[Git][security-tracker-team/security-tracker][master] 10 commits: mark CVE-2026-88382 as postponed for Bullseye
Thorsten Alteholz (@alteholz)
alteholz at debian.org
Sun Sep 27 17:48:40 BST 2026
Thorsten Alteholz pushed to branch master at Debian Security Tracker / security-tracker
Commits:
67745c50 by Thorsten Alteholz at 2026-09-27T18:47:53+02:00
mark CVE-2026-88382 as postponed for Bullseye
- - - - -
4df89e22 by Thorsten Alteholz at 2026-09-27T18:47:55+02:00
mark temporary entries of lxd as EOL in Bookworm
- - - - -
a24230ce by Thorsten Alteholz at 2026-09-27T18:47:57+02:00
mark CVE-2026-73064 as EOL for Bookworm
- - - - -
6173596d by Thorsten Alteholz at 2026-09-27T18:47:59+02:00
mark CVE-2026-89258 as postponed for Bookworm
- - - - -
542cd555 by Thorsten Alteholz at 2026-09-27T18:48:01+02:00
mark some CVEs of imagemagick as postponed for Bookworm
- - - - -
133150ce by Thorsten Alteholz at 2026-09-27T18:48:03+02:00
mark CVE-2026-93712 and CVE-2026-93711 as postponed for Bookworm
- - - - -
a17d894e by Thorsten Alteholz at 2026-09-27T18:48:05+02:00
mark some CVEs of libde265 as postponed for Bookworm
- - - - -
ede6296f by Thorsten Alteholz at 2026-09-27T18:48:07+02:00
mark CVE-2026-88359 as postponed for Bookworm
- - - - -
5dd79ec5 by Thorsten Alteholz at 2026-09-27T18:48:09+02:00
mark CVE-2026-88386 and CVE-2026-88372 as postponed for Bookworm
- - - - -
f9de6b1a by Thorsten Alteholz at 2026-09-27T18:48:11+02:00
mark CVE-2026-88806 as postponed for Bookworm
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1104,6 +1104,7 @@ CVE-2026-88387 (LibRaw 0.22.0 contains an incorrect numeric conversion vulnerabi
CVE-2026-88386 (libsndfile 1.2.2 contains a misaligned memory access issue in psf_binh ...)
- libsndfile <unfixed> (bug #1149062)
[trixie] - libsndfile <no-dsa> (Minor issue)
+ [bookworm] - libsndfile <postponed> (Minor issue)
NOTE: https://github.com/libsndfile/libsndfile/issues/1150
NOTE: Fixed by: https://github.com/libsndfile/libsndfile/commit/474e4d328b1e6240b93ec6ed14efb7c6a44bee57
CVE-2026-87722 (Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search ...)
@@ -2941,11 +2942,13 @@ CVE-2026-XXXX [GHSA-h85r-gjgx-g2rv]
- incus 7.0.1-5
[trixie] - incus 6.0.4-2+deb13u11
- lxd <unfixed>
+ [bookworm] - lxd <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/lxc/incus/security/advisories/GHSA-h85r-gjgx-g2rv
CVE-2026-XXXX [GHSA-27q7-qwhm-c34p]
- incus 7.0.1-5
[trixie] - incus 6.0.4-2+deb13u11
- lxd <unfixed>
+ [bookworm] - lxd <end-of-life> (EOL in bookworm LTS)
NOTE: https://github.com/lxc/incus/security/advisories/GHSA-27q7-qwhm-c34p
CVE-2026-92288 (Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 ...)
- lemonldap-ng 2.23.4+ds-1
@@ -3161,6 +3164,7 @@ CVE-2026-88383 (libical 4.0.6 contains an incompatible function pointer in icalp
CVE-2026-88382 (hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory a ...)
- hiredis <unfixed> (bug #1149059)
[trixie] - hiredis <no-dsa> (Minor issue)
+ [bookworm] - hiredis <postponed> (Minor issue)
NOTE: https://github.com/redis/hiredis/issues/1357
CVE-2026-88378 (QuickJS commit 04be24600 contains a heap out-of-bounds write condition ...)
- quickjs-ng <unfixed>
@@ -3174,11 +3178,13 @@ CVE-2026-88376 (Bento4 1.6.0.0 contains an integer underflow vulnerability in AP
CVE-2026-88373 (libde265 commit 4d45a6b contains a NULL pointer dereference vulnerabil ...)
