[Pkg-utopia-maintainers] Bug#1148113: network-manager-vpnc: CVE-2026-91840 CVE-2026-91841

[Salvatore Bonaccorso]

Source: network-manager-vpnc
Version: 1.4.0-2
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi,

The following vulnerabilities were published for network-manager-vpnc.

CVE-2026-91840[0]:
| username newline injection reaches a root password helper


CVE-2026-91841[1]:
| Incomplete fix of CVE-2018-10900


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-91840
    https://www.cve.org/CVERecord?id=CVE-2026-91840
    https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/19
[1] https://security-tracker.debian.org/tracker/CVE-2026-91841
    https://www.cve.org/CVERecord?id=CVE-2026-91841
    https://gitlab.gnome.org/Archive/NetworkManager-vpnc/-/work_items/20

Regards,
Salvatore