Skip to content

Commit d64c332

Browse files
aboutcode-automationaboutcode-automation
committed
Sync Collecting Fix Commits: Sun Aug 30 22:32:09 UTC 2026
Signed-off-by: AboutCode Automation <automation@aboutcode.org>
1 parent fb227a9 commit d64c332

4 files changed

Lines changed: 67 additions & 0 deletions

File tree

‎data/fix-commits/advisory-database-b78f1d41.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,66 @@
11
{
22
"vcs_url": "https://github.com/github/advisory-database",
33
"vulnerabilities": {
4+
"GHSA-M3GJ-74X3-VC94": {
5+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
6+
},
7+
"GHSA-24X6-X325-JQ73": {
8+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
9+
},
10+
"GHSA-6JCG-QGQ8-G5V3": {
11+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
12+
},
13+
"GHSA-8PHR-845G-QM53": {
14+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
15+
},
16+
"GHSA-98QM-M636-J482": {
17+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
18+
},
19+
"GHSA-GV76-63G6-CRCF": {
20+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
21+
},
22+
"GHSA-HHM8-R256-G2G6": {
23+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
24+
},
25+
"GHSA-MX6F-C9QG-RQ5J": {
26+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
27+
},
28+
"GHSA-QM67-7H74-XJP2": {
29+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
30+
},
31+
"GHSA-R8W5-55MM-GXP4": {
32+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
33+
},
34+
"GHSA-WH46-V79M-W9CQ": {
35+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
36+
},
37+
"GHSA-XR92-VPVX-MM24": {
38+
"f236a70f2708a6aa408132459535abe64696cfda": "Publish Advisories\n\nGHSA-m3gj-74x3-vc94\nGHSA-24x6-x325-jq73\nGHSA-6jcg-qgq8-g5v3\nGHSA-8phr-845g-qm53\nGHSA-98qm-m636-j482\nGHSA-gv76-63g6-crcf\nGHSA-hhm8-r256-g2g6\nGHSA-mx6f-c9qg-rq5j\nGHSA-qm67-7h74-xjp2\nGHSA-r8w5-55mm-gxp4\nGHSA-wh46-v79m-w9cq\nGHSA-xr92-vpvx-mm24"
39+
},
40+
"GHSA-2GRQ-5G3V-CGMG": {
41+
"5550ea434681df9f657524372ee51c0492327c5a": "Publish Advisories\n\nGHSA-2grq-5g3v-cgmg\nGHSA-4856-mq7c-4vq3\nGHSA-fxp3-gjcq-53qx\nGHSA-jh33-xjhv-rf6g\nGHSA-ph8r-m79f-q97v\nGHSA-qcr2-8wjw-w786\nGHSA-rv8m-mrhh-346m\nGHSA-x8c2-cv62-f3wv"
42+
},
43+
"GHSA-4856-MQ7C-4VQ3": {
44+
"5550ea434681df9f657524372ee51c0492327c5a": "Publish Advisories\n\nGHSA-2grq-5g3v-cgmg\nGHSA-4856-mq7c-4vq3\nGHSA-fxp3-gjcq-53qx\nGHSA-jh33-xjhv-rf6g\nGHSA-ph8r-m79f-q97v\nGHSA-qcr2-8wjw-w786\nGHSA-rv8m-mrhh-346m\nGHSA-x8c2-cv62-f3wv"
45+
},
46+
"GHSA-FXP3-GJCQ-53QX": {
47+
"5550ea434681df9f657524372ee51c0492327c5a": "Publish Advisories\n\nGHSA-2grq-5g3v-cgmg\nGHSA-4856-mq7c-4vq3\nGHSA-fxp3-gjcq-53qx\nGHSA-jh33-xjhv-rf6g\nGHSA-ph8r-m79f-q97v\nGHSA-qcr2-8wjw-w786\nGHSA-rv8m-mrhh-346m\nGHSA-x8c2-cv62-f3wv"
48+
},
49+
"GHSA-JH33-XJHV-RF6G": {
50+
"5550ea434681df9f657524372ee51c0492327c5a": "Publish Advisories\n\nGHSA-2grq-5g3v-cgmg\nGHSA-4856-mq7c-4vq3\nGHSA-fxp3-gjcq-53qx\nGHSA-jh33-xjhv-rf6g\nGHSA-ph8r-m79f-q97v\nGHSA-qcr2-8wjw-w786\nGHSA-rv8m-mrhh-346m\nGHSA-x8c2-cv62-f3wv"
51+
},
52+
"GHSA-PH8R-M79F-Q97V": {
53+
"5550ea434681df9f657524372ee51c0492327c5a": "Publish Advisories\n\nGHSA-2grq-5g3v-cgmg\nGHSA-4856-mq7c-4vq3\nGHSA-fxp3-gjcq-53qx\nGHSA-jh33-xjhv-rf6g\nGHSA-ph8r-m79f-q97v\nGHSA-qcr2-8wjw-w786\nGHSA-rv8m-mrhh-346m\nGHSA-x8c2-cv62-f3wv"
54+
},
55+
"GHSA-QCR2-8WJW-W786": {
56+
"5550ea434681df9f657524372ee51c0492327c5a": "Publish Advisories\n\nGHSA-2grq-5g3v-cgmg\nGHSA-4856-mq7c-4vq3\nGHSA-fxp3-gjcq-53qx\nGHSA-jh33-xjhv-rf6g\nGHSA-ph8r-m79f-q97v\nGHSA-qcr2-8wjw-w786\nGHSA-rv8m-mrhh-346m\nGHSA-x8c2-cv62-f3wv"
57+
},
58+
"GHSA-RV8M-MRHH-346M": {
59+
"5550ea434681df9f657524372ee51c0492327c5a": "Publish Advisories\n\nGHSA-2grq-5g3v-cgmg\nGHSA-4856-mq7c-4vq3\nGHSA-fxp3-gjcq-53qx\nGHSA-jh33-xjhv-rf6g\nGHSA-ph8r-m79f-q97v\nGHSA-qcr2-8wjw-w786\nGHSA-rv8m-mrhh-346m\nGHSA-x8c2-cv62-f3wv"
60+
},
61+
"GHSA-X8C2-CV62-F3WV": {
62+
"5550ea434681df9f657524372ee51c0492327c5a": "Publish Advisories\n\nGHSA-2grq-5g3v-cgmg\nGHSA-4856-mq7c-4vq3\nGHSA-fxp3-gjcq-53qx\nGHSA-jh33-xjhv-rf6g\nGHSA-ph8r-m79f-q97v\nGHSA-qcr2-8wjw-w786\nGHSA-rv8m-mrhh-346m\nGHSA-x8c2-cv62-f3wv"
63+
},
464
"GHSA-42P8-VFG5-26VR": {
565
"631e472e68a0063b378c35500bf1bd64132a652a": "Publish Advisories\n\nGHSA-42p8-vfg5-26vr\nGHSA-54f9-jfc2-qh3v\nGHSA-9h33-6q7m-9r9j\nGHSA-9rhj-r9gw-f4p2\nGHSA-q78f-c32r-53f2\nGHSA-v975-p34v-4fvr"
666
},

