[Git][security-tracker-team/security-tracker][master] pypdf fixed in sid
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Wed Sep 30 16:28:11 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
f7aa2de1 by Moritz Muehlenhoff at 2026-09-30T17:27:45+02:00
pypdf fixed in sid
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -37356,7 +37356,7 @@ CVE-2026-84361 (Composer is a dependency Manager for the PHP language. From 1.0
NOTE: Fixed by: https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220 (2.10.3)
NOTE: Fixed by: https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af (2.2.30)
CVE-2026-84309 (pypdf is a free and open-source pure-python PDF library. Prior to 6.16 ...)
- - pypdf <unfixed> (bug #1146638)
+ - pypdf 6.19.0-1 (bug #1146638)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -37798,7 +37798,7 @@ CVE-2026-84470 (A flaw was found in Ansible Automation Platform's automation-con
CVE-2026-84373 (Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 ...)
NOT-FOR-US: Vitest
CVE-2026-84311 (pypdf is a free and open-source pure-python PDF library. Prior to 6.16 ...)
- - pypdf <unfixed> (bug #1146476)
+ - pypdf 6.19.0-1 (bug #1146476)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -37807,7 +37807,7 @@ CVE-2026-84311 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3966
NOTE: https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942 (6.16.1)
CVE-2026-84310 (pypdf is a free and open-source pure-python PDF library. Prior to 6.16 ...)
- - pypdf <unfixed> (bug #1146476)
+ - pypdf 6.19.0-1 (bug #1146476)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -38838,7 +38838,7 @@ CVE-2026-82731 (URL Redirection to Untrusted Site ('Open Redirect') vulnerabilit
CVE-2026-82730 (Incorrect Authorization vulnerability in ash-project ash_typescript al ...)
NOT-FOR-US: ash-project
CVE-2026-82398 (pypdf is a free and open-source pure-python PDF library. Prior to 6.15 ...)
- - pypdf <unfixed> (bug #1146476)
+ - pypdf 6.19.0-1 (bug #1146476)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -70647,7 +70647,7 @@ CVE-2026-66808 (Deserialization of untrusted data in Microsoft Office SharePoint
CVE-2026-9169 (DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on ...)
NOT-FOR-US: LUCID Vision Labs Arena SDK
CVE-2026-71870 (pypdf is a free and open-source pure-python PDF library. Prior to 6.15 ...)
- - pypdf <unfixed> (bug #1143902)
+ - pypdf 6.19.0-1 (bug #1143902)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -70656,7 +70656,7 @@ CVE-2026-71870 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3944
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa (6.15.0)
CVE-2026-71852 (pypdf is a free and open-source pure-python PDF library. Prior to 6.15 ...)
- - pypdf <unfixed> (bug #1143902)
+ - pypdf 6.19.0-1 (bug #1143902)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -98307,7 +98307,7 @@ CVE-2026-59939 (httplib2 is a comprehensive HTTP client library for Python. Prio
NOTE: https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3
NOTE: Fixed by: https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427 (v0.32.0)
CVE-2026-59936 (pypdf is a free and open-source pure-python PDF library. Prior to 6.14 ...)
- - pypdf <unfixed> (bug #1141771)
+ - pypdf 6.19.0-1 (bug #1141771)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -98317,7 +98317,7 @@ CVE-2026-59936 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3891
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b (6.14.1)
CVE-2026-59935 (pypdf is a free and open-source pure-python PDF library. Prior to 6.14 ...)
- - pypdf <unfixed> (bug #1141771)
+ - pypdf 6.19.0-1 (bug #1141771)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -98796,7 +98796,7 @@ CVE-2026-5459 (The User Frontend: AI Powered Frontend Posting, User Directory, P
CVE-2026-5356 (The LatePoint \u2013 Calendar Booking Plugin for Appointments and Even ...)
