Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
fa4cbb93 by Salvatore Bonaccorso at 2026-10-02T17:03:51+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -630,15 +630,15 @@ CVE-2026-103687 (A vulnerability has been found in
rhukster dom-sanitizer up to
CVE-2026-103686 (A flaw has been found in rhukster dom-sanitizer up to 1.0.15.
Impacted ...)
NOT-FOR-US: DOMSanitizer
CVE-2026-103680 (A flaw was found in tnef. A heap-based buffer overflow can
occur in th ...)
- - tnef <unfixed> (unimportant)
+ - tnef <unfixed> (unimportant; bug #1149710)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544478
NOTE: Crash in CLI tool, no security impact (mitigated by toolchain
hardening)
CVE-2026-103679 (A flaw was found in tnef. A remote attacker could exploit
this vulnera ...)
- - tnef <unfixed> (unimportant)
+ - tnef <unfixed> (unimportant; bug #1149710)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544477
NOTE: Crash in CLI tool, no security impact
CVE-2026-103678 (A flaw was found in tnef. An attacker can exploit this
vulnerability b ...)
- - tnef <unfixed> (unimportant)
+ - tnef <unfixed> (unimportant; bug #1149710)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2544476
NOTE: Crash in CLI tool, no security impact
CVE-2026-103664 (MISP contains a reflected cross-site scripting (XSS)
vulnerability in ...)
@@ -676,7 +676,7 @@ CVE-2026-103489 (In JetBrains YouTrack before 2026.2.19422
hTML injection in VCS
CVE-2026-103488 (In JetBrains YouTrack before 2026.2.19422 missing
authorisation allowe ...)
NOT-FOR-US: JetBrains
CVE-2026-103431 (colmux in collectl before 4.3.20.2 does not sanitize
ANSI/VT100 termin ...)
- - collectl <unfixed>
+ - collectl <unfixed> (bug #1149711)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2543974
CVE-2026-103353 (Incorrect Behavior Order vulnerability in WP ManageNinja LLC
FluentFor ...)
NOT-FOR-US: WordPress plugin or theme
@@ -753,15 +753,15 @@ CVE-2026-103265 (Fleet versions before 4.89.0 fail to
properly filter MDM comman
CVE-2026-103264 (Fleet versions before 4.87.0 contain an authentication bypass
vulnerab ...)
NOT-FOR-US: Fleet
CVE-2026-103263 (Tornado before 6.5.9 contains a path traversal vulnerability
in Static ...)
- - python-tornado <unfixed>
+ - python-tornado <unfixed> (bug #1149712)
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-c2m8-h5v5-343r
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/437ab5f76565403b3403438d2e555d11f8128d32
(v6.5.9)
CVE-2026-103262 (Tornado versions before 6.5.9 contain an unbounded memory
accumulation ...)
- - python-tornado <unfixed>
+ - python-tornado <unfixed> (bug #1149712)
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-chx6-46f5-w4vp
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/e412435febba4569c552c5c9054f1bf92bd171a9
(v6.5.9)
CVE-2026-103261 (Tornado before 6.5.9 fails to limit the number of query
string fields ...)
- - python-tornado <unfixed>
+ - python-tornado <unfixed> (bug #1149712)
NOTE:
https://github.com/tornadoweb/tornado/security/advisories/GHSA-3hv7-mjh2-fv65
NOTE: Fixed by:
https://github.com/tornadoweb/tornado/commit/03945136ea9746eccf61caf88edae39642e59c93
(v6.5.9)
CVE-2026-103260 (n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain
an approva ...)
@@ -5506,7 +5506,7 @@ CVE-2026-18413 (The ADC API requires each driver to
reject a sampling sequence w
CVE-2026-16513 (The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles()
in subsys ...)
NOT-FOR-US: Zephyr, different from src:zephyr
CVE-2026-102422 (shell-quote's `quote()` function emits a `{ comment }` token
as `#` fo ...)
- - node-shell-quote <unfixed>
+ - node-shell-quote <unfixed> (bug #1149713)
NOTE:
https://github.com/ljharb/shell-quote/security/advisories/GHSA-pqg4-j6r4-53mv
NOTE: Fixed by:
https://github.com/ljharb/shell-quote/commit/6002b2ed90c6b83095eb272b6b0adaf3a172b0bc
(v1.11.0)
CVE-2026-102414 (pbkdf2 through 3.1.6 re-hashes passwords longer than the
digest's bloc ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fa4cbb9334a73b2e4fa7977a5b0c182cba7ae206
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fa4cbb9334a73b2e4fa7977a5b0c182cba7ae206
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