‎data/fix-commits/buildroot-0b809119.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
{
22
"vcs_url": "https://github.com/buildroot/buildroot",
33
"vulnerabilities": {
4+
"CVE-2026-10846": {
5+
"911dc3a5d28ca33a1e44358a5c4760a6eba1f9ae": "package/libldns: security bump version to 1.9.2\n\nhttps://community.nlnetlabs.nl/t/ldns-1-9-1-released/3403\nhttps://community.nlnetlabs.nl/t/ldns-1-9-2-released/3404\n\"Please do not install ldns version 1.9.1 as it has a wrong .so version.\n Install ldns version 1.9.2 instead.\"\n\nFixes CVE-2026-10846.\n\nSigned-off-by: Bernd Kuhls <bernd@kuhls.net>\nSigned-off-by: Julien Olivain <ju.o@free.fr>"
6+
},
47
"CVE-2026-19499": {
58
"be382f6061216ca82a735d0992894c4e6fe5173a": "package/{glibc, localedef}: security bump version to 2.44-36-g2d5421ffc\n\nFixes the following CVEs:\n\nCVE-2026-19499:\nhttps://gitlab.com/gnutools/glibc/-/commit/63b53df549451a5d69fcba6d7612ea99f517e8e3\n\nCVE-2026-77117:\nhttps://gitlab.com/gnutools/glibc/-/commit/6f9b2bfa500bf5d1cff5d990adfff4b71298dadd\n\nCVE-2026-80489:\nhttps://gitlab.com/gnutools/glibc/-/commit/cb61572ea3f773e1e1978f6c412cc36a30acdb0c\n\nAdded GLIBC_IGNORE_CVES for CVE-2026-19542 which was forgotten in\nbuildroot commit 58f31377389dd2f5090e4dd69deb4d5f994f88c0.\n\nSigned-off-by: Bernd Kuhls <bernd@kuhls.net>\nSigned-off-by: Julien Olivain <ju.o@free.fr>"
69
},

