Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1a78aea8 by Salvatore Bonaccorso at 2026-10-02T09:32:47+02:00
Add Debian bug reference sfor various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1571,25 +1571,25 @@ CVE-2026-92899 (Apache WSS4J remembers the Nonce of
each UsernameToken it accept
- wss4j <unfixed>
NOTE:
https://lists.apache.org/thread.html/nrzngsz1xm2lztq3t873663xx9wnrwm7
CVE-2026-92873 (Pgpool-II contains an incorrect implementation of an
authentication al ...)
- - pgpool2 <unfixed>
+ - pgpool2 <unfixed> (bug #1149670)
NOTE: https://pgpool.net/news/2026-09-29/
CVE-2026-92872 (Pgpool-II inserts sensitive information into log file, which
may allow ...)
- - pgpool2 <unfixed>
+ - pgpool2 <unfixed> (bug #1149670)
NOTE: https://pgpool.net/news/2026-09-29/
CVE-2026-92871 (A NULL pointer dereference vulnerability exists in Pgpool-II,
which ma ...)
- - pgpool2 <unfixed>
+ - pgpool2 <unfixed> (bug #1149670)
NOTE: https://pgpool.net/news/2026-09-29/
CVE-2026-92870 (A stack-based buffer overflow vulnerability exists in
Pgpool-II, which ...)
- - pgpool2 <unfixed>
+ - pgpool2 <unfixed> (bug #1149670)
NOTE: https://pgpool.net/news/2026-09-29/
CVE-2026-92869 (An out-of-bounds write vulnerability exists in Pgpool-II,
which may al ...)
- - pgpool2 <unfixed>
+ - pgpool2 <unfixed> (bug #1149670)
NOTE: https://pgpool.net/news/2026-09-29/
CVE-2026-92868 (An improper certificate validation vulnerability exists in
Pgpool-II, ...)
- - pgpool2 <unfixed>
+ - pgpool2 <unfixed> (bug #1149670)
NOTE: https://pgpool.net/news/2026-09-29/
CVE-2026-92867 (An out-of-bounds write vulnerability exists in Pgpool-II ,
which may a ...)
- - pgpool2 <unfixed>
+ - pgpool2 <unfixed> (bug #1149670)
NOTE: https://pgpool.net/news/2026-09-29/
CVE-2026-92712 (The ReactPress \u2013 Create React App for WordPress plugin
for WordPr ...)
NOT-FOR-US: WordPress plugin
@@ -3783,7 +3783,7 @@ CVE-2026-75824 (The User Frontend WordPress plugin
before 4.3.12 does not check
CVE-2026-75823 (The User Frontend WordPress plugin before 4.3.12 does not
prevent tam ...)
NOT-FOR-US: WordPress plugin
CVE-2026-74225 (U-Boot before 2026.10-rc5 contains out-of-bounds memory access
in dhcp ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Introduced with:
https://github.com/u-boot/u-boot/commit/a0245818f7f8e375abc00f36ff88326331e4e2f9
(v2023.07-rc2)
NOTE: Fixed by:
https://github.com/u-boot/u-boot/commit/20209a62bc8565fc1e040882bc03c71ff0d73076
(v2026.10-rc5)
@@ -3792,12 +3792,12 @@ CVE-2026-74222 (U-Boot before 2026.10-rc5 contains a
use-after-free vulnerabilit
NOTE: Introduced with:
https://github.com/u-boot/u-boot/commit/e40c910e88a9a38ee1335ab1391dc2ee83993a65
(v2025.07-rc3)
NOTE: Fixed by:
https://github.com/u-boot/u-boot/commit/2d94618a58aeb7630f18eee33419ce48d0fd3616
(v2026.10-rc5)
CVE-2026-74221 (U-Boot before 2026.10-rc5 contains a buffer overflow in
nfs_readlink_r ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Introduced with:
https://github.com/u-boot/u-boot/commit/cf3a4f1e86ecdd24f87b615051b49d8e1968c230
(v2019.10-rc4)
NOTE: Fixed by:
https://github.com/u-boot/u-boot/commit/1c0aff3a5fbfeee7a8948f624e0b8554e6e0d8fd
(v2026.10-rc5)
CVE-2026-74220 (U-Boot before 2026.10-rc5 contains a buffer overflow in
nfs_read_reply ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Introduced with:
https://github.com/u-boot/u-boot/commit/aa207cf3a6d68f39d64cd29057a4fb63943e9078
(v2019.10-rc4)
NOTE: Fixed by:
https://github.com/u-boot/u-boot/commit/0bbf09859658b8cc9ac13be41af23b516b8ef69a
