Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
fb370e1b by Moritz Muehlenhoff at 2026-10-12T09:23:49+02:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2809,6 +2809,7 @@ CVE-2026-107387 (music-metadata is a metadata parser for
audio and video media f
NOT-FOR-US: music-metadata
CVE-2026-107386 (amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until
1.14.0, the fr ...)
- golang-github-rabbitmq-amqp091-go 1.14.0-1
+ [trixie] - golang-github-rabbitmq-amqp091-go <no-dsa> (Minor issue)
NOTE:
https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8
NOTE: https://github.com/rabbitmq/amqp091-go/pull/377
NOTE: Fixed by:
https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3
(v1.14.0)
@@ -2853,10 +2854,12 @@ CVE-2026-107332 (Insecure file permissions in the
CodeCatalyst connection handle
NOT-FOR-US: Amazon
CVE-2026-107325 (Improper validation of a BSON array length in the MongoDB Go
Driver ca ...)
- golang-mongodb-mongo-driver <unfixed> (bug #1150459)
+ [trixie] - golang-mongodb-mongo-driver <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/GODRIVER-4136
NOTE: Fixed by:
https://github.com/mongodb/mongo-go-driver/commit/a0973940ec32f31e406ca4a5d7db03288bb628dc
(v2.9.2)
CVE-2026-107324 (An integer overflow in BSON value-length handling in the
MongoDB Go Dr ...)
- golang-mongodb-mongo-driver <unfixed> (bug #1150459)
+ [trixie] - golang-mongodb-mongo-driver <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/GODRIVER-4102
NOTE: Fixed by:
https://github.com/mongodb/mongo-go-driver/commit/6e5eff3ea7bc5b6743f9fcec6bb8d523b0c98bbc
(v2.9.2)
CVE-2026-107322 (An incomplete list of disallowed inputs in Amazon Agent
Plugins for AW ...)
@@ -2923,6 +2926,7 @@ CVE-2026-106437 (The BSON buffer-reservation API in the
MongoDB C Driver can rec
NOTE: Fixed by:
https://github.com/mongodb/mongo-c-driver/commit/b7f1f5742351741c068020196fd88f196551aad2
(1.30.13)
CVE-2026-106436 (The BSON encoder in the MongoDB PHP Driver does not check
some return ...)
- php-mongodb <unfixed> (bug #1150514)
+ [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-2739
NOTE: Fixed by:
https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260
(2.5.4, 2.1.11, 1.21.11)
CVE-2026-106435 (The MongoDB Python Driver's binary accelerator can read
outside a buff ...)
@@ -2943,6 +2947,7 @@ CVE-2026-106433 (Improper state management in MongoDB
libmongocrypt can cause pr
NOTE: Fixed by:
https://github.com/mongodb/libmongocrypt/commit/8bc580ea69eea13a932197221edf72830fbc38a1
(1.20.5)
CVE-2026-106432 (The BSON encoder in the MongoDB PHP Driver converts a string
length to ...)
- php-mongodb <unfixed> (bug #1150514)
+ [trixie] - php-mongodb <no-dsa> (Minor issue)
NOTE: https://jira.mongodb.org/browse/PHPC-2741
NOTE: Fixed by:
https://github.com/mongodb/mongo-php-driver/commit/79036dd7a4c946cfef2d0105f8102f26d685b260
(2.5.4, 2.1.11, 1.21.11)
CVE-2026-106431 (An off-by-one error in the BSON bulk document writer in the
MongoDB C ...)
@@ -64299,7 +64304,7 @@ CVE-2026-73196 (A flaw was found in FreeIPA. A
low-privilege authenticated user
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2474712
CVE-2026-72854 (msgpack_unpacker_expand_buffer in src/unpack.c, reached
through the pu ...)
- msgpack-c 7.0.2-1 (bug #1150652)
- [trixie] - msgpack-c <postponed> (Minor issue, revisit when fixed
upstream)
+ [trixie] - msgpack-c <no-dsa> (Minor issue)
[bookworm] - msgpack-c <postponed> (Minor issue, revisit when fixed
upstream)
NOTE: https://github.com/msgpack/msgpack-c/issues/1181
NOTE: https://github.com/msgpack/msgpack-c/pull/1182
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fb370e1b5ad74e54716ff2cb29e7bb929e7ac49f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fb370e1b5ad74e54716ff2cb29e7bb929e7ac49f
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
