Skip to content

Commit 7705bcc

Browse files
aboutcode-automationaboutcode-automation
committed
Sync Collecting Fix Commits: Sat Sep 12 16:02:18 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent ef8ad7c commit 7705bcc

6 files changed

Lines changed: 94 additions & 7 deletions

‎data/fix-commits/advisory-database-b78f1d41.json‎

Lines changed: 47 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,53 @@
11
{
22
"vcs_url": "https://github.com/github/advisory-database",
33
"vulnerabilities": {
4+
"GHSA-9VJP-F3JG-99PQ": {
5+
"ae35cac1e6d892f7236428f09e9b68edee21a13b": "Publish Advisories\n\nGHSA-9vjp-f3jg-99pq\nGHSA-c47m-m826-fc8g\nGHSA-h5hr-vppv-v9cg\nGHSA-pxq3-m9x7-5w4m"
6+
},
7+
"GHSA-C47M-M826-FC8G": {
8+
"ae35cac1e6d892f7236428f09e9b68edee21a13b": "Publish Advisories\n\nGHSA-9vjp-f3jg-99pq\nGHSA-c47m-m826-fc8g\nGHSA-h5hr-vppv-v9cg\nGHSA-pxq3-m9x7-5w4m"
9+
},
10+
"GHSA-H5HR-VPPV-V9CG": {
11+
"ae35cac1e6d892f7236428f09e9b68edee21a13b": "Publish Advisories\n\nGHSA-9vjp-f3jg-99pq\nGHSA-c47m-m826-fc8g\nGHSA-h5hr-vppv-v9cg\nGHSA-pxq3-m9x7-5w4m"
12+
},
13+
"GHSA-PXQ3-M9X7-5W4M": {
14+
"ae35cac1e6d892f7236428f09e9b68edee21a13b": "Publish Advisories\n\nGHSA-9vjp-f3jg-99pq\nGHSA-c47m-m826-fc8g\nGHSA-h5hr-vppv-v9cg\nGHSA-pxq3-m9x7-5w4m"
15+
},
16+
"GHSA-F47W-MRG9-G9P2": {
17+
"3e55d55d9874d3c94451be33bab8201736aa2952": "Publish GHSA-f47w-mrg9-g9p2",
18+
"b1f5dee94f0dcf3f7f74d2cf421c36fd7f8dc073": "Publish Advisories\n\nGHSA-c9pv-p24c-23v6\nGHSA-crrq-mjw6-39qp\nGHSA-f47w-mrg9-g9p2\nGHSA-prp4-5w2g-8v2c\nGHSA-qh75-x5jv-g7wg"
19+
},
20+
"GHSA-992Q-9GWP-7R79": {
21+
"91d0ac6869b6b0f6fbdecfe62ae42a7b64f6ba7a": "Improve GHSA-992q-9gwp-7r79",
22+
"22a92599d64cf7f0829ac83465aba971dcae0567": "Publish GHSA-992q-9gwp-7r79"
23+
},
24+
"GHSA-49RV-C869-35HW": {
25+
"f499ec93bd23c98dc7f2ea93a5f831a91436db9e": "Publish Advisories\n\nGHSA-49rv-c869-35hw\nGHSA-4q25-cq4p-f83q\nGHSA-637j-vv5r-2x85\nGHSA-6hw9-7gx5-mw88\nGHSA-9c57-9fxg-8x9j\nGHSA-cg5c-mg8j-jqc2\nGHSA-f69h-9mwp-64rp"
