Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
75fa80aa by Moritz Muehlenhoff at 2026-09-29T17:41:28+02:00
qemu fixed and new issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,15 @@
+CVE-2026-16271 [hw/display/qxl: validate primary surface stride against width]
+ - qemu 1:11.1.2+ds-1
+CVE-2026-77913 [hw/display/vga: fix text-mode OOB write after a graphics
surface switch]
+ - qemu 1:11.1.2+ds-1
+CVE-2026-84788 [io/channel-socket: do not treat a zero length write as an
error]
+ - qemu 1:11.1.2+ds-1
+CVE-2026-66900 [hw/net/virtio-net: strip trailing padding when caching RSC
segment]
+ - qemu 1:11.1.2+ds-1
+CVE-2026-66899 [virtio-balloon: fix free-page BH teardown on unrealize]
+ - qemu 1:11.1.2+ds-1
+CVE-2026-17588 [hw/usb/hcd-xhci: Set reentrancy guard in timer functions]
+ - qemu 1:11.1.2+ds-1
CVE-2026-46675 [Use-after-free of zlib input in `png_read_end` after
incomplete zTXt, iTXt or iCCP decompression]
- libpng1.6 <unfixed>
NOTE:
https://github.com/pnggroup/libpng/security/advisories/GHSA-qvg3-h654-xq3j
@@ -2170,7 +2182,7 @@ CVE-2026-93899 (The Better Messages \u2013 Chat Rooms,
Group Chat, Private Messa
CVE-2026-93897 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
NOT-FOR-US: WordPress plugin
CVE-2026-93834 (A use-after-free vulnerability was found in QEMU's 9pfs
subsystem. A r ...)
- - qemu <unfixed> (bug #1149064)
+ - qemu 1:11.1.2+ds-1 (bug #1149064)
[trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/4491
NOTE: Introduced with:
https://gitlab.com/qemu-project/qemu/-/commit/02cb7f3a256517cbf3136caff2863fbafc57b540
(v1.0-rc0)
@@ -10314,7 +10326,7 @@ CVE-2026-81943 (PLANET IGS-5225-8P2T4S industrial
managed switch V1 and V2 firmw
CVE-2026-81942 (PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2
firmware ve ...)
NOT-FOR-US: PLANET
CVE-2026-81627 (A flaw was found in QEMU. The VAPIC setup hypercall in
hw/i386/vapic.c ...)
- - qemu <unfixed> (bug #1148473)
+ - qemu 1:11.1.2+ds-1 (bug #1148473)
[trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/4206
NOTE: Fixed by:
https://gitlab.com/qemu-project/qemu/-/commit/d61c8a6fb7388486353aa267ba0d75b098f16662
(master)
@@ -85979,7 +85991,7 @@ CVE-2026-12701 (A path traversal vulnerability was
found in pulpcore. The relati
CVE-2026-12341 (This vulnerability impacts all versions of IdentityIQ and
allows an un ...)
NOT-FOR-US: SailPoint Technologies
CVE-2026-12080 (A flaw was found in the QEMU Guest Agent (qga). A local
unprivileged u ...)
- - qemu <unfixed>
+ - qemu 1:11.1.2+ds-1
[trixie] - qemu <no-dsa> (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/work_items/3929
CVE-2026-64207 (In the Linux kernel, the following vulnerability has been
resolved: n ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/75fa80aa441f74600524c21e1c6e3ea9490f95d6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/75fa80aa441f74600524c21e1c6e3ea9490f95d6
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
