Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f7aa2de1 by Moritz Muehlenhoff at 2026-09-30T17:27:45+02:00
pypdf fixed in sid
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -37356,7 +37356,7 @@ CVE-2026-84361 (Composer is a dependency Manager for
the PHP language. From 1.0
NOTE: Fixed by:
https://github.com/composer/composer/commit/0aac50528e83ed635cf788333635897469440220
(2.10.3)
NOTE: Fixed by:
https://github.com/composer/composer/commit/199ad81a9cc6a2a5164ad79a8da26b2e19e521af
(2.2.30)
CVE-2026-84309 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.16 ...)
- - pypdf <unfixed> (bug #1146638)
+ - pypdf 6.19.0-1 (bug #1146638)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -37798,7 +37798,7 @@ CVE-2026-84470 (A flaw was found in Ansible Automation
Platform's automation-con
CVE-2026-84373 (Vitest is a testing framework powered by Vite. From 2.1.0
until 4.1.11 ...)
NOT-FOR-US: Vitest
CVE-2026-84311 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.16 ...)
- - pypdf <unfixed> (bug #1146476)
+ - pypdf 6.19.0-1 (bug #1146476)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -37807,7 +37807,7 @@ CVE-2026-84311 (pypdf is a free and open-source
pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3966
NOTE:
https://github.com/py-pdf/pypdf/commit/d91ab705fd81ed1a9cec175c6958600dea1a4942
(6.16.1)
CVE-2026-84310 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.16 ...)
- - pypdf <unfixed> (bug #1146476)
+ - pypdf 6.19.0-1 (bug #1146476)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -38838,7 +38838,7 @@ CVE-2026-82731 (URL Redirection to Untrusted Site
('Open Redirect') vulnerabilit
CVE-2026-82730 (Incorrect Authorization vulnerability in ash-project
ash_typescript al ...)
NOT-FOR-US: ash-project
CVE-2026-82398 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.15 ...)
- - pypdf <unfixed> (bug #1146476)
+ - pypdf 6.19.0-1 (bug #1146476)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -70647,7 +70647,7 @@ CVE-2026-66808 (Deserialization of untrusted data in
Microsoft Office SharePoint
CVE-2026-9169 (DLL Search Order Hijacking in LUCID Vision Labs Arena SDK
1.0.80.49 on ...)
NOT-FOR-US: LUCID Vision Labs Arena SDK
CVE-2026-71870 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.15 ...)
- - pypdf <unfixed> (bug #1143902)
+ - pypdf 6.19.0-1 (bug #1143902)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -70656,7 +70656,7 @@ CVE-2026-71870 (pypdf is a free and open-source
pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3944
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/afba8080e19d29a3c256a742b340995e695b35aa
(6.15.0)
CVE-2026-71852 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.15 ...)
- - pypdf <unfixed> (bug #1143902)
+ - pypdf 6.19.0-1 (bug #1143902)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -98307,7 +98307,7 @@ CVE-2026-59939 (httplib2 is a comprehensive HTTP client
library for Python. Prio
NOTE:
https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3
NOTE: Fixed by:
https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427
(v0.32.0)
CVE-2026-59936 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.14 ...)
- - pypdf <unfixed> (bug #1141771)
+ - pypdf 6.19.0-1 (bug #1141771)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -98317,7 +98317,7 @@ CVE-2026-59936 (pypdf is a free and open-source
pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3891
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/ec3b14596186c40caca7cf8ab9b2155203e01b5b
(6.14.1)
CVE-2026-59935 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.14 ...)
- - pypdf <unfixed> (bug #1141771)
+ - pypdf 6.19.0-1 (bug #1141771)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -98796,7 +98796,7 @@ CVE-2026-5459 (The User Frontend: AI Powered Frontend
Posting, User Directory, P
CVE-2026-5356 (The LatePoint \u2013 Calendar Booking Plugin for Appointments
and Even ...)
NOT-FOR-US: WordPress plugin
CVE-2026-59938 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.14 ...)
- - pypdf <unfixed> (bug #1141771)
+ - pypdf 6.19.0-1 (bug #1141771)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -98806,7 +98806,7 @@ CVE-2026-59938 (pypdf is a free and open-source
pure-python PDF library. Prior t
NOTE: https://github.com/py-pdf/pypdf/pull/3888
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/c64583be16b8e8763d8777075f8ecbf382014b7a
(6.14.0)
CVE-2026-59937 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.14 ...)
