Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e8397533 by Salvatore Bonaccorso at 2026-11-01T17:35:51+01:00
Add Debian bug references for various issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -46,7 +46,7 @@ CVE-2026-XXXX [GHSA-gff5-3vgr-p8h2]
CVE-2026-13575
NOT-FOR-US: HTTP::Session Perl module
CVE-2026-111426
- - kdeconnect <unfixed>
+ - kdeconnect <unfixed> (bug #1152780)
NOTE: https://kde.org/info/security/advisory-20261030-2.txt
NOTE: Fixed by:
https://invent.kde.org/network/kdeconnect-kde/-/commit/71c63c47b51047533f5d9533f27be4375778b21d
(release/26.08 branch)
CVE-2026-120252 (imagecodecs 2023.1.23 through 2026.10.10 contains a
stack-based buffer ...)
@@ -447,22 +447,22 @@ CVE-2026-119343 (Stirling-PDF is a locally hosted web
application that facilitat
CVE-2026-119342 (Stirling-PDF is a locally hosted web application that
facilitates vari ...)
NOT-FOR-US: Stirling-PDF
CVE-2026-119341 (Tesseract is an open source OCR engine. Prior to 5.5.4,
ReadAdaptedCla ...)
- - tesseract <unfixed>
+ - tesseract <unfixed> (bug #1152789)
NOTE:
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-357f-833m-3f83
NOTE: https://github.com/tesseract-ocr/tesseract/pull/4645
NOTE: Fixed by:
https://github.com/tesseract-ocr/tesseract/commit/614e971036d2b95d521057ff63d68d6612429b23
(5.5.4)
CVE-2026-119340 (Tesseract is an open source OCR engine. Prior to 5.5.4,
GENERIC_2D_ARR ...)
- - tesseract <unfixed>
+ - tesseract <unfixed> (bug #1152789)
NOTE:
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-6xhq-wvww-6xfg
NOTE: https://github.com/tesseract-ocr/tesseract/pull/4649
NOTE: Fixed by:
https://github.com/tesseract-ocr/tesseract/commit/048e92378f1a34dcdaf94bc515c7552ac01f08ef
(5.5.4)
CVE-2026-119339 (Tesseract is an open source OCR engine. Prior to 5.5.4,
WeightMatrix:: ...)
- - tesseract <unfixed>
+ - tesseract <unfixed> (bug #1152789)
NOTE:
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-h9g4-frjx-6cj3
NOTE: https://github.com/tesseract-ocr/tesseract/pull/4657
NOTE: Fixed by:
https://github.com/tesseract-ocr/tesseract/commit/c053424327352b9d5180aa7540c1f9e67c64f27e
(5.5.4)
CVE-2026-119338 (Tesseract is an open source OCR engine. From 5.4.0 until
5.5.4, Append ...)
- - tesseract <unfixed>
+ - tesseract <unfixed> (bug #1152789)
NOTE:
https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-vf7v-2h4f-6f4j
NOTE: https://github.com/tesseract-ocr/tesseract/pull/4647
NOTE: Fixed by:
https://github.com/tesseract-ocr/tesseract/commit/fa52414ff1fd13ae4b00048d2498f9141b0bc2eb
(5.5.4)
@@ -1027,12 +1027,12 @@ CVE-2026-119597 (OpenDeepWiki through 2.0.6 contains a
hard-coded JWT signing ke
CVE-2026-119596 (UNIT3D through 9.2.0 contains a missing authorization
vulnerability in ...)
NOT-FOR-US: UNIT3D
CVE-2026-119591 (SQLite before 3.54.0 contains a stack exhaustion
vulnerability in coun ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/bugs/info/2026-10-04T05:34:47Z
NOTE: https://sqlite.org/src/info/ab621a3e11ee4acc
NOTE:
https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2
(version-3.54.0)
CVE-2026-119586 (SQLite command-line shell through 3.54.1 contains a command
injection ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
TODO: check upstream details
CVE-2026-119578 (MONAI from 1.6.0 before 1.6.1 contains a remote code
execution vulnera ...)
NOT-FOR-US: MONAI
@@ -1161,47 +1161,47 @@ CVE-2026-119408 (n8n before 2.42.6, 2.43.x before
2.43.3, and 3.x before 3.0.1 c
CVE-2026-119407 (Element Web and Element Desktop before 1.12.32 accept guest
credential ...)
