Sync Collecting Fix Commits: Sat May 23 17:45:46 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/imagemagick-b15feb65.json

@@ -1,12 +1,13 @@
 {
   "vcs_url": "https://github.com/imagemagick/imagemagick",
   "vulnerabilities": {
-    "GHSA-XCJM-WQFF-M669": {
-      "d1bf6bcf357fef944280263892dadf84fbb2211d": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xcjm-wqff-m669"
-    },
     "GHSA-8PJ9-6897-74XC": {
+      "2fd447c5475aa7c1a2093b857d96af220473b11b": "reject farbfeld files with zero columns or rows (#8750)\n\nThe header dimensions are read directly from the blob and then control\nthe ping early-return path, which lets a 16-byte file with width=0 or\nheight=0 succeed and surface as a 0x0 image to callers. SetImageExtent\nalready rejects this on the non-ping path. Same bug class as the recent\nDCM fix in 84fbcef (GHSA-8pj9-6897-74xc).",
       "84fbcef8a558b1da075417a89d29aa5632d57f63": "Added missing check for returning an image with zero columns or rows (https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-8pj9-6897-74xc)"
     },
+    "GHSA-XCJM-WQFF-M669": {
+      "d1bf6bcf357fef944280263892dadf84fbb2211d": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-xcjm-wqff-m669"
+    },
     "GHSA-GM48-C7F2-V67P": {
       "3705205e1424d379c2fc46c026c8560ccea0509e": "https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-gm48-c7f2-v67p"
     },

data/fix-commits/nixpkgs-97436190.json

@@ -1,6 +1,10 @@
 {
   "vcs_url": "https://github.com/nixos/nixpkgs",
   "vulnerabilities": {
+    "CVE-2026-43983": {
+      "2d9c6e1e667c14e87f80c95ad750f07beb6d6ac8": "[25.11] pocket-id: fix CVE-2026-43983, 1.15.0 -> 1.16.0 (#519749)",
+      "02bd18ef8069c19768d100e71f39bf425208ea59": "pocket-id: fix CVE-2026-43983\n\nNot-cherry-picked-because: the package in unstable has advanced to the next major version"
+    },
     "CVE-2026-9256": {
       "308c3c352cdbda17ab08b750886d3b5895018a05": "nginx: 1.30.1 -> 1.30.2\n\nChangelog: https://nginx.org/en/CHANGES-1.30\nAdvisory: https://my.f5.com/manage/s/article/K000161377\n\nFixes: CVE-2026-9256"
     },

