Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c5f2efa6 by Moritz Muehlenhoff at 2026-06-01T10:10:12+02:00
trixie/bookworm triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -264,9 +264,13 @@ CVE-2026-47187
NOTE: Fixed by:
https://github.com/libfuse/sshfs/commit/bcd132f17ccf1b8592a229df797c9b08883fec26
(sshfs-3.7.6)
CVE-2026-9516 [BOM-shift PV-corruption SIGABRT]
- libcpanel-json-xs-perl 4.41-1 (bug #1138273)
+ [trixie] - libcpanel-json-xs-perl <no-dsa> (Minor issue)
+ [bookworm] - libcpanel-json-xs-perl <no-dsa> (Minor issue)
NOTE: Fixed by:
https://github.com/rurban/Cpanel-JSON-XS/commit/dfe1b41a36caba51dc12a2917fe50285d1ffaa7b
(4.41)
CVE-2026-9334 [dupkeys_as_arrayref type confusion]
- libcpanel-json-xs-perl 4.41-1 (bug #1138273)
+ [trixie] - libcpanel-json-xs-perl <no-dsa> (Minor issue)
+ [bookworm] - libcpanel-json-xs-perl <no-dsa> (Minor issue)
NOTE: Fixed by:
https://github.com/rurban/Cpanel-JSON-XS/commit/11a7c550a0d8fac2f84414f24d5df9b2bfe346e2
(4.41)
CVE-2026-XXXX [Attacker-controlled heap out-of-bounds write in libvncclient
Tight decoder]
- libvncserver <unfixed> (bug #1138253)
@@ -1235,7 +1239,11 @@ CVE-2026-6816 (An access bypass vulnerability in Drupal
TFA Basic Plugins allows
NOT-FOR-US: Drupal core and addons
CVE-2026-6324 (A flaw was found in libsoup. A remote attacker could exploit an
unsign ...)
- libsoup3 <unfixed> (bug #1138213)
+ [trixie] - libsoup3 <no-dsa> (Minor issue)
+ [bookworm] - libsoup3 <no-dsa> (Minor issue)
- libsoup2.4 <removed>
+ [trixie] - libsoup2.4 <no-dsa> (Minor issue)
+ [bookworm] - libsoup2.4 <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/issues/508
NOTE: https://gitlab.gnome.org/GNOME/libsoup/-/merge_requests/517
NOTE:
https://gitlab.gnome.org/GNOME/libsoup/-/commit/96ac392b444d01bd5de1d1276b187c3ed49d048c
(3.7.1)
@@ -1506,19 +1514,19 @@ CVE-2026-47753
[trixie] - incus <not-affected> (Vulnerable code not resent)
NOTE: https://github.com/lxc/incus/pull/3425
NOTE:
https://github.com/lxc/incus/security/advisories/GHSA-8g7m-96c8-8wwc
-CVE-2026-47734
+CVE-2026-47734 [dulwich: Unbounded memory allocation in receive-pack from
crafted thin packs]
- dulwich 1.2.5-1
NOTE:
https://github.com/jelmer/dulwich/security/advisories/GHSA-xrvj-v92f-53gj
-CVE-2026-47712
+ NOTE:
https://github.com/jelmer/dulwich/commit/f860ca489d63624ae6d7c7945fbbd19018b8125c
(dulwich-1.2.5)
+CVE-2026-47712 [dulwich: Commit subjects not sanitized in
porcelain.format_patch]
- dulwich 1.2.5-1
NOTE:
https://github.com/jelmer/dulwich/security/advisories/GHSA-555p-6grf-mh7f
-CVE-2026-42563
+CVE-2026-42563 [dulwich: Command Injection via Merge Driver Path]
- dulwich 1.2.5-1
NOTE:
https://github.com/jelmer/dulwich/security/advisories/GHSA-9277-mp7x-85jf
CVE-2026-42305
- - dulwich 1.2.5-1
+ - dulwich <not-affected> (Windows-specific)
NOTE:
https://github.com/jelmer/dulwich/security/advisories/GHSA-897w-fcg9-f6xj
- TODO: check, Windows only, or as well just NTFS filesystems?
CVE-2026-9828 (Deserialization of untrusted data vulnerability in QOS.CH Sarl
logback ...)
- logback <unfixed>
NOTE: https://logback.qos.ch/news.html#1.5.33
@@ -2909,6 +2917,8 @@ CVE-2026-47118 (Agent Zero before version 1.15 contains a
path traversal vulnera
NOT-FOR-US: Agent Zero
CVE-2026-47104 (libusb before version 1.0.30 contains a one-byte out-of-bounds
read vu ...)
- libusb-1.0 2:1.0.30-1
+ [trixie] - libusb-1.0 <no-dsa> (Minor issue)
+ [bookworm] - libusb-1.0 <no-dsa> (Minor issue)
NOTE: https://github.com/libusb/libusb/issues/1813
NOTE: https://github.com/libusb/libusb/pull/1814
NOTE:
https://github.com/libusb/libusb/commit/bc0886173ea15b8cc9bba2918f58a97a7f185231
(v1.0.30-rc2)
@@ -3307,6 +3317,8 @@ CVE-2026-2030 (The WPBakery Page Builder Addons by
Livemesh plugin for WordPress
NOT-FOR-US: WordPress plugin
CVE-2026-23679 (libusb before version 1.0.30 contains a NULL pointer
dereference vulne ...)
- libusb-1.0 2:1.0.30-1
+ [trixie] - libusb-1.0 <no-dsa> (Minor issue)
+ [bookworm] - libusb-1.0 <no-dsa> (Minor issue)
NOTE: https://github.com/libusb/libusb/issues/1813
NOTE: https://github.com/libusb/libusb/pull/1814
NOTE:
https://github.com/libusb/libusb/commit/bc0886173ea15b8cc9bba2918f58a97a7f185231
(v1.0.30-rc2)
@@ -6486,6 +6498,8 @@ CVE-2026-9011 (The Ditty \u2013 Responsive News Tickers,
Sliders, and Lists plug
NOT-FOR-US: WordPress plugin
CVE-2026-8997 (vifm is vulnerable to a heap buffer overflow during the history
merge ...)
- vifm 0.14.3-3 (bug #1137528)
+ [trixie] - vifm <no-dsa> (Minor issue)
+ [bookworm] - vifm <no-dsa> (Minor issue)
NOTE: Fixed by:
https://github.com/vifm/vifm/commit/23063c741f15a85621fd232dfc3ac5b779f6910d
CVE-2026-8992 (An improper certificate validation vulnerability in Ivanti
Secure Acce ...)
NOT-FOR-US: Ivanti
=====================================
data/dsa-needed.txt
=====================================
@@ -24,6 +24,8 @@ ceph (carnil)
--
cups
--
+erlang
+--
expat
--
fastnetmon
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5f2efa6749649919494cd690a21d6005313aeb4
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5f2efa6749649919494cd690a21d6005313aeb4
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