26+
},
27+
"GHSA-4Q25-CQ4P-F83Q": {
28+
"f499ec93bd23c98dc7f2ea93a5f831a91436db9e": "Publish Advisories\n\nGHSA-49rv-c869-35hw\nGHSA-4q25-cq4p-f83q\nGHSA-637j-vv5r-2x85\nGHSA-6hw9-7gx5-mw88\nGHSA-9c57-9fxg-8x9j\nGHSA-cg5c-mg8j-jqc2\nGHSA-f69h-9mwp-64rp"
29+
},
30+
"GHSA-637J-VV5R-2X85": {
31+
"f499ec93bd23c98dc7f2ea93a5f831a91436db9e": "Publish Advisories\n\nGHSA-49rv-c869-35hw\nGHSA-4q25-cq4p-f83q\nGHSA-637j-vv5r-2x85\nGHSA-6hw9-7gx5-mw88\nGHSA-9c57-9fxg-8x9j\nGHSA-cg5c-mg8j-jqc2\nGHSA-f69h-9mwp-64rp"
32+
},
33+
"GHSA-6HW9-7GX5-MW88": {
34+
"f499ec93bd23c98dc7f2ea93a5f831a91436db9e": "Publish Advisories\n\nGHSA-49rv-c869-35hw\nGHSA-4q25-cq4p-f83q\nGHSA-637j-vv5r-2x85\nGHSA-6hw9-7gx5-mw88\nGHSA-9c57-9fxg-8x9j\nGHSA-cg5c-mg8j-jqc2\nGHSA-f69h-9mwp-64rp"
35+
},
36+
"GHSA-9C57-9FXG-8X9J": {
37+
"f499ec93bd23c98dc7f2ea93a5f831a91436db9e": "Publish Advisories\n\nGHSA-49rv-c869-35hw\nGHSA-4q25-cq4p-f83q\nGHSA-637j-vv5r-2x85\nGHSA-6hw9-7gx5-mw88\nGHSA-9c57-9fxg-8x9j\nGHSA-cg5c-mg8j-jqc2\nGHSA-f69h-9mwp-64rp"
38+
},
39+
"GHSA-CG5C-MG8J-JQC2": {
40+
"f499ec93bd23c98dc7f2ea93a5f831a91436db9e": "Publish Advisories\n\nGHSA-49rv-c869-35hw\nGHSA-4q25-cq4p-f83q\nGHSA-637j-vv5r-2x85\nGHSA-6hw9-7gx5-mw88\nGHSA-9c57-9fxg-8x9j\nGHSA-cg5c-mg8j-jqc2\nGHSA-f69h-9mwp-64rp"
41+
},
42+
"GHSA-F69H-9MWP-64RP": {
43+
"f499ec93bd23c98dc7f2ea93a5f831a91436db9e": "Publish Advisories\n\nGHSA-49rv-c869-35hw\nGHSA-4q25-cq4p-f83q\nGHSA-637j-vv5r-2x85\nGHSA-6hw9-7gx5-mw88\nGHSA-9c57-9fxg-8x9j\nGHSA-cg5c-mg8j-jqc2\nGHSA-f69h-9mwp-64rp"
44+
},
45+
"GHSA-QJQ8-433V-GM7M": {
46+
"2df2b7c8cdb536d8cf58f20cf01fd2aa258ce7cc": "Publish Advisories\n\nGHSA-qjq8-433v-gm7m\nGHSA-xcq8-9qm4-gwm6"
47+
},
48+
"GHSA-XCQ8-9QM4-GWM6": {
49+
"2df2b7c8cdb536d8cf58f20cf01fd2aa258ce7cc": "Publish Advisories\n\nGHSA-qjq8-433v-gm7m\nGHSA-xcq8-9qm4-gwm6"
50+
},
451
"GHSA-3MPH-M2WR-4WH3": {
552
"ee37b6415dcde7c399d15a2afd7052c41788d633": "Publish Advisories\n\nGHSA-3mph-m2wr-4wh3\nGHSA-67c7-wvpf-h5rm\nGHSA-67xq-jjpf-484h\nGHSA-97p7-8jv8-2rmm\nGHSA-mqrq-3vgp-g3ff"
