Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2bc0fe82 by Moritz Muehlenhoff at 2026-10-01T09:21:46+02:00
auto-nfu: Update wikimedia rule
- - - - -
2 changed files:
- data/CVE/list
- data/packages/nfu.yaml
Changes:
=====================================
data/CVE/list
=====================================
@@ -1055,7 +1055,7 @@ CVE-2026-103445 (Improper neutralization of
Script-Related HTML tags in a web pa
CVE-2026-103444 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103443 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103442 (External control of system or configuration setting
vulnerability in T ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103441 (Deserialization of untrusted data vulnerability in The
Wikimedia Found ...)
@@ -1063,11 +1063,11 @@ CVE-2026-103441 (Deserialization of untrusted data
vulnerability in The Wikimedi
CVE-2026-103440 (Exposure of sensitive information through data queries
vulnerability i ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103439 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103438 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103437 (Improper neutralization of Script-Related HTML tags in a web
page (bas ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103436 (apcupsd through 3.14.14 discloses uninitialized stack memory
in getups ...)
- apcupsd <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2493140
@@ -1584,21 +1584,21 @@ CVE-2026-103054 (AiSOC versions before 12.0.0 contain
an authorization bypass vu
CVE-2026-103053 (AiSOC versions 9.0.0 before 12.0.0 fail to enforce
authentication on t ...)
NOT-FOR-US: AiSOC
CVE-2026-103051 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103050 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103049 (Improper neutralization of input during web page generation
('cross-si ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103048 (URL redirection to untrusted site ('open redirect')
vulnerability in T ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103047 (Improper neutralization of input during web page generation
('cross-si ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103046 (Improper neutralization of input during web page generation
('cross-si ...)
NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103045 (Improper neutralization of input during web page generation
('cross-si ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103044 (XML injection (aka blind XPath injection) vulnerability in
The Wikimed ...)
- TODO: check
+ NOT-FOR-US: MediaWiki extensions/skins not packaged in Debian
CVE-2026-103043 (anchorme through 3.0.8 contains a regular expression denial
of service ...)
NOT-FOR-US: anchorme Node.js module
CVE-2026-103042 (LightLLM through 1.2.0 contains a memory exhaustion
vulnerability in t ...)
=====================================
data/packages/nfu.yaml
=====================================
@@ -968,11 +968,14 @@
- product: '.*CampaignEvents.*'
- product: '.*Cargo.*'
- product: '.*CentralAuth.*'
+ - product: '.*CentralNotice.*'
- product: '.*Charts.*'
- product: '.*CheckUser.*'
- product: '.*CirrusSearch.*'
+ - product: '.*Collection.*'
- product: '.*CookieConsent.*'
- product: '.*DataTransfer.*'
+ - product: '.*EasyTimeline.*'
- product: '.*EventBus.*'
- product: '.*ExternalData.*'
- product: '.*ExternalGuidance.*'
@@ -984,6 +987,7 @@
- product: '.*LanguageSelector.*'
- product: '.*LastModified.*'
- product: '.*Lockdown.*'
+ - product: '.*MassMessage.*'
- product: '.*Monaco.*'
- product: '.*OAuth.*'
- product: '.*PageForms.*'
@@ -991,6 +995,8 @@
- product: '.*PageTriage.*'
- product: '.*ProofreadPage.*'
- product: '.*RedirectManager.*'
+ - product: '.*ReadingLists.*'
+ - product: '.*Refreshed.*'
- product: '.*ReportIncident.*'
- product: '.*Score.*'
- product: '.*TemplateSandbox.*'
@@ -1009,7 +1015,6 @@
- product: '.*Wikilove.*'
- product: '.*Wikistories.*'
- product: Wikipedia Android App
- - product: timeline
# Description based rules
- reason: Advantech
description: '.*\bAdvantech\b.*'
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2bc0fe82958dc895e4a853f6dd5b5091fba7286b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2bc0fe82958dc895e4a853f6dd5b5091fba7286b
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
