Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
a0ec0d2c by Salvatore Bonaccorso at 2026-09-29T22:42:13+02:00
Reserve DSA number for pcre2 update
- - - - -
3 changed files:
- data/CVE/list
- data/DSA/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1694,6 +1694,7 @@ CVE-2026-97029 (Flatpak's process ID namespace separation
does not prevent a san
NOTE:
https://github.com/flatpak/flatpak/security/advisories/GHSA-f3p8-vr7v-gxf2
CVE-2026-XXXX [GHSA-r9hj-j2rw-4q3m: PCRE2: out-of-bounds write in JIT matching
with large stack allocations]
- pcre2 10.48-3.1 (bug #1149217)
+ [trixie] - pcre2 10.46-1~deb13u3
NOTE:
https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m
NOTE: Fixed by:
https://github.com/PCRE2Project/pcre2/commit/2b4038298072684b0fae29b15bedfb1a75bda46d
(pcre2-10.49)
CVE-2026-XXXX [GHSA-9qqc-m43j-g4r2]
=====================================
data/DSA/list
=====================================
@@ -1,3 +1,5 @@
+[29 Sep 2026] DSA-6530-1 pcre2 - security update
+ [trixie] - pcre2 10.46-1~deb13u3
[29 Sep 2026] DSA-6529-1 libwebsockets - security update
{CVE-2026-19773}
[trixie] - libwebsockets 4.3.5-1+deb13u3
=====================================
data/dsa-needed.txt
=====================================
@@ -113,8 +113,6 @@ openssl (carnil)
--
pacemaker
--
-pcre2 (carnil)
---
pdfminer (carnil)
Required followup for CVE-2025-64512 as original fix was incomplete.
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a0ec0d2c0e6f93ae29ca2d4bbcc38b2d078f7c49
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a0ec0d2c0e6f93ae29ca2d4bbcc38b2d078f7c49
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
