[Git][security-tracker-team/security-tracker][master] Update status for php-league-commonmark issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7399b324 by Salvatore Bonaccorso at 2026-09-07T22:21:55+02:00
Update status for php-league-commonmark issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -87,7 +87,9 @@ CVE-2026-86430 (league/commonmark versions before 2.9.1 contain multiple denial
 CVE-2026-86429 (The league/commonmark (thephpleague/commonmark) library in versions >= ...)
 	TODO: check
 CVE-2026-86428 (commonmark versions from 1.5.0 before 2.10.0 contain a denial of servi ...)
-	TODO: check
+	- php-league-commonmark 2.10.0-1
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-8rr7-cvq3-gmfh
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/f27eb720972490b5af4dbb635ad8634529faf9f2 (2.10.0)
 CVE-2026-86427 (LibreNMS before 26.8.0 contains an argument injection vulnerability in ...)
 	NOT-FOR-US: LibreNMS
 CVE-2026-86426 (LibreNMS before 26.8.0 contains an authentication bypass vulnerability ...)
@@ -727473,7 +727475,8 @@ CVE-2019-10012 (Jenzabar JICS (aka Internet Campus Solution) before 9 allows rem
 CVE-2019-10011 (ICS/StaticPages/AddTestUsers.aspx in Jenzabar JICS (aka Internet Campu ...)
 	NOT-FOR-US: Jenzabar
 CVE-2019-10010 (Cross-site scripting (XSS) vulnerability in the PHP League CommonMark  ...)
-	NOT-FOR-US: PHP League CommonMark library
+	- php-league-commonmark <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-3v43-877x-qgmq
 CVE-2019-10009 (A Directory Traversal issue was discovered in the Web GUI in Titan FTP ...)
 	NOT-FOR-US: Titan FTP
 CVE-2019-10008 (Zoho ManageEngine ServiceDesk 9.3 allows session hijacking and privile ...)
@@ -745470,7 +745473,8 @@ CVE-2018-20584 (JasPer 2.0.14 allows remote attackers to cause a denial of servi
 	- jasper <removed>
 	NOTE: https://github.com/mdadams/jasper/issues/192
 CVE-2018-20583 (Cross-site scripting (XSS) vulnerability in the PHP League CommonMark  ...)
-	NOT-FOR-US: PHP League CommonMark library
+	- php-league-commonmark <not-affected> (Fixed before initial upload to Debian)
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-rfj4-8hcc-qvwm
 CVE-2018-20582 (The GREE+ (aka com.gree.greeplus) application 1.4.0.8 for Android suff ...)
 	NOT-FOR-US: GREE+ (aka com.gree.greeplus) application
 CVE-2018-20581



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7399b324ec1dc3dc37d271d54b6a2cd3105266d4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7399b324ec1dc3dc37d271d54b6a2cd3105266d4
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260907/cb5d791d/attachment.htm>