Sync Collecting Fix Commits: Wed Sep 9 08:29:28 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -2,7 +2,9 @@
   "vcs_url": "https://android.googlesource.com/platform/frameworks/base",
   "vulnerabilities": {
     "CVE-2025-22442": {
-      "79dd06a8c17c5e5b8a5a22b4f8819a5c8c263011": "CVE-2025-22442: set profile user restrictions earlier\n\nBug: 382064697\nFlag: EXEMPT BUGFIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:994366d40c9519f00a9a67c554f7b459ebf587ee\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:0821e223d2d989c7c3b3820faa063e982aed6dc7\nMerged-In: I9019c05f61455feb1ce03d0dd8818a6f13c7af97\nChange-Id: I9019c05f61455feb1ce03d0dd8818a6f13c7af97"
+      "e7890bc1f9c067be1a351a2e90ef261aba98e57c": "CVE-2025-22442: set profile user restrictions earlier\n\nBug: 382064697\nFlag: EXEMPT BUGFIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:7774f273686c4022ba609b783b87d75b96deeaa3\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:63c6b64431826ecf2741e2f0640dafe372a06cf8\nMerged-In: Ib71ff2a93dd16f4b7373db30ea24fffc45a42880\nChange-Id: Ib71ff2a93dd16f4b7373db30ea24fffc45a42880",
+      "79dd06a8c17c5e5b8a5a22b4f8819a5c8c263011": "CVE-2025-22442: set profile user restrictions earlier\n\nBug: 382064697\nFlag: EXEMPT BUGFIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:994366d40c9519f00a9a67c554f7b459ebf587ee\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:0821e223d2d989c7c3b3820faa063e982aed6dc7\nMerged-In: I9019c05f61455feb1ce03d0dd8818a6f13c7af97\nChange-Id: I9019c05f61455feb1ce03d0dd8818a6f13c7af97",
+      "59a2f1fa1a7c7a5b83d8696799339cad73a32cff": "CVE-2025-22442: set profile user restrictions earlier\n\nBug: 382064697\nFlag: EXEMPT BUGFIX\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:7774f273686c4022ba609b783b87d75b96deeaa3\nCherrypick-From: https://googleplex-android-review.googlesource.com/q/commit:5d892d00333f39d59eec63fc9dc3c8765c7cd236\nMerged-In: Ib71ff2a93dd16f4b7373db30ea24fffc45a42880\nChange-Id: Ib71ff2a93dd16f4b7373db30ea24fffc45a42880"
     },
     "CVE-2025-48525": {
       "bde20ba16ceac713395a347a8a0fd18d3b7792b3": "Revert \"[CDM] Revoke NLS when all associations are removed.\"\n\nThis reverts commit a987e9d91a93b5945ac7d6477e6d34cd2715f2ec.\n\nReason for revert: CVE-2025-48525 A-391895151 is being removed from ASB#2025-09 due to a possible regression that may prevent Android Auto projection to launch properly. Partners are recommended to remove this fix until the updated fix is available.\n\nBug: 391895151\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:cd108837baa0008e53f93eba3208db56a0499bb0)\nMerged-In: I648f49c7413afebf46409806a90db2576b5ef5af\nChange-Id: I648f49c7413afebf46409806a90db2576b5ef5af"

data/fix-commits/base-9ee096e2.json

@@ -1,13 +1,14 @@
 {
   "vcs_url": "https://gitlab.com/gitlab-org/gitlab",
   "vulnerabilities": {
+    "CVE-2022-1944": {
+      "3748b61510b95e299ef1c49363bca252bf1e42b9": "Allow administrators in Admin Mode to open job terminals\n\nThe owner_of_job condition on this rule closed CVE-2022-1944, where a\nuser with the Developer role could open a terminal on another\nDeveloper's running job. That report was about peer access inside a\nproject. An administrator is neither its actor nor its target, but the\ncondition caught them anyway, so an administrator who did not trigger a\njob sees no debug button and cannot reach the terminal action.\n\nAdmin Mode is not reachable by a user with the Developer role, so this\nbranch does not reopen the report.\n\nWhere the instance setting for Admin Mode is off, the admin condition\nfalls back to a plain administrator check with no re-authentication\nstep. See app/policies/base_policy.rb.\n\nChangelog: changed",
+      "c61e79b49c28112dbb391bb7e6df6c10194ff83f": "Correct who can run interactive web terminals\n\nThe permissions table has granted this ability by role since the feature\nshipped. Since 15.1 only the user who triggered a job can run its\nterminal, so the row is wrong for both roles it marks.\n\nThe ownership condition arrived with the fix for CVE-2022-1944, which\nstopped a user with the Developer role from opening a terminal on\nanother user's running job. The table was never updated with it. The\nfeature page states the rule correctly.\n\nRelated to https://gitlab.com/gitlab-org/gitlab/-/issues/616886"
