Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b6ee9e70 by Salvatore Bonaccorso at 2026-10-09T22:31:24+02:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -985,7 +985,7 @@ CVE-2026-107780 (Dromara Skyeye through commit
003549ae5615bd114ba5bb8ddf6a8e8ea
CVE-2026-107779 (Dromara Skyeye through commit
003549ae5615bd114ba5bb8ddf6a8e8ead97c321 ...)
NOT-FOR-US: Dromara Skyeye
CVE-2026-107778 (MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer
dereferen ...)
- - krb5 <unfixed>
+ - krb5 <unfixed> (bug #1150461)
NOTE: https://github.com/krb5/krb5/pull/1511
NOTE: Fixed by:
https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08
(master)
NOTE: Fixed by:
https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a
(krb5-1.22 branch)
@@ -1051,7 +1051,7 @@ CVE-2026-107714 (The Mechanize library is used for
automating interaction with w
CVE-2026-107709 (A path traversal vulnerability exists in Bower decompress-zip
through ...)
NOT-FOR-US: Bower decompress-zip
CVE-2026-107708 (MIT krb5 through 1.22.2 contains a NULL pointer dereference
vulnerabil ...)
- - krb5 <unfixed>
+ - krb5 <unfixed> (bug #1150461)
NOTE: https://github.com/krb5/krb5/pull/1510
NOTE: Fixed by:
https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7
(master)
NOTE: Fixed by:
https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d
(krb5-1.22 branch)
@@ -1127,7 +1127,7 @@ CVE-2026-107660 (FFmpeg before 8.1.3 and 9.x before 9.0.2
contains an improper c
NOTE: Fixed by:
https://code.ffmpeg.org/FFmpeg/FFmpeg/commit/0cd2a70eacd510c2efed48b9fc177c7cb2bc549f
(n8.1.3)
NOTE: mbedtls not enabled in Debian builds
CVE-2026-107651 (A flaw was found in Eye of GNOME (eog). A heap-based buffer
overflow e ...)
- - eog <unfixed>
+ - eog <unfixed> (bug #1150455)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547986
NOTE: https://gitlab.gnome.org/GNOME/eog/-/issues/342
CVE-2026-107640 (Integrics Enswitch 3.13 through 4.4 contains an
authentication bypass ...)
@@ -1141,10 +1141,10 @@ CVE-2026-107637 (pH7Builder (pH7 Social Dating CMS)
before 18.5.0 contains an im
CVE-2026-107636 (pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a
payment va ...)
NOT-FOR-US: pH7Builder (pH7 Social Dating CMS)
CVE-2026-107635 (Dislocker through 0.7.3 contains an integer underflow
vulnerability in ...)
- - dislocker <unfixed>
+ - dislocker <unfixed> (bug #1150456)
NOTE: Fixed by:
https://github.com/Aorimn/dislocker/commit/0706462db88efe8df88150e4c3e4332b808f4581
CVE-2026-107634 (Dislocker through 0.7.3 contains a heap out-of-bounds read
vulnerabili ...)
- - dislocker <unfixed>
+ - dislocker <unfixed> (bug #1150456)
NOTE: Fixed by:
https://github.com/Aorimn/dislocker/commit/9158e9e41dd669b360cbc53cc18ccae729b67b48
CVE-2026-107623 (A flaw was found in the OIDC Dynamic Client Registration
(DCR) compone ...)
- keycloak <itp> (bug #1088287)
@@ -1283,11 +1283,11 @@ CVE-2026-107333 (Malcolm's nginx based reverse proxy
contains a URL path normali
CVE-2026-107332 (Insecure file permissions in the CodeCatalyst connection
handler in AW ...)
NOT-FOR-US: Amazon
CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go
Driver ca ...)
- - golang-mongodb-mongo-driver <unfixed>
+ - golang-mongodb-mongo-driver <unfixed> (bug #1150459)
NOTE: https://jira.mongodb.org/browse/GODRIVER-4136
NOTE: Fixed by:
https://github.com/mongodb/mongo-go-driver/commit/a0973940ec32f31e406ca4a5d7db03288bb628dc
(v2.9.2)
CVE-2026-107324 (An integer overflow in BSON value-length handling in the
MongoDB Go Dr ...)
- - golang-mongodb-mongo-driver <unfixed>
+ - golang-mongodb-mongo-driver <unfixed> (bug #1150459)
NOTE: https://jira.mongodb.org/browse/GODRIVER-4102
NOTE: Fixed by:
https://github.com/mongodb/mongo-go-driver/commit/6e5eff3ea7bc5b6743f9fcec6bb8d523b0c98bbc
(v2.9.2)
CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent
Plugins for AW ...)
