[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Thu Sep 3 20:04:55 BST 2026
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
8470c732 by Salvatore Bonaccorso at 2026-09-03T21:04:17+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -213,11 +213,11 @@ CVE-2026-84840 (A vulnerability was identified in tsi-coop tsi-dpdp-cms up to 0.
CVE-2026-84839 (A vulnerability was determined in tsi-coop tsi-dpdp-cms up to 0.5.0. A ...)
NOT-FOR-US: tsi-coop tsi-dpdp-cms
CVE-2026-84838 (A flaw was found in rpmuncompress. This command injection vulnerabilit ...)
- - rpm <unfixed>
+ - rpm <unfixed> (bug #1146602)
[trixie] - rpm <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2462222
CVE-2026-84837 (A flaw was found in rpm. An attacker can exploit a command injection v ...)
- - rpm <unfixed>
+ - rpm <unfixed> (bug #1146602)
[trixie] - rpm <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478408
CVE-2026-84835 (Missing Authorization vulnerability in DimaFreund Rentsyst allows Expl ...)
@@ -1437,7 +1437,7 @@ CVE-2026-84267 (A flaw was found in the SFTP backend in gvfs. When mounting a sh
CVE-2026-84235 (A denial-of-service security issue exists in the affected product. The ...)
NOT-FOR-US: Rockwell Automation
CVE-2026-84233 (A flaw was found in rpm. A local attacker could supply a specially cra ...)
- - rpm <unfixed>
+ - rpm <unfixed> (bug #1146602)
[trixie] - rpm <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478409
TODO: check upstream details
@@ -1640,13 +1640,13 @@ CVE-2026-77194 (The Simple Membership plugin for WordPress is vulnerable to Auth
CVE-2026-76111 (Dell PowerStore contains an Incorrect Authorization vulnerability. An ...)
NOT-FOR-US: Dell / EMC
CVE-2026-75538 (An attacker that connects to an open Erlang TCP port that uses the ine ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-8m6r-2pj2-25pm
NOTE: https://cna.erlef.org/cves/CVE-2026-75538.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-75538
NOTE: Fixed by: https://github.com/erlang/otp/commit/08e8efdba8500d2d6f54c6b1de1492b228017c9b (OTP-29.0.6, OTP-28.5.0.6, OTP-27.3.4.17)
CVE-2026-74994 (The mod_auth module in OTP's inets httpd server, when configured with ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-c3cq-q8x6-547g
NOTE: https://cna.erlef.org/cves/CVE-2026-74994.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-74994
@@ -1656,7 +1656,7 @@ CVE-2026-74994 (The mod_auth module in OTP's inets httpd server, when configured
CVE-2026-74916 (The WP Fastest Cache WordPress plugin before 1.5.1 does not include a ...)
NOT-FOR-US: WordPress plugin
CVE-2026-74835 (The inets application HTTP server httpd fails to enforce a configured ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-8qrh-x566-5xv5
NOTE: https://cna.erlef.org/cves/CVE-2026-74835.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-74835
@@ -1664,13 +1664,13 @@ CVE-2026-74835 (The inets application HTTP server httpd fails to enforce a confi
NOTE: Fixed by: https://github.com/erlang/otp/commit/7f9c460d1818c2afb78fbd01f8d8b81343bbb011 (OTP-28.5.0.6)
NOTE: Fixed by: https://github.com/erlang/otp/commit/0bceff0c2987cae83d9d4a77c5ecacd6d01b8b86 (OTP-27.3.4.17)
CVE-2026-73812 (httpd function check_header/3 rejects duplicate Content-Length (per CV ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-7j6m-4ffg-hg46
NOTE: https://cna.erlef.org/cves/CVE-2026-73812.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-73812
NOTE: Fixed by: https://github.com/erlang/otp/commit/591dc00dc99dc2a426167a3b5257c0c94bd45e91 (OTP-29.0.6, OTP-28.5.0.6, OTP-27.3.4.17)
CVE-2026-73276 (Gracefulness code ignored cases that should be rejected, resulting in ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-6v7q-jwgh-cx8p
NOTE: https://cna.erlef.org/cves/CVE-2026-73276.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-73276
@@ -1678,7 +1678,7 @@ CVE-2026-73276 (Gracefulness code ignored cases that should be rejected, resulti
NOTE: Fixed by: https://github.com/erlang/otp/commit/c285240c6e4b93960c5dc4f17ba04e6fdfb27a0f (OTP-28.5.0.6)
NOTE: Fixed by: https://github.com/erlang/otp/commit/60add5a19e2154560fdff3fe92dba14a68bbd683 (OTP-27.3.4.17)
CVE-2026-73270 (Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inet ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-mh78-93cr-jx8f
NOTE: https://cna.erlef.org/cves/CVE-2026-73270.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-73270
@@ -1688,27 +1688,27 @@ CVE-2026-73270 (Improper Handling of Case Sensitivity vulnerability in Erlang/OT
CVE-2026-71562 (Improper Validation of Specified Quantity in Input vulnerability in Er ...)
