Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9417de3e by Moritz Muehlenhoff at 2026-09-30T09:28:22+02:00
auto-nfu: Update rules for wikimedia, nvidia and apache
- - - - -
2 changed files:
- data/CVE/list
- data/packages/nfu.yaml
Changes:
=====================================
data/CVE/list
=====================================
@@ -881,11 +881,11 @@ CVE-2026-102521 (The decoder in `readFromDataView` in
lib0 before 0.2.119 can be
CVE-2026-102507 (Sliver C2 framework version 1.7.7 and earlier contains an
unhandled pa ...)
NOT-FOR-US: Sliver C2 framework
CVE-2026-102497 (The Apache XmlSchema walker (xmlschema-walker) doesn't detect
cycles i ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102496 (Apache XmlSchema doesn't limit how deeply schema structures
can be nes ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102495 (Apache XmlSchema doesn't limit how deeply schema imports and
includes ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-102491 (A vulnerability was identified in mahonelau kykms up to
8f130c2d85842d ...)
NOT-FOR-US: mahonelau kykms
CVE-2026-102474 (A flaw was found in dash. The printf builtin reserves four
bytes befor ...)
@@ -944,15 +944,15 @@ CVE-2026-100244 (Exposure of Sensitive Information to an
Unauthorized Actor vuln
CVE-2026-100243 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100242 (Dependency on Vulnerable Third-Party Component and
Uncontrolled Resour ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100241 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100240 (Missing Authorization vulnerability in Wikimedia Foundation
Mediawiki ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-100238 (Improper Neutralization of Input During Web Page Generation
(XSS or 'C ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2025-33207 (NVIDIA ConnectX and Bluefield contain a vulnerability in a
control reg ...)
- TODO: check
+ NOT-FOR-US: NVIDIA
CVE-2023-54400 (Fumasoft Fumeng Cloud contains a SQL injection vulnerability
in the Aj ...)
NOT-FOR-US: Fumasoft Fumeng Cloud
CVE-2022-51019 (Akaunting before 2.1.31 contains an OS command injection
vulnerability ...)
@@ -1803,7 +1803,7 @@ CVE-2026-97335 (Incorrect authorization in the custom
storage volume creation en
- lxd <removed>
NOTE:
https://github.com/canonical/lxd/security/advisories/GHSA-p456-92fx-44xh
CVE-2026-96740 (A flaw was found in the StreamsHub Console for Apache Kafka.
Tenant-su ...)
- TODO: check
+ NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-96538 (WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a
missing auth ...)
NOT-FOR-US: WarehousePG (WHPG)
CVE-2026-95104 (Stack-based buffer overflow vulnerability exists in BUFFALO
Wi-Fi prod ...)
=====================================
data/packages/nfu.yaml
=====================================
@@ -451,6 +451,7 @@
- product: Apache Traffic Control
- product: Apache Uniffle
- product: Apache Wicket
+ - product: Apache XMLSchema
- product: Apache Zeppelin
- product: Pony Mail
- reason: Check Point
@@ -643,6 +644,7 @@
- product: BioNeMo Framework
- product: 'BlueField.*'
- product: CUDA-Q
+ - product: 'ConnectX.*'
- product: Container Toolkit
- product: DALI
- product: DeepStream
@@ -651,8 +653,7 @@
- product: Dynamo
- product: FLARE SDK
- product: Infrastructure Controller
- - product: Isaac Lab
- - product: Isaac Launchable
+ - product: 'Isaac.*'
- product: KAI Scheduler
- product: 'Megatron.*'
- product: Merlin Transformers4Rec
@@ -662,11 +663,9 @@
- product: NVDebug tool
- product: NVIDIA Apex
- product: NVIDIA App
- - product: NVIDIA Isaac-GR00T N1
- - product: NVIDIA Isaac-GR00T N1.5
+ - product: 'NVIDIA Isaac*'
- product: NVIDIA Merlin Transformers4Rec
- - product: NVIDIA NeMo Curator
- - product: NVIDIA NeMo Framework
+ - product: 'NVIDIA NeMo.*'
- product: NVIDIA WebDataset
- product: NVIDIA runx
- product: NVTabular
@@ -974,10 +973,13 @@
- product: 'Mediawiki - CentralAuth.*'
- product: 'Mediawiki - Charts.*'
- product: 'Mediawiki - CirrusSearch.*'
+ - product: 'Mediawiki - DataTransfer.*'
- product: 'MediaWiki - CSS.*'
+ - product: 'Mediawiki - EventBus.*'
- product: 'Mediawiki - ExternalData.*'
- product: 'Mediawiki - ExternalGuidance.*'
- product: 'Mediawiki - FlaggedRevs.*'
+ - product: 'Mediawiki - Flow.*'
- product: 'Mediawiki - GlobalWatchlist.*'
- product: 'Mediawiki - GrowthExperiments.*'
- product: 'Mediawiki - LanguageSelector.*'
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9417de3e242d00a1400e00c2b70b7788572e3026
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9417de3e242d00a1400e00c2b70b7788572e3026
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
