[Git][security-tracker-team/security-tracker][master] Add Debian bug references for various issues

Sat Sep 26 14:32:47 BST 2026


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
82516e41 by Salvatore Bonaccorso at 2026-09-26T15:32:08+02:00
Add Debian bug references for various issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -376,7 +376,7 @@ CVE-2026-97846 (Keycloak provides a feature called mTLS holder-of-key binding wh
 CVE-2026-97818 (phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and ...)
 	- phpipam <itp> (bug #731713)
 CVE-2026-97764 (django-allauth before 65.19.4 does not have the expected limits on fai ...)
-	- django-allauth <unfixed>
+	- django-allauth <unfixed> (bug #1149065)
 	NOTE: Fixed by: https://codeberg.org/allauth/django-allauth/commit/4379e7931fe7572aacc4f3b4b5f2298d5f3ecc96 (65.19.4)
 	NOTE: Fixed by: https://codeberg.org/allauth/django-allauth/commit/4e252aa2be7cef5d72d78049d6fb07cb27a89c83 (65.19.4)
 CVE-2026-97737 (In Wakapi before 2.17.6, the user caching service allows a lookup to b ...)
@@ -484,7 +484,7 @@ CVE-2026-93899 (The Better Messages \u2013 Chat Rooms, Group Chat, Private Messa
 CVE-2026-93897 (The GeoDirectory \u2013 WP Business Directory Plugin and Classified Li ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-93834 (A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A r ...)
-	- qemu <unfixed>
+	- qemu <unfixed> (bug #1149064)
 	NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/4491
 	NOTE: Introduced with: https://gitlab.com/qemu-project/qemu/-/commit/02cb7f3a256517cbf3136caff2863fbafc57b540 (v1.0-rc0)
 	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/fe9e30899ffceef25cf345ec83f76546afca19dd (master)
@@ -569,12 +569,12 @@ CVE-2026-88389 (Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereferen
 CVE-2026-88388 (Espruino 2v29 (commit bffc6d0) contains a stack-based buffer overflow  ...)
 	NOT-FOR-US: Espruino
 CVE-2026-88387 (LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability i ...)
-	- libraw <unfixed>
+	- libraw <unfixed> (bug #1149063)
 	NOTE: https://github.com/LibRaw/LibRaw/issues/844
 	NOTE: https://github.com/LibRaw/LibRaw/pull/853
 	NOTE: Fixed by: https://github.com/LibRaw/LibRaw/commit/b41cbbd61951783e0440590dae55411a16185bdf (master)
 CVE-2026-88386 (libsndfile 1.2.2 contains a misaligned memory access issue in psf_binh ...)
-	- libsndfile <unfixed>
+	- libsndfile <unfixed> (bug #1149062)
 	NOTE: https://github.com/libsndfile/libsndfile/issues/1150
 	NOTE: Fixed by: https://github.com/libsndfile/libsndfile/commit/474e4d328b1e6240b93ec6ed14efb7c6a44bee57
 CVE-2026-87722 (Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search ...)
@@ -2603,18 +2603,18 @@ CVE-2026-88385 (Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load
 	NOTE: https://github.com/michaelrsweet/mxml/issues/356
 	NOTE: Fixed by: https://github.com/michaelrsweet/mxml/commit/83ef80ae3c5413b73f501edb59ee74e31ce399d0 (v4.0.6)
 CVE-2026-88384 (OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribut ...)
-	- openexr <unfixed>
+	- openexr <unfixed> (bug #1149061)
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/issues/2612
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/2615
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/e782bcc1ffe1cc9edfaa5dbad4f28e866eaf9bbb (v3.5.0-rc)
 CVE-2026-88383 (libical 4.0.6 contains an incompatible function pointer in icalparamet ...)