- libde265 1.1.2-1
[trixie] - libde265 <no-dsa> (Minor issue)
+ [bookworm] - libde265 <postponed> (Minor issue)
NOTE: https://github.com/strukturag/libde265/issues/534
NOTE: Fixed by: https://github.com/strukturag/libde265/commit/f8d324914e43d92af23614f22959cf9eee7bf9ea (v1.1.2)
CVE-2026-88372 (libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_re ...)
- libsndfile <unfixed>
[trixie] - libsndfile <postponed> (Minor issue, revisit when fixed upstream)
+ [bookworm] - libsndfile <postponed> (Minor issue)
NOTE: https://github.com/libsndfile/libsndfile/issues/1151
CVE-2026-88371 (ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in t ...)
- zbar <unfixed> (bug #1149058; unimportant)
@@ -3213,6 +3219,7 @@ CVE-2026-88360 (libvips 8.19.0 contains a memory access vulnerability when proce
CVE-2026-88359 (libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_it ...)
- libfyaml <unfixed> (bug #1149055)
[trixie] - libfyaml <no-dsa> (Minor issue)
+ [bookworm] - libfyaml <postponed> (Minor issue)
NOTE: https://github.com/pantoniou/libfyaml/issues/315
NOTE: Fixed by: https://github.com/pantoniou/libfyaml/commit/12d903a5c9163d15edf2ef9d7311bd0d1505d902 (v1.0.0-beta1)
CVE-2026-88358 (simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in ...)
@@ -3336,6 +3343,7 @@ CVE-2026-75907 (The door access control on a Norwegian Cruise Line asset grants
CVE-2026-73064 (In Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker wh ...)
- mbedtls 3.6.7-1
[trixie] - mbedtls <no-dsa> (Minor issue)
+ [bookworm] - mbedtls <end-of-life> (EOL in bookworm LTS)
NOTE: https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2026-07-random-generator-fault-tls-integrity/
CVE-2026-71540 (Wazuh is an open-source security platform providing unified XDR and SI ...)
NOT-FOR-US: Wazuh
@@ -7418,6 +7426,7 @@ CVE-2026-88807 (A heap overflow in libXrender before 0.9.13 inRenderQueryPictFor
CVE-2026-88806 (A malicious X server could exploit a buffer overflow in libX11 before ...)
- libx11 <unfixed> (bug #1148733)
[trixie] - libx11 <no-dsa> (Minor issue)
+ [bookworm] - libx11 <postponed> (Minor issue)
NOTE: https://gitlab.freedesktop.org/xorg/lib/libx11/-/merge_requests/309
CVE-2026-88788 (The Text Styler WordPress plugin through 1.1.1 does not sanitise and e ...)
NOT-FOR-US: WordPress plugin
@@ -7805,6 +7814,7 @@ CVE-2026-15801 (A vulnerability was found in CRI-O related to the container chec
CVE-2026-93712 (Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from out ...)
- libdancer2-perl <unfixed> (bug #1148732)
[trixie] - libdancer2-perl <no-dsa> (Minor issue)
+ [bookworm] - libdancer2-perl <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43742973/
NOTE: https://github.com/PerlDancer/Dancer2/security/advisories/GHSA-6xw8-v24c-m783
NOTE: Introduced with: https://github.com/PerlDancer/Dancer2/commit/d2f922bbf4ca18942a177d38fa62abcce05ed3f4 (v0.02)
@@ -7812,6 +7822,7 @@ CVE-2026-93712 (Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files fr
CVE-2026-93711 (Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from res ...)
- libdancer2-perl <unfixed> (bug #1148732)
[trixie] - libdancer2-perl <no-dsa> (Minor issue)
+ [bookworm] - libdancer2-perl <postponed> (Minor issue)
NOTE: https://lists.security.metacpan.org/cve-announce/msg/43742971/
NOTE: https://github.com/PerlDancer/Dancer2/issues/1822
NOTE: Fixed by: https://github.com/PerlDancer/Dancer2/commit/ff89ac12af7b8899812a79e9924dfea7a5d9833b (v2.2.0)
@@ -8802,23 +8813,27 @@ CVE-2026-93591 (SiYuan versions before 3.8.3 contain an SQL injection vulnerabil
CVE-2026-93590 (ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in ...)
