Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b01bcfe9 by Salvatore Bonaccorso at 2026-09-14T20:23:25+02:00
Add bug reference for node-webfont issue to query help from maintainers
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -38002,7 +38002,7 @@ CVE-2026-73571 (An authorization bypass vulnerability
exists in Zimbra Collabora
CVE-2026-73570 (A remote code execution vulnerability exists in Zimbra
Collaboration ( ...)
NOT-FOR-US: Zimbra
CVE-2026-73569 (fast-xml-parser allows users to process XML from JS object
without C/C ...)
- - node-webfont <undetermined>
+ - node-webfont <unfixed> (bug #1147730)
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8r6m-32jq-jx6q
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e546e03987662de5495d050b5fba26bea65383f
(v5.10.1)
NOTE: node-webfont provides node-fast-xml-parser
@@ -119112,7 +119112,7 @@ CVE-2026-41654 (Weblate is a web based localization
tool. Prior to version 5.17.
CVE-2026-41653 (BentoPDF is a client-side PDF toolkit that is self hostable.
Prior to ...)
NOT-FOR-US: BentoPDF
CVE-2026-41650 (fast-xml-parser allows users to process XML from JS object
without C/C ...)
- - node-webfont <undetermined>
+ - node-webfont <unfixed> (bug #1147730)
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-gh4j-gqv2-49f6
NOTE: node-webfont provides node-fast-xml-parser
CVE-2026-41644 (monetr is a budgeting application for recurring expenses.
Prior to ver ...)
@@ -145481,7 +145481,7 @@ CVE-2026-33399 (Wallos is an open-source,
self-hostable personal subscription tr
CVE-2026-33353 (Soft Serve is a self-hostable Git server for the command line.
From ve ...)
NOT-FOR-US: Soft Serve
CVE-2026-33349 (fast-xml-parser allows users to process XML from JS object
without C/C ...)
- - node-webfont <undetermined>
+ - node-webfont <unfixed> (bug #1147730)
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jp2q-39xq-3w4g
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/239b64aa1fc5c5455ddebbbb54a187eb68c9fdb7
NOTE: node-webfont provides node-fast-xml-parser
@@ -147976,7 +147976,7 @@ CVE-2026-33038 (WWBN AVideo is an open source video
platform. Versions 25.0 and
CVE-2026-33037 (WWBN AVideo is an open source video platform. In versions 25.0
and bel ...)
NOT-FOR-US: WWBN AVideo
CVE-2026-33036 (fast-xml-parser allows users to process XML from JS object
without C/C ...)
- - node-webfont <undetermined>
+ - node-webfont <unfixed> (bug #1147730)
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-8gc5-j5rx-235r
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/bd26122c838e6a55e7d7ac49b4ccc01a49999a01
NOTE: node-webfont provides node-fast-xml-parser
@@ -157804,7 +157804,7 @@ CVE-2026-27945 (ZITADEL is an open source identity
management platform. Zitadel
CVE-2026-27943 (OpenEMR is a free and open source electronic health records
and medica ...)
NOT-FOR-US: OpenEMR
CVE-2026-27942 (fast-xml-parser allows users to validate XML, parse XML to JS
object, ...)
- - node-webfont <undetermined>
+ - node-webfont <unfixed> (bug #1147730)
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-fj3w-jwp8-x2g3
NOTE: https://github.com/NaturalIntelligence/fast-xml-parser/pull/791
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/c13a961910f14986295dd28484eee830fa1a0e8a
@@ -160129,7 +160129,7 @@ CVE-2026-26046 (A vulnerability was found in a Moodle
TeX filter administrative
CVE-2026-26045 (A flaw was identified in Moodle\u2019s backup restore
functionality wh ...)
- moodle <removed>
CVE-2026-25896 (fast-xml-parser allows users to validate XML, parse XML to JS
object, ...)
- - node-webfont <undetermined>
+ - node-webfont <unfixed> (bug #1147730)
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-m7jm-9gc2-mpf2
NOTE: Fixed by:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/943ef0eb1b2d3284e72dd74f44a042ee9f07026e
(v5.3.5)
NOTE: Fixed by:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/ddcd0acf26ddd682cb0dc15a2bd6aa3b96bb1e69
(v5.3.5)
@@ -161107,7 +161107,7 @@ CVE-2026-26280 (systeminformation is a System and OS
information library for nod
- jupyterlab 4.0.11+ds5+~cs11.25.27-1
NOTE: node-systeminformation split from jupyterlab
CVE-2026-26278 (fast-xml-parser allows users to validate XML, parse XML to JS
object, ...)
- - node-webfont <undetermined>
+ - node-webfont <unfixed> (bug #1147730)
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-jmr7-xgp7-cmfj
NOTE: Fixed by:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/910dae5be2de2955e968558fadf6e8f74f117a77
(v5.3.6)
NOTE: node-webfont provides node-fast-xml-parser
@@ -457207,7 +457207,7 @@ CVE-2023-26922 (SQL injection vulnerability found in
Varisicte matrix-gui v.2 al
CVE-2023-26921 (OS Command Injection vulnerability in quectel AG550QCN allows
attacker ...)
NOT-FOR-US: quectel
CVE-2023-26920 (fast-xml-parser before 4.1.2 allows __proto__ for Prototype
Pollution.)
- - node-webfont <undetermined>
+ - node-webfont <unfixed> (bug #1147730)
NOTE: https://gist.github.com/Sudistark/a5a45bd0804d522a1392cb5023aa7ef7
NOTE:
https://github.com/NaturalIntelligence/fast-xml-parser/commit/2b032a4f799c63d83991e4f992f1c68e4dd05804
(4.2.1)
NOTE: node-webfont provides node-fast-xml-parser
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b01bcfe9170c15bfaf515bcccde9f69e012d3c13
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b01bcfe9170c15bfaf515bcccde9f69e012d3c13
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