NOT-FOR-US: WordPress plugin
CVE-2026-59938 (pypdf is a free and open-source pure-python PDF library. Prior to 6.14 ...)
- - pypdf <unfixed> (bug #1141771)
+ - pypdf 6.19.0-1 (bug #1141771)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -98806,7 +98806,7 @@ CVE-2026-59938 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3888
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a (6.14.0)
CVE-2026-59937 (pypdf is a free and open-source pure-python PDF library. Prior to 6.14 ...)
- - pypdf <unfixed> (bug #1141771)
+ - pypdf 6.19.0-1 (bug #1141771)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -103274,7 +103274,7 @@ CVE-2026-57585 (MessagePack is the serializer implementation for Python msgpack.
NOTE: https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964
NOTE: Fixed by: https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d (v1.2.1)
CVE-2026-57204 (pypdf is a free and open-source pure-python PDF library. Prior to 6.13 ...)
- - pypdf <unfixed> (bug #1141339)
+ - pypdf 6.19.0-1 (bug #1141339)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112377,7 +112377,7 @@ CVE-2026-54911 (UltraJSON is a fast JSON encoder and decoder written in pure C w
NOTE: https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2
NOTE: https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf (5.13.0)
CVE-2026-54651 (pypdf is a free and open-source pure-python PDF library. Prior to 6.13 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112386,7 +112386,7 @@ CVE-2026-54651 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj
NOTE: https://github.com/py-pdf/pypdf/pull/3839
CVE-2026-54531 (pypdf is a free and open-source pure-python PDF library. Prior to 6.13 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112395,7 +112395,7 @@ CVE-2026-54531 (pypdf is a free and open-source pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96
NOTE: https://github.com/py-pdf/pypdf/pull/3830
CVE-2026-54530 (pypdf is a free and open-source pure-python PDF library. Prior to 6.13 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112418,7 +112418,7 @@ CVE-2026-53923 (vLLM is an inference and serving engine for large language model
CVE-2026-49468 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or ...)
NOT-FOR-US: LiteLLM
CVE-2026-49461 (pypdf is a free and open-source pure-python PDF library. Prior to 6.12 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112426,8 +112426,9 @@ CVE-2026-49461 (pypdf is a free and open-source pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v
NOTE: https://github.com/py-pdf/pypdf/pull/3805
+ NOTE: https://github.com/py-pdf/pypdf/commit/0b5b8adf02a25b23adae9037ff32d16232936c0f (6.12.2)
CVE-2026-49460 (pypdf is a free and open-source pure-python PDF library. Prior to 6.12 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112435,6 +112436,7 @@ CVE-2026-49460 (pypdf is a free and open-source pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg
NOTE: https://github.com/py-pdf/pypdf/pull/3806
+ NOTE: https://github.com/py-pdf/pypdf/commit/6755d925fae26a79c2f76f5c911bcd728f75a952 (6.12.2)
CVE-2026-48746 (vLLM is an inference and serving engine for large language models (LLM ...)
- vllm <itp> (bug #1095237)
CVE-2026-48517 (MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.30 ...)
@@ -128919,7 +128921,7 @@ CVE-2026-49238 (An issue was discovered in Canonical Multipass before version 1.
CVE-2026-49237 (An issue was discovered in Canonical Multipass for macOS before versio ...)
NOT-FOR-US: Multipass
CVE-2026-48735 (pypdf is a free and open-source pure-python PDF library. Prior to 6.12 ...)
- - pypdf <unfixed> (bug #1138192)
+ - pypdf 6.19.0-1 (bug #1138192)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -128927,6 +128929,7 @@ CVE-2026-48735 (pypdf is a free and open-source pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c
NOTE: https://github.com/py-pdf/pypdf/pull/3796
+ NOTE: https://github.com/py-pdf/pypdf/commit/62191d5a5c3ee218856d3cbaa039366bc97909f7 (6.12.1)
CVE-2026-48526 (PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, w ...)
