Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
96321671 by Salvatore Bonaccorso at 2025-05-17T11:24:57+02:00
Add CVE-2025-40906/libbson-xs-perl
Rationale: The CVEs affecting libbbson-xs-perl due to issues in the
embedding libbson were addressed via the specific libbson CVEs, this CVE
is more to make aware of the overall situation around BSON::XS. Thus
mark it as unimporant and keep unfixed as no version is switching to a
libbson version bumping the version to a version including all fixes.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -199,7 +199,11 @@ CVE-2025-47534 (Missing Authorization vulnerability in
ValvePress Wordpress Auto
CVE-2025-46464 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
NOT-FOR-US: WordPress plugin or theme
CVE-2025-40906 (BSON::XS versions 0.8.4 and earlier for Perl includes a
bundled libbso ...)
- TODO: check
+ - libbson-xs-perl <removed> (unimportant)
+ NOTE: https://lists.security.metacpan.org/cve-announce/msg/29655123/
+ NOTE: The CVE assignment is specific to BSON::XS versions 0.8.4
bundling libbson 1.1.7
+ NOTE: with several CVEs affected. Fixes for those were covered in the
corresponding
+ NOTE: CVEs.
CVE-2025-40632 (Cross-site scripting (XSS) in Icewarp Mail Server affecting
version 11 ...)
NOT-FOR-US: Icewarp Mail Server
CVE-2025-40631 (HTTP host header injection vulnerability in Icewarp Mail
Server affect ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9632167158f04a55b68d7f11d127918b041b4467
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9632167158f04a55b68d7f11d127918b041b4467
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
