Skip to content

Commit baf43ea

Browse files
aboutcode-automationaboutcode-automation
committed
Sync Collecting Fix Commits: Wed Aug 12 17:50:01 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent 52c8e65 commit baf43ea

7 files changed

Lines changed: 167 additions & 7 deletions

File tree

‎data/fix-commits/advisory-database-b78f1d41.json‎

Lines changed: 86 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,92 @@
11
{
22
"vcs_url": "https://github.com/github/advisory-database",
33
"vulnerabilities": {
4+
"GHSA-2Q7C-5GJM-7Q23": {
5+
"bfef29f8e04ad5037181f98a990572d825dff579": "Publish Advisories\n\nGHSA-2q7c-5gjm-7q23\nGHSA-3pjj-qpw6-5fcm\nGHSA-mwpv-rg79-863c\nGHSA-3pjj-qpw6-5fcm\nGHSA-mwpv-rg79-863c"
6+
},
7+
"GHSA-3PJJ-QPW6-5FCM": {
8+
"bfef29f8e04ad5037181f98a990572d825dff579": "Publish Advisories\n\nGHSA-2q7c-5gjm-7q23\nGHSA-3pjj-qpw6-5fcm\nGHSA-mwpv-rg79-863c\nGHSA-3pjj-qpw6-5fcm\nGHSA-mwpv-rg79-863c"
9+
},
10+
"GHSA-MWPV-RG79-863C": {
11+
"bfef29f8e04ad5037181f98a990572d825dff579": "Publish Advisories\n\nGHSA-2q7c-5gjm-7q23\nGHSA-3pjj-qpw6-5fcm\nGHSA-mwpv-rg79-863c\nGHSA-3pjj-qpw6-5fcm\nGHSA-mwpv-rg79-863c"
12+
},
13+
"GHSA-4R8W-73JC-3M7Q": {
14+
"1aa5c157625234561b20b817edfbd5607d6b0cad": "Publish Advisories\n\nGHSA-4r8w-73jc-3m7q\nGHSA-hc43-m36c-8v33\nGHSA-p5f7-rjhp-pxvc\nGHSA-ww38-37g9-m3q3\nGHSA-4r8w-73jc-3m7q\nGHSA-hc43-m36c-8v33\nGHSA-p5f7-rjhp-pxvc\nGHSA-ww38-37g9-m3q3"
15+
},
16+
"GHSA-HC43-M36C-8V33": {
17+
"1aa5c157625234561b20b817edfbd5607d6b0cad": "Publish Advisories\n\nGHSA-4r8w-73jc-3m7q\nGHSA-hc43-m36c-8v33\nGHSA-p5f7-rjhp-pxvc\nGHSA-ww38-37g9-m3q3\nGHSA-4r8w-73jc-3m7q\nGHSA-hc43-m36c-8v33\nGHSA-p5f7-rjhp-pxvc\nGHSA-ww38-37g9-m3q3"
18+
},
19+
"GHSA-P5F7-RJHP-PXVC": {
20+
"1aa5c157625234561b20b817edfbd5607d6b0cad": "Publish Advisories\n\nGHSA-4r8w-73jc-3m7q\nGHSA-hc43-m36c-8v33\nGHSA-p5f7-rjhp-pxvc\nGHSA-ww38-37g9-m3q3\nGHSA-4r8w-73jc-3m7q\nGHSA-hc43-m36c-8v33\nGHSA-p5f7-rjhp-pxvc\nGHSA-ww38-37g9-m3q3"
21+
},
22+
"GHSA-WW38-37G9-M3Q3": {
23+
"1aa5c157625234561b20b817edfbd5607d6b0cad": "Publish Advisories\n\nGHSA-4r8w-73jc-3m7q\nGHSA-hc43-m36c-8v33\nGHSA-p5f7-rjhp-pxvc\nGHSA-ww38-37g9-m3q3\nGHSA-4r8w-73jc-3m7q\nGHSA-hc43-m36c-8v33\nGHSA-p5f7-rjhp-pxvc\nGHSA-ww38-37g9-m3q3"
24+
},
25+
"GHSA-5VPF-XVV7-C8VH": {
26+
"b84cc9611c792f4bb2aa85b1cc83d79c3e838231": "Publish Advisories\n\nGHSA-5vpf-xvv7-c8vh\nGHSA-8r2h-xh92-gq57\nGHSA-x2r2-rvhq-2mqv\nGHSA-5vpf-xvv7-c8vh\nGHSA-8r2h-xh92-gq57\nGHSA-x2r2-rvhq-2mqv"
