Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d538ff7a by Salvatore Bonaccorso at 2026-07-28T10:59:17+02:00
Add new erlang issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -722,9 +722,20 @@ CVE-2026-59528 (Subscriber Sensitive Data Exposure in
ShipTime: Discounted Shipp
CVE-2026-59527 (Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions.)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-59251 (Allocation of resources without limits in Erlang/OTP
public_key certif ...)
- TODO: check
+ - erlang <unfixed>
+ NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352
+ NOTE: https://cna.erlef.org/cves/CVE-2026-59251.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-59251
+ NOTE: Introduced with:
https://github.com/erlang/otp/commit/9d1dda7bad5a64b58c10a1554751689e94131a73
(OTP-26.2)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/f04c6bba38de1cf1b1836a7d9a9fbe239bd939e8
(OTP-27.3.4.15)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/f8580fc117098c08165f46c26fd0750c5cfb2a90
(OTP-29.0.4, OTP-28.5.0.4)
CVE-2026-59250 (Classic buffer overflow in the Erlang/OTP megaco flex scanner
C driver ...)
- TODO: check
+ - erlang <unfixed>
+ NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-7xgh-gmgf-q2g7
+ NOTE: https://cna.erlef.org/cves/CVE-2026-59250.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-59250
+ NOTE: Introduced with:
https://github.com/erlang/otp/commit/84adefa331c4159d432d22840663c38f155cd4c1
(OTP_R13B03)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/8704c8f550a11ed5f825e3c011ecb03565b79c4f
(OTP-27.3.4.15, OTP-28.5.0.4, OTP-29.0.4)
CVE-2026-59239 (Stored Cross-site Scripting (CWE-79) in the email module in
Roskus Pro ...)
NOT-FOR-US: Roskus Prospero Flow CRM
CVE-2026-58662 (Improper Validation of Specified Quantity in Input,
Out-of-bounds Read ...)
@@ -732,7 +743,13 @@ CVE-2026-58662 (Improper Validation of Specified Quantity
in Input, Out-of-bound
CVE-2026-58389 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
TODO: check
CVE-2026-58227 (The Erlang/OTP ssl application does not detect cycles when
reconstruct ...)
- TODO: check
+ - erlang <unfixed>
+ NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw
+ NOTE: https://cna.erlef.org/cves/CVE-2026-58227.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-58227
+ NOTE: Introduced with:
https://github.com/erlang/otp/commit/addc42df113f8f15fc20e9dff45490b3ce0d3d6b
(OTP-23.2)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/241d43703989fec4b6bf637beaeb366d92dcc4c2
(OTP-28.5.0.4)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/7db64720177961e04545681480d691c4be81c54d
(OTP-29.0.4)
CVE-2026-58023 (Out-of-bounds Read vulnerability in Apache Thrift c_glib
bindings. Th ...)
TODO: check
CVE-2026-57917 (proCertum SmartSignparses external XML entities from arbitrary
crafted ...)
@@ -752,15 +769,32 @@ CVE-2026-55969 (Integer Overflow or Wraparound
vulnerability in Apache Thrift C+
CVE-2026-55968 (Inefficient Algorithmic Complexity, Allocation of Resources
Without Li ...)
TODO: check
CVE-2026-55953 (The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does
not veri ...)
- TODO: check
+ - erlang <unfixed>
+ NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882
+ NOTE: https://cna.erlef.org/cves/CVE-2026-55953.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-55953
+ NOTE: Introduced with:
https://github.com/erlang/otp/commit/84adefa331c4159d432d22840663c38f155cd4c1
(OTP_R13B03)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/e6ff938116b2872bccc478af7fefb56627285b77
(OTP-27.3.4.15)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/0a82596d425abe43dc2e0b3d74aa1557ef74051c
(OTP-28.5.0.4)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/064e236414614f9085cbbbd6eacf0e43c02d1b4b
(OTP-29.0.4)
CVE-2026-55737 (Signed to Unsigned Conversion Error and Out-of-bounds Write
vulnerabil ...)