+    },
     "GHSA-2X63-GW47-W4MM": {
       "11985383a7e66db208dab02742fb9debb8bfaa50": "Merge branch 'duo/fix/626827-bump-websocket-driver-to-0.8.2' into 'master' \n\nBump websocket-driver to 0.8.2 in remaining lockfiles (GHSA-2x63-gw47-w4mm)\n\nSee merge request https://gitlab.com/gitlab-org/gitlab/-/merge_requests/252879\n\nMerged-by: Panos Kanellidis <pkanellidis@gitlab.com>\nApproved-by: Anas Shahid <ashahid@gitlab.com>\nApproved-by: Panos Kanellidis <pkanellidis@gitlab.com>\nCo-authored-by: Duo Developer <service_account_group_9970_1976e9ecde3c53c783b64edb9ae993eb@noreply.gitlab.com>",
       "dbec9ef841fec3bf7e893642aeecf33b2f8a77ce": "Bump websocket-driver to 0.8.2 in remaining lockfiles\n\nFix GHSA-2x63-gw47-w4mm by updating websocket-driver from outdated\nversions in two lockfiles that were missed in the initial fix:\n- gems/gitlab-database-load_balancing: 0.8.0 -> 0.8.2\n- vendor/gems/microsoft_graph_mailer: 0.7.5 -> 0.8.2\n\nResolves https://gitlab.com/gitlab-org/gitlab/-/work_items/626827\n\nChangelog: security"
     },
-    "CVE-2022-1944": {
-      "c61e79b49c28112dbb391bb7e6df6c10194ff83f": "Correct who can run interactive web terminals\n\nThe permissions table has granted this ability by role since the feature\nshipped. Since 15.1 only the user who triggered a job can run its\nterminal, so the row is wrong for both roles it marks.\n\nThe ownership condition arrived with the fix for CVE-2022-1944, which\nstopped a user with the Developer role from opening a terminal on\nanother user's running job. The table was never updated with it. The\nfeature page states the rule correctly.\n\nRelated to https://gitlab.com/gitlab-org/gitlab/-/issues/616886"
-    },
     "CVE-2026-32700": {
       "93801163255d9f56f4754d64d2a8e7391e43c6be": "Upgrade devise gem from 4.9.4 to 5.0.4\n\nBumps devise to v5.0.4 to resolve CVE-2026-32700 and CVE-2026-40295.\n\nAlso relaxes the devise version constraint in the vendored\ndevise-pbkdf2-encryptable gemspec from '~> 4.0' to '>= 4.0, < 6.0'\nto allow compatibility with devise v5.\n\nResolves https://gitlab.com/gitlab-org/gitlab/-/work_items/606702\n\nChangelog: security"
     },

data/fix-commits/git-e83ef8ed.json

@@ -1,6 +1,9 @@
 {
   "vcs_url": "https://github.com/imagemagick/imagemagick",
   "vulnerabilities": {
+    "GHSA-2VWG-3G4G-QPRM": {
+      "cafc7372c8113a9636766f0eddde7b90373c9b44": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-2vwg-3g4g-qprm"
+    },
     "GHSA-VV56-WMGW-M36W": {
       "ce92ae07c2ca2c20c131eaf6da6da734c1cafce0": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-vv56-wmgw-m36w"
     },

data/fix-commits/gitlab-accd617b.json

@@ -1,6 +1,22 @@
 {
   "vcs_url": "https://github.com/nixos/nixpkgs",
   "vulnerabilities": {
+    "CVE-2026-84964": {
+      "c05d66308e17058e87bcb4ac67196a5d3b2747ac": "mongoc: 1.30.3 -> 1.30.9\n\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.4\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.5\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.7\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.8\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.9\n\nthis also automaticaly fixes the cmake error currently occuring with\ncmake 4.4.0+ on staging-next (https://hydra.nixos.org/build/344554671)\nas\nhttps://github.com/mongodb/mongo-c-driver/commit/3f9366cb27623f1a6f3b038146235059a378ad6d\nis included in this release.\n\nFixes: CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-84963\n(cherry picked from commit 9a63787cc28e8c3563386113217d3fa9f9cdd593)",
+      "9a63787cc28e8c3563386113217d3fa9f9cdd593": "mongoc: 1.30.3 -> 1.30.9\n\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.4\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.5\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.7\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.8\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.9\n\nthis also automaticaly fixes the cmake error currently occuring with\ncmake 4.4.0+ on staging-next (https://hydra.nixos.org/build/344554671)\nas\nhttps://github.com/mongodb/mongo-c-driver/commit/3f9366cb27623f1a6f3b038146235059a378ad6d\nis included in this release.\n\nFixes: CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-84963"
+    },
+    "CVE-2026-84965": {
