[Git][security-tracker-team/security-tracker][master] auto-nfu: Extend Eclipse and nvidia rules
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Sep 29 22:14:16 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ed205a99 by Moritz Muehlenhoff at 2026-09-29T23:13:45+02:00
auto-nfu: Extend Eclipse and nvidia rules
- - - - -
2 changed files:
- data/CVE/list
- data/packages/nfu.yaml
Changes:
=====================================
data/CVE/list
=====================================
@@ -187,7 +187,7 @@ CVE-2026-68911 (Nicotine+ is a graphical client for the Soulseek peer-to-peer ne
CVE-2026-66083 (The /datasources/unauth-datasource endpoint does not properly enforce ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-65102 (NVIDIA DeepStream contains a vulnerability where an attacker could ca ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-63209 (compress provides various compression algorithms. Prior to version 1.1 ...)
TODO: check
CVE-2026-4523 (GitLab has remediated an issue in GitLab CE/EE affecting all versions ...)
@@ -278,9 +278,9 @@ CVE-2026-102758 (The `_nx_secure_x509_asn1_tlv_block_parse()` function parses AS
CVE-2026-102757 (An unprivileged, memory-protected ThreadX module can have the kernel r ...)
NOT-FOR-US: Eclipse
CVE-2026-102730 (Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open( ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102729 (`gx_binres_theme_load()` sizes its theme buffer for the theme it was a ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102728 (Two client-side TLS/DTLS handshake parsers in NetX Secure read fields ...)
NOT-FOR-US: Eclipse
CVE-2026-102727 (FTP Passive Data Connection Not Bound to the Authenticated Control Pee ...)
@@ -298,15 +298,15 @@ CVE-2026-102722 (In the IPv4 PASV path, the FTP Client accepts whatever address
CVE-2026-102721 (A TFTP server that answers with a short ERROR packet makes the client ...)
NOT-FOR-US: Eclipse
CVE-2026-102720 (A DHCP server, or anyone on the LAN who answers a DISCOVER first, can ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102719 (Predictable DTLS HelloVerifyRequest Cookie in NetX Secure)
TODO: check
CVE-2026-102718 (hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon do ...)
NOT-FOR-US: Eclipse
CVE-2026-102716 (An unauthenticated client can drain the RTSP server's packet pool with ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102715 (Any host on the LAN can send two mDNS records and make the responder w ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102714 (`_nx_icmpv6_validate_options()` scans the option area with `while (len ...)
NOT-FOR-US: Eclipse
CVE-2026-102713 (The TFTP server accepts a DATA datagram of any size. The dispatcher re ...)
@@ -316,7 +316,7 @@ CVE-2026-102712 (On the first DTLS ClientHello, the parser copies a device-claim
CVE-2026-102711 (Two issues in the ThreadX loadable-module loader, reached when a devic ...)
TODO: check
CVE-2026-102710 (Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_M ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102709 (Improper validation of non-secure (NS) pointers in multiple TrustZone- ...)
NOT-FOR-US: Eclipse
CVE-2026-102697 (Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorizatio ...)
=====================================
data/packages/nfu.yaml
=====================================
@@ -533,6 +533,7 @@
- product: Eclipse OpenVSX
- product: Eclipse Parsson
- product: Eclipse Theia
+ - product: 'eclipse-thread.*'
- product: Eclipse ThreadX
- product: Eclipse ThreadX - NetX Duo
- product: Eclipse ThreadX - USBX
@@ -540,6 +541,7 @@
- product: Eclipse aeriOS
- product: Eclipse tinydtls
- product: FileX
+ - product: GUIX
- product: Jersey
- product: NetX Duo
- product: NextX Duo
@@ -638,9 +640,11 @@
- product: AIStore
- product: AIStore framework
- product: BioNeMo Framework
+ - product: 'BlueField.*'
- product: CUDA-Q
- product: Container Toolkit
- product: DALI
+ - product: DeepStream
- product: DGX Spark
- product: DLS component of NVIDIA License System
- product: Dynamo
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed205a99edd9cedda577ab4bfed1a5ae18e43644
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed205a99edd9cedda577ab4bfed1a5ae18e43644
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/7b1d2ba4/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list