-	- libical3 <unfixed>
+	- libical3 <unfixed> (bug #1149060)
 	- libical <removed>
 	NOTE: https://github.com/libical/libical/issues/1361
 	NOTE: https://github.com/libical/libical/pull/1363
 	NOTE: Fixed by: https://github.com/libical/libical/commit/1fc946aaa91e5995dee593092723ba67d7113846 (4.0 branch)
 CVE-2026-88382 (hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory a ...)
-	- hiredis <unfixed>
+	- hiredis <unfixed> (bug #1149059)
 	[trixie] - hiredis <no-dsa> (Minor issue)
 	NOTE: https://github.com/redis/hiredis/issues/1357
 CVE-2026-88378 (QuickJS commit 04be24600 contains a heap out-of-bounds write condition ...)
@@ -2636,7 +2636,7 @@ CVE-2026-88372 (libsndfile 1.2.2 contains an integer overflow vulnerability in m
 	[trixie] - libsndfile <postponed> (Minor issue, revisit when fixed upstream)
 	NOTE: https://github.com/libsndfile/libsndfile/issues/1151
 CVE-2026-88371 (ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in t ...)
-	- zbar <unfixed>
+	- zbar <unfixed> (bug #1149058)
 	NOTE: https://github.com/mchehab/zbar/issues/336
 CVE-2026-88370 (libconfini 1.16.4 contains a heap out-of-bounds write condition involv ...)
 	NOT-FOR-US: libconfini
@@ -2654,26 +2654,26 @@ CVE-2026-88366 (NanoSVG commit 239e102ec contains an incorrect numeric conversio
 CVE-2026-88365 (minimp3 commit ea99364f contains an integer overflow vulnerability in  ...)
 	NOT-FOR-US: minimp3
 CVE-2026-88362 (MuJS e892c9fdb contains an incorrect numeric conversion vulnerability  ...)
-	- mujs <unfixed>
+	- mujs <unfixed> (bug #1149057)
 	[trixie] - mujs <no-dsa> (Minor issue)
 	NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709636
 	NOTE: Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mujs.git/commit/?id=8a32c397b28fe45747ac4e9e4f3dca049825eda7
 CVE-2026-88361 (SumatraPDF 3.6.1 contains an integer overflow vulnerability in EngineM ...)
 	NOT-FOR-US: SumatraPDF
 CVE-2026-88360 (libvips 8.19.0 contains a memory access vulnerability when processing  ...)
-	- vips <unfixed>
+	- vips <unfixed> (bug #1149056)
 	NOTE: https://github.com/libvips/libvips/issues/5187
 CVE-2026-88359 (libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_it ...)
-	- libfyaml <unfixed>
+	- libfyaml <unfixed> (bug #1149055)
 	NOTE: https://github.com/pantoniou/libfyaml/issues/315
 	NOTE: Fixed by: https://github.com/pantoniou/libfyaml/commit/12d903a5c9163d15edf2ef9d7311bd0d1505d902 (v1.0.0-beta1)
 CVE-2026-88358 (simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in ...)
-	- simdjson <unfixed>
+	- simdjson <unfixed> (bug #1149053)
 	NOTE: https://github.com/simdjson/simdjson/issues/2815
 	NOTE: https://github.com/simdjson/simdjson/pull/2817
 	NOTE: Fixed by: https://github.com/simdjson/simdjson/commit/20b28712ffce8320237b75a587d35a2e89140577
 CVE-2026-88357 (nDPI 5.1.0 contains a memory access issue in the DNS dissector and ser ...)
-	- ndpi <unfixed>
+	- ndpi <unfixed> (bug #1149051)
 	NOTE: https://github.com/ntop/nDPI/issues/3213
 	NOTE: https://github.com/ntop/nDPI/pull/3231
 CVE-2026-88355 (An incorrect buffer size calculation vulnerability exists in tinyexpr  ...)