27+
},
28+
"GHSA-8R2H-XH92-GQ57": {
29+
"b84cc9611c792f4bb2aa85b1cc83d79c3e838231": "Publish Advisories\n\nGHSA-5vpf-xvv7-c8vh\nGHSA-8r2h-xh92-gq57\nGHSA-x2r2-rvhq-2mqv\nGHSA-5vpf-xvv7-c8vh\nGHSA-8r2h-xh92-gq57\nGHSA-x2r2-rvhq-2mqv"
30+
},
31+
"GHSA-X2R2-RVHQ-2MQV": {
32+
"b84cc9611c792f4bb2aa85b1cc83d79c3e838231": "Publish Advisories\n\nGHSA-5vpf-xvv7-c8vh\nGHSA-8r2h-xh92-gq57\nGHSA-x2r2-rvhq-2mqv\nGHSA-5vpf-xvv7-c8vh\nGHSA-8r2h-xh92-gq57\nGHSA-x2r2-rvhq-2mqv"
33+
},
34+
"GHSA-P8QJ-FJ6R-W7Q9": {
35+
"f1c83d1f5a08b3e0b325d51c09b3c45c40249193": "Publish Advisories\n\nGHSA-p8qj-fj6r-w7q9\nGHSA-p8qj-fj6r-w7q9"
36+
},
37+
"GHSA-9FW2-H3HF-293R": {
38+
"c1ef9c8832074eccfe711bcbeb494c1fbfd6e3bc": "Publish Advisories\n\nGHSA-9fw2-h3hf-293r\nGHSA-9fw2-h3hf-293r"
39+
},
40+
"GHSA-5WHC-4Q84-FJ73": {
41+
"9121792a4656567c10b44860965a8bc6ccc8da9d": "Publish Advisories\n\nGHSA-5whc-4q84-fj73\nGHSA-5whc-4q84-fj73"
42+
},
43+
"GHSA-M69X-PW9P-7J3Q": {
44+
"ea2d35bad29759cfd7c3af3e7368c1d74c039470": "Publish Advisories\n\nGHSA-m69x-pw9p-7j3q\nGHSA-xg2j-3hj6-pc24\nGHSA-m69x-pw9p-7j3q\nGHSA-xg2j-3hj6-pc24"
45+
},
46+
"GHSA-XG2J-3HJ6-PC24": {
47+
"ea2d35bad29759cfd7c3af3e7368c1d74c039470": "Publish Advisories\n\nGHSA-m69x-pw9p-7j3q\nGHSA-xg2j-3hj6-pc24\nGHSA-m69x-pw9p-7j3q\nGHSA-xg2j-3hj6-pc24"
48+
},
49+
"GHSA-6RPQ-6VV2-5222": {
50+
"133ad1310dfedfbdb25f9eee0f9d74fc17fc0834": "Publish Advisories\n\nGHSA-6rpq-6vv2-5222\nGHSA-6rpq-6vv2-5222"
51+
},
52+
"GHSA-H47F-GMJP-M7RR": {
53+
"a1a4224d71743d2786ebc1a8cd9e2fe0ab7caaba": "Publish Advisories\n\nGHSA-h47f-gmjp-m7rr\nGHSA-q939-rpr3-3284"
54+
},
55+
"GHSA-Q939-RPR3-3284": {
56+
"a1a4224d71743d2786ebc1a8cd9e2fe0ab7caaba": "Publish Advisories\n\nGHSA-h47f-gmjp-m7rr\nGHSA-q939-rpr3-3284"
57+
},
58+
"GHSA-3763-QP59-59VF": {
59+
"bb21d3fa82e759a368f888208fd6a7fd460ef9df": "Publish Advisories\n\nGHSA-3763-qp59-59vf\nGHSA-6pvm-2vjj-rx4w\nGHSA-88p2-jj8w-j8qg\nGHSA-jmqm-f8q4-v7wx"
60+
},
61+
"GHSA-6PVM-2VJJ-RX4W": {
62+
"bb21d3fa82e759a368f888208fd6a7fd460ef9df": "Publish Advisories\n\nGHSA-3763-qp59-59vf\nGHSA-6pvm-2vjj-rx4w\nGHSA-88p2-jj8w-j8qg\nGHSA-jmqm-f8q4-v7wx"
63+
},
64+
"GHSA-88P2-JJ8W-J8QG": {
65+
"bb21d3fa82e759a368f888208fd6a7fd460ef9df": "Publish Advisories\n\nGHSA-3763-qp59-59vf\nGHSA-6pvm-2vjj-rx4w\nGHSA-88p2-jj8w-j8qg\nGHSA-jmqm-f8q4-v7wx"
66+
},
67+
"GHSA-JMQM-F8Q4-V7WX": {
68+
"bb21d3fa82e759a368f888208fd6a7fd460ef9df": "Publish Advisories\n\nGHSA-3763-qp59-59vf\nGHSA-6pvm-2vjj-rx4w\nGHSA-88p2-jj8w-j8qg\nGHSA-jmqm-f8q4-v7wx"
