[Git][security-tracker-team/security-tracker][master] Add new set of pypdf issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c7df7e6d by Salvatore Bonaccorso at 2026-10-30T08:32:47+01:00
Add new set of pypdf issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -131,19 +131,47 @@ CVE-2026-119260 (Use after free in Frames in Google Chrome prior to 156.0.8078.7
 CVE-2026-119210 (MariaDB Connector/J is used to connect applications developed in Java  ...)
 	TODO: check
 CVE-2026-119209 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	TODO: check
+	- pypdf <unfixed>
+	- pypdf2 <removed>
+	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-x3rh-gjgm-fmqc
+	NOTE: https://github.com/py-pdf/pypdf/pull/4269
+	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/a93fe3a901fd00af38f0a105c3ba7175fa72dcb4 (6.21.3)
 CVE-2026-119208 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	TODO: check
+	- pypdf <unfixed>
+	- pypdf2 <removed>
+	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-62m5-6wh8-28x7
+	NOTE: https://github.com/py-pdf/pypdf/pull/4270
+	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/82b91951dc74496bb3efe6465434f041bb6a5e6b (6.21.3)
 CVE-2026-119207 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	TODO: check
+	- pypdf <unfixed>
+	- pypdf2 <removed>
+	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-4vqv-7265-gm2w
+	NOTE: https://github.com/py-pdf/pypdf/pull/4265
+	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/64270258c0eced720f7960aecf8cef31afd39f8d (6.21.3)
 CVE-2026-119206 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	TODO: check
+	- pypdf <unfixed>
+	- pypdf2 <removed>
+	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-42gh-23hr-vphw
+	NOTE: https://github.com/py-pdf/pypdf/pull/4251
+	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/b891fef37000cd86baa6e9848a3387d080b3b03e (6.21.3)
 CVE-2026-119205 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	TODO: check
+	- pypdf <unfixed>
+	- pypdf2 <removed>
+	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-mfr5-77xh-9j7h
+	NOTE: https://github.com/py-pdf/pypdf/pull/4288
+	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/f176db1a1f7f9af3e472e69a843ef1175653b044 (6.21.4)
 CVE-2026-119204 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	TODO: check
+	- pypdf <unfixed>
+	- pypdf2 <removed>
+	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-cggf-277g-3q54
+	NOTE: https://github.com/py-pdf/pypdf/pull/4290
+	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/ea4ac663133f1b3de1d7a8f2e6fa239802fde79e (6.21.4)
 CVE-2026-119203 (pypdf is a free and open-source pure-python PDF library. Prior to 6.21 ...)
-	TODO: check
+	- pypdf <unfixed>
+	- pypdf2 <removed>
+	NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-5849-834g-hvw5
+	NOTE: https://github.com/py-pdf/pypdf/pull/4289
+	NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/06593f993789a4b573dd955730c1a7051128bb2a (6.21.4)
 CVE-2026-119202 (@hapi/content provides HTTP Content-* header parsing. From 3.0.6 until ...)
 	TODO: check
 CVE-2026-119201 (Nuxt is an open-source web development framework for Vue.js. From 4.6. ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c7df7e6d769bb07ea48e0eb5acd53307c70fc808

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c7df7e6d769bb07ea48e0eb5acd53307c70fc808
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/0e00298d/attachment.htm>