Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
21fa43b6 by Salvatore Bonaccorso at 2026-10-07T09:48:56+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -45,7 +45,7 @@ CVE-2026-95106 (Gitea accepted pushed Git trees containing
two entries with the
CVE-2026-94205 (Gitea Actions decided whether a fork pull request run needed
approval ...)
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-94114 (Symbolic name not mapping to correct object vulnerability in
Apache Co ...)
- - bcel <unfixed>
+ - bcel <unfixed> (bug #1150215)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/07/12
NOTE:
https://github.com/apache/commons-bcel/commit/14890bf2b9014df25f9b4de86f29b5e917e5656b
(commons-bcel-6.13.0-RC1)
NOTE: https://lists.apache.org/thread/d87nxx7nb5bombqggxhxo9lz16nwtsf9
@@ -522,85 +522,85 @@ CVE-2026-101027 (When `[migrations] ALLOWED_DOMAINS` was
configured, a hostname
CVE-2026-101023 (Gitea's OAuth2 token endpoint verified the signature and
grant of a to ...)
NOT-FOR-US: Gitea (used to be packaged in the Debian archive as
src:gitea, but never in a stable release)
CVE-2026-88812 [XKB SetGeometry TextDoodad Double Free]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/c724006ee76fb002add50fcb4d97e8c96c279f09
(xorg-server-21.1.25)
CVE-2026-93515 [Present Extension Cross-Window Notify Use-After-Free]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/a469f98bcfab50dab607ff5ac24037632b0079a3
(xorg-server-21.1.25)
CVE-2026-93516 [XInput Passive Grab modifierDevice Use-After-Free]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/9442a53c137bb9eb61336c6fd39627912d50cc8d
(xorg-server-21.1.25)
CVE-2026-93517 [GLX RenderLarge Heap Buffer Overflow]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/3961cdca467975a7d377f1f7bcd55d52eb3f417a
(xorg-server-21.1.25)
CVE-2026-93518 [XKB ResizeKeyType Numeric Truncation]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/558ba8f784b0f5d4d96948051b2f04c983af20cc
(xorg-server-21.1.25)
CVE-2026-93519 [XFixes Pointer Barrier Event List Buffer Overflow]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/9c3880d0745acefc98ed37e79498dfbe558a0f40
(xorg-server-21.1.25)
CVE-2026-93520 [XKB ChangeKeycodeRange Heap Out-of-Bounds Write]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/5ec0535af2bcc93381666dc110abebba8975f8ae
(xorg-server-21.1.25)
CVE-2026-93521 [RandR ChangeProviderProperty Heap Buffer Overflow]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/00ce692c7f6ea1900888a2a24aecf6cba5544ae1
(xorg-server-21.1.25)
CVE-2026-93522 [Glamor CopyArea CPU-FBO Heap Buffer Overflow]
- xorg-server <not-affected> (Vulnerable code not present)
- - xwayland <unfixed>
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/d6deb27b655abae79396bf3aedc2937a10ae2d4f
(xwayland-24.1.14)
CVE-2026-93523 [XInput2 PassiveUngrabDevice Modifier Out-of-Bounds Write]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/aa56160fa213d8767e7da0c076b5c8242703313b
(xorg-server-21.1.25)
CVE-2026-93524 [XKB SetMap Key Width/Action Count Desync Out-Of-Bounds Read]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
NOTE: Fixed by:
https://gitlab.freedesktop.org/xorg/xserver/-/commit/927ee1282d21550807619521bee909ef62ed0571
(xorg-server-21.1.25)
CVE-2026-93536 [GestureBuildSprite Use-After-Free]
- - xorg-server <unfixed>
- - xwayland <unfixed>
+ - xorg-server <unfixed> (bug #1150214)
+ - xwayland <unfixed> (bug #1150213)
[trixie] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
[bookworm] - xwayland <ignored> (Minor issue; Xwayland shouldn't be
running as root)
NOTE:
https://lists.x.org/archives/xorg-announce/2026-October/003747.html
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/21fa43b6257cb51a1f57ed1f5b205ace23666387
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/21fa43b6257cb51a1f57ed1f5b205ace23666387
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