69+
},
70+
"GHSA-5C4F-9PQ9-6C77": {
71+
"9d7c21b1fa4b3249987b13c1b6c3a9d897418610": "Publish Advisories\n\nGHSA-5c4f-9pq9-6c77\nGHSA-j5jq-cr68-v2xx"
72+
},
73+
"GHSA-J5JQ-CR68-V2XX": {
74+
"9d7c21b1fa4b3249987b13c1b6c3a9d897418610": "Publish Advisories\n\nGHSA-5c4f-9pq9-6c77\nGHSA-j5jq-cr68-v2xx"
75+
},
76+
"GHSA-FRVP-7C67-39W9": {
77+
"c549a81c2f1a00ab8428ba43ce447983d55435fb": "Improve GHSA-frvp-7c67-39w9",
78+
"71f9a776dcc57c73b43bfde87d4fed2dd6e5116c": "Improve GHSA-frvp-7c67-39w9",
79+
"32e7885f9dd6f50edc2a4b9aee21e32f55f76f84": "Publish Advisories\n\nGHSA-frvp-7c67-39w9\nGHSA-xgm2-5f3f-mvvc"
80+
},
81+
"GHSA-M7JC-G4RC-JMVH": {
82+
"34fdec434e7d1e6d824e29110ed9747803636521": "Publish Advisories\n\nGHSA-m7jc-g4rc-jmvh\nGHSA-v7cf-8gh9-gxmj\nGHSA-vgp4-2fc4-qff2"
83+
},
84+
"GHSA-V7CF-8GH9-GXMJ": {
85+
"34fdec434e7d1e6d824e29110ed9747803636521": "Publish Advisories\n\nGHSA-m7jc-g4rc-jmvh\nGHSA-v7cf-8gh9-gxmj\nGHSA-vgp4-2fc4-qff2"
86+
},
87+
"GHSA-VGP4-2FC4-QFF2": {
88+
"34fdec434e7d1e6d824e29110ed9747803636521": "Publish Advisories\n\nGHSA-m7jc-g4rc-jmvh\nGHSA-v7cf-8gh9-gxmj\nGHSA-vgp4-2fc4-qff2"
89+
},
490
"GHSA-28WG-GHJ8-5HJV": {
591
"ab12e627c4f8db93d09c44ddcff54c649a7c7a16": "Improve GHSA-28wg-ghj8-5hjv",
692
"95c9fc812ec5669683acefd1d20ff9586fef36c8": "Publish Advisories\n\nGHSA-5p2g-fcmc-qvqq\nGHSA-w3rx-r6r6-pgpr\nGHSA-28wg-ghj8-5hjv"
@@ -2677,10 +2763,6 @@
26772763
"GHSA-XQR5-6593-973M": {
26782764
"ab64d2689922b4d5356117c22a58696efcf8f103": "Publish Advisories\n\nGHSA-4m43-9f84-rm49\nGHSA-57h4-c69h-52fm\nGHSA-59rr-38mm-f3g9\nGHSA-59wm-6vhj-9fgr\nGHSA-5gg4-m865-6qwr\nGHSA-5j5v-r5qf-p5c4\nGHSA-6ghg-p2q3-j73x\nGHSA-6wp8-c88g-h8qm\nGHSA-9f46-w698-g5q9\nGHSA-gjcp-gv56-hccw\nGHSA-gx6f-fm4p-x72r\nGHSA-h3q5-7qh5-pg2p\nGHSA-hjcp-jmpx-g3qm\nGHSA-jfpp-p8m5-m237\nGHSA-pp6r-c7gq-g5pr\nGHSA-pwxm-3jqh-j7gq\nGHSA-r7mx-568f-jgg3\nGHSA-vfgx-g9m5-wfgv\nGHSA-vq3f-pc8h-pv73\nGHSA-wp32-3jr9-wf9m\nGHSA-xqr5-6593-973m"
26792765
},
2680-
"GHSA-FRVP-7C67-39W9": {
2681-
"71f9a776dcc57c73b43bfde87d4fed2dd6e5116c": "Improve GHSA-frvp-7c67-39w9",
2682-
"32e7885f9dd6f50edc2a4b9aee21e32f55f76f84": "Publish Advisories\n\nGHSA-frvp-7c67-39w9\nGHSA-xgm2-5f3f-mvvc"
2683-
},
26842766
"GHSA-2QGP-6C6G-CMWV": {
26852767
"4bccde75489609e3f7728de6aa6bbc657e3046c4": "Publish Advisories\n\nGHSA-2qgp-6c6g-cmwv\nGHSA-65r4-f2jx-xqqr\nGHSA-q9wm-fmhh-v7p9\nGHSA-qfcq-v28c-qmm4\nGHSA-r273-83r5-88cp\nGHSA-x65g-869w-3ggw"
26862768
},