@@ -1355,7 +1355,7 @@ CVE-2026-106436 (The BSON encoder in the MongoDB PHP
Driver does not check some
NOTE: https://jira.mongodb.org/browse/PHPC-2739
NOTE: Fixed by:
https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260
(2.5.4, 2.1.11, 1.21.11)
CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read
outside a buff ...)
- - pymongo <unfixed>
+ - pymongo <unfixed> (bug #1150462)
[trixie] - pymongo <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PYTHON-6110
NOTE: Fixed by:
https://github.com/mongodb/mongo-python-driver/commit/bb8d4e195275e75bd94ebeffb53cc747d357fcf4
(4.18.3)
@@ -2352,19 +2352,19 @@ CVE-2026-107175 (MISP contains a defect in its event
save workflow that prevents
CVE-2026-107174 (A flaw was found in source-to-image. When unpacking archive
files, the ...)
NOT-FOR-US: source-to-image in OpenShift
CVE-2026-107170 (A flaw was found in m17n-lib. A partial failure during
library initial ...)
- - m17n-lib <unfixed>
+ - m17n-lib <unfixed> (bug #1150458)
[trixie] - m17n-lib <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547411
CVE-2026-107169 (A flaw was found in m17n-lib. An attacker could provide
specially craf ...)
- - m17n-lib <unfixed>
+ - m17n-lib <unfixed> (bug #1150458)
[trixie] - m17n-lib <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547410
CVE-2026-107168 (A flaw was found in m17n-lib. By providing crafted input
containing an ...)
- - m17n-lib <unfixed>
+ - m17n-lib <unfixed> (bug #1150458)
[trixie] - m17n-lib <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547409
CVE-2026-107167 (A flaw was found in m17n-lib. A user providing specially
crafted text ...)
- - m17n-lib <unfixed>
+ - m17n-lib <unfixed> (bug #1150458)
[trixie] - m17n-lib <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2547408
CVE-2026-107166 (A weakness has been identified in Open5GS up to 2.7.7. This
vulnerabil ...)
@@ -2372,7 +2372,7 @@ CVE-2026-107166 (A weakness has been identified in
Open5GS up to 2.7.7. This vul
CVE-2026-107162 (Express Gateway through 1.16.11 contains an authentication
bypass vuln ...)
NOT-FOR-US: Express Gateway
CVE-2026-107159 (MiniUPnPd through 2.3.11 built with --strict contains a
divide-by-zero ...)
- - miniupnpd <unfixed>
+ - miniupnpd <unfixed> (bug #1150457)
NOTE: Fixed by:
https://github.com/miniupnp/miniupnp/commit/8f13b7a5843f5270db684099c0a083f98869636a
CVE-2026-107151 (Missing authentication has been found in remote-execution
task updates ...)
NOT-FOR-US: rubygem-smart_proxy_dynflow
@@ -3368,17 +3368,17 @@ CVE-2026-77178 (Oracle VM VirtualBox before 7.2.8
allows guest OS users to cause
CVE-2026-76105 (Dell Container Storage Modules, versions prior to 1.18.0
contain(s) an ...)
NOT-FOR-US: Dell / EMC
CVE-2026-75820 (GNU Aspell contains an integer truncation vulnerability in the
Writabl ...)
- - aspell <unfixed>
+ - aspell <unfixed> (bug #1150460)
[trixie] - aspell <no-dsa> (Minor issue)
NOTE: https://cert.pl/en/posts/2026/10/CVE-2026-75818
NOTE: Fixed by:
https://github.com/GNUAspell/aspell/commit/782ce94e4dc71eaec4ee1bd945eb3b9c47c5387d
CVE-2026-75819 (GNU Aspell contains an out-of-bounds read vulnerability in
ReadOnlyDic ...)
- - aspell <unfixed>
+ - aspell <unfixed> (bug #1150460)
[trixie] - aspell <no-dsa> (Minor issue)
NOTE: https://cert.pl/en/posts/2026/10/CVE-2026-75818
NOTE: Fixed by:
https://github.com/GNUAspell/aspell/commit/941953b25031bc9104e83f58e138a664b8dedc3f
CVE-2026-75818 (GNU Aspell prezip-bin contains a heap-based buffer overflow
vulnerabil ...)
- - aspell <unfixed>
+ - aspell <unfixed> (bug #1150460)
[trixie] - aspell <no-dsa> (Minor issue)
NOTE: https://cert.pl/en/posts/2026/10/CVE-2026-75818
NOTE: Fixed by:
https://github.com/GNUAspell/aspell/commit/15b188437f9e0192d4ac4472ad66a4e2f62a782f
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6ee9e706f1a6a9fe587534cb8e9acdce7a55086
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b6ee9e706f1a6a9fe587534cb8e9acdce7a55086
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
