Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ed205a99 by Moritz Muehlenhoff at 2026-09-29T23:13:45+02:00
auto-nfu: Extend Eclipse and nvidia rules
- - - - -
2 changed files:
- data/CVE/list
- data/packages/nfu.yaml
Changes:
=====================================
data/CVE/list
=====================================
@@ -187,7 +187,7 @@ CVE-2026-68911 (Nicotine+ is a graphical client for the
Soulseek peer-to-peer ne
CVE-2026-66083 (The /datasources/unauth-datasource endpoint does not properly
enforce ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-65102 (NVIDIA DeepStream contains a vulnerability where an attacker
could ca ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2026-63209 (compress provides various compression algorithms. Prior to
version 1.1 ...)
TODO: check
CVE-2026-4523 (GitLab has remediated an issue in GitLab CE/EE affecting all
versions ...)
@@ -278,9 +278,9 @@ CVE-2026-102758 (The
`_nx_secure_x509_asn1_tlv_block_parse()` function parses AS
CVE-2026-102757 (An unprivileged, memory-protected ThreadX module can have the
kernel r ...)
NOT-FOR-US: Eclipse
CVE-2026-102730 (Mounting an attacker-controlled NAND flash image
(`lx_nand_flash_open( ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102729 (`gx_binres_theme_load()` sizes its theme buffer for the theme
it was a ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102728 (Two client-side TLS/DTLS handshake parsers in NetX Secure
read fields ...)
NOT-FOR-US: Eclipse
CVE-2026-102727 (FTP Passive Data Connection Not Bound to the Authenticated
Control Pee ...)
@@ -298,15 +298,15 @@ CVE-2026-102722 (In the IPv4 PASV path, the FTP Client
accepts whatever address
CVE-2026-102721 (A TFTP server that answers with a short ERROR packet makes
the client ...)
NOT-FOR-US: Eclipse
CVE-2026-102720 (A DHCP server, or anyone on the LAN who answers a DISCOVER
first, can ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102719 (Predictable DTLS HelloVerifyRequest Cookie in NetX Secure)
TODO: check
CVE-2026-102718 (hey, `_nx_snmp_utility_object_id_get` in the NetX Duo SNMP
addon do ...)
NOT-FOR-US: Eclipse
CVE-2026-102716 (An unauthenticated client can drain the RTSP server's packet
pool with ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102715 (Any host on the LAN can send two mDNS records and make the
responder w ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102714 (`_nx_icmpv6_validate_options()` scans the option area with
`while (len ...)
NOT-FOR-US: Eclipse
CVE-2026-102713 (The TFTP server accepts a DATA datagram of any size. The
dispatcher re ...)
@@ -316,7 +316,7 @@ CVE-2026-102712 (On the first DTLS ClientHello, the parser
copies a device-claim
CVE-2026-102711 (Two issues in the ThreadX loadable-module loader, reached
when a devic ...)
TODO: check
CVE-2026-102710 (Attacker model / Preconditions: a loaded
`TXM_MODULE_USER_MODE | TXM_M ...)
- TODO: check
+ NOT-FOR-US: Eclipse
CVE-2026-102709 (Improper validation of non-secure (NS) pointers in multiple
TrustZone- ...)
NOT-FOR-US: Eclipse
CVE-2026-102697 (Ollama versions 0.14.0 before 0.31.2 contain an incorrect
authorizatio ...)
=====================================
data/packages/nfu.yaml
=====================================
@@ -533,6 +533,7 @@
- product: Eclipse OpenVSX
- product: Eclipse Parsson
- product: Eclipse Theia
+ - product: 'eclipse-thread.*'
- product: Eclipse ThreadX
- product: Eclipse ThreadX - NetX Duo
- product: Eclipse ThreadX - USBX
@@ -540,6 +541,7 @@
- product: Eclipse aeriOS
- product: Eclipse tinydtls
- product: FileX
+ - product: GUIX
- product: Jersey
- product: NetX Duo
- product: NextX Duo
@@ -638,9 +640,11 @@
- product: AIStore
- product: AIStore framework
- product: BioNeMo Framework
+ - product: 'BlueField.*'
- product: CUDA-Q
- product: Container Toolkit
- product: DALI
+ - product: DeepStream
- product: DGX Spark
- product: DLS component of NVIDIA License System
- product: Dynamo
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed205a99edd9cedda577ab4bfed1a5ae18e43644
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed205a99edd9cedda577ab4bfed1a5ae18e43644
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