- pyjwt 2.13.0-1 (bug #1138191)
[trixie] - pyjwt <no-dsa> (Minor issue)
@@ -128963,7 +128966,7 @@ CVE-2026-48522 (PyJWT is a JSON Web Token implementation in Python. Prior to 2.1
NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4
NOTE: https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81 (2.13.0)
CVE-2026-48156 (pypdf is a free and open-source pure-python PDF library. Prior to 6.12 ...)
- - pypdf <unfixed> (bug #1138193)
+ - pypdf 6.19.0-1 (bug #1138193)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -128971,8 +128974,9 @@ CVE-2026-48156 (pypdf is a free and open-source pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6
NOTE: https://github.com/py-pdf/pypdf/pull/3791
+ NOTE: https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70 (6.12.0)
CVE-2026-48155 (pypdf is a free and open-source pure-python PDF library. Prior to 6.12 ...)
- - pypdf <unfixed> (bug #1138194)
+ - pypdf 6.19.0-1 (bug #1138194)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -128980,6 +128984,7 @@ CVE-2026-48155 (pypdf is a free and open-source pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE: https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8
NOTE: https://github.com/py-pdf/pypdf/pull/3790
+ NOTE: https://github.com/py-pdf/pypdf/commit/9d2747057c4afc06ccc0fc6244a3915ba6ea6f0b (6.12.0)
CVE-2026-47762 (TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, an ...)
- tinymce <removed>
NOTE: https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv
@@ -152958,7 +152963,7 @@ CVE-2026-41455 (WeKan before8.35 contains a server-side request forgery vulnerab
CVE-2026-41454 (WeKan before8.35 contains a missing authorization vulnerability in the ...)
- wekan <itp> (bug #819238)
CVE-2026-41314 (pypdf is a free and open-source pure-python PDF library. An attacker w ...)
- - pypdf <unfixed> (bug #1134738)
+ - pypdf 6.19.0-1 (bug #1134738)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -152968,7 +152973,7 @@ CVE-2026-41314 (pypdf is a free and open-source pure-python PDF library. An atta
NOTE: https://github.com/py-pdf/pypdf/pull/3734
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11 (6.10.2)
CVE-2026-41313 (pypdf is a free and open-source pure-python PDF library. An attacker w ...)
- - pypdf <unfixed> (bug #1134737)
+ - pypdf 6.19.0-1 (bug #1134737)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -152978,7 +152983,7 @@ CVE-2026-41313 (pypdf is a free and open-source pure-python PDF library. An atta
NOTE: https://github.com/py-pdf/pypdf/pull/3735
NOTE: Fixed by: https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a (6.10.2)
CVE-2026-41312 (pypdf is a free and open-source pure-python PDF library. An attacker w ...)
- - pypdf <unfixed> (bug #1134736)
+ - pypdf 6.19.0-1 (bug #1134736)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -153048,7 +153053,7 @@ CVE-2026-41171 (Squidex is an open source headless content management system and
CVE-2026-41170 (Squidex is an open source headless content management system and conte ...)
NOT-FOR-US: Squidex
CVE-2026-41168 (pypdf is a free and open-source pure-python PDF library. An attacker w ...)
- - pypdf <unfixed> (bug #1134733)
+ - pypdf 6.19.0-1 (bug #1134733)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -156562,7 +156567,7 @@ CVE-2026-40263 (Note Mark is an open-source note-taking application. In versions
CVE-2026-40262 (Note Mark is an open-source note-taking application. In versions 0.19. ...)
NOT-FOR-US: Note Mark
CVE-2026-40260 (pypdf is a free and open-source pure-python PDF library. In versions p ...)
- - pypdf <unfixed> (bug #1134731)
+ - pypdf 6.19.0-1 (bug #1134731)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f7aa2de10e2434354224da76378d2e382a20158c
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f7aa2de10e2434354224da76378d2e382a20158c
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/aff81ec0/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list