- imagemagick 8:7.1.2.31+dfsg1-1
[trixie] - imagemagick <no-dsa> (Minor issue)
+ [bookworm] - imagemagick <postponed> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-7hjx-392p-f8cm
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/59046410c17e9421f0ad7b4bec478a892cf30c12 (7.1.2-31)
CVE-2026-93589 (ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero ...)
- imagemagick 8:7.1.2.31+dfsg1-1
[trixie] - imagemagick <no-dsa> (Minor issue)
+ [bookworm] - imagemagick <postponed> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-4gg2-hfgh-6f5c
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/8f620237fe341e814430fe3621b867b0b615f446 (7.1.2-31)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/1e91833e30a88c104276dcfbc01bb68ac4528514 (6.9.13-56)
CVE-2026-93588 (ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL point ...)
- imagemagick 8:7.1.2.31+dfsg1-1
[trixie] - imagemagick <no-dsa> (Minor issue)
+ [bookworm] - imagemagick <postponed> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-92rw-c5mw-27v4
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/c4b3c9039a1509e3e7869331773865b521a62f93 (7.1.2-31)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick6/commit/3b124bb81d3c53ec7d2b46f5ea04c00c4b07b9b3 (6.9.13-56)
CVE-2026-93587 (ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy byp ...)
- imagemagick 8:7.1.2.31+dfsg1-1
[trixie] - imagemagick <no-dsa> (Minor issue)
+ [bookworm] - imagemagick <postponed> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-89wq-f8f6-2j2v
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/d779ac52f92c3045ced59362b483bee25a3fc784 (7.1.2-31)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/b5da5eac006bae77c587a7c238e346c90ea52acd (7.1.2-31)
@@ -8827,6 +8842,7 @@ CVE-2026-93587 (ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a poli
CVE-2026-93586 (ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after- ...)
- imagemagick 8:7.1.2.31+dfsg1-1
[trixie] - imagemagick <no-dsa> (Minor issue)
+ [bookworm] - imagemagick <postponed> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-3rjr-534c-8v67
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/282f455de5c80a7a0d1a713087db9c8fce344141 (7.1.2-31)
NOTE: Fixed by: https://github.com/ImageMagick/ImageMagick/commit/4fe31106f41fa114945ceaf93226fb151ada0d19 (7.1.2-31)
@@ -22416,6 +22432,7 @@ CVE-2026-89259 (Hugo is a static site generator. From v0.161.0, Hugo executes No
CVE-2026-89258 (Hugo is a static site generator. In versions after v0.123.0 and before ...)
- hugo 0.165.0-1
[trixie] - hugo <no-dsa> (Minor issue)
+ [bookworm] - hugo <postponed> (Minor issue)
NOTE: https://github.com/gohugoio/hugo/security/advisories/GHSA-vrv5-r5rf-6v4j
CVE-2026-89257 (AVideo through 29.0 contains an insecure direct object reference (IDOR ...)
NOT-FOR-US: WWBN AVideo
@@ -32472,11 +32489,13 @@ CVE-2025-12737 (The administrative operations within the Carbon Console do not a
CVE-2026-XXXX [Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') and Use After Free and Double Free in libde265]
- libde265 1.1.2-1
[trixie] - libde265 <no-dsa> (Minor issue)
+ [bookworm] - libde265 <postponed> (Minor issue)
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-xp3h-6f5r-8cxp
NOTE: https://github.com/strukturag/libde265/commit/eb346780796055d9f9aac62d725d3170aa60c7b4 (v1.1.2)
CVE-2026-XXXX [heap-use-after-free in decoder_context::reset() via dangling previous_slice_header]
- libde265 1.1.2-1
[trixie] - libde265 <no-dsa> (Minor issue)
+ [bookworm] - libde265 <postponed> (Minor issue)
NOTE: https://github.com/strukturag/libde265/security/advisories/GHSA-mm7m-v26f-wf8x
NOTE: https://github.com/strukturag/libde265/commit/07bc500d45f781a7e2915afb7eebc2d6d9a541c9 (v1.1.2)
CVE-2026-56855 (Previously, after a channel has been established, a malicious peer cou ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/6d1151114b25589c517de31cea142d62b3a0e3b7...f9de6b1a6404a8a1d0cc02a57a801ad8ec6c56e9
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/6d1151114b25589c517de31cea142d62b3a0e3b7...f9de6b1a6404a8a1d0cc02a57a801ad8ec6c56e9
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260927/157a6d07/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list