- - pypdf <unfixed> (bug #1141771)
+ - pypdf 6.19.0-1 (bug #1141771)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -103274,7 +103274,7 @@ CVE-2026-57585 (MessagePack is the serializer
implementation for Python msgpack.
NOTE:
https://github.com/msgpack/msgpack-python/security/advisories/GHSA-6v7p-g79w-8964
NOTE: Fixed by:
https://github.com/msgpack/msgpack-python/commit/2c56ddb5d0025ed481d962c0f5d62d19dec7476d
(v1.2.1)
CVE-2026-57204 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.13 ...)
- - pypdf <unfixed> (bug #1141339)
+ - pypdf 6.19.0-1 (bug #1141339)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112377,7 +112377,7 @@ CVE-2026-54911 (UltraJSON is a fast JSON encoder and
decoder written in pure C w
NOTE:
https://github.com/ultrajson/ultrajson/security/advisories/GHSA-3j69-69wj-xqx2
NOTE:
https://github.com/ultrajson/ultrajson/commit/169eaf36b1116fece5034ee79a7a0ef3f6deedcf
(5.13.0)
CVE-2026-54651 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.13 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112386,7 +112386,7 @@ CVE-2026-54651 (pypdf is a free and open-source
pure-python PDF library. Prior t
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-g9xf-7f8q-9mcj
NOTE: https://github.com/py-pdf/pypdf/pull/3839
CVE-2026-54531 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.13 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112395,7 +112395,7 @@ CVE-2026-54531 (pypdf is a free and open-source
pure-python PDF library. Prior t
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-m2v9-299j-rv96
NOTE: https://github.com/py-pdf/pypdf/pull/3830
CVE-2026-54530 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.13 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112418,7 +112418,7 @@ CVE-2026-53923 (vLLM is an inference and serving
engine for large language model
CVE-2026-49468 (LiteLLM is a proxy server (AI Gateway) to call LLM APIs in
OpenAI (or ...)
NOT-FOR-US: LiteLLM
CVE-2026-49461 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.12 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112426,8 +112426,9 @@ CVE-2026-49461 (pypdf is a free and open-source
pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-j543-4vmf-qm7v
NOTE: https://github.com/py-pdf/pypdf/pull/3805
+ NOTE:
https://github.com/py-pdf/pypdf/commit/0b5b8adf02a25b23adae9037ff32d16232936c0f
(6.12.2)
CVE-2026-49460 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.12 ...)
- - pypdf <unfixed> (bug #1140629)
+ - pypdf 6.19.0-1 (bug #1140629)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <postponed> (Minor issue)
- pypdf2 <removed>
@@ -112435,6 +112436,7 @@ CVE-2026-49460 (pypdf is a free and open-source
pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-5hgr-hg42-57jg
NOTE: https://github.com/py-pdf/pypdf/pull/3806
+ NOTE:
https://github.com/py-pdf/pypdf/commit/6755d925fae26a79c2f76f5c911bcd728f75a952
(6.12.2)
CVE-2026-48746 (vLLM is an inference and serving engine for large language
models (LLM ...)
- vllm <itp> (bug #1095237)
CVE-2026-48517 (MessagePack for C# is a MessagePack serializer for C#. Prior
to 2.5.30 ...)
@@ -128919,7 +128921,7 @@ CVE-2026-49238 (An issue was discovered in Canonical
Multipass before version 1.
CVE-2026-49237 (An issue was discovered in Canonical Multipass for macOS
before versio ...)
NOT-FOR-US: Multipass
CVE-2026-48735 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.12 ...)
- - pypdf <unfixed> (bug #1138192)
+ - pypdf 6.19.0-1 (bug #1138192)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -128927,6 +128929,7 @@ CVE-2026-48735 (pypdf is a free and open-source
pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-wjqc-6w8f-h24c
NOTE: https://github.com/py-pdf/pypdf/pull/3796
+ NOTE:
https://github.com/py-pdf/pypdf/commit/62191d5a5c3ee218856d3cbaa039366bc97909f7
(6.12.1)
CVE-2026-48526 (PyJWT is a JSON Web Token implementation in Python. Prior to
2.13.0, w ...)
- pyjwt 2.13.0-1 (bug #1138191)
[trixie] - pyjwt <no-dsa> (Minor issue)
@@ -128963,7 +128966,7 @@ CVE-2026-48522 (PyJWT is a JSON Web Token
implementation in Python. Prior to 2.1
NOTE:
https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4
NOTE:
https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81
(2.13.0)
CVE-2026-48156 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.12 ...)