NOT-FOR-US: Element
CVE-2026-119379 (SQLite before 3.54.0 built with the session extension
contains a heap ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/bugs/info/2026-08-16T10:15:25Z
NOTE: https://sqlite.org/src/info/3f57024aecea0f3b
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52
(version-3.54.0)
CVE-2026-119378 (SQLite before 3.54.0 contains a use-after-free vulnerability
in the R- ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/src/info/6a9e1415659f9e75
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04
(version-3.54.0)
CVE-2026-119377 (SQLite before 3.54.0 contains an authorization bypass
vulnerability in ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/bugs/info/2026-07-05T08:15:45Z
NOTE: https://sqlite.org/src/info/bbd69ce274620008
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237
(version-3.54.0)
NOTE: https://sqlite.org/src/info/2cb22877683680c1
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8
(version-3.54.0)
CVE-2026-119376 (SQLite before 3.54.0 contains a stack exhaustion
vulnerability that al ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/bugs/info/2026-10-04T04:50:56Z
NOTE: https://sqlite.org/src/info/252c0b7bf5a727d2
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2
(version-3.54.0)
CVE-2026-119375 (SQLite before 3.54.0 contains an information disclosure
vulnerability ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/bugs/info/2026-08-17T15:54:41Z
NOTE: https://sqlite.org/src/info/f9b4ee369557c36c
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e
(version-3.54.0)
CVE-2026-119374 (SQLite before 3.54.0 built with FTS5 contains a heap buffer
overflow i ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/src/info/9cd4f9e920
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9
(version-3.54.0)
CVE-2026-119373 (SQLite before 3.54.0 built with FTS5 contains a heap buffer
overflow i ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/bugs/info/2026-08-04T08:49:27Z
NOTE: https://sqlite.org/src/info/a7f8c92f62
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80
(version-3.54.0)
CVE-2026-119372 (SQLite before 3.54.0 built with FTS3/FTS4 and
SQLITE_ENABLE_FTS3_PAREN ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/bugs/info/2026-08-17T09:18:24Z
NOTE: https://sqlite.org/src/info/e4635c4153
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731
(version-3.54.0)
CVE-2026-119371 (SQLite before 3.54.0 contains a stack exhaustion
vulnerability that al ...)
- - sqlite3 <unfixed>
+ - sqlite3 <unfixed> (bug #1152790)
NOTE: https://sqlite.org/bugs/info/2026-10-04T04:58:58Z
NOTE: https://sqlite.org/src/info/f54730871303e655
NOTE: Fixed by:
https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb
(version-3.54.0)
@@ -1216,7 +1216,7 @@ CVE-2026-119367 (Missing Authorization vulnerability in
Liquid Web / StellarWP T
CVE-2026-119365 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2026-119364 (ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4
contains a link ...)
- - proftpd-dfsg <unfixed>
+ - proftpd-dfsg <unfixed> (bug #1152788)
NOTE: https://github.com/proftpd/proftpd/issues/2374
NOTE: Fixed by:
https://github.com/proftpd/proftpd/commit/c41691f8981f98081fcb8a535c3c21b06a3f04af
(v1.3.10rc5)
CVE-2026-119300 (Wekan is open source kanban built with Meteor. Prior to
11.11, the use ...)
@@ -3529,26 +3529,26 @@ CVE-2026-XXXX [GHSA-vj9g-4mg6-q9hw]
- amule 1:3.2.0-1
NOTE:
https://github.com/amule-org/amule/security/advisories/GHSA-vj9g-4mg6-q9hw
CVE-2026-105031 (When using the OpenSSL TLS implementation, both the
pn_ssl_domain_set_ ...)
- - qpid-proton <unfixed>
+ - qpid-proton <unfixed> (bug #1152779)
[trixie] - qpid-proton <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/28/22
NOTE: https://issues.apache.org/jira/browse/PROTON-2976
NOTE:
https://github.com/apache/qpid-proton/commit/d793f97e4a2d0f960eda32724a2e867236468337
(0.41.1-rc1)
CVE-2026-105042 (A message body that is deeply nested and decoded by
pn_message_body() ...)
- - qpid-proton <unfixed>
+ - qpid-proton <unfixed> (bug #1152779)
[trixie] - qpid-proton <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/28/23
NOTE: https://issues.apache.org/jira/browse/PROTON-2976
NOTE:
https://github.com/apache/qpid-proton/commit/d793f97e4a2d0f960eda32724a2e867236468337
(0.41.1-rc1)
CVE-2026-114230 (When dispatching SASL frames to authenticate the peer, Proton
will als ...)
- - qpid-proton <unfixed>
+ - qpid-proton <unfixed> (bug #1152779)
[trixie] - qpid-proton <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/28/24
NOTE: https://issues.apache.org/jira/browse/PROTON-2945
NOTE:
https://github.com/apache/qpid-proton/commit/94e2df384a493cbb8a4870a40d90e08708e131eb
(0.41.1-rc1)
NOTE:
https://github.com/apache/qpid-proton/commit/b7fb4507bb233db10825e6ffd456086dedca22f6
(0.41.1-rc1)
CVE-2026-115942 (A misconfigured wildcard TLS certificate causes a stack read
overflow. ...)
