Abhijith PA pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2a6e1cf5 by Abhijith PA at 2026-08-25T18:49:37+05:30
Reserve DLA-4755-1 for libvncserver
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -122246,14 +122246,12 @@ CVE-2026-32854 (LibVNCServer versions 0.9.15 and
prior (fixed incommit dc78dee)
- libvncserver 0.9.15+dfsg-3 (bug #1132017)
[trixie] - libvncserver 0.9.15+dfsg-1+deb13u1
[bookworm] - libvncserver 0.9.14+dfsg-1+deb12u1
- [bullseye] - libvncserver <postponed> (Minor issue)
NOTE:
https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
NOTE: Fixed by:
https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314
CVE-2026-32853 (LibVNCServer versions 0.9.15 and prior (fixed incommit
009008e) contai ...)
- libvncserver 0.9.15+dfsg-3 (bug #1132016)
[trixie] - libvncserver 0.9.15+dfsg-1+deb13u1
[bookworm] - libvncserver 0.9.14+dfsg-1+deb12u1
- [bullseye] - libvncserver <postponed> (Minor issue)
NOTE:
https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
NOTE: Fixed by:
https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931
CVE-2026-32647 (NGINX Open Source and NGINX Plus have a vulnerability in the
ngx_http_ ...)
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[25 Aug 2026] DLA-4755-1 libvncserver - security update
+ {CVE-2026-32853 CVE-2026-32854 CVE-2026-44988 CVE-2026-50538}
+ [bullseye] - libvncserver 0.9.13+dfsg-2+deb11u2
[25 Aug 2026] DLA-4754-1 thunderbird - security update
{CVE-2026-74934 CVE-2026-74935 CVE-2026-74936 CVE-2026-74939
CVE-2026-74940 CVE-2026-74941 CVE-2026-74942 CVE-2026-74943 CVE-2026-74944
CVE-2026-74945 CVE-2026-74946 CVE-2026-74948 CVE-2026-74949 CVE-2026-74953
CVE-2026-74957 CVE-2026-74959 CVE-2026-74960 CVE-2026-74962 CVE-2026-74963
CVE-2026-74964 CVE-2026-74965 CVE-2026-74967 CVE-2026-74969 CVE-2026-74971
CVE-2026-74972 CVE-2026-74973 CVE-2026-74974 CVE-2026-74976 CVE-2026-74983
CVE-2026-74987 CVE-2026-74990}
[bullseye] - thunderbird 1:140.14.0esr-1~deb11u1
=====================================
data/dla-needed.txt
=====================================
@@ -430,9 +430,6 @@ libstb/bullseye
NOTE: 20260226: Fixed CVE-2021-28021 CVE-2021-37789 CVE-2021-42715
CVE-2022-28041 CVE-2022-28042 with DLA-4493-1 (abhijith)
NOTE: 20260429: Revisit when upstream merge the proposed fixes. Though other
embed libstb projects patched (abhijith)
--
-libvncserver (Abhijith PA)
- NOTE: 20260612: Added by Front-Desk (rouca)
---
libwebsockets/bookworm
NOTE: 20260718: Added by Front-Desk (Beuc)
NOTE: 20260718: 2 CVEs fixed in both bullseye and trixie (Beuc/front-desk)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2a6e1cf5a97676baf836917baf7179efdf79aa33
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2a6e1cf5a97676baf836917baf7179efdf79aa33
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