- - pypdf <unfixed> (bug #1138193)
+ - pypdf 6.19.0-1 (bug #1138193)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -128971,8 +128974,9 @@ CVE-2026-48156 (pypdf is a free and open-source
pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-248m-82v9-q6g6
NOTE: https://github.com/py-pdf/pypdf/pull/3791
+ NOTE:
https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70
(6.12.0)
CVE-2026-48155 (pypdf is a free and open-source pure-python PDF library. Prior
to 6.12 ...)
- - pypdf <unfixed> (bug #1138194)
+ - pypdf 6.19.0-1 (bug #1138194)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -128980,6 +128984,7 @@ CVE-2026-48155 (pypdf is a free and open-source
pure-python PDF library. Prior t
[bullseye] - pypdf2 <postponed> (Minor issue)
NOTE:
https://github.com/py-pdf/pypdf/security/advisories/GHSA-cj93-chg6-vgv8
NOTE: https://github.com/py-pdf/pypdf/pull/3790
+ NOTE:
https://github.com/py-pdf/pypdf/commit/9d2747057c4afc06ccc0fc6244a3915ba6ea6f0b
(6.12.0)
CVE-2026-47762 (TinyMCE is an open source rich text editor. Prior to 5.11.1,
7.9.3, an ...)
- tinymce <removed>
NOTE:
https://github.com/tinymce/tinymce/security/advisories/GHSA-v98h-vmpc-fpqv
@@ -152958,7 +152963,7 @@ CVE-2026-41455 (WeKan before8.35 contains a
server-side request forgery vulnerab
CVE-2026-41454 (WeKan before8.35 contains a missing authorization
vulnerability in the ...)
- wekan <itp> (bug #819238)
CVE-2026-41314 (pypdf is a free and open-source pure-python PDF library. An
attacker w ...)
- - pypdf <unfixed> (bug #1134738)
+ - pypdf 6.19.0-1 (bug #1134738)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -152968,7 +152973,7 @@ CVE-2026-41314 (pypdf is a free and open-source
pure-python PDF library. An atta
NOTE: https://github.com/py-pdf/pypdf/pull/3734
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/ac734dab4eef92bcce50d503949b4d9887d89f11
(6.10.2)
CVE-2026-41313 (pypdf is a free and open-source pure-python PDF library. An
attacker w ...)
- - pypdf <unfixed> (bug #1134737)
+ - pypdf 6.19.0-1 (bug #1134737)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -152978,7 +152983,7 @@ CVE-2026-41313 (pypdf is a free and open-source
pure-python PDF library. An atta
NOTE: https://github.com/py-pdf/pypdf/pull/3735
NOTE: Fixed by:
https://github.com/py-pdf/pypdf/commit/c50a0104cf083356f7c7f5d61410466a57f5c88a
(6.10.2)
CVE-2026-41312 (pypdf is a free and open-source pure-python PDF library. An
attacker w ...)
- - pypdf <unfixed> (bug #1134736)
+ - pypdf 6.19.0-1 (bug #1134736)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -153048,7 +153053,7 @@ CVE-2026-41171 (Squidex is an open source headless
content management system and
CVE-2026-41170 (Squidex is an open source headless content management system
and conte ...)
NOT-FOR-US: Squidex
CVE-2026-41168 (pypdf is a free and open-source pure-python PDF library. An
attacker w ...)
- - pypdf <unfixed> (bug #1134733)
+ - pypdf 6.19.0-1 (bug #1134733)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
@@ -156562,7 +156567,7 @@ CVE-2026-40263 (Note Mark is an open-source
note-taking application. In versions
CVE-2026-40262 (Note Mark is an open-source note-taking application. In
versions 0.19. ...)
NOT-FOR-US: Note Mark
CVE-2026-40260 (pypdf is a free and open-source pure-python PDF library. In
versions p ...)
- - pypdf <unfixed> (bug #1134731)
+ - pypdf 6.19.0-1 (bug #1134731)
[trixie] - pypdf <no-dsa> (Minor issue)
[bookworm] - pypdf <no-dsa> (Minor issue)
- pypdf2 <removed>
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f7aa2de10e2434354224da76378d2e382a20158c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f7aa2de10e2434354224da76378d2e382a20158c
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
