[Git][security-tracker-team/security-tracker][master] Add new u-boot issues

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
384ac6b6 by Salvatore Bonaccorso at 2026-09-30T23:09:30+02:00
Add new u-boot issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1108,13 +1108,19 @@ CVE-2026-72510 (The "supplier_no" parameter used in the business allocation sear
 CVE-2026-72507 (The "reportType" parameter in the product summary report feature withi ...)
 	NOT-FOR-US: Toptech Systems
 CVE-2026-71974 (U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerabilit ...)
-	TODO: check
+	- u-boot <not-affected> (Vulnerable code introduced later)
+	NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/abadcda24b100b8eb0f138085cca6595518cec85 (v2025.04-rc1)
+	NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/35432ef6fe2c79ab72709966e64815a45eb55c76 (v2026.10-rc3)
 CVE-2026-71973 (U-Boot before 2026.10-rc4 contains an integer overflow vulnerability i ...)
-	TODO: check
+	- u-boot <unfixed>
+	NOTE: Introduced with: https://github.com/u-boot/u-boot/commit/c51006130370b48b7eb5a93ada745385aa27f6bf (v2020.10-rc2)
+	NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/561ae28cb56a082cfa90c1c421c4955bc215470b (v2026.10-rc4)
 CVE-2026-71972 (U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerabili ...)
-	TODO: check
+	- u-boot <unfixed>
+	NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/5201e83342d64c2f438ea35158575f28225e752e
 CVE-2026-71971 (U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled contains an ou ...)
-	TODO: check
+	- u-boot <unfixed>
+	NOTE: Fixed by: https://github.com/u-boot/u-boot/commit/04ca915d5bf39dda5d1bce62d04d2b59d293c5b9 (v2026.10-rc3)
 CVE-2026-71379 (The file export endpoint allows any unauthenticated attacker to export ...)
 	NOT-FOR-US: Toptech Systems
 CVE-2026-71302 (The application accepts user-supplied session identifiers and does not ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/384ac6b6e155e30ffe562c9854cc94dc0ee8015a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/384ac6b6e155e30ffe562c9854cc94dc0ee8015a
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260930/0a11b8a4/attachment.htm>