Thorsten Alteholz pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
bc1fe43b by Thorsten Alteholz at 2026-09-27T10:51:30+02:00
add znc
- - - - -
7b97b940 by Thorsten Alteholz at 2026-09-27T10:51:30+02:00
add xdg-dbus-proxy
- - - - -
e917e448 by Thorsten Alteholz at 2026-09-27T10:51:30+02:00
add rsyslog
- - - - -
f81d51bb by Thorsten Alteholz at 2026-09-27T10:51:30+02:00
add libreoffice
- - - - -
477adad3 by Thorsten Alteholz at 2026-09-27T10:51:32+02:00
mark CVE-2026-96675 and CVE-2026-96674 as postponed for Bookworm
- - - - -
88674587 by Thorsten Alteholz at 2026-09-27T10:51:34+02:00
mark CVE-2026-62943 as postponed for Bookworm
- - - - -
e4c91e00 by Thorsten Alteholz at 2026-09-27T10:51:36+02:00
mark CVE-2026-92768, CVE-2026-92747 and CVE-2026-92745 as postponed for Bookworm
- - - - -
34cf050f by Thorsten Alteholz at 2026-09-27T10:51:38+02:00
mark CVE-2026-22591 and CVE-2026-22590 as postponed for Bookworm
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -4423,10 +4423,12 @@ CVE-2026-96676 (A vulnerability was identified in Fast
FAC1900R 20190827_2.0.2.
CVE-2026-96675 (alsa-lib through 1.2.16.1 contains a denial of service
vulnerability i ...)
- alsa-lib <unfixed> (bug #1148900)
[trixie] - alsa-lib <no-dsa> (Minor issue)
+ [bookworm] - alsa-lib <postponed> (Minor issue)
NOTE: https://github.com/alsa-project/alsa-lib/pull/527
CVE-2026-96674 (alsa-lib through 1.2.16.1 computes combined topology element
size usin ...)
- alsa-lib <unfixed> (bug #1148896)
[trixie] - alsa-lib <no-dsa> (Minor issue)
+ [bookworm] - alsa-lib <postponed> (Minor issue)
NOTE: https://github.com/alsa-project/alsa-lib/pull/527
CVE-2026-96673 (Photoview through 2.4.0 contains an SQL injection
vulnerability in the ...)
NOT-FOR-US: Photoview
@@ -8928,14 +8930,17 @@ CVE-2026-92976 (A stored Cross-Site Scripting (XSS)
vulnerability in the profile
CVE-2026-92768 (A flaw was found in cockpit-machines. This vulnerability
allows a loca ...)
- cockpit-machines 357-1
[trixie] - cockpit-machines <no-dsa> (Minor issue)
+ [bookworm] - cockpit-machines <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2469258
CVE-2026-92747 (A flaw was found in `cockpit-machines`. This vulnerability
allows a lo ...)
- cockpit-machines 357-1
[trixie] - cockpit-machines <no-dsa> (Minor issue)
+ [bookworm] - cockpit-machines <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2469260
CVE-2026-92745 (A flaw was found in cockpit-machines. This vulnerability
allows a loca ...)
- cockpit-machines 357-1
[trixie] - cockpit-machines <no-dsa> (Minor issue)
+ [bookworm] - cockpit-machines <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2476266
CVE-2026-92702 (Cocos AI is a confidential computing system for running AI
workloads i ...)
NOT-FOR-US: Cocos AI
@@ -9228,6 +9233,7 @@ CVE-2026-63199 (Perses is an open-source dashboard and
visualization project for
CVE-2026-62943 (btrbk is a tool for creating snapshots and remote backups of
Btrfs sub ...)
- btrbk <unfixed> (bug #1148559)
[trixie] - btrbk <no-dsa> (Minor issue)
+ [bookworm] - btrbk <postponed> (Minor issue)
NOTE:
https://github.com/digint/btrbk/security/advisories/GHSA-pf45-7g54-65h5
NOTE: Introduced with:
https://github.com/digint/btrbk/commit/8d0d7edda7cc775b87fd450266b756885f1eaa80
(v0.29.0)
NOTE: Fixed by:
https://github.com/digint/btrbk/commit/29ca3c093205395bdeb9dd98677ab4139c458aec
(v0.32.7)
@@ -24333,10 +24339,12 @@ CVE-2026-23855 (Dell iDRAC9, 14G versions prior to
7.00.00.184, 15G/16G versions
CVE-2026-22591 (eprosima Fast DDS is a C++ implementation of the DDS (Data
Distributio ...)
- fastdds <unfixed>
[trixie] - fastdds <no-dsa> (Minor issue)
+ [bookworm] - fastdds <postponed> (Minor issue)
NOTE:
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7577-rf2r-j88m
CVE-2026-22590 (eprosima Fast DDS is a C++ implementation of the DDS (Data
Distributio ...)
- fastdds <unfixed>
[trixie] - fastdds <no-dsa> (Minor issue)
+ [bookworm] - fastdds <postponed> (Minor issue)
NOTE:
https://github.com/eProsima/Fast-DDS/security/advisories/GHSA-7r7h-hwfj-q626
CVE-2026-19778 (The WPMR Google Feed Manager for WooCommerce \u2013 Sell on
Google Mer ...)
NOT-FOR-US: WordPress plugin
=====================================
data/dla-needed.txt
=====================================
@@ -333,6 +333,9 @@ libio-compress-perl
libmojo-jwt-perl
NOTE: 20260805: Added by Front-Desk (rouca)
--
+libreoffice
+ NOTE: 20260927: Added by Front-Desk (ta)
+--
librest
NOTE: 20260802: Added by Front-Desk (ta)
--
@@ -650,6 +653,9 @@ rsync (Thorsten Alteholz)
NOTE: 20260615: Requested by Sylvain to track regressions, same as in
dsa-needed. (charles)
NOTE: 20260705: making progress with updated patches
--
+rsyslog
+ NOTE: 20260927: Added by Front-Desk (ta)
+--
ruby-oauth2
NOTE: 20260805: Added by Front-Desk (rouca)
--
@@ -824,6 +830,9 @@ wireshark
wordpress
NOTE: 20260807: Added by Front-Desk. Follow DSA (rouca)
--
+xdg-dbus-proxy
+ NOTE: 20260927: Added by Front-Desk (ta)
+--
xen
NOTE: 20260714: Added by Front-Desk (Beuc)
NOTE: 20260714: Upcoming DSA + 2 postponed CVEs fixed in trixie
(Beuc/front-desk)
@@ -844,6 +853,9 @@ zlib (tobi)
NOTE: 20260910: New CVE without activity from upstream yet (eamanu)
NOTE: 20260917: Upcoming DSA, patch available (Beuc/front-desk)
--
+znc
+ NOTE: 20260927: Added by Front-Desk (ta)
+--
zookeeper
NOTE: 20260925: Added by Front-Desk (ta)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b43fd720f835f6a35d078cb4bfc6f6ac2943d1b6...34cf050fc51e82322598555f45e8c6bd50106a63
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/b43fd720f835f6a35d078cb4bfc6f6ac2943d1b6...34cf050fc51e82322598555f45e8c6bd50106a63
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