+      "c05d66308e17058e87bcb4ac67196a5d3b2747ac": "mongoc: 1.30.3 -> 1.30.9\n\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.4\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.5\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.7\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.8\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.9\n\nthis also automaticaly fixes the cmake error currently occuring with\ncmake 4.4.0+ on staging-next (https://hydra.nixos.org/build/344554671)\nas\nhttps://github.com/mongodb/mongo-c-driver/commit/3f9366cb27623f1a6f3b038146235059a378ad6d\nis included in this release.\n\nFixes: CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-84963\n(cherry picked from commit 9a63787cc28e8c3563386113217d3fa9f9cdd593)",
+      "9a63787cc28e8c3563386113217d3fa9f9cdd593": "mongoc: 1.30.3 -> 1.30.9\n\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.4\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.5\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.7\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.8\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.9\n\nthis also automaticaly fixes the cmake error currently occuring with\ncmake 4.4.0+ on staging-next (https://hydra.nixos.org/build/344554671)\nas\nhttps://github.com/mongodb/mongo-c-driver/commit/3f9366cb27623f1a6f3b038146235059a378ad6d\nis included in this release.\n\nFixes: CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-84963"
+    },
+    "CVE-2026-84969": {
+      "c05d66308e17058e87bcb4ac67196a5d3b2747ac": "mongoc: 1.30.3 -> 1.30.9\n\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.4\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.5\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.7\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.8\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.9\n\nthis also automaticaly fixes the cmake error currently occuring with\ncmake 4.4.0+ on staging-next (https://hydra.nixos.org/build/344554671)\nas\nhttps://github.com/mongodb/mongo-c-driver/commit/3f9366cb27623f1a6f3b038146235059a378ad6d\nis included in this release.\n\nFixes: CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-84963\n(cherry picked from commit 9a63787cc28e8c3563386113217d3fa9f9cdd593)",
+      "9a63787cc28e8c3563386113217d3fa9f9cdd593": "mongoc: 1.30.3 -> 1.30.9\n\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.4\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.5\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.7\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.8\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.9\n\nthis also automaticaly fixes the cmake error currently occuring with\ncmake 4.4.0+ on staging-next (https://hydra.nixos.org/build/344554671)\nas\nhttps://github.com/mongodb/mongo-c-driver/commit/3f9366cb27623f1a6f3b038146235059a378ad6d\nis included in this release.\n\nFixes: CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-84963"
+    },
+    "CVE-2026-84963": {
+      "c05d66308e17058e87bcb4ac67196a5d3b2747ac": "mongoc: 1.30.3 -> 1.30.9\n\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.4\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.5\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.7\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.8\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.9\n\nthis also automaticaly fixes the cmake error currently occuring with\ncmake 4.4.0+ on staging-next (https://hydra.nixos.org/build/344554671)\nas\nhttps://github.com/mongodb/mongo-c-driver/commit/3f9366cb27623f1a6f3b038146235059a378ad6d\nis included in this release.\n\nFixes: CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-84963\n(cherry picked from commit 9a63787cc28e8c3563386113217d3fa9f9cdd593)",
+      "9a63787cc28e8c3563386113217d3fa9f9cdd593": "mongoc: 1.30.3 -> 1.30.9\n\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.4\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.5\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.6\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.7\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.8\nhttps://github.com/mongodb/mongo-c-driver/releases/tag/1.30.9\n\nthis also automaticaly fixes the cmake error currently occuring with\ncmake 4.4.0+ on staging-next (https://hydra.nixos.org/build/344554671)\nas\nhttps://github.com/mongodb/mongo-c-driver/commit/3f9366cb27623f1a6f3b038146235059a378ad6d\nis included in this release.\n\nFixes: CVE-2026-84964, CVE-2026-84965, CVE-2026-84969, CVE-2026-84963"