- - qpid-proton <unfixed>
+ - qpid-proton <unfixed> (bug #1152779)
[trixie] - qpid-proton <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2026/10/28/25
NOTE: https://issues.apache.org/jira/browse/PROTON-2974
@@ -9113,7 +9113,7 @@ CVE-2026-115930 (The MongoDB Shell (mongosh) relies on
Node.jsas a third-party r
CVE-2026-115923 (Backstage is an open framework for building developer
portals. Prior t ...)
NOT-FOR-US: Backstage
CVE-2026-115922 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
- - onnx <unfixed>
+ - onnx <unfixed> (bug #1152787)
[trixie] - onnx <no-dsa> (Minor issue)
NOTE:
https://github.com/onnx/onnx/security/advisories/GHSA-q69g-f4f5-v8m7
NOTE: https://github.com/onnx/onnx/pull/8033
@@ -9122,19 +9122,19 @@ CVE-2026-115922 (Open Neural Network Exchange (ONNX) is
an open standard for mac
NOTE: Fixed by:
https://github.com/onnx/onnx/commit/05c1bc3bceceb8d3cf11e9e7fc7f19f971c44988
(v1.23.0)
NOTE: Fixed by:
https://github.com/onnx/onnx/commit/8de2cf6aa47928e6515ac6d9e1a8b4758886a7df
(v1.22.0)
CVE-2026-115921 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
- - onnx <unfixed>
+ - onnx <unfixed> (bug #1152787)
[trixie] - onnx <no-dsa> (Minor issue)
NOTE:
https://github.com/onnx/onnx/security/advisories/GHSA-m4pr-6v3c-6fgr
NOTE: https://github.com/onnx/onnx/pull/7916
NOTE: Fixed by:
https://github.com/onnx/onnx/commit/dd6bc92ea39fd2274fd671f0734b0b8b558356f5
(v1.22.0)
CVE-2026-115920 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
- - onnx <unfixed>
+ - onnx <unfixed> (bug #1152787)
[trixie] - onnx <no-dsa> (Minor issue)
NOTE:
https://github.com/onnx/onnx/security/advisories/GHSA-6pwm-x34p-fvj2
NOTE: https://github.com/onnx/onnx/pull/7997
NOTE: Fixed by:
https://github.com/onnx/onnx/commit/2ec288908952eea9dcf48d4b197915e1f72c6abf
(v1.22.0)
CVE-2026-115919 (Open Neural Network Exchange (ONNX) is an open standard for
machine le ...)
- - onnx <unfixed>
+ - onnx <unfixed> (bug #1152787)
[trixie] - onnx <no-dsa> (Minor issue)
NOTE:
https://github.com/onnx/onnx/security/advisories/GHSA-48m4-24cq-37qf
NOTE: https://github.com/onnx/onnx/pull/7879
@@ -18285,7 +18285,7 @@ CVE-2026-113604 (Ghidra 10.2 through 12.1.4 contains a
denial of service vulnera
CVE-2026-113603 (The x402 SIWX server extension in @x402/extensions 2.3.1
through 2.28. ...)
NOT-FOR-US: x402 SIWX
CVE-2026-113602 (json-smart through 2.6.0 contains an input validation bypass
vulnerabi ...)
- - json-smart <unfixed>
+ - json-smart <unfixed> (bug #1152785)
[trixie] - json-smart <no-dsa> (Minor issue)
[bookworm] - json-smart <postponed> (Minor issue; can be fixed in next
update)
NOTE: https://github.com/netplex/json-smart-v2/issues/302
@@ -18314,13 +18314,13 @@ CVE-2026-113506 (A vulnerability has been found in
aaPanel up to 8.25.0. The aff
CVE-2026-113505 (A flaw has been found in aaPanel up to 8.25.0. Impacted is
the functio ...)
NOT-FOR-US: aaPanel
CVE-2026-113496 (A flaw was found in cockpit-machines. When saving Virtual
Network Comp ...)
- - cockpit-machines <unfixed>
+ - cockpit-machines <unfixed> (bug #1152783)
[trixie] - cockpit-machines <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556058
NOTE: https://github.com/advisories/GHSA-vxhg-j5jv-qgqm
NOTE: Fixed by:
https://github.com/cockpit-project/cockpit-machines/commit/e0d400eb32ef806bfcdda701608f8dc222cec2ab
CVE-2026-113495 (A flaw was found in cockpit-machines. Red Hat Subscription
Management ...)
- - cockpit-machines <unfixed>
+ - cockpit-machines <unfixed> (bug #1152782)
[trixie] - cockpit-machines <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2556057
NOTE: https://github.com/advisories/GHSA-rq8f-q9xv-wmhm
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e8397533ffeb090889176d168fdd0783fd74d6ab
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e8397533ffeb090889176d168fdd0783fd74d6ab
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