(v2026.10-rc5)
@@ -3810,16 +3810,16 @@ CVE-2026-71974 (U-Boot before 2026.10-rc3 contains an
out-of-bounds write vulner
NOTE: Introduced with:
https://github.com/u-boot/u-boot/commit/abadcda24b100b8eb0f138085cca6595518cec85
(v2025.04-rc1)
NOTE: Fixed by:
https://github.com/u-boot/u-boot/commit/35432ef6fe2c79ab72709966e64815a45eb55c76
(v2026.10-rc3)
CVE-2026-71973 (U-Boot before 2026.10-rc4 contains an integer overflow
vulnerability i ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Introduced with:
https://github.com/u-boot/u-boot/commit/c51006130370b48b7eb5a93ada745385aa27f6bf
(v2020.10-rc2)
NOTE: Fixed by:
https://github.com/u-boot/u-boot/commit/561ae28cb56a082cfa90c1c421c4955bc215470b
(v2026.10-rc4)
CVE-2026-71972 (U-Boot through 2026.10-rc5 contains an out-of-bounds write
vulnerabili ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Fixed by:
https://github.com/u-boot/u-boot/commit/5201e83342d64c2f438ea35158575f28225e752e
CVE-2026-71971 (U-Boot before 2026.10-rc3 with CONFIG_IP_DEFRAG enabled
contains an ou ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Fixed by:
https://github.com/u-boot/u-boot/commit/04ca915d5bf39dda5d1bce62d04d2b59d293c5b9
(v2026.10-rc3)
CVE-2026-71379 (The file export endpoint allows any unauthenticated attacker
to export ...)
@@ -4369,7 +4369,7 @@ CVE-2026-19547 (Ghostscript for Windows is vulnerable to
local privilege escalat
- ghostscript <not-affected> (Only affects Ghostscript on Windows)
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=709522
CVE-2026-15390 (Das U-Bootwith CONFIG_IP_DEFRAG=y parameter fails to clear IP
reassemb ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1149671)
[trixie] - u-boot <no-dsa> (Minor issue)
NOTE: Fixed by:
https://source.denx.de/u-boot/u-boot/-/commit/b1aec609bb5e0d08c25c888c91935287ab4ee5fa
(v2026.07)
CVE-2026-12345 (The cleanup of tempfile.TemporaryDirectory is vulnerable to a
race con ...)
@@ -6379,7 +6379,7 @@ CVE-2026-96543
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/work_items/16326
NOTE: Duplicate of https://gitlab.gnome.org/GNOME/gimp/-/issues/16314
CVE-2026-96544
- - gimp <unfixed>
+ - gimp <unfixed> (bug #1149674)
[trixie] - gimp <not-affected> (Vulnerable code not present)
[bookworm] - gimp <not-affected> (Vulnerable code not present)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2539572
@@ -6393,7 +6393,7 @@ CVE-2026-62439
NOTE: https://gitlab.gnome.org/GNOME/gimp/-/issues/16314
NOTE: Fixed by:
https://gitlab.gnome.org/GNOME/gimp/-/commit/4427b9f31552060aafa5b03caee6ffdd6c257c8b
(GIMP_3_2_6)
CVE-2026-95622
- - modemmanager <unfixed>
+ - modemmanager <unfixed> (bug #1149673)
[trixie] - modemmanager <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2540006
CVE-2026-91182
@@ -6755,7 +6755,7 @@ CVE-2026-XXXX [TROVE-2026-053]
NOTE: https://gitlab.torproject.org/tpo/core/tor/-/work_items/41368
NOTE:
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.9/ChangeLog
CVE-2026-95510 [use of uninitialized struct sigaction]
- - inetutils <unfixed>
+ - inetutils <unfixed> (bug #1149672)
[trixie] - inetutils <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/09/26/1
NOTE: Introduced with:
https://codeberg.org/inetutils/inetutils/commit/9476515fd31e416739d850c1948e9222a53deea9
(inetutils-1_9)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1a78aea8e9fdb4cc809cf6bcc24025c4cb176164
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1a78aea8e9fdb4cc809cf6bcc24025c4cb176164
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
