[Git][security-tracker-team/security-tracker][master] Update status for new php-league-commonmark issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
92bc986d by Salvatore Bonaccorso at 2026-09-07T22:38:57+02:00
Update status for new php-league-commonmark issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -73,19 +73,33 @@ CVE-2026-86440 (Affected versions of MISP insufficiently validate URLs used by d
 CVE-2026-86435 (commonmark versions from 1.5.0 before 2.8.4 contain a denial of servic ...)
 	- php-league-commonmark 2.9.0-1
 	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-jfm3-95jq-q3rf
-	NOTE: https://github.com/thephpleague/commonmark/commit/66028124a17ba193da7b11cc3dfda92df21bfbf4 (2.9.0)
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/66028124a17ba193da7b11cc3dfda92df21bfbf4 (2.9.0)
 CVE-2026-86434 (league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) con ...)
-	TODO: check
+	- php-league-commonmark 2.9.0-1
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-mh25-x5hq-wrqp
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/6cfa16c7f37e2748114c56d9375a09af656b995c (2.9.0)
 CVE-2026-86433 (commonmark versions from 1.5.0 before 2.8.4 contain a denial of servic ...)
-	TODO: check
+	- php-league-commonmark 2.9.0-1
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-g2gp-3wwq-f4ph
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/2d4c0fafa62501be919262064cffa6d71687430b (2.9.0)
 CVE-2026-86432 (commonmark versions from 2.0.0 before 2.8.4 contain a denial of servic ...)
-	TODO: check
+	- php-league-commonmark 2.9.0-1
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-mj63-m3rc-8ppr
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/b5ac8c3947ca81844e85a09c7e0a5b4148bde2e1 (2.9.0)
 CVE-2026-86431 (league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2. ...)
-	TODO: check
+	- php-league-commonmark 2.10.0-1
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-f8fg-pg57-v4j8
 CVE-2026-86430 (league/commonmark versions before 2.9.1 contain multiple denial of ser ...)
-	TODO: check
+	- php-league-commonmark 2.10.0-1
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-j8pm-gj4c-rq4x
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/d9375fadc308a63a02950a68d822417a6e4c33b2 (2.9.1)
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/0768217751fbfaeb8d76762f6944e9af7114295e (2.9.1)
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/e0036ef031fd36ec1c3c82db8743fc928b5271c8 (2.9.1)
 CVE-2026-86429 (The league/commonmark (thephpleague/commonmark) library in versions >= ...)
-	TODO: check
+	- php-league-commonmark 2.10.0-1
+	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-jjv6-8j6v-6j52
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/04a5d11ef6bf2d0b927310810d6a2a85d3c184b9 (2.9.1)
+	NOTE: Fixed by: https://github.com/thephpleague/commonmark/commit/2f611b599c51661b005dc45c16ceaa547546e687 (2.9.1)
 CVE-2026-86428 (commonmark versions from 1.5.0 before 2.10.0 contain a denial of servi ...)
 	- php-league-commonmark 2.10.0-1
 	NOTE: https://github.com/thephpleague/commonmark/security/advisories/GHSA-8rr7-cvq3-gmfh



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/92bc986dca130d15fe1b3c841a43f069dd7ebf19

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/92bc986dca130d15fe1b3c841a43f069dd7ebf19
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260907/a039dcbd/attachment.htm>