data/fix-commits/prometheus-f95ed07a.json

@@ -1,12 +1,6 @@
 {
   "vcs_url": "https://github.com/prometheus/prometheus",
   "vulnerabilities": {
-    "CVE-2026-44990": {
-      "fcf6d37fed143781a6260f12b6dae1b729b1b1e7": "web/ui: bump sanitize-html in mantine-ui to v2.17.4 [SECURITY]\n\nThe previous commit on this branch only refreshed the legacy react-app\nlockfile, leaving the mantine-ui workspace lockfile pinned at\nsanitize-html 2.17.3 \u2014 which is in the affected range of CVE-2026-44990\n/ GHSA-rpr9-rxv7-x643 (CVSS 9.3 critical, default-config XSS via the\n<xmp> raw-text passthrough). Bump the declared range in\nweb/ui/mantine-ui/package.json from ^2.17.3 to ^2.17.4 and refresh the\nworkspace-root lockfile so the modern UI is patched too.\n\nThe lockfile delta is small because the mantine-ui workspace was already\non htmlparser2 v10 and dayjs via other deps; the only new transitive\naddition is launder 1.7.1 (now a direct dependency of sanitize-html).\n\n```release-notes\n[SECURITY] Update sanitize-html to v2.17.4 to fix CVE-2026-44990 (XSS via the <xmp> raw-text passthrough) in the bundled mantine-ui and react-app UIs.\n```\n\nSigned-off-by: Arve Knudsen <arve.knudsen@gmail.com>"
-    },
-    "GHSA-RPR9-RXV7-X643": {
-      "fcf6d37fed143781a6260f12b6dae1b729b1b1e7": "web/ui: bump sanitize-html in mantine-ui to v2.17.4 [SECURITY]\n\nThe previous commit on this branch only refreshed the legacy react-app\nlockfile, leaving the mantine-ui workspace lockfile pinned at\nsanitize-html 2.17.3 \u2014 which is in the affected range of CVE-2026-44990\n/ GHSA-rpr9-rxv7-x643 (CVSS 9.3 critical, default-config XSS via the\n<xmp> raw-text passthrough). Bump the declared range in\nweb/ui/mantine-ui/package.json from ^2.17.3 to ^2.17.4 and refresh the\nworkspace-root lockfile so the modern UI is patched too.\n\nThe lockfile delta is small because the mantine-ui workspace was already\non htmlparser2 v10 and dayjs via other deps; the only new transitive\naddition is launder 1.7.1 (now a direct dependency of sanitize-html).\n\n```release-notes\n[SECURITY] Update sanitize-html to v2.17.4 to fix CVE-2026-44990 (XSS via the <xmp> raw-text passthrough) in the bundled mantine-ui and react-app UIs.\n```\n\nSigned-off-by: Arve Knudsen <arve.knudsen@gmail.com>"
-    },
     "GHSA-39J6-789Q-QXVH": {
       "9122d1f50bd3056bffd035b202612fe116c13efd": "Merge pull request #18650 from roidelapluie/roidelapluie/ghsa-39j6-789q-qxvh-3.5\n\ndiscovery/stackit: use config.Secret for ServiceAccountKey and PrivateKey",
       "fd2d158f49819797216c263790fd46370be1b06a": "discovery/stackit: use config.Secret for ServiceAccountKey and PrivateKey\n\nFixes GHSA-39j6-789q-qxvh\n\nSigned-off-by: Julien Pivotto <291750+roidelapluie@users.noreply.github.com>",