+    },
     "CVE-2026-79604": {
       "d8a628df371e38d77b7849ed6b83be2614a1b409": "ocamlPackages.oxenstored: patch with XSA-512\n\n            Xen Security Advisory CVE-2026-79604 / XSA-512\n                               version 3\n\n             oxenstored: Unbounded accumulation of watches\n\nOxenstored maintains two datastructures about watches; one global trie,\nand one hashtable tracked per domain.  When a xenbus reconnect is\nrequested, watches are not cleared out of the global trie.\n\nA guest can cause unbounded memory usage in oxenstored.  This can lead\nto a system-wide DoS.\n\nThis is the XAPI oxenstored patch.\n\nhttps://xenbits.xenproject.org/xsa/advisory-512.html\n\nSigned-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>",
       "a36b0d5d62e07851b4a9bd65d5f1617d11604593": "xen: patch with XSA-512\n\n            Xen Security Advisory CVE-2026-79604 / XSA-512\n                               version 3\n\n             oxenstored: Unbounded accumulation of watches\n\nOxenstored maintains two datastructures about watches; one global trie,\nand one hashtable tracked per domain.  When a xenbus reconnect is\nrequested, watches are not cleared out of the global trie.\n\nA guest can cause unbounded memory usage in oxenstored.  This can lead\nto a system-wide DoS.\n\nThis is the Xen oxenstored patch.\n\nhttps://xenbits.xenproject.org/xsa/advisory-512.html\n\nSigned-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>"
@@ -381,6 +397,10 @@
       "dcd7ad7d9ed5573a2e7844bf96d0deedd992f3a1": "[26.05] dolibarr: fix CVE-2026-81728 and CVE-2026-82633 (#558698)",
       "5d53f7125d453c62b38d6f38493506c5f4a91662": "dolibarr: fix CVE-2026-81728 and CVE-2026-82633\n\nAssisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)\nNot-cherry-picked-because: master is already fixed by Dolibarr 24.0.0"
     },
+    "CVE-2023-29552": {
+      "808056bc4afd7d0da8a678b4f50a190e5bd0b8b0": "openslp: drop\n\nAffected by CVE-2023-29552: https://ubuntu.com/security/CVE-2023-29552",
+      "aa8c9e7d23dbd3844d26c36e914557b9477bee71": "openslp: Mark vulnerable to CVE-2023-29552"
+    },
     "CVE-2026-84353": {
       "cb032254520de4ab99e737f6d754561b975cc37d": "ungoogled-chromium: 152.0.7977.64-1 -> 152.0.7977.75-1\n\nhttps://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html\n\nThis update includes 26 security fixes.\n\nCVEs:\nCVE-2026-84353 CVE-2026-84352 CVE-2026-84354 CVE-2026-84359\nCVE-2026-84357 CVE-2026-84324 CVE-2026-84349 CVE-2026-84326\nCVE-2026-84333 CVE-2026-84351 CVE-2026-84325 CVE-2026-84328\nCVE-2026-84347 CVE-2026-84323 CVE-2026-84355 CVE-2026-84358\nCVE-2026-84332 CVE-2026-84330 CVE-2026-84334 CVE-2026-84348\nCVE-2026-84335 CVE-2026-84327 CVE-2026-84329 CVE-2026-84356\nCVE-2026-84350 CVE-2026-84331\n\n(cherry picked from commit d1173f76d8fb2f202e9e1cfdb89dc5998bf597d9)",
       "d1173f76d8fb2f202e9e1cfdb89dc5998bf597d9": "ungoogled-chromium: 152.0.7977.64-1 -> 152.0.7977.75-1\n\nhttps://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html\n\nThis update includes 26 security fixes.\n\nCVEs:\nCVE-2026-84353 CVE-2026-84352 CVE-2026-84354 CVE-2026-84359\nCVE-2026-84357 CVE-2026-84324 CVE-2026-84349 CVE-2026-84326\nCVE-2026-84333 CVE-2026-84351 CVE-2026-84325 CVE-2026-84328\nCVE-2026-84347 CVE-2026-84323 CVE-2026-84355 CVE-2026-84358\nCVE-2026-84332 CVE-2026-84330 CVE-2026-84334 CVE-2026-84348\nCVE-2026-84335 CVE-2026-84327 CVE-2026-84329 CVE-2026-84356\nCVE-2026-84350 CVE-2026-84331",
@@ -30991,9 +31011,6 @@
       "b65d5650628bdba206410b1427009b6fa86caccd": "Merge pull request #219350 from yl3dy/strongswan-cve-2023-26463\n\nstrongswan: fix CVE-2023-26463",
       "56227123fc7ad32103af6726d1f65cf0da3c80d9": "strongswan: fix CVE-2023-26463\n\nhttps://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html"
     },
-    "CVE-2023-29552": {
-      "aa8c9e7d23dbd3844d26c36e914557b9477bee71": "openslp: Mark vulnerable to CVE-2023-29552"
-    },
     "CVE-2023-22845": {
       "46559d5fca477f1d5ce692253be958b64abd6834": "openimageio_1: add CVE-2023-22845, CVE-2023-24472 & CVE-2023-24473 to knownVulnerabilities"
     },