Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
eebf8721 by Sylvain Beucler at 2026-07-14T11:46:34+02:00
lts: virtuoso-opensource: new DoS CVEs postponed
- - - - -
10cdb9d6 by Sylvain Beucler at 2026-07-14T12:09:33+02:00
lts: add docker.io/bookworm
- - - - -
754ec06a by Sylvain Beucler at 2026-07-14T12:31:29+02:00
lts: add xen/bookworm
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -15568,46 +15568,68 @@ CVE-2025-62180 (Pega Platform versions 8.3.0 through
Infinity 25.1.2 are affecte
NOT-FOR-US: Pega Platform
CVE-2025-61029 (An issue in the sqlo_untry component of openlink
virtuoso-opensource v ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1228
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/9df21ea5c2100b90503ee83d828dae6a3d56444a
(v7.2.12)
CVE-2025-61028 (An issue in the time_t_to_dt component of openlink
virtuoso-opensource ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1233
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/1d2e0e1caecb20311b0538e454d26a0cdb2e6439
(v7.2.12)
CVE-2025-61027 (An issue in the t_set_push component of openlink
virtuoso-opensource v ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1232
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/975c0f3159010d3535526491195ba330ecff069f
(v7.2.12)
CVE-2025-61025 (An issue in the sslr_qst_get component of openlink
virtuoso-opensource ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1229
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/d1774339a7ff48f924ac6bc486f541851166091b
(v7.2.12)
CVE-2025-61024 (An issue in the sqlo_try_in_loop component of openlink
virtuoso-openso ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1227
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/9df21ea5c2100b90503ee83d828dae6a3d56444a
(v7.2.12)
CVE-2025-61023 (An issue in the st_compare component of openlink
virtuoso-opensource v ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1230
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/b27928d04343730b2cb6c23d1c23d52770347940
(v7.2.12)
CVE-2025-61022 (An issue in the sqlo_tb_col_preds component of openlink
virtuoso-opens ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1226
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/9df21ea5c2100b90503ee83d828dae6a3d56444a
(v7.2.12)
CVE-2025-61021 (An issue in the sqlo_natural_join_cond component of openlink
virtuoso- ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1223
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/99e0c0a22691a08e69958875b1b30007baa82b8e
(v7.2.12)
CVE-2025-61020 (An issue in the sqlo_strip_in_join component of openlink
virtuoso-open ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1225
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/9df21ea5c2100b90503ee83d828dae6a3d56444a
(v7.2.12)
CVE-2025-61019 (An issue in the sqlo_key_part_best component of openlink
virtuoso-open ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1222
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/dbca721f1d4e55531c4206b7b29dbe4d34138049
(v7.2.12)
CVE-2025-61018 (An issue in the sqlo_place_dt_set component of openlink
virtuoso-opens ...)
- virtuoso-opensource 7.2.12+dfsg-0.2
+ [bookworm] - virtuoso-opensource <postponed> (Minor issue, DoS)
+ [bullseye] - virtuoso-opensource <postponed> (Minor issue, DoS)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1224
NOTE: Fixed by:
https://github.com/openlink/virtuoso-opensource/commit/1943d722383d641689fa3cf7829cd4a49237c0eb
(v7.2.12)
CVE-2025-55639 (GPAC MP4Box v2.4 was discovered to contain a NULL pointer
dereference ...)
=====================================
data/dla-needed.txt
=====================================
@@ -130,8 +130,9 @@ cups (Thorsten Alteholz)
docker-registry/bullseye
NOTE: 20260419: Added by Front-Desk (rouca)
--
-docker.io/bullseye
+docker.io
NOTE: 20250805: Added by Front-Desk (rouca)
+ NOTE: 20260714: Also add for bookworm (Beuc/front-desk)
--
dracut
NOTE: 20260611: Added by Front-Desk (rouca)
@@ -764,6 +765,10 @@ watcher/bullseye
wireshark/bullseye
NOTE: 20260430: Added by Front-Desk (lamby)
--
+xen/bookworm
+ NOTE: 20260714: Added by Front-Desk (Beuc)
+ NOTE: 20260714: Upcoming DSA + 2 postponed CVEs fixed in trixie
(Beuc/front-desk)
+--
xmlrpc-c/bullseye
NOTE: 20250411: Added by Front-Desk (Beuc)
NOTE: 20250411: See issues with old embedded expat library:
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/aa03f7c3b218e0b81824a54546591a147231e4bf...754ec06ad531c3d3739be852e0e9fb15f7213880
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/aa03f7c3b218e0b81824a54546591a147231e4bf...754ec06ad531c3d3739be852e0e9fb15f7213880
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
