[Git][security-tracker-team/security-tracker][master] 6 commits: lts: mark CVE-2026-111581/libblockdev as postponed

[Daniel Leidert (@dleidert)]

Daniel Leidert pushed to branch master at Debian Security Tracker / security-tracker


Commits:
6be3ddf0 by Daniel Leidert at 2026-10-31T04:03:33+01:00
lts: mark CVE-2026-111581/libblockdev as postponed

The analysis shows only minor consequences.

- - - - -
10323ed2 by Daniel Leidert at 2026-10-31T04:22:16+01:00
lts: mark CVE-2026-110353/haproxy as postponed

- - - - -
d1b83f26 by Daniel Leidert at 2026-10-31T04:51:28+01:00
Add patch link for CVE-2026-110715/mujs

- - - - -
15cec7eb by Daniel Leidert at 2026-10-31T04:55:54+01:00
Add patch link for CVE-2026-110716/unshield

- - - - -
cf080a3c by Daniel Leidert at 2026-10-31T04:58:22+01:00
lts: mark CVE-2026-110716/unshield as postponed

- - - - -
99e68705 by Daniel Leidert at 2026-10-31T05:32:03+01:00
Add patch link for CVE-2026-112007/schism

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -12784,6 +12784,7 @@ CVE-2026-110369 (Deserialization of Untrusted Data vulnerability in GS Plugins W
 CVE-2026-110353 (HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to c ...)
 	- haproxy 3.2.26-1
 	[trixie] - haproxy <no-dsa> (Minor issue)
+	[bookworm] - haproxy <postponed> (Minor issue; can be fixed with next update)
 	NOTE: https://git.haproxy.org/?p=haproxy.git;a=commit;h=cec63e95f62a7412484f1134f5aa227e5b7e1466 (v3.5-dev9)
 	NOTE: https://git.haproxy.org/?p=haproxy-3.2.git;a=commit;h=31a657a0ea846a42fa3eac2409de88f0dce9e2af (v3.2.26)
 	NOTE: https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=e1672c9ca04c81b544a60e316eb2bb4af02381e1 (v3.0.30)
@@ -19611,6 +19612,7 @@ CVE-2026-112008 (libmng through 2.0.3 contains a heap-based buffer overflow vuln
 	- libmng <undetermined>
 CVE-2026-112007 (Schism Tracker through 20260524 contains a heap out-of-bounds write vu ...)
 	- schism <undetermined>
+	NOTE: Fixed by: https://github.com/schismtracker/schismtracker/commit/03a7e29367bea085509059a40b6c1efe2681a7cb (master)
 CVE-2026-112006 (OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45 ...)
 	- python-opentelemetry 1.45.1-1
 	NOTE: Fixed by: https://github.com/open-telemetry/opentelemetry-python/commit/89cc68b9ea7e15969b4f042d63397bdc74a3d60e (v1.45.0)
@@ -22854,6 +22856,7 @@ CVE-2026-111593
 CVE-2026-111581 (A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_ ...)
 	- libblockdev <unfixed>
 	[trixie] - libblockdev <no-dsa> (Minor issue)
+	[bookworm] - libblockdev <postponed> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2554104
 CVE-2026-111555 (A flaw was found in luksmeta. Improper boundary validation of metadata ...)
 	- luksmeta 10-2 (bug #1151196)
@@ -25259,8 +25262,11 @@ CVE-2026-110717 (Janus WebRTC Server through 1.4.3 contains a path traversal vul
 	- janus <undetermined>
 CVE-2026-110716 (unshield through 1.6.2 contains a heap out-of-bounds read vulnerabilit ...)
 	- unshield <undetermined>
+	[bookworm] - unshield <postponed> (Minor issue; can be fixed with next update)
+	NOTE: Fixed by: https://github.com/twogood/unshield/commit/d0d7d18480582248ae4d3234ad743904cd8acb77 (main)
 CVE-2026-110715 (MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write v ...)
 	- mujs <undetermined>
+	NOTE: Fixed by: https://codeberg.org/ccxvii/mujs/commit/32064e10caa45e68fc87331ca53d042049cc9396 (1.3.11)
 CVE-2026-110714 (libsmb2 through 6.2 contains an integer underflow vulnerability in dec ...)
 	- libsmb2 <undetermined>
 CVE-2026-110713 (libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability i ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/00fbf251ab0de74ee020e8b4795d630a525046d2...99e68705f697736ba651a3610cbd5859cd6a6246

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/00fbf251ab0de74ee020e8b4795d630a525046d2...99e68705f697736ba651a3610cbd5859cd6a6246
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261031/156dc249/attachment.htm>