[Git][security-tracker-team/security-tracker][master] auto-nfu: Extend wikimedia and eclipse rules
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Sep 29 22:43:40 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
a5c11333 by Moritz Muehlenhoff at 2026-09-29T23:43:09+02:00
auto-nfu: Extend wikimedia and eclipse rules
- - - - -
2 changed files:
- data/CVE/list
- data/packages/nfu.yaml
Changes:
=====================================
data/CVE/list
=====================================
@@ -264,7 +264,7 @@ CVE-2026-102807 (OpenClaw before 2026.9.4 contains an incorrect authorization vu
CVE-2026-102806 (OpenClaw before 2026.9.5 contains an incorrect authorization vulnerabi ...)
NOT-FOR-US: OpenClaw
CVE-2026-102796 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-102762 (The NetX Duo MQTT client leaks the packet carrying a malformed PUBLISH ...)
NOT-FOR-US: Eclipse
CVE-2026-102761 (NetX Duo's WebSocket client resets the unmasking cursor to the first ` ...)
@@ -300,7 +300,7 @@ CVE-2026-102721 (A TFTP server that answers with a short ERROR packet makes the
CVE-2026-102720 (A DHCP server, or anyone on the LAN who answers a DISCOVER first, can ...)
NOT-FOR-US: Eclipse
CVE-2026-102719 (Predictable DTLS HelloVerifyRequest Cookie in NetX Secure)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102718 (hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP addon do ...)
NOT-FOR-US: Eclipse
CVE-2026-102716 (An unauthenticated client can drain the RTSP server's packet pool with ...)
@@ -314,7 +314,7 @@ CVE-2026-102713 (The TFTP server accepts a DATA datagram of any size. The dispat
CVE-2026-102712 (On the first DTLS ClientHello, the parser copies a device-claimed sess ...)
NOT-FOR-US: Eclipse
CVE-2026-102711 (Two issues in the ThreadX loadable-module loader, reached when a devic ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102710 (Attacker model / Preconditions: a loaded `TXM_MODULE_USER_MODE | TXM_M ...)
NOT-FOR-US: Eclipse
CVE-2026-102709 (Improper validation of non-secure (NS) pointers in multiple TrustZone- ...)
@@ -442,7 +442,7 @@ CVE-2026-100245 (Improper Neutralization of Input During Web Page Generation (XS
CVE-2026-100244 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100243 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100242 (Dependency on Vulnerable Third-Party Component and Uncontrolled Resour ...)
TODO: check
CVE-2026-100241 (Exposure of Sensitive Information to an Unauthorized Actor vulnerabili ...)
=====================================
data/packages/nfu.yaml
=====================================
@@ -543,6 +543,7 @@
- product: FileX
- product: GUIX
- product: Jersey
+ - product: netxduo
- product: NetX Duo
- product: NextX Duo
- product: OpenJ9
@@ -963,44 +964,44 @@
- cna: wikimedia-foundation
- anyOf:
- product: CheckUser
- - product: MediaWiki CookieConsent extension
- - product: MediaWiki GlobalBlocking extension
- - product: MediaWiki PageForms extension
- - product: MediaWiki WatchAnalytics extension
- - product: Mediawiki - ApprovedRevs Extension
- - product: MediaWiki - CampaignEvents extension
- - product: Mediawiki - CampaignEvents Extension
- - product: Mediawiki - Cargo Extension
- - product: Mediawiki - Cargo extension
- - product: Mediawiki - CentralAuth Extension
- - product: Mediawiki - Charts Extension
- - product: Mediawiki - CirrusSearch Extension
- - product: MediaWiki - CSS extension
- - product: Mediawiki - ExternalData Extension
- - product: Mediawiki - ExternalGuidance
- - product: Mediawiki - FlaggedRevs extension
- - product: Mediawiki - GlobalWatchlist Extension
- - product: Mediawiki - GrowthExperiments Extension
- - product: Mediawiki - LanguageSelector Extension
- - product: Mediawiki - LastModified Extension
- - product: Mediawiki - Lockdown Extension
- - product: Mediawiki - Monaco Skin
- - product: Mediawiki - PageTriage Extension
- - product: MediaWiki - ProofreadPage Extension
- - product: Mediawiki - RedirectManager Extension
- - product: MediaWiki - ReportIncident Extension
- - product: Mediawiki - Score Extension
- - product: Mediawiki - TemplateSandbox Extension
- - product: Mediawiki - Thanks Extension
- - product: Mediawiki - Translate Extension
- - product: Mediawiki - UploadWizard Extension
- - product: Mediawiki - UrlShortener Extension
- - product: MediaWiki - VisualData Extension
- - product: Mediawiki - Wikibase Extension
- - product: Mediawiki - WikiLambda Extension
- - product: Mediawiki - WikiLove Extension
- - product: Mediawiki - Wikilove Extension
- - product: Mediawiki - Wikistories
+ - product: 'MediaWiki CookieConsent.*'
+ - product: 'MediaWiki GlobalBlocking.*'
+ - product: 'MediaWiki PageForms.*'
+ - product: 'MediaWiki WatchAnalytics.*'
+ - product: 'Mediawiki - ApprovedRevs.*'
+ - product: 'Mediawiki - CampaignEvents.*'
+ - product: 'Mediawiki - Cargo.*'
+ - product: 'Mediawiki - CentralAuth.*'
+ - product: 'Mediawiki - Charts.*'
+ - product: 'Mediawiki - CirrusSearch.*'
+ - product: 'MediaWiki - CSS.*'
+ - product: 'Mediawiki - ExternalData.*'
+ - product: 'Mediawiki - ExternalGuidance.*'
+ - product: 'Mediawiki - FlaggedRevs.*'
+ - product: 'Mediawiki - GlobalWatchlist.*'
+ - product: 'Mediawiki - GrowthExperiments.*'
+ - product: 'Mediawiki - LanguageSelector.*'
+ - product: 'Mediawiki - LastModified.*'
+ - product: 'Mediawiki - Lockdown.*'
+ - product: 'Mediawiki - Monaco.*'
+ - product: 'Mediawiki - PageTriage.*'
+ - product: 'MediaWiki - ProofreadPage.*'
+ - product: 'Mediawiki - RedirectManager.*'
+ - product: 'MediaWiki - ReportIncident.*'
+ - product: 'Mediawiki - Score.*'
+ - product: 'Mediawiki - TemplateSandbox.*'
+ - product: 'Mediawiki - Thanks.*'
+ - product: 'Mediawiki - Translate.*'
+ - product: 'Mediawiki - UserPageViewTracker.*'
+ - product: 'Mediawiki - UploadWizard.*'
+ - product: 'Mediawiki - UrlShortener.*'
+ - product: 'MediaWiki - VisualData.*'
+ - product: 'Mediawiki - Wikibase.*'
+ - product: 'Mediawiki - WikiLambda.*'
+ - product: 'Mediawiki - WikiLove.*'
+ - product: 'Mediawiki - Wikilove.*'
+ - product: 'Mediawiki - WikiSEO.*'
+ - product: 'Mediawiki - Wikistories.*'
- product: Wikipedia Android App
- product: OAuth
- product: timeline
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a5c113338fb98f282743b7e8da0d11caeeb86e0b
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a5c113338fb98f282743b7e8da0d11caeeb86e0b
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260929/cb1c2155/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list