Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
177d007c by Salvatore Bonaccorso at 2026-10-09T21:39:39+02:00
Update status for some golang-gvisor-gvisor issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -15590,7 +15590,8 @@ CVE-2026-96883 (pgcollection is an open source
extension to PostgreSQL. A type c
CVE-2026-96874 (Improper neutralization of input during web page generation
('cross-si ...)
NOT-FOR-US: X-SpringBoot
CVE-2026-96812 (Improper Exposure of Resource to Wrong Sphere in the host file
helper ...)
- NOT-FOR-US: Google gVisor
+ - golang-gvisor-gvisor <unfixed>
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/573a9e73cf844f9196cbdf776d6a98836b5c0f5c
(release-20260824.0)
CVE-2026-96766 (The GeoDirectory \u2013 WP Business Directory Plugin and
Classified Li ...)
NOT-FOR-US: WordPress plugin
CVE-2026-96752 (The Zero Spam for WordPress plugin for WordPress is vulnerable
to Stor ...)
@@ -336080,11 +336081,17 @@ CVE-2024-10847 (The Storely theme for WordPress is
vulnerable to Stored Cross-Si
CVE-2024-10604 (Vulnerabilities in the algorithms used by Fuchsia to populate
network ...)
NOT-FOR-US: Fuchsia
CVE-2024-10603 (Weaknesses in the generation of TCP/UDP source ports and some
other he ...)
- NOT-FOR-US: gVisor
+ - golang-gvisor-gvisor 0.0~20240729.0-1
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/83f75082e5b03fafca9201d9d9939028f712b0b2
(release-20231030.0)
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/cbdb2c61b1f753834cedf2ebe68cbc335dadca52
(release-20231113.0)
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/5d2bf2546805afa09a6f6d9b23ec267823e32205
(release-20231113.0)
CVE-2024-10591 (The MWB HubSpot for WooCommerce \u2013 CRM, Abandoned Cart,
Email Mark ...)
NOT-FOR-US: WordPress plugin
CVE-2024-10026 (A weak hashing algorithm and small sizes of seeds/secrets in
Google's ...)
- NOT-FOR-US: gVisor
+ - golang-gvisor-gvisor 0.0~20240729.0-1
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/f956b5ac17ae1f60a4d21999b59ba18c55f86d56
(release-20231204.0)
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/e54bfde79278cafadedbf73c68ee10cb5982f2af
(release-20231204.0)
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/83f75082e5b03fafca9201d9d9939028f712b0b2
(release-20231030.0)
CVE-2025-24884 (kube-audit-rest is a simple logger of mutation/creation
requests to th ...)
NOT-FOR-US: kube-audit-rest
CVE-2025-24795 (The Snowflake Connector for Python provides an interface for
developin ...)
@@ -795191,7 +795198,8 @@ CVE-2018-20169 (An issue was discovered in the Linux
kernel before 4.19.9. The U
[stretch] - linux 4.9.161-1
NOTE:
https://git.kernel.org/linus/704620afc70cf47abb9d6a1a57f3825d2bca49cf
CVE-2018-20168 (Google gVisor before 2018-08-22 reuses a pagetable in a
different leve ...)
- NOT-FOR-US: gVisor
+ - golang-gvisor-gvisor <not-affected> (Fixed before initial upload to
Debian)
+ NOTE: https://project-zero.issues.chromium.org/issues/42450740
CVE-2018-20166 (A file-upload vulnerability exists in Rukovoditel 2.3.1.
index.php?mod ...)
NOT-FOR-US: Rukovoditel
CVE-2017-18355 (Installed packages are exposed by node_modules in Rendertron
1.0.0, al ...)
@@ -804392,7 +804400,8 @@ CVE-2018-19335 (Google Monorail before 2018-06-07 has
a Cross-Site Search (XS-Se
CVE-2018-19334 (Google Monorail before 2018-05-04 has a Cross-Site Search
(XS-Search) ...)
NOT-FOR-US: Google Monorail
CVE-2018-19333 (pkg/sentry/kernel/shm/shm.go in Google gVisor before
2018-11-01 allows ...)
- NOT-FOR-US: gVisor
+ - golang-gvisor-gvisor <not-affected> (Fixed before initial upload to
Debian)
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/0e277a39c8b6f905e289b75e8ad0594e6b3562ca
(release-20190304.1)
CVE-2018-19332 (An issue was discovered in S-CMS v1.5. There is a CSRF
vulnerability t ...)
NOT-FOR-US: S-CMS
CVE-2018-19331 (An issue was discovered in S-CMS v1.5. There is a SQL
injection vulner ...)
@@ -812793,7 +812802,9 @@ CVE-2018-16361 (An issue was discovered in BTITeam
XBTIT 2.5.4. news.php allows
CVE-2018-16360
RESERVED
CVE-2018-16359 (Google gVisor before 2018-08-23, within the seccomp sandbox,
permits a ...)
- NOT-FOR-US: gVisor
+ - golang-gvisor-gvisor <not-affected> (Fixed before initial upload to
Debian)
+ NOTE: https://project-zero.issues.chromium.org/issues/42450695
+ NOTE: Fixed by:
https://github.com/google/gvisor/commit/001a4c2493b13a43d62c7511fb509a959ae4abc2
(release-20190304.1)
CVE-2018-16358 (A cross-site scripting (XSS) vulnerability in
inc/core/class.dc.core.p ...)
- dotclear <removed>
CVE-2018-16357 (An issue was discovered in PbootCMS. There is a SQL injection
via the ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/177d007c1e2946c8467a9f9ed6f461848af60820
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/177d007c1e2946c8467a9f9ed6f461848af60820
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
