/security/advisories/GHSA-22qq-2fwx-7p67
NOTE: Fixed by: https://github.com/pylint-dev/pylint/commit/58c87cffca9de2b3e89aa07b89686cbc90cfea2d (v4.0.9)
CVE-2026-114607 (Better Auth is an authentication and authorization library for TypeScr ...)
@@ -10060,6 +10084,7 @@ CVE-2026-114583 (tarfile.tar_filter could be bypassed using crafted link entries
[trixie] - python3.13 <no-dsa> (Minor issue)
- python3.11 <removed>
- jython <unfixed>
+ [trixie] - jython <no-dsa> (Minor issue)
- pypy3 <unfixed>
[trixie] - pypy3 <no-dsa> (Minor issue)
NOTE: https://github.com/python/cpython/issues/160097
@@ -22416,8 +22441,12 @@ CVE-2026-111167 (GNU LibreDWG through 0.14.8612 contains a global out-of-bounds
- libredwg <itp> (bug #595191)
CVE-2026-111166 (libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerabil ...)
- libmikmod 3.3.16-1
+ [trixie] - libmikmod <no-dsa> (Minor issue)
+ NOTE: https://github.com/sezero/mikmod/commit/b5f742e4e995d7503efee695ef26f275bba4c938 (libmikmod-3.3.16)
CVE-2026-111165 (libmikmod through 3.3.15 contains a global out-of-bounds read vulnerab ...)
- libmikmod 3.3.16-1
+ [trixie] - libmikmod <no-dsa> (Minor issue)
+ NOTE: https://github.com/sezero/mikmod/commit/8f814ebfc0ca66f6471b1f448ff8b904e7d56a53 (libmikmod-3.3.16)
CVE-2026-111164 (UADE through 3.05 contains an out-of-bounds read vulnerability in uade ...)
NOT-FOR-US: UADE
CVE-2026-111163 (WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerabilit ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -68,6 +68,9 @@ gst-plugins-good1.0 (jmm)
hplip
security patches first need to be isolated
--
+imagemagick (jmm)
+ Second update by Bastien to be reviewed
+--
jackson-databind
--
jetty9
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e8ea0fdb992d560ded28821a6ae00adc12be55f
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e8ea0fdb992d560ded28821a6ae00adc12be55f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261029/6e93d611/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list