From e8396e9310edfc8c6e5083ab07b5746fb8e4c9a0 Mon Sep 17 00:00:00 2001 From: "russell@unturf.com" Date: Fri, 3 Apr 2026 14:10:53 -0400 Subject: [PATCH] undf: assign UNDF-2026-000001196..1205; stamp openscad-0002/0003, suitecrm-0005/0006, calibre-0003/0004, invoiceninja-0004/0005, xtuple-0001 --- UNDF-REGISTRY.json | 12 +++++++++++- .../calibre-0003-html-depth-first-flat-index.patch | 1 + .../patch/calibre-0004-htmlfile-links-dedup.patch | 1 + .../invoiceninja-0004/patch/invoiceninja-0004.patch | 1 + .../invoiceninja-0005/patch/invoiceninja-0005.patch | 1 + .../patch/openscad-0001-amf-vertex-dedup.patch | 2 +- .../openscad-0002-polysetbuilder-color-dedup.patch | 1 + .../openscad-0003-octoprint-token-log-redact.patch | 1 + ...tecrm-0005-projecttask-allsubtasks-in_array.patch | 1 + .../suitecrm-0006-lucene-parsehits-in_array.patch | 1 + defects/xtuple-0001/patch/xtuple-0001.patch | 1 + 11 files changed, 21 insertions(+), 2 deletions(-) diff --git a/UNDF-REGISTRY.json b/UNDF-REGISTRY.json index 45dd189dc..d70417df2 100644 --- a/UNDF-REGISTRY.json +++ b/UNDF-REGISTRY.json @@ -1193,5 +1193,15 @@ "zulip-0003-0003": "UNDF-2026-000001192", "wine-0002-0002": "UNDF-2026-000001193", "wine-0003-0003": "UNDF-2026-000001194", - "wine-0004-0004": "UNDF-2026-000001195" + "wine-0004-0004": "UNDF-2026-000001195", + "calibre-0003": "UNDF-2026-000001196", + "calibre-0004": "UNDF-2026-000001197", + "invoiceninja-0004-0004": "UNDF-2026-000001198", + "invoiceninja-0005-0005": "UNDF-2026-000001199", + "openscad-0001-0001": "UNDF-2026-000001200", + "openscad-0002-0002": "UNDF-2026-000001201", + "openscad-0003-0003": "UNDF-2026-000001202", + "suitecrm-0005-0005": "UNDF-2026-000001203", + "suitecrm-0006-0006": "UNDF-2026-000001204", + "xtuple-0001-0001": "UNDF-2026-000001205" } diff --git a/defects/calibre/patch/calibre-0003-html-depth-first-flat-index.patch b/defects/calibre/patch/calibre-0003-html-depth-first-flat-index.patch index ac1770676..e691d60cb 100644 --- a/defects/calibre/patch/calibre-0003-html-depth-first-flat-index.patch +++ b/defects/calibre/patch/calibre-0003-html-depth-first-flat-index.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001196 # CWE-407: Algorithmic Complexity — HTML ebook traversal flat.index() O(L*F) # Severity: MEDIUM # File: src/calibre/ebooks/html/input.py diff --git a/defects/calibre/patch/calibre-0004-htmlfile-links-dedup.patch b/defects/calibre/patch/calibre-0004-htmlfile-links-dedup.patch index 7684947e4..c172a4b97 100644 --- a/defects/calibre/patch/calibre-0004-htmlfile-links-dedup.patch +++ b/defects/calibre/patch/calibre-0004-htmlfile-links-dedup.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001197 # CWE-407: Algorithmic Complexity — HTMLFile.find_links list dedup O(L^2) # Severity: LOW-MEDIUM # File: src/calibre/ebooks/html/input.py diff --git a/defects/invoiceninja-0004/patch/invoiceninja-0004.patch b/defects/invoiceninja-0004/patch/invoiceninja-0004.patch index 4a85a3aa4..7f52d1f8d 100644 --- a/defects/invoiceninja-0004/patch/invoiceninja-0004.patch +++ b/defects/invoiceninja-0004/patch/invoiceninja-0004.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001198 --- a/app/Utils/Traits/SettingsSaver.php +++ b/app/Utils/Traits/SettingsSaver.php @@ -40,7 +40,10 @@ trait SettingsSaver diff --git a/defects/invoiceninja-0005/patch/invoiceninja-0005.patch b/defects/invoiceninja-0005/patch/invoiceninja-0005.patch index f627bd526..36129d3b1 100644 --- a/defects/invoiceninja-0005/patch/invoiceninja-0005.patch +++ b/defects/invoiceninja-0005/patch/invoiceninja-0005.