Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2e6343db by Salvatore Bonaccorso at 2026-10-13T07:47:18+02:00
Add two erlang-hex issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,7 +3,12 @@ CVE-2026-9191 (Progress MarkLogic Server 12.x releases before
12.1.0 and 11.x re
CVE-2026-96618 (Improper Handling of Highly Compressed Data (Data
Amplification) vulne ...)
NOT-FOR-US: hexpm (server side)
CVE-2026-96612 (Improper Limitation of a Pathname to a Restricted Directory
('Path Tra ...)
- TODO: check
+ - erlang-hex <unfixed>
+ NOTE:
https://github.com/hexpm/hex/security/advisories/GHSA-2vjj-c5hr-6xc3
+ NOTE: https://cna.erlef.org/cves/CVE-2026-96612.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-96612
+ NOTE: Introduced with:
https://github.com/hexpm/hex/commit/380f87054e1bc08ee13d2b5311bc01f98dad2fc6
(v0.6.0)
+ NOTE: Fixed by:
https://github.com/hexpm/hex/commit/1b3e2ae8f0dd7273a2c2625b9e50b6c67c8568fb
(v2.5.2)
CVE-2026-94451 (Quarkus REST Data Panache provides a way to automatically
generate RES ...)
NOT-FOR-US: Red Hat software not packaged in Debian
CVE-2026-93695 (In Progress ShareFile Storage Zones Controller v5.12.6 and
below, File ...)
@@ -93,7 +98,12 @@ CVE-2026-83536 (A flaw was found in
openstack-network-exporter. The HTTP server
CVE-2026-83535 (A flaw was found in openstack-network-exporter. When an
operator confi ...)
TODO: check
CVE-2026-81856 (Improper Neutralization of Escape, Meta, or Control Sequences
vulnerab ...)
- TODO: check
+ - erlang-hex <unfixed>
+ NOTE:
https://github.com/hexpm/hex/security/advisories/GHSA-fpmj-3cxg-p766
+ NOTE: https://cna.erlef.org/cves/CVE-2026-81856.html
+ NOTE: https://osv.dev/vulnerability/EEF-CVE-2026-81856
+ NOTE: Introduced with:
https://github.com/hexpm/hex/commit/211303e3f68f5d3ce06450c1ff1a7a770a9ab236
(v0.0.1)
+ NOTE: Fixed by:
https://github.com/hexpm/hex/commit/dd3305ddf0032f6d0b468fd40dbbc3072bfcb8b8
(v2.5.2)
CVE-2026-78404 (IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5is
vulnerable ...)
NOT-FOR-US: IBM
CVE-2026-77366 (obsidian-tc is a governed, agent-ready Model Context Protocol
server f ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e6343db0e6fb87dcfae33ebbd13bd40bd0a1e92
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e6343db0e6fb87dcfae33ebbd13bd40bd0a1e92
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