@@ -5458,7 +5458,7 @@ CVE-2026-76708 (A vulnerability exists in the Analytics and Location Engine (ALE
 CVE-2026-75799 (The YAHMAN Add-ons WordPress plugin before 0.9.31 does not validate th ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2026-75432 (An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitiv ...)
-	- yaml-cpp <unfixed>
+	- yaml-cpp <unfixed> (bug #1149048)
 	NOTE: https://github.com/jbeder/yaml-cpp/issues/1475
 	NOTE: https://github.com/jbeder/yaml-cpp/pull/1476
 	NOTE: Fixed by: https://github.com/jbeder/yaml-cpp/commit/8b2e6ba3288de15ed7a61d5c89cde2ed47327c1e
@@ -12457,7 +12457,7 @@ CVE-2026-85128 (The Choose User Role at Registration WordPress plugin before 1.3
 CVE-2026-82561 (Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace ...)
 	NOT-FOR-US: Apache software not packaged in Debian
 CVE-2026-81872 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to v ...)
-	- golang-opentelemetry-otel <unfixed>
+	- golang-opentelemetry-otel <unfixed> (bug #1149049)
 	[trixie] - golang-opentelemetry-otel <no-dsa> (Minor issue)
 	NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65
 	NOTE: https://github.com/open-telemetry/opentelemetry-go/issues/6797
@@ -12465,13 +12465,13 @@ CVE-2026-81872 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prio
 	NOTE: Introduced with: https://github.com/open-telemetry/opentelemetry-go/commit/4af9c20a80182e5ac8212182d3ba970d0d558a45 (v1.26.0)
 	NOTE: Fixed by: https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582 (v1.45.0)
 CVE-2026-81871 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to v ...)
-	- golang-opentelemetry-otel <unfixed>
+	- golang-opentelemetry-otel <unfixed> (bug #1149049)
 	[trixie] - golang-opentelemetry-otel <no-dsa> (Minor issue)
 	NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w34q-cm8f-9c5x
 	NOTE: Introduced with: https://github.com/open-telemetry/opentelemetry-go/commit/d99c76fa32fbbcf3e1e0cee4c49a7f181b0697bb (v1.28.0)
 	NOTE: Fixed by: https://github.com/open-telemetry/opentelemetry-go/commit/c65d435b43e5e6b82310e6b18dd4cdcb8ac63a0c (v1.45.0)
 CVE-2026-81870 (OpenTelemetry-Go is the Go implementation of OpenTelemetry. From versi ...)
-	- golang-opentelemetry-otel <unfixed>
+	- golang-opentelemetry-otel <unfixed> (bug #1149049)
 	[trixie] - golang-opentelemetry-otel <no-dsa> (Minor issue)
 	NOTE: https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-8wmf-6v46-5gfg
 	NOTE: https://github.com/open-telemetry/opentelemetry-go/pull/8438
@@ -31556,7 +31556,7 @@ CVE-2026-84969 (A memory-handling error in the BSON-to-JSON conversion helpers o
 	NOTE: Fixed by: https://github.com/mongodb/mongo-c-driver/commit/08d0cfaaf08a54d7e87a5e5fa8d38251bf0eeca6 (1.30.9)
 	NOTE: Introduced by: https://github.com/mongodb/mongo-c-driver/commit/f2c1bb7989177fa2ddba1a915e8423e46ee1defe (1.30.0)
 CVE-2026-84968 (An out-of-bounds read in the BSON decoding component of the MongoDB PH ...)
-	- php-mongodb <unfixed>
+	- php-mongodb <unfixed> (bug #1149050)
 	[trixie] - php-mongodb <no-dsa> (Minor issue)
 	[bookworm] - php-mongodb <postponed> (Minor issue, infoleak)
 	NOTE: https://jira.mongodb.org/browse/PHPC-2744



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/82516e41284bbc2db0753cdefbcd977683719766

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/82516e41284bbc2db0753cdefbcd977683719766
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260926/5b11b4b2/attachment-0001.htm>