653
},
@@ -31,9 +78,6 @@
3178
"GHSA-CRRQ-MJW6-39QP": {
3279
"b1f5dee94f0dcf3f7f74d2cf421c36fd7f8dc073": "Publish Advisories\n\nGHSA-c9pv-p24c-23v6\nGHSA-crrq-mjw6-39qp\nGHSA-f47w-mrg9-g9p2\nGHSA-prp4-5w2g-8v2c\nGHSA-qh75-x5jv-g7wg"
3380
},
34-
"GHSA-F47W-MRG9-G9P2": {
35-
"b1f5dee94f0dcf3f7f74d2cf421c36fd7f8dc073": "Publish Advisories\n\nGHSA-c9pv-p24c-23v6\nGHSA-crrq-mjw6-39qp\nGHSA-f47w-mrg9-g9p2\nGHSA-prp4-5w2g-8v2c\nGHSA-qh75-x5jv-g7wg"
36-
},
3781
"GHSA-PRP4-5W2G-8V2C": {
3882
"b1f5dee94f0dcf3f7f74d2cf421c36fd7f8dc073": "Publish Advisories\n\nGHSA-c9pv-p24c-23v6\nGHSA-crrq-mjw6-39qp\nGHSA-f47w-mrg9-g9p2\nGHSA-prp4-5w2g-8v2c\nGHSA-qh75-x5jv-g7wg"
3983
},
@@ -114,9 +158,6 @@
114158
"6a128843aec80e9e4f0615d5df1480e90d3a08d2": "Improve GHSA-937c-856w-w843",
115159
"8a763b39b893cb17708ee8dfe8ad4f06b392dcca": "Publish Advisories\n\nGHSA-xj79-6hh5-9w6q\nGHSA-34f9-5v7x-jpw3\nGHSA-46mh-97fq-r9vh\nGHSA-693g-ppp7-3j2h\nGHSA-937c-856w-w843\nGHSA-9f4g-f7vv-f9gh\nGHSA-gqrp-6638-7vpg\nGHSA-gwqp-9qgw-c5pv\nGHSA-h8hr-49hh-qr69\nGHSA-j374-979j-mcx7\nGHSA-j4c7-rfxg-2m4p\nGHSA-jxfm-4h2p-76mq\nGHSA-m7ff-3hm8-6qxh\nGHSA-q5pg-prw5-6c62\nGHSA-rfvm-pvfp-c8vq\nGHSA-rv8v-63hf-3gj7\nGHSA-wc93-h4m4-584v"
116160
},
117-
"GHSA-992Q-9GWP-7R79": {
118-
"22a92599d64cf7f0829ac83465aba971dcae0567": "Publish GHSA-992q-9gwp-7r79"
119-
},
120161
"GHSA-8VM2-C32J-MVFR": {
121162
"7cb1175d90c1048d961a05685204716aceafbe5b": "Publish Advisories\n\nGHSA-8vm2-c32j-mvfr\nGHSA-r2g5-993q-664g\nGHSA-325j-mg25-8q58",
122163
"b9a5dabb187c951e386c22889ef10768e97b8d9f": "Publish Advisories\n\nGHSA-q856-29gm-xf3x\nGHSA-3w6r-r33r-cfg6\nGHSA-5x67-m8gc-wm3p\nGHSA-6v32-2jc8-w595\nGHSA-78fj-q294-w4gw\nGHSA-7rcj-2493-83x3\nGHSA-85qj-f5wg-rwp9\nGHSA-87gp-wmhr-wgcw\nGHSA-8vm2-c32j-mvfr\nGHSA-9j3r-2vv4-g5x8\nGHSA-chxj-gxww-q98w\nGHSA-g345-7jg6-m22p\nGHSA-mc62-3gf7-rphg\nGHSA-qvj8-gwpm-4x49\nGHSA-r2g5-993q-664g\nGHSA-vjr9-f93j-mjr7",