NOT-FOR-US: fosrl/pangolin
CVE-2026-71380 (Missing Release of Resource after Effective Lifetime vulnerability in ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-5vp4-58hc-h8cc
NOTE: https://cna.erlef.org/cves/CVE-2026-71380.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-71380
NOTE: Fixed by: https://github.com/erlang/otp/commit/81b453aac5a006bb8d26405f2bc3cf24e9d7733c (OTP-29.0.6, OTP-28.5.0.6, OTP-27.3.4.17)
CVE-2026-70409 (Improper Validation of Specified Quantity in Input vulnerability in Er ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-9vgh-c8cm-m9p4
NOTE: https://cna.erlef.org/cves/CVE-2026-70409.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-70409
NOTE: Fixed by: https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa (OTP-29.0.6, OTP-28.5.0.6)
NOTE: Fixed by: https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d (OTP-27.3.4.17)
CVE-2026-70405 (Improper Validation of Specified Quantity in Input vulnerability in Er ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-q7cq-pfgf-5hr7
NOTE: https://cna.erlef.org/cves/CVE-2026-70405.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-70405
NOTE: Fixed by: https://github.com/erlang/otp/commit/e3be1cfe9f6cedd0cd20d9905e05601dfb31c8aa (OTP-29.0.6, OTP-28.5.0.6)
NOTE: Fixed by: https://github.com/erlang/otp/commit/aba0fe8c2d700bf4ac94607cf7f00e53bbe4042d (OTP-27.3.4.17)
CVE-2026-70399 (Allocation of Resources Without Limits or Throttling vulnerability in ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-pwvh-c689-f8q5
NOTE: https://cna.erlef.org/cves/CVE-2026-70399.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-70399
@@ -1716,7 +1716,7 @@ CVE-2026-70399 (Allocation of Resources Without Limits or Throttling vulnerabili
NOTE: Fixed by: https://github.com/erlang/otp/commit/6746dc4e1df5257ad8ac91cbbd167cb8b0274ce7 (OTP-28.5.0.6)
NOTE: Fixed by: https://github.com/erlang/otp/commit/d94a94c96eb4cccbd6f7d7da5975f0c035b69612 (OTP-27.3.4.17)
CVE-2026-69664 (Missing Release of Resource after Effective Lifetime vulnerability in ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-mr35-8h7w-w3gq
NOTE: https://cna.erlef.org/cves/CVE-2026-69664.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-69664
@@ -1724,7 +1724,7 @@ CVE-2026-69664 (Missing Release of Resource after Effective Lifetime vulnerabili
NOTE: Fixed by: https://github.com/erlang/otp/commit/bd4e74348c6be8a49f060da6fd48d43f3a960292 (OTP-28.5.0.6)
NOTE: Fixed by: https://github.com/erlang/otp/commit/a3adf63078438c86527d704e23282b7721d8ca12 (OTP-27.3.4.17)
CVE-2026-66835 (Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remo ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-r4vv-vc2c-2fw6
NOTE: https://cna.erlef.org/cves/CVE-2026-66835.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-66835
@@ -1796,7 +1796,7 @@ CVE-2026-61750 (NVIDIA Megatron Bridge contains a vulnerability where an attacke
CVE-2026-5480
REJECTED
CVE-2026-59696 (Improper Validation of Specified Quantity in Input vulnerability in Er ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-8qw4-2chm-mvj2
NOTE: https://cna.erlef.org/cves/CVE-2026-59696.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-59696
@@ -1819,7 +1819,7 @@ CVE-2026-58567 (Dell PowerStore contains an OS Command Injection vulnerability.
CVE-2026-58566 (Dell PowerStore, an Incorrect Authorization vulnerability. A low privi ...)
NOT-FOR-US: Dell / EMC
CVE-2026-55951 (The Erlang/OTP httpc HTTP client does not enforce a limit on the total ...)
- - erlang <unfixed>
+ - erlang <unfixed> (bug #1146603)
NOTE: https://github.com/erlang/otp/security/advisories/GHSA-f9fw-mg7q-4g3x
NOTE: https://cna.erlef.org/cves/CVE-2026-55951.html
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-55951
@@ -67355,7 +67355,7 @@ CVE-2026-57964
- spice-vdagent <not-affected> (MacOS/BSD specific)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2493580
CVE-2026-44605 (A flaw was found in the RPM Package Manager (RPM). A local user could ...)
- - rpm <unfixed>
+ - rpm <unfixed> (bug #1146602)
[trixie] - rpm <no-dsa> (Minor issue)
[bookworm] - rpm <postponed> (Minor issue)
[bullseye] - rpm <postponed> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8470c732ab0b484f1f5ba3d0dbebcbb64c05fdb4
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8470c732ab0b484f1f5ba3d0dbebcbb64c05fdb4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260903/67110ea4/attachment.htm>
More information about the debian-security-tracker-commits
mailing list