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001199 --- a/app/PaymentDrivers/CBAPowerBoard/CreditCard.php +++ b/app/PaymentDrivers/CBAPowerBoard/CreditCard.php @@ -67,10 +67,11 @@ class CreditCard implements LivewireMethodInterface diff --git a/defects/openscad-0001/patch/openscad-0001-amf-vertex-dedup.patch b/defects/openscad-0001/patch/openscad-0001-amf-vertex-dedup.patch index 1fe6c9bce..a65021ba5 100644 --- a/defects/openscad-0001/patch/openscad-0001-amf-vertex-dedup.patch +++ b/defects/openscad-0001/patch/openscad-0001-amf-vertex-dedup.patch @@ -1,4 +1,4 @@ -# UNDF: UNDF-2026-000000883 +# UNDF: UNDF-2026-000001200 --- a/src/io/export_amf.cc +++ b/src/io/export_amf.cc @@ -36,6 +36,7 @@ diff --git a/defects/openscad-0002/patch/openscad-0002-polysetbuilder-color-dedup.patch b/defects/openscad-0002/patch/openscad-0002-polysetbuilder-color-dedup.patch index f9169f977..31dbcafce 100644 --- a/defects/openscad-0002/patch/openscad-0002-polysetbuilder-color-dedup.patch +++ b/defects/openscad-0002/patch/openscad-0002-polysetbuilder-color-dedup.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001201 --- a/src/geometry/PolySetBuilder.h +++ b/src/geometry/PolySetBuilder.h @@ -3,6 +3,7 @@ diff --git a/defects/openscad-0003/patch/openscad-0003-octoprint-token-log-redact.patch b/defects/openscad-0003/patch/openscad-0003-octoprint-token-log-redact.patch index de678f105..ebedfc881 100644 --- a/defects/openscad-0003/patch/openscad-0003-octoprint-token-log-redact.patch +++ b/defects/openscad-0003/patch/openscad-0003-octoprint-token-log-redact.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001202 --- a/src/gui/OctoPrint.cc +++ b/src/gui/OctoPrint.cc @@ -67,9 +67,9 @@ const QJsonDocument OctoPrint::getJsonData(const QString& endpoint) const diff --git a/defects/suitecrm-0005/patch/suitecrm-0005-projecttask-allsubtasks-in_array.patch b/defects/suitecrm-0005/patch/suitecrm-0005-projecttask-allsubtasks-in_array.patch index e3df4bef9..da7b1e6f0 100644 --- a/defects/suitecrm-0005/patch/suitecrm-0005-projecttask-allsubtasks-in_array.patch +++ b/defects/suitecrm-0005/patch/suitecrm-0005-projecttask-allsubtasks-in_array.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001203 --- a/modules/ProjectTask/ProjectTask.php +++ b/modules/ProjectTask/ProjectTask.php @@ -433,7 +433,7 @@ class ProjectTask extends SugarBean diff --git a/defects/suitecrm-0006/patch/suitecrm-0006-lucene-parsehits-in_array.patch b/defects/suitecrm-0006/patch/suitecrm-0006-lucene-parsehits-in_array.patch index 39d702291..5ac990a1e 100644 --- a/defects/suitecrm-0006/patch/suitecrm-0006-lucene-parsehits-in_array.patch +++ b/defects/suitecrm-0006/patch/suitecrm-0006-lucene-parsehits-in_array.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001204 --- a/lib/Search/AOD/LuceneSearchEngine.php +++ b/lib/Search/AOD/LuceneSearchEngine.php @@ -187,8 +187,9 @@ class LuceneSearchEngine implements SearchEngine diff --git a/defects/xtuple-0001/patch/xtuple-0001.patch b/defects/xtuple-0001/patch/xtuple-0001.patch index 51e044ab9..290f232cc 100644 --- a/defects/xtuple-0001/patch/xtuple-0001.patch +++ b/defects/xtuple-0001/patch/xtuple-0001.patch @@ -1,3 +1,4 @@ +# UNDF: UNDF-2026-000001205 --- a/OpenRPT/renderer/orutils.cpp +++ b/OpenRPT/renderer/orutils.cpp @@ -21,6 +21,7 @@