Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker
Commits: 5e69436b by Sylvain Beucler at 2026-07-13T21:50:16+02:00 CVE-2026-58052/7zip,p7zip: initial triage Following discussion at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1138181 and https://lists.debian.org/debian-lts/2026/07/msg00038.html Using <ignored> rather than <not-affected> to err on the safe side. This CVE is most probably going to be fixed by the next upload anyway, by bumping to 26.02 or later as usual. - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -9868,7 +9868,15 @@ CVE-2026-58054 (MyBB 1.8.40 does not restrict which usergroup a limited Admin Co CVE-2026-58053 (Gitea act_runner with the Docker backend (through act 0.262.0) passes ...) - gitea <removed> CVE-2026-58052 (7-Zip for Windows through 26.02 fails to preserve the Mark-of-the-Web ...) - TODO: check + - 7zip 26.02+dfsg-2 + [bookworm] - 7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g) + - p7zip 16.02+transitional.1 + [bookworm] - p7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g) + [bullseye] - p7zip <ignored> (Only affects Windows NTFS with transparent ADS and :$DATA canonicalization, i.e. not the current ntfs-3g) + NOTE: Since p7zip/16.02+transitional.1 src:p7zip is only an empty source package + NOTE: depending on 7zip. Mark this version as fixed version. + NOTE: https://github.com/bikini/exploitarium/tree/main/7zip-rar5-motw-chain-poc + NOTE: https://lists.debian.org/debian-lts/2026/07/msg00038.html CVE-2026-58051 (libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but ...) - libssh2 <undetermined> NOTE: https://github.com/bikini/exploitarium/tree/main/libssh2-publickey-list-calc-poc View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e69436b5256c312db7a31242126e5514fc60559 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e69436b5256c312db7a31242126e5514fc60559 You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
_______________________________________________ debian-security-tracker-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