‎data/fix-commits/libvirt-17f92cad.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
{
22
"vcs_url": "https://gitlab.com/libvirt/libvirt",
33
"vulnerabilities": {
4+
"CVE-2026-18917": {
5+
"5a62cbf2907d4590283597b46da9c0f41e7b4d4f": "remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917)\n\nCVE-2026-18917\n\nThe RPC handler 'remoteDispatchNodeGetFreePages' multiplies the 'npages'\nargument with the 'cellcount' argument passed to 'virNodeGetFreePages',\nboth of which are declared as 'unsigned int' to both do an RPC limit\ncheck against the 'REMOTE_NODE_MAX_CELLS' constant and then to allocate\nthe memory to hold the result from the actual hypervisor driver.\n\nSince both the values are 'unsigned int' the product is also unsigned\nint so big enough numbers can overflow, both passing the check and also\nallocating not enough memory for the result. The hypervisor driver\nassumes that the passed buffer is large enough and overwrites memory.\n\nWhen this happens the the hypervisor daemon crashes.\n\nThis can be triggered e.g. by passing 1023 and 4198405 as values which\nmultiply to 1019 after wrapping to 32 bit unsigned value.\n\nUse the VIR_INT_MULTIPLY_OVERFLOW macro in the check to avoid the issue\nthe same way as we do for other APIs doing multiplication of arguments\nto determine amount of required memory.\n\nFixes: 34f2d0319d2098c77c8cc27d8350616029125a2b (v1.2.5-164-g34f2d0319d)\nCloses: https://gitlab.com/libvirt/libvirt/-/work_items/903\nSigned-off-by: Peter Krempa <pkrempa@redhat.com>\nReviewed-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>"
6+
},
47
"CVE-2025-13193": {
58
"69335a484768d550854da1133d5490074695e825": "storage: create images with a private umask during qemu-img create/convert\n\nOn the local (non-NETFS) path virStorageBackendCreateExecCommand() ran\nqemu-img with umask 0, so the destination image was created\nworld-readable (0644) and the full source disk was written into it\nbefore libvirt tightened the mode with a later chmod(). This is the same\nclass as CVE-2025-13193; apply the same fix by setting a 0077 umask so\nqemu-img creates the file private from the start.\n\nFixes: CVE-2026-63623\nReported-by: HE WEI\uff08\u30ae\u30ab\u30af\uff09 <skyexpoc@gmail.com>\nSigned-off-by: HE WEI\uff08\u30ae\u30ab\u30af\uff09 <skyexpoc@gmail.com>\n[DB: merged the two virCommandSetUmask to one]\nReviewed-by: J\u00e1n Tomko <jtomko@redhat.com>\nSigned-off-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>",
69
"2504f6f99bf5decd6c3857cca786f2cac48f5795": "NEWS: Mention CVE-2025-13193 and improvements for block stats/config and backups\n\nSigned-off-by: Peter Krempa <pkrempa@redhat.com>\nReviewed-by: Jiri Denemark <jdenemar@redhat.com>"

0 commit comments

Comments
 (0)