Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7dc875ab by Salvatore Bonaccorso at 2026-07-28T11:09:30+02:00
Add new batch of thrift issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -739,9 +739,11 @@ CVE-2026-59250 (Classic buffer overflow in the Erlang/OTP
megaco flex scanner C
CVE-2026-59239 (Stored Cross-site Scripting (CWE-79) in the email module in
Roskus Pro ...)
NOT-FOR-US: Roskus Prospero Flow CRM
CVE-2026-58662 (Improper Validation of Specified Quantity in Input,
Out-of-bounds Read ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/13mzvylr3r3nktxrh5k1h30ng1t1sw1d
CVE-2026-58389 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/ht2mjt8m3vz9v0h5pqzvc4r4nzfxwtrw
CVE-2026-58227 (The Erlang/OTP ssl application does not detect cycles when
reconstruct ...)
- erlang <unfixed>
NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-r5jr-mq46-vmhw
@@ -751,7 +753,8 @@ CVE-2026-58227 (The Erlang/OTP ssl application does not
detect cycles when recon
NOTE: Fixed by:
https://github.com/erlang/otp/commit/241d43703989fec4b6bf637beaeb366d92dcc4c2
(OTP-28.5.0.4)
NOTE: Fixed by:
https://github.com/erlang/otp/commit/7db64720177961e04545681480d691c4be81c54d
(OTP-29.0.4)
CVE-2026-58023 (Out-of-bounds Read vulnerability in Apache Thrift c_glib
bindings. Th ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/z2myopbovxngfvchdz8hddots9p5ffbt
CVE-2026-57917 (proCertum SmartSignparses external XML entities from arbitrary
crafted ...)
NOT-FOR-US: proCertum SmartSign
CVE-2026-57916 (proCertum SmartSign opens Certificate Practice Statement (CPS)
URI wit ...)
@@ -761,13 +764,17 @@ CVE-2026-56538 (An endpoint in HCL Connections is
vulnerable to information disc
CVE-2026-56537 (HCL Connections is vulnerable to information disclosure which
could al ...)
NOT-FOR-US: HCL
CVE-2026-55971 (Heap-based Buffer Overflow vulnerability in Apache Thrift C++
bindings ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/xjs36m6kjxpmrmzwck636msg3nvoqnmx
CVE-2026-55970 (Buffer Over-read vulnerability in Apache Thrift C++ bindings.
This is ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/8pbnw4dyxxc9opp6qq725jhrzg25v8q7
CVE-2026-55969 (Integer Overflow or Wraparound vulnerability in Apache Thrift
C++, c_g ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/xmkgd107k795hyrg5kf97mny30sgl5bo
CVE-2026-55968 (Inefficient Algorithmic Complexity, Allocation of Resources
Without Li ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/gxhhfyr6flr5vzr4qnxm13p6fc41qstp
CVE-2026-55953 (The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does
not veri ...)
- erlang <unfixed>
NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-c6cw-pr89-w882
@@ -824,13 +831,17 @@ CVE-2026-51244 (schreibfaul1 ESP32-audioI2S 3.4.5 has a
buffer overflow vulnerab
CVE-2026-51235 (LibRaw 0.21 is vulnerable to Buffer Overflow in the stretch()
function ...)
TODO: check
CVE-2026-49158 (Improper Handling of Highly Compressed Data (Data
Amplification) vulne ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/fmjl8l415tj9zwlob8v2dr5hq1d0hts7
CVE-2026-48586 (Improper Handling of Highly Compressed Data (Data
Amplification) vulne ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/p008svsjf9p6bj47wyyf5dgglq5z7xoq
CVE-2026-48145 (Improper Validation of Certificate with Host Mismatch
vulnerability in ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/2popgc4ks1l87jjho1w5fpk5k4x06b7h
CVE-2026-48144 (Improper Validation of Certificate with Host Mismatch
vulnerability in ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/2xoltfxgzf5jyhcwq6y07spts5cn6ppj
CVE-2026-48052 (Papra is a minimalistic document management and archiving
platform. Pr ...)
NOT-FOR-US: Papra
CVE-2026-48051 (Papra is a minimalistic document management and archiving
platform. Pr ...)
@@ -852,9 +863,11 @@ CVE-2026-45623 (PostCSS takes a CSS file and provides an
API to analyze and modi
NOTE:
https://github.com/postcss/postcss/commit/94484cae6d4308167939f2ac888d166bd80dff01
(8.5.12)
NOTE:
https://github.com/postcss/postcss/commit/85c4d7dab830be366f8a96047f9e5b7944e101d8
(8.5.12)
CVE-2026-45112 (Allocation of Resources Without Limits or Throttling
vulnerability in ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/hl9kmf1z2o3lxvspoj3g9ykl8lj9mdxc
CVE-2026-43871 (Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability i ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/l4dwf14zbyqsmkc28c99ojj3t3gg9qby
CVE-2026-42792 (Improper Handling of Exceptional Conditions vulnerability in
Erlang OT ...)
- erlang <unfixed>
NOTE:
https://github.com/erlang/otp/security/advisories/GHSA-h6f3-hx58-xhj6
@@ -862,7 +875,8 @@ CVE-2026-42792 (Improper Handling of Exceptional Conditions
vulnerability in Erl
NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-42792
NOTE: Fixed by;
https://github.com/erlang/otp/commit/865d203e4a6a8f44179eced9e1428f9259e4a3bb
(OTP-29.0.4, OTP-28.5.0.4, OTP-27.3.4.15)
CVE-2026-41608 (Improper Handling of Highly Compressed Data (Data
Amplification) vulne ...)
- TODO: check
+ - thrift <unfixed>
+ NOTE: https://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f
CVE-2026-40000 (The Activity
zte.com.cn.filer/zte.com.cn.filer.FilePreViewActivity wit ...)
NOT-FOR-US: ZTE
CVE-2026-24252 (NVIDIA NeMo for Linux contains a vulnerability where an
attacker may c ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7dc875ab452062a6b6ce10eb3411934e23eed563
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7dc875ab452062a6b6ce10eb3411934e23eed563
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