- TODO: check
+ - erlang <unfixed>
+ NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-446w-268v-9462
+ NOTE: https://cna.erlef.org/cves/CVE-2026-55737.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-55737
+ NOTE: Introduced with;
https://github.com/erlang/otp/commit/ebcbb97b4ec223464cac3d94375739a248ddef6e
(OTP-25.0-rc2)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/c5210b42a9d3d96f3d25601942ce8122be0f3761
(OTP-29.0.4, OTP-28.5.0.4, OTP-27.3.4.15)
CVE-2026-55579 (Pheditor is a single-file editor and file manager written in
PHP. From ...)
NOT-FOR-US: Pheditor
CVE-2026-55578 (Pheditor is a single-file editor and file manager written in
PHP. From ...)
NOT-FOR-US: Pheditor
CVE-2026-54890 (Integer Underflow (Wrap or Wraparound) vulnerability in erlang
otp erl ...)
- TODO: check
+ - erlang <unfixed>
+ NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-54pw-5645-jh86
+ NOTE: https://cna.erlef.org/cves/CVE-2026-54890.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-54890
+ NOTE: Introduced with:
https://github.com/erlang/otp/commit/24ef4cbaeda9b9c26682cba75f2f15b0c58722aa
(OTP-27.0-rc1)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/dc1bf9344c0ce62717cf60866590cea0242780fd
(OTP-29.0.4, OTP-28.5.0.4, OTP-27.3.4.15)
CVE-2026-54540 (Pheditor is a single-file editor and file manager written in
PHP. Prio ...)
NOT-FOR-US: Pheditor
CVE-2026-54272 (ip-address is a library for parsing and manipulating IPv4 and
IPv6 add ...)
@@ -804,7 +838,12 @@ CVE-2026-48051 (Papra is a minimalistic document
management and archiving platfo
CVE-2026-48030 (Pheditor is a single-file editor and file manager written in
PHP. From ...)
NOT-FOR-US: Pheditor
CVE-2026-47078 (Relative Path Traversal vulnerability in Erlang OTP (stdlib
zip module ...)
- TODO: check
+ - erlang <unfixed>
+ NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-rf72-wp7h-jg3x
+ NOTE: https://cna.erlef.org/cves/CVE-2026-47078.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-47078
+ NOTE: Introduced with:
https://github.com/erlang/otp/commit/8d537f51a4262d24f3395c4148323eaca9facbbd
(OTP-27.1)
+ NOTE: Fixed by:
https://github.com/erlang/otp/commit/8a933c9c7835b06776d31d17b79b7336627d887a
(OTP-29.0.4, OTP-28.5.0.4, OTP-27.3.4.15)
CVE-2026-45623 (PostCSS takes a CSS file and provides an API to analyze and
modify its ...)
- node-postcss 8.5.12+~cs9.3.32-1
NOTE:
https://github.com/postcss/postcss/security/advisories/GHSA-6g55-p6wh-862q
@@ -817,7 +856,11 @@ CVE-2026-45112 (Allocation of Resources Without Limits or
Throttling vulnerabili
CVE-2026-43871 (Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability i ...)
TODO: check
CVE-2026-42792 (Improper Handling of Exceptional Conditions vulnerability in
Erlang OT ...)
- TODO: check
+ - erlang <unfixed>
+ NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6
+ NOTE: https://cna.erlef.org/cves/CVE-2026-42792.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-42792
+ NOTE: Fixed by;
https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb
(OTP-29.0.4, OTP-28.5.0.4, OTP-27.3.4.15)
CVE-2026-41608 (Improper Handling of Highly Compressed Data (Data
Amplification) vulne ...)
TODO: check
CVE-2026-40000 (The Activity
zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity wit ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d538ff7a901fdac7be32aea620e4f805d9beb3d0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d538ff7a901fdac7be32aea620e4f805d9beb3d0
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