data/fix-commits/qemu-0a8b25ef.json

@@ -1,6 +1,16 @@
 {
   "vcs_url": "https://gitlab.com/qemu-project/qemu",
   "vulnerabilities": {
+    "CVE-2026-8343": {
+      "030f7e9a844e51a1ec42cf55a3ecbe00e2059287": "ui: fix validation of VNC extended clipboard data length\n\nQEMU's VNC extended clipboard handler inflates a client-controlled\ncompressed clipboard payload. The code checks the declared text size\nagainst the total inflated buffer size:\n\n    if (tsize < size)\n\nbut then copies from:\n\n    tbuf = buf + 4;\n    qemu_clipboard_set_data(..., tsize, tbuf, true);\n\nThe correct bound is the remaining data length after the 4-byte length\nfield, not the total inflated buffer length.\n\nAs a result, a VNC client can make QEMU copy up to 3 bytes past the end\nof the inflated heap buffer. With a second VNC client, those copied\nbytes are observable through the normal VNC extended clipboard PROVIDE\npath.\n\nFixes: CVE-2026-8343\nReported-by: Heechan Kang <gganji11@naver.com>\nReported-by: Feifan Qian <bea1e@proton.me>\nReviewed-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>\nSigned-off-by: Heechan Kang <gganji11@naver.com>\n[DB: added #include and 'return' statements]\nSigned-off-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>\nReviewed-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>\nMessage-ID: <20260512095543.459949-1-berrange@redhat.com>"
+    },
+    "CVE-2026-48003": {
+      "1f7bca5e1d58151e1c28f5b3d2edab119db133c1": "ui/vnc: fix OOB read updating VNC update frequency stats\n\nIncorrect loop bounds in vnc_update_freq result in iterating past the\nlast row and past the last column in the VNC stats array. With suitably\nchosen dimensions this could be a OOB read that accesses memory beyond\nthe VncDisplay struct that the stats array is embedded in.\n\nShould this hit a guard page, it could trigger a guest crash. If it\ndoes not, then the VNC frequency stats will be updated with garbage.\n\nFixes: CVE-2026-48003\nReported-by: boy juju <agx1657748706@gmail.com>\nReviewed-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>\nSigned-off-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>\nMessage-ID: <20260521103353.1645561-5-berrange@redhat.com>"
+    },
+    "CVE-2026-48002": {
+      "07322795e0906d624bd856b4a4a5b747645dea3b": "ui/vnc: fix OOB write in lossy rect worker code\n\nIncorrect calculation of the boundary condition when tracking lossy\nrectangles in the worker thread will result in an OOB write which\ncan corrupt further worker state, and/or trigger any guard pages\nthat may lie beyond the VncWorker struct. This can be triggered\nthrough careful choice of the display resolution in the guest\nOS by an unprivileged user.\n\nFixes: CVE-2026-48002\nReported-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>\nSigned-off-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>\nMessage-ID: <20260521103353.1645561-4-berrange@redhat.com>\n[Marc-Andr\u00e9 - added assert() suggest by philmd@linaro.org]\nSigned-off-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>",
+      "df20bbb41dd5f878d0b4b8f7a1b4ce75a318c3eb": "ui/vnc: fix OOB write in VNC stats array\n\nThe VncSurface struct maintains update statistics in an array:\n\n    VncRectStat stats[VNC_STAT_ROWS][VNC_STAT_COLS];\n\nwhere the dimensions are defined as:\n\n  #define VNC_STAT_RECT  64\n  #define VNC_STAT_COLS (VNC_MAX_WIDTH / VNC_STAT_RECT)\n  #define VNC_STAT_ROWS (VNC_MAX_HEIGHT / VNC_STAT_RECT)\n\nIf VNC_MAX_WIDTH / VNC_MAX_HEIGHT are not an exact multiple of\nVNC_STAT_REC, the COLS/ROWS will be undersized by 1.\n\nUnfortunately:\n\n  #define VNC_MAX_HEIGHT 2160\n\nis not a multiple of 64, so there is potential for OOB reads and\nwrites in the 'stats' array, if the guest surface is over 2112\npixels in height. An array overflow occurs when vnc_update_stats()\nrecords new statistics, either scribbling over data later in the\nVncDisplay struct that 'stats' is embedded in, or performing an\nOOB write on the allocated struct memory.\n\nFixes: CVE-2026-48002\nReported-by: boy juju <agx1657748706@gmail.com>\nReviewed-by: Marc-Andr\u00e9 Lureau <marcandre.lureau@redhat.com>\nSigned-off-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>\nMessage-ID: <20260521103353.1645561-3-berrange@redhat.com>"
+    },
     "CVE-2026-8341": {
       "6a15005290ee1187f8ae9aa44e99b40cae07be45": "hw/uefi: check auth.hdr_length minimum size\n\nauth.hdr_length maximum is already checked (against buffer size).  The\nheader has some fixed fields which are included in the header length, so\nthere also is a minimum size which must be verified.  Add a check for\nthat.  Fixes possible integer underflow.\n\nWhile being at it replace the magic number '24' with sizeof calculations\nfor better code documentation.\n\nFixes: CVE-2026-8341\nFixes: f1488fac0584 (\"hw/uefi: add var-service-auth.c\")\nReported-by: Feifan Qian <bea1e@proton.me>\nReviewed-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>\nSigned-off-by: Gerd Hoffmann <kraxel@redhat.com>\nMessage-ID: <20260512060523.17493-1-kraxel@redhat.com>\n(cherry picked from commit b33fd8ab1caa07aeb290ef5dac44a4e7fd4be02b)\nSigned-off-by: Michael Tokarev <mjt@tls.msk.ru>",
       "689117427e328bfed5b61b2698d8fc05523f2408": "hw/uefi: check auth.hdr_length minimum size\n\nauth.hdr_length maximum is already checked (against buffer size).  The\nheader has some fixed fields which are included in the header length, so\nthere also is a minimum size which must be verified.  Add a check for\nthat.  Fixes possible integer underflow.\n\nWhile being at it replace the magic number '24' with sizeof calculations\nfor better code documentation.\n\nFixes: CVE-2026-8341\nFixes: f1488fac0584 (\"hw/uefi: add var-service-auth.c\")\nReported-by: Feifan Qian <bea1e@proton.me>\nReviewed-by: Daniel P. Berrang\u00e9 <berrange@redhat.com>\nSigned-off-by: Gerd Hoffmann <kraxel@redhat.com>\nMessage-ID: <20260512060523.17493-1-kraxel@redhat.com>\n(cherry picked from commit b33fd8ab1caa07aeb290ef5dac44a4e7fd4be02b)\nSigned-off-by: Michael Tokarev <mjt@tls.msk.ru>",