[Git][security-tracker-team/security-tracker][master] CVE assigned for one phpunit issue

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
49da367f by Salvatore Bonaccorso at 2026-10-30T08:37:37+01:00
CVE assigned for one phpunit issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -198,8 +198,6 @@ CVE-2026-119194 (pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until
 	- pyasn1 <unfixed>
 	NOTE: https://github.com/pyasn1/pyasn1/security/advisories/GHSA-fm9c-5rcf-2q5p
 	NOTE: Fixed by: https://github.com/pyasn1/pyasn1/commit/a36e3a3d067148d26197a6b7221fd0e2cde9cc86 (v0.6.5)
-CVE-2026-119193 (PHPUnit is a testing framework for PHP. From 13.4.0 until 13.4.4, the  ...)
-	TODO: check
 CVE-2026-119191 (Forge (also called node-forge) is a native implementation of Transport ...)
 	TODO: check
 CVE-2026-119190 (Forge (also called node-forge) is a native implementation of Transport ...)
@@ -4060,11 +4058,12 @@ CVE-2013-20008 (Linksys WAG200G through 1.01.06 contains a weak password change
 	NOT-FOR-US: Linksys
 CVE-2013-20007 (Linksys WAG200G through 1.01.06 contains an OS command injection vulne ...)
 	NOT-FOR-US: Linksys
-CVE-2026-XXXX [GHSA-9vw2-f4vp-x7gf: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling]
+CVE-2026-119193 [GHSA-9vw2-f4vp-x7gf: PHPUnit vulnerable to code execution by other local users via shared temporary directory in PHPT code coverage handling]
 	- phpunit 13.4.5+ds-1
 	[trixie] - phpunit <not-affected> (Vulnerable code introduced later)
 	[bookworm] - phpunit <not-affected> (Vulnerable code introduced later)
 	NOTE: https://github.com/sebastianbergmann/phpunit/security/advisories/GHSA-9vw2-f4vp-x7gf
+	NOTE: Fixed by: https://github.com/sebastianbergmann/phpunit/commit/ae31c78a86e9d6c641497bacf47462d7bb7d7f34 (13.4.4)
 CVE-2026-116273 (MIME::Parser versions before 5.521 for Perl set no limit on the number ...)
 	- libmime-tools-perl 5.522-1 (bug #1152317)
 	[trixie] - libmime-tools-perl <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/49da367fd8b9817ebd0c4b9ab6e387f924308d35

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/49da367fd8b9817ebd0c4b9ab6e387f924308d35
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261030/94c97901/attachment.htm>