‎data/fix-commits/jellyfin-8fb43f19.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
{
22
"vcs_url": "https://github.com/jellyfin/jellyfin",
33
"vulnerabilities": {
4+
"GHSA-9X85-GX46-6522": {
5+
"911ac3769cdcce50a8f6e0b3c0739d509bd9a23f": "Fix GHSA-9x85-gx46-6522"
6+
},
47
"GHSA-WWWM-PX48-FPVQ": {
58
"c04f11bd76acd19a1440bbb4351160642a09ef9c": "Merge pull request #17685 from jellyfin/GHSA-wwwm-px48-fpvq-v12\n\nFix GHSA-wwwm-px48-fpvq",
69
"a8da0664a387aa871f7c0ee03fd3f53c82d00346": "Fix GHSA-wwwm-px48-fpvq\n\n# Conflicts:\n#\tMediaBrowser.MediaEncoding/Subtitles/SubtitleEncoder.cs",

‎data/fix-commits/php-src-b629c133.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
"vcs_url": "https://github.com/php/php-src",
33
"vulnerabilities": {
44
"GHSA-H35G-VWH6-M678": {
5+
"9c74d7d1bcd254b4ad64a9b21fe41f546e764cd4": "[mysqlnd] Fix result set field metadata length buffer over-read\n\nThe rset_field metadata reader trusted each length-encoded string size:\na hostile server could send a length marker at the end of a field packet\nwhose value exceeds the remaining payload, advancing p past header.size\nand past the command buffer before the next dereference, and recording\nattacker-controlled lengths on pointers outside the packet that later\nfeed memcpy() into the field memory pool. Bound each metadata string by\nbailing once p leaves the payload and rejecting lengths larger than the\nremaining bytes, matching php_mysqlnd_auth_response_read() from\nGHSA-h35g-vwh6-m678; an audit found no other users of the READ_RSET_FIELD\nmacro and the trailing default-value check never dereferences its length.\n\nCloses GH-23496",
56
"9e5cf96095ca54543c68787092cc28fcc4bc534d": "[mysqlnd] Fix OK packet message length buffer over-read\n\nThe OK packet message-length varint is read after the last bounds check,\nso a length-encoded integer at the end of a packet can advance p past\nheader.size and even past the end of the 4096-byte command buffer. The\nold MIN(net_len, buf_len - (p - begin)) clamp then underflows and passes\nan unclamped attacker-controlled length to mnd_pestrndup(), reading heap\nmemory beyond both the packet and its allocation. Reject a message length\nthat extends past the payload, matching php_mysqlnd_auth_response_read()\nfrom GHSA-h35g-vwh6-m678; an audit found no further readers using the\nvulnerable buf_len clamp.\n\nCloses GH-23497",
67
"235d1b14a3fa317cd2837d16aae716b615bea40c": "Fix GH-17499: mysqli flaky test: ghsa-h35g-vwh6-m678-stmt-row-string",
78
"c5954553008d85f9da8d32e086216fe25e30c0a6": "Fix GHSA-h35g-vwh6-m678: Mysqlnd - various heap buffer over-reads\n\nThis fixes issues causing buffer over-read that leak heap content:\n- RESP packet field default left over for COM_LIST\n- RESP packet upsert filename\n- OK packet message\n- RESP packet for stmt row data\n - ps_fetch_from_1_to_8_bytes\n - ps_fetch_float\n - ps_fetch_double\n - ps_fetch_time\n - ps_fetch_date\n - ps_fetch_datetime\n - ps_fetch_string\n - ps_fetch_bit\n- RESP packet for query row data (just possible overflow on 32bit)\n\nIt also adds various protocol tests using a new fake server.",

0 commit comments

Comments
 (0)