‎data/fix-commits/buildroot-0b809119.json‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,21 @@
11
{
22
"vcs_url": "https://github.com/buildroot/buildroot",
33
"vulnerabilities": {
4+
"GHSA-V7W4-4GC9-QCGV": {
5+
"17be3c2dcd33a57e1a606416146e1f110c09bba2": "package/tpm2-tools: security bump version to 5.8\n\nhttps://github.com/tpm2-software/tpm2-tools/blob/5.8/docs/CHANGELOG.md\n\nFixes: GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66 & GHSA-qp88-8f4j-wv7q.\n\nSwitched to sha256 tarball hash provided by upstream.\n\nSigned-off-by: Bernd Kuhls <bernd@kuhls.net>\nSigned-off-by: Julien Olivain <ju.o@free.fr>"
6+
},
7+
"GHSA-GWFG-W3JR-XH66": {
8+
"17be3c2dcd33a57e1a606416146e1f110c09bba2": "package/tpm2-tools: security bump version to 5.8\n\nhttps://github.com/tpm2-software/tpm2-tools/blob/5.8/docs/CHANGELOG.md\n\nFixes: GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66 & GHSA-qp88-8f4j-wv7q.\n\nSwitched to sha256 tarball hash provided by upstream.\n\nSigned-off-by: Bernd Kuhls <bernd@kuhls.net>\nSigned-off-by: Julien Olivain <ju.o@free.fr>"
9+
},
10+
"GHSA-QP88-8F4J-WV7Q": {
11+
"17be3c2dcd33a57e1a606416146e1f110c09bba2": "package/tpm2-tools: security bump version to 5.8\n\nhttps://github.com/tpm2-software/tpm2-tools/blob/5.8/docs/CHANGELOG.md\n\nFixes: GHSA-v7w4-4gc9-qcgv, GHSA-gwfg-w3jr-xh66 & GHSA-qp88-8f4j-wv7q.\n\nSwitched to sha256 tarball hash provided by upstream.\n\nSigned-off-by: Bernd Kuhls <bernd@kuhls.net>\nSigned-off-by: Julien Olivain <ju.o@free.fr>"
12+
},
13+
"GHSA-R7HP-698J-2H6C": {
14+
"51b366290b780a6c5f9e09f8e84bf5749d2022b2": "package/xdg-dbus-proxy: security bump to verssion 0.1.8\n\nFixes and issue that caused broadcast messages to skip some checks.\nRelease notes:\n\n https://github.com/flatpak/xdg-dbus-proxy/releases/tag/0.1.8\n\nFixes:\nhttps://github.com/flatpak/xdg-dbus-proxy/security/advisories/GHSA-r7hp-698j-2h6c\n\nSigned-off-by: Adrian Perez de Castro <aperez@igalia.com>\n[Julien: add link to GHSA]\nSigned-off-by: Julien Olivain <ju.o@free.fr>"
15+
},
16+
"CVE-2026-41608": {
17+
"0e5019c2e470e1502f1420879f644365c7ea8842": "package/thrift: bump version to 0.24.0\n\nhttps://github.com/apache/thrift/blob/v0.24.0/CHANGES.md\n\nPlease note that this bump includes CVE-2026-41608:\nhttps://lists.apache.org/thread/vwsbcwqdpwdtp8qkjo11ol6rodbfm21f\nwhich fixes a security bug in the python bindings that are not used by\nbuildroot.\n\nBuilding this defconfig\n\nBR2_aarch64=y\nBR2_TOOLCHAIN_EXTERNAL=y\nBR2_TOOLCHAIN_EXTERNAL_CUSTOM=y\nBR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y\nBR2_TOOLCHAIN_EXTERNAL_URL=\"http://toolchains.bootlin.com/downloads/releases/toolchains/aarch64--glibc--bleeding-edge-2017.05-toolchains-1-2.tar.bz2\"\nBR2_TOOLCHAIN_EXTERNAL_GCC_6=y\nBR2_TOOLCHAIN_EXTERNAL_HEADERS_4_9=y\nBR2_TOOLCHAIN_EXTERNAL_CUSTOM_GLIBC=y\nBR2_TOOLCHAIN_EXTERNAL_CXX=y\nBR2_PACKAGE_THRIFT=y\n\nwithout this bump does not cause build errors.\n\nThe Gitlab pipelines detected a build error for this bump with the\ndefconfig bootlin-aarch64-glibc-old:\n\n/builds/bkuhls/buildroot/br-test-pkg/bootlin-aarch64-glibc-old/build/thrift-0.24.0/lib/cpp/src/thrift/transport/TBufferTransports.h:110:32:\n error: \u2018ptrdiff_t\u2019 does not name a type\n\nTo fix the problem we add a patch to include cstddef.\n\nSigned-off-by: Bernd Kuhls <bernd@kuhls.net>\nSigned-off-by: Julien Olivain <ju.o@free.fr>"
18+
},
419
"GHSA-5QPQ-XQFV-J9PG": {
520
"6f125a653038c9460b515b1f0d4c8c4be37d88c3": "package/xz: security bump version to 5.8.4\n\nhttps://github.com/tukaani-project/xz/releases/tag/v5.8.4\n\n- lzma_alone_decoder(), lzma_lzip_decoder(),\n lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an\n invalid memory access after memory allocation has failed and\n the application reinitializes the existing decoder to decode\n a different file. This bug could at least result in a crash.\n This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.\n (Also in v5.2, v5.4, and v5.6.)\n\nSigned-off-by: Bernd Kuhls <bernd@kuhls.net>\nSigned-off-by: Peter Korsgaard <peter@korsgaard.com>"
621
},

0 commit comments

Comments
 (0)