[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Wed Sep 2 10:38:11 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
9ebe5224 by Salvatore Bonaccorso at 2026-09-02T11:37:42+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -517,12 +517,12 @@ CVE-2026-84470 (A flaw was found in Ansible Automation Platform's automation-con
CVE-2026-84373 (Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 ...)
NOT-FOR-US: Vitest
CVE-2026-84311 (pypdf is a free and open-source pure-python PDF library. Prior to 6.16 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1146476)
- pypdf2 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2527050
TODO: check upstream references
CVE-2026-84310 (pypdf is a free and open-source pure-python PDF library. Prior to 6.16 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1146476)
- pypdf2 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2527049
TODO: check upstream references
@@ -662,26 +662,26 @@ CVE-2026-84303 (gRPC-Go is the Go language implementation of gRPC. Prior to 1.83
NOTE: https://github.com/grpc/grpc-go/pull/9335 (v1.83.x backport)
NOTE: Fixed by: https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe (v1.83.1)
CVE-2026-84270 (A flaw was found in the MTP backend in gvfs. When reading a file from ...)
- - gvfs <unfixed>
+ - gvfs <unfixed> (bug #1146478)
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/issues/864
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/340
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/070e5e4223c97f7e793a342ba6e64df1095ccb0d (1.61.90)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/25add8b5103384c7edc8ad74722ed93eb3f6f077 (1.60.2)
CVE-2026-84269 (A flaw was found in the AFP backend in gvfs. When mounting a share, a ...)
- - gvfs <unfixed>
+ - gvfs <unfixed> (bug #1146478)
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/issues/863
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/340
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/072a7e02d11f5b7dfa324b70dd0e16d60f9b9e60 (1.61.90)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/81525b2c917950554255784542674222bfee797d (1.60.2)
CVE-2026-84268 (A flaw was found in the SFTP backend in gvfs. When mounting a share an ...)
- - gvfs <unfixed>
+ - gvfs <unfixed> (bug #1146478)
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/issues/862
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/5ab77256f9c071c7c99a5298db1729cf143bff05 (1.61.90)
NOTE: Follow up: https://gitlab.gnome.org/GNOME/gvfs/-/commit/1ff24454d1c9b964a5f0efdd54c6d1421e770d64 (1.61.90)
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/ea1322daab1979b30cf96b3e39ed6db5e45fc041 (1.60.2)
NOTE: Follow up: https://gitlab.gnome.org/GNOME/gvfs/-/commit/1590471ad9c382de4fc544bdf49c8f424eea96f8 (1.60.2)
CVE-2026-84267 (A flaw was found in the SFTP backend in gvfs. When mounting a share, a ...)
- - gvfs <unfixed>
+ - gvfs <unfixed> (bug #1146478)
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/issues/861
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/340
NOTE: Fixed by: https://gitlab.gnome.org/GNOME/gvfs/-/commit/d9a59b8e385189b4783d9b66ca475f530fb26693 (1.61.90)
@@ -765,69 +765,69 @@ CVE-2026-83619 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09 (0.8.15)
NOTE: 0.9.x is not affected by the vulnerability, mark first version in unstable as fixed version
CVE-2026-83618 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362 (0.9.12)
CVE-2026-83617 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362 (0.9.12)
CVE-2026-83616 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9 (0.9.12)
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b (0.8.15)
CVE-2026-83615 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1 (0.9.12)
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d (0.8.15)
CVE-2026-83614 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4 (0.9.12)
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9 (0.8.15)
CVE-2026-83613 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3 (0.9.12)
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213 (0.8.15)
CVE-2026-83612 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707 (0.9.12)
CVE-2026-83611 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362 (0.9.12)
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828 (0.8.15)
CVE-2026-83610 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b (0.9.12)
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0 (0.8.15)
CVE-2026-83609 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-3px3-54cx-rmw9
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: Fixed by: https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362 (0.9.12)
CVE-2026-83608 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE: https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
@@ -1354,14 +1354,14 @@ CVE-2026-82731 (URL Redirection to Untrusted Site ('Open Redirect') vulnerabilit
CVE-2026-82730 (Incorrect Authorization vulnerability in ash-project ash_typescript al ...)
NOT-FOR-US: ash-project
CVE-2026-82398 (pypdf is a free and open-source pure-python PDF library. Prior to 6.15 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1146476)
[trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-fc8x-2rww-xw9m
NOTE: https://github.com/py-pdf/pypdf/pull/3947
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa (6.15.0)
CVE-2026-82397 (Tornado is a Python web framework and asynchronous networking library. ...)
- - python-tornado <unfixed>
+ - python-tornado <unfixed> (bug #1146475)
NOTE: https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
NOTE: Fixed by: https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de (v6.5.8)
CVE-2026-82396 (Sulu is an open-source PHP content management system based on the Symf ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ebe52244d3674b3e94fdc9127e2cca4bfaeb22e
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ebe52244d3674b3e94fdc9127e2cca4bfaeb22e
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260902/08f0efc0/attachment.htm>
More information about the debian-security-tracker-commits
mailing list