Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9ebe5224 by Salvatore Bonaccorso at 2026-09-02T11:37:42+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -517,12 +517,12 @@ CVE-2026-84470 (A flaw was found in Ansible Automation
Platform's automation-con
CVE-2026-84373 (Vitest is a testing framework powered by Vite. From 2.1.0
until 4.1.11 ...)
NOT-FOR-US: Vitest
CVE-2026-84311 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.16 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1146476)
- pypdf2 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2527050
TODO: check upstream references
CVE-2026-84310 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.16 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1146476)
- pypdf2 <removed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2527049
TODO: check upstream references
@@ -662,26 +662,26 @@ CVE-2026-84303 (gRPC-Go is the Go language implementation
of gRPC. Prior to 1.83
NOTE: https://github.com/grpc/grpc-go/pull/9335 (v1.83.x backport)
NOTE: Fixed by:
https://github.com/grpc/grpc-go/commit/ebba6f3f1b206e2b4dc4d1d5a96d18430302c2fe
(v1.83.1)
CVE-2026-84270 (A flaw was found in the MTP backend in gvfs. When reading a
file from ...)
- - gvfs <unfixed>
+ - gvfs <unfixed> (bug #1146478)
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/issues/864
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/340
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/070e5e4223c97f7e793a342ba6e64df1095ccb0d
(1.61.90)
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/25add8b5103384c7edc8ad74722ed93eb3f6f077
(1.60.2)
CVE-2026-84269 (A flaw was found in the AFP backend in gvfs. When mounting a
share, a ...)
- - gvfs <unfixed>
+ - gvfs <unfixed> (bug #1146478)
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/issues/863
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/340
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/072a7e02d11f5b7dfa324b70dd0e16d60f9b9e60
(1.61.90)
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/81525b2c917950554255784542674222bfee797d
(1.60.2)
CVE-2026-84268 (A flaw was found in the SFTP backend in gvfs. When mounting a
share an ...)
- - gvfs <unfixed>
+ - gvfs <unfixed> (bug #1146478)
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/issues/862
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/5ab77256f9c071c7c99a5298db1729cf143bff05
(1.61.90)
NOTE: Follow up:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/1ff24454d1c9b964a5f0efdd54c6d1421e770d64
(1.61.90)
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/ea1322daab1979b30cf96b3e39ed6db5e45fc041
(1.60.2)
NOTE: Follow up:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/1590471ad9c382de4fc544bdf49c8f424eea96f8
(1.60.2)
CVE-2026-84267 (A flaw was found in the SFTP backend in gvfs. When mounting a
share, a ...)
- - gvfs <unfixed>
+ - gvfs <unfixed> (bug #1146478)
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/issues/861
NOTE: https://gitlab.gnome.org/GNOME/gvfs/-/merge_requests/340
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gvfs/-/commit/d9a59b8e385189b4783d9b66ca475f530fb26693
(1.61.90)
@@ -765,69 +765,69 @@ CVE-2026-83619 (xmldom is a pure JavaScript W3C
standard-based (XML DOM Level 2
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/3abb0934f5a8a84d83a1f9cde0f2bd04c08b2a09
(0.8.15)
NOTE: 0.9.x is not affected by the vulnerability, mark first version in
unstable as fixed version
CVE-2026-83618 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-vr34-hp96-76pp
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362
(0.9.12)
CVE-2026-83617 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-jxjr-3g7g-3944
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362
(0.9.12)
CVE-2026-83616 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-c7q8-3ch8-vqpv
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/1cde3e31a07c41c87cfd368d6946aa477f16b4f9
(0.9.12)
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/3b694872bcb5c7e3cbadba961a4be2488750ce5b
(0.8.15)
CVE-2026-83615 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-965w-775f-mr7g
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/dabffe884e864eeecb1f515c716f875e1bc47ec1
(0.9.12)
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/954370f58c046223faf95ba77efcbc8ce014409d
(0.8.15)
CVE-2026-83614 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-93r5-fhx6-vmg9
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/0748720b620555f8c222782dcab575cf0cf403b4
(0.9.12)
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/f40ccb861eee0acbf5ee4feb9a34932e87b329c9
(0.8.15)
CVE-2026-83613 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-8344-3jmq-59r6
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/cfb09b5dbeb035fdfedc9f01e2bbaf226bf47cf3
(0.9.12)
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/2c548f200cfec991cd5846627ef8f03542309213
(0.8.15)
CVE-2026-83612 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-6mj3-qw4j-hgrw
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/7ced40c06c28d151e996a97045018c3559ae4707
(0.9.12)
CVE-2026-83611 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-6h8r-xr42-gp59
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362
(0.9.12)
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/4430189660b0d380ee9c9ee7550a1358688e8828
(0.8.15)
CVE-2026-83610 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-6gmq-8vp8-gcm6
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/4664386e4f4d99d17b416a151dbe8323e245284b
(0.9.12)
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/6c3fb5ffeafe7901ec928ce9010988dd716c94a0
(0.8.15)
CVE-2026-83609 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-3px3-54cx-rmw9
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: Fixed by:
https://github.com/xmldom/xmldom/commit/7b2ec67e1750daadd0bb06c92e875e726544a362
(0.9.12)
CVE-2026-83608 (xmldom is a pure JavaScript W3C standard-based (XML DOM Level
2 Core) ...)
- - node-xmldom <unfixed>
+ - node-xmldom <unfixed> (bug #1146473)
NOTE:
https://github.com/xmldom/xmldom/security/advisories/GHSA-27p8-2357-5qqv
NOTE: https://github.com/xmldom/xmldom/pull/1071
NOTE: https://github.com/xmldom/xmldom/pull/1072
@@ -1354,14 +1354,14 @@ CVE-2026-82731 (URL Redirection to Untrusted Site
('Open Redirect') vulnerabilit
CVE-2026-82730 (Incorrect Authorization vulnerability in ash-project
ash_typescript al ...)
NOT-FOR-US: ash-project
CVE-2026-82398 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.15 ...)
- - pypdf <unfixed>
+ - pypdf <unfixed> (bug #1146476)
[trixie] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-fc8x-2rww-xw9m
NOTE: https://github.com/py-pdf/pypdf/pull/3947
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/4959848e057e37c218dccad7465259210923faaa
(6.15.0)
CVE-2026-82397 (Tornado is a Python web framework and asynchronous networking
library. ...)
- - python-tornado <unfixed>
+ - python-tornado <unfixed> (bug #1146475)
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-mpf4-983q-p7j4
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/8d6363ed7b69d5f0da806efe34d256627a2191de
(v6.5.8)
CVE-2026-82396 (Sulu is an open-source PHP content management system based on
the Symf ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ebe52244d3674b3e94fdc9127e2cca4bfaeb22e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ebe52244d3674b3e94fdc9127e2cca4bfaeb22e
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
