Arnaud Rebillout pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
72a1eebd by Arnaud Rebillout at 2026-06-08T09:10:54+07:00
Reserve DLA-4621-1 for glibc
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -75316,7 +75316,6 @@ CVE-2025-15281 (Calling wordexp with WRDE_REUSE in
conjunction with WRDE_APPEND
- glibc 2.42-11 (bug #1126266)
[trixie] - glibc 2.41-12+deb13u2
[bookworm] - glibc 2.36-9+deb12u14
- [bullseye] - glibc <postponed> (Minor issue, unlikely scenario)
NOTE: https://www.openwall.com/lists/oss-security/2026/01/20/3
NOTE: Introduced with:
https://sourceware.org/git/?p=glibc.git;a=commit;h=8f2ece695d8822e9ecc63ecd157e90bf17a6fe65
(glibc-2.0.92)
NOTE: Fixed by:
https://sourceware.org/git/?p=glibc.git;a=commit;h=80cc58ea2de214f85b0a1d902a3b668ad2ecb302
(glibc-2.43)
@@ -76201,7 +76200,6 @@ CVE-2026-0915 (Calling getnetbyaddr or getnetbyaddr_r
with a configured nsswitch
- glibc 2.42-8 (bug #1125748)
[trixie] - glibc 2.41-12+deb13u2
[bookworm] - glibc 2.36-9+deb12u14
- [bullseye] - glibc <postponed> (Minor issue, high attack complexity)
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=33802
NOTE: https://www.openwall.com/lists/oss-security/2026/01/16/6
NOTE: Introduced with:
https://sourceware.org/git/?p=glibc.git;a=commit;h=5f0e6fc702296840d2daa39f83f6cb1e40073d58
(glibc-1.93)
@@ -76820,7 +76818,6 @@ CVE-2026-0861 (Passing too large an alignment to the
memalign suite of functions
- glibc 2.42-8 (bug #1125678)
[trixie] - glibc 2.41-12+deb13u2
[bookworm] - glibc 2.36-9+deb12u14
- [bullseye] - glibc <postponed> (Minor issue, unlikely scenario)
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=33796
NOTE: https://www.openwall.com/lists/oss-security/2026/01/16/5
NOTE: Introduced with:
https://sourceware.org/git/?p=glibc.git;a=commit;h=9bf8e29ca136094f73f69f725f15c51facc97206
(glibc-2.30)
@@ -140867,7 +140864,6 @@ CVE-2025-8060 (A vulnerability has been found in
Tenda AC23 16.03.07.52 and clas
CVE-2025-8058 (The regcomp function in the GNU C library version from 2.4 to
2.41 is ...)
- glibc 2.41-11 (bug #1109803)
[bookworm] - glibc 2.36-9+deb12u13
- [bullseye] - glibc <postponed> (Minor issue)
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=33185
NOTE:
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2025-0005
NOTE: Introduced with:
https://sourceware.org/git/?p=glibc.git;a=commit;h=963d8d782fc98fb6dc3a66f0068795f9920c269d
(glibc-2.4)
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[08 Jun 2026] DLA-4621-1 glibc - security update
+ {CVE-2025-8058 CVE-2025-15281 CVE-2026-0861 CVE-2026-0915 CVE-2026-4046}
+ [bullseye] - glibc 2.31-13+deb11u14
[07 Jun 2026] DLA-4620-1 apache2 - security update
{CVE-2026-49975}
[bullseye] - apache2 2.4.67-1~deb11u2
=====================================
data/dla-needed.txt
=====================================
@@ -177,10 +177,6 @@ glances/bullseye
NOTE: 20260518: Added by Front-Desk (Beuc)
NOTE: 20260518: Many postponed vulnerabilities piled-up (Beuc/front-desk)
--
-glibc/bullseye (arnaudr)
- NOTE: 20260404: Added by Front-Desk (ta)
- NOTE: 20260404: no upstream fix yet
---
golang-github-gorilla-csrf/bullseye
NOTE: 20250422: Added by Front-Desk (rouca)
NOTE: 20250422: Need to binNMU reverse depends (in that order):
golang-github-alecthomas-chroma, golang-github-niklasfasching-go-org,
golang-github-yuin-goldmark-highlighting, hugo (rouca)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72a1eebdb6481923a184eb97d79f781d6d649494
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72a1eebdb6481923a184eb97d79f781d6d649494
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
