Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c35dfcfb by Moritz Muehlenhoff at 2026-11-02T22:48:27+01:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2007,7 +2007,7 @@ CVE-2026-107868 (Unauthenticated Bypass Vulnerability in
YITH WooCommerce Produc
CVE-2026-107630 (The Email Templates Customizer and Designer for WordPress and
WooComme ...)
NOT-FOR-US: WordPress plugin
CVE-2026-105924 (A NULL pointer dereference vulnerability in the Qt QCborValue
to JSON ...)
- - qt6-base <unfixed>
+ - qt6-base <unfixed> (bug #1152892)
- qtbase-opensource-src <unfixed>
NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/766809 (not
public yet)
NOTE:
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-105924
@@ -9448,7 +9448,7 @@ CVE-2026-97200 (Allocation of Resources Without Limits or
Throttling vulnerabili
CVE-2026-96581 (Authorization Bypass Through User-Controlled Key vulnerability
in ash- ...)
NOT-FOR-US: ash-project
CVE-2026-96432 (A malicious or compromised HTTP/2 server withholding SETTINGS
ACK can ...)
- - qt6-base <unfixed>
+ - qt6-base <unfixed> (bug #1152890)
NOTE:
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-96432:
NOTE: Fixed by:
https://github.com/qt/qtbase/commit/156dcb4770d7f4747b973ba509f6df1933f64817
(v6.11.3)
CVE-2026-95664 (Improper Neutralization of Special Elements used in an
Expression Lang ...)
@@ -10010,7 +10010,7 @@ CVE-2026-108525 (Allocation of Resources Without Limits
or Throttling vulnerabil
CVE-2026-107656 (An authentication bypass using an alternate path or channel
vulnerabil ...)
NOT-FOR-US: Fortinet
CVE-2026-107157 (Specially crafted CBOR input passed to QCborValue::fromCbor()
in Qt Co ...)
- - qt6-base <unfixed>
+ - qt6-base <unfixed> (bug #1152890)
- qtbase-opensource-src <unfixed>
NOTE:
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-107157:
NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/745719
@@ -10782,7 +10782,7 @@ CVE-2026-97353 (The News Kit Addons For Elementor
WordPress plugin through 1.4.7
CVE-2026-97352 (The News Kit Addons For Elementor WordPress plugin before
1.4.9 does n ...)
NOT-FOR-US: WordPress plugin
CVE-2026-95620 (A use-after-free vulnerability in the Qt QNetworkAccessManager
HTTP/2 ...)
- - qt6-base <unfixed>
+ - qt6-base <unfixed> (bug #1152890)
[trixie] - qt6-base <not-affected> (Vulnerable code not present)
[bookworm] - qt6-base <not-affected> (Vulnerable code not present)
NOTE:
https://wiki.qt.io/List_of_known_vulnerabilities_in_Qt_products#CVE-2026-95620:
@@ -14275,7 +14275,7 @@ CVE-2026-105927 (The Apache Pulsar WebSocket service
allows a WebSocket consumer
CVE-2026-105926 (The Pulsar broker serves two schema commands on its binary
protocol: G ...)
NOT-FOR-US: Apache software not packaged in Debian
CVE-2026-105923 (A malicious SVG can trigger an integer overflow which in turn
triggers ...)
- - qt6-base <unfixed>
+ - qt6-base <unfixed> (bug #1152890)
[trixie] - qt6-base <no-dsa> (Minor issue)
- qtbase-opensource-src <unfixed>
[trixie] - qtbase-opensource-src <no-dsa> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c35dfcfb42faa8a96a8f4182be3a6568fbbaa065
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c35dfcfb42faa8a96a8f4182be3a6568fbbaa065
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
