Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f6cea122 by Salvatore Bonaccorso at 2026-10-20T22:16:26+02:00
Add new tomcat9 issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -35,8 +35,11 @@ CVE-2026-93475 (The X.509 parser in NetX Secure accepts an
RSA public key of any
CVE-2026-93446 (Incomplete cleanup vulnerability in Apache Tomcat could cause
TLS 1.3 ...)
- tomcat11 <unfixed>
- tomcat10 <unfixed>
+ - tomcat9 9.0.70-2
+ NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE:
https://github.com/apache/tomcat/commit/e49e0c47ea925ad9442ba933a144ea62433d6a06
(11.0.27)
NOTE:
https://github.com/apache/tomcat/commit/ccbe01a52a9b255ad98e71b5bed76ed10a099503
(10.1.61)
+ NOTE:
https://github.com/apache/tomcat/commit/02166d1c7c32973685734ef132e56eb232605cc5
(9.0.123)
CVE-2026-93003 (The Web add-on's HTTP server searches the entire request
packet for he ...)
NOT-FOR-US: Eclipse
CVE-2026-92853 (The TLS 1.3 Certificate-message parser in NetX Secure
decrements the m ...)
@@ -74,14 +77,19 @@ CVE-2026-90797 (An unlimited gzip decompression routine in
chttpd in Apache Couc
CVE-2026-88041 (Incomplete cleanup vulnerability in Apache Tomcat allowed an
trailer i ...)
- tomcat11 <unfixed>
- tomcat10 <unfixed>
+ - tomcat9 9.0.70-2
+ NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE:
https://github.com/apache/tomcat/commit/a276dea827437090498678e09df0539ec397a7b5
(11.0.27)
NOTE:
https://github.com/apache/tomcat/commit/395bcafcfcf2e1cff451a5785361679931b49a79
(10.1.61)
+ NOTE:
https://github.com/apache/tomcat/commit/885985272887e9a5d47245cec240a5d1d0e39b5b
(9.0.123)
CVE-2026-86471 (An unvalidated runtime configuration value in Apache CouchDB
3.5.2 and ...)
TODO: check
CVE-2026-85267 (A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell
prior to ...)
TODO: check
CVE-2026-80353 (Time-of-check time-of-use (TOCTOU) race condition
vulnerability in Apa ...)
- TODO: check
+ - tomcat9 9.0.70-2
+ NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
+ NOTE:
https://github.com/apache/tomcat/commit/894158fd49679a6bd48d9689905829e1fdc45cb2
(9.0.123)
CVE-2026-75997
REJECTED
CVE-2026-75751
@@ -91,13 +99,19 @@ CVE-2026-75747
CVE-2026-74049 (Execution After Redirect (EAR) vulnerability in Apache Tomcat.
This ...)
- tomcat11 <unfixed>
- tomcat10 <unfixed>
+ - tomcat9 9.0.70-2
+ NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE:
https://github.com/apache/tomcat/commit/d7948a090ad3f803d9669c8b8401c39e2f532bb7
(11.0.27)
NOTE:
https://github.com/apache/tomcat/commit/f8023d833675f00968b89b45639210d3c7dcc95d
(10.1.61)
+ NOTE:
https://github.com/apache/tomcat/commit/6cd2ec7f60b13f8bd93290993401958502c33211
(9.0.123)
CVE-2026-74048 (Not Failing Securely ('Failing Open') vulnerability in Apache
Tomcat. ...)
- tomcat11 <unfixed>
- tomcat10 <unfixed>
+ - tomcat9 9.0.70-2
+ NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE:
https://github.com/apache/tomcat/commit/db6d674b40ac572f3b2205a4c4f06836516fd3f5
(11.0.27)
NOTE:
https://github.com/apache/tomcat/commit/5561032ca9d2bf32fafd8a8a417692c9826e30fe
(10.1.61)
+ NOTE:
https://github.com/apache/tomcat/commit/25714916ca36205f63f3c3d0da419981ed9d83c2
(9.0.123)
CVE-2026-48279
REJECTED
CVE-2026-43858 (A stack-based buffer overflow vulnerability could allow a
remote authe ...)
@@ -562,13 +576,19 @@ CVE-2026-103119 (Buffer under-read vulnerability in
Apache Tomcat meant that a l
CVE-2026-101356 (Incorrect object recycling and re-use vulnerability in Apache
Tomcat a ...)
- tomcat11 <unfixed>
- tomcat10 <unfixed>
+ - tomcat9 9.0.70-2
+ NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE:
https://github.com/apache/tomcat/commit/1dc6aa151b3b99b32ac9ae7c60e41c326063321b
(11.0.27)
NOTE:
https://github.com/apache/tomcat/commit/6c7da60893bd186d6cb2df7330299d7e70e68279
(10.1.61)
+ NOTE:
https://github.com/apache/tomcat/commit/4b1eb9a1664b10471f5740279d9f2e2259c5d108
(9.0.123)
CVE-2026-101296 (A missing critical step in authentication vulnerability in
Apache Tomc ...)
- tomcat11 <unfixed>
- tomcat10 <unfixed>
+ - tomcat9 9.0.70-2
+ NOTE: Starting with 9.0.70-2 src:tomcat9 no longer ships the server
stack, using that as the fixed version
NOTE:
https://github.com/apache/tomcat/commit/e43453fc04abb44f64faf571ca98af71aa3c20a1
(11.0.27)
NOTE:
https://github.com/apache/tomcat/commit/8fafc6f263311b7a0b7ce67477822175d1adf7ce
(10.1.61)
+ NOTE:
https://github.com/apache/tomcat/commit/42827afa4d073ac3d9f8b3cc81b857aa455bf1e6
(9.0.123)
CVE-2026-101201 (A malformed header in the binary file fed to
QBinaryJson::fromBinaryDa ...)
TODO: check
CVE-2026-100134 (Acrobat for Edge is affected by an out-of-bounds write
vulnerability t ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f6cea12250d212758122e7c8e7bcc09d257bb5d4
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f6cea12250d212758122e7c8e7bcc09d257bb5d4
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
