Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3575493b by Salvatore Bonaccorso at 2026-10-07T10:58:10+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -194,7 +194,7 @@ CVE-2026-43598 (Improper input validation in the AMD ROCm
Communication Collecti
- rccl <unfixed>
NOTE:
https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-6033.html
CVE-2026-19572 (A security vulnerability has been identified in FlexNet
Publisher lmad ...)
- TODO: check
+ NOT-FOR-US: FlexNet Publisher
CVE-2026-19396 (A predictable seed in the pseudo-random number generator
(PRNG) in the ...)
NOT-FOR-US: ASUS
CVE-2026-19386 (A stack-based buffer overflow in the ASUS router modules
allows an aut ...)
@@ -243,7 +243,7 @@ CVE-2026-106552 (In sftp in OpenSSH before 10.6, a server
can trigger directory
- openssh 1:10.6p1-1
NOTE: https://www.openssh.org/releasenotes.html#10.6
CVE-2026-106550 (Mozilla's Node-convict (version 6.2.2 and later) is
vulnerable to a De ...)
- TODO: check
+ NOT-FOR-US: Node convict
CVE-2026-106547 (A heap-based buffer overflow in H5VM_array_fill() in
src/H5VM.c in HDF ...)
- hdf5 <unfixed> (unimportant)
NOTE: https://github.com/HDFGroup/hdf5/pull/6529
@@ -295,7 +295,7 @@ CVE-2026-106487 (Backstage is an open framework for
building developer portals.
CVE-2026-106486 (Backstage is an open framework for building developer
portals. Prior t ...)
NOT-FOR-US: Backstage
CVE-2026-106471 (A flaw was found in Candlepin. The central authorization
filter incorr ...)
- TODO: check
+ NOT-FOR-US: Candlepin
CVE-2026-106463 (Backstage is an open framework for building developer
portals. Prior t ...)
NOT-FOR-US: Backstage
CVE-2026-106462 (Backstage is an open framework for building developer
portals. Prior t ...)
@@ -340,9 +340,9 @@ CVE-2026-106449 (yawkat LZ4 Java provides LZ4 compression
for Java. Prior to 1.1
NOTE:
https://github.com/yawkat/lz4-java/security/advisories/GHSA-343h-94h5-c4wr
NOTE: Fixed by:
https://github.com/yawkat/lz4-java/commit/c8ebf97d504fb34434fda46fc761e8202570e0d8
(v1.11.4)
CVE-2026-106448 (StableLib is a stable library of useful TypeScript and
JavaScript code ...)
- TODO: check
+ NOT-FOR-US: StableLib
CVE-2026-106447 (StableLib is a stable library of useful TypeScript and
JavaScript code ...)
- TODO: check
+ NOT-FOR-US: StableLib
CVE-2026-106446 (Handlebars provides the power necessary to let users build
semantic te ...)
- node-handlebars <unfixed>
NOTE:
https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-8r5x-fm3f-whwj
@@ -466,11 +466,11 @@ CVE-2026-104045 (A flaw was found in SSSD. A local user
can trigger a Denial of
- sssd <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2478663
CVE-2026-103870 (A flaw was found in pulp-rpm when it publishes a distribution
tree. Ad ...)
- TODO: check
+ NOT-FOR-US: Pulp (Red Hat)
CVE-2026-103869 (A flaw was found in pulp-ansible's bearer-token refresh for
collection ...)
- TODO: check
+ NOT-FOR-US: Pulp (Red Hat)
CVE-2026-103868 (A flaw was found in pulp-container when it authenticates to
an upstrea ...)
- TODO: check
+ NOT-FOR-US: Pulp (Red Hat)
CVE-2026-103681 (The Frontend Dashboard WordPress plugin before 3.0.0 does not
perform ...)
NOT-FOR-US: WordPress plugin
CVE-2026-103670 (When a Gitea Actions run was inserted, older runs in the same
workflow ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3575493b9a1a30fcf9d214e511229922c4c78849
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3575493b9a1a30fcf9d214e511229922c4c78849
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
