Anton Gladky pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5bb2ad15 by Anton Gladky at 2022-04-08T16:22:58+02:00
Reserve DLA-2972-1 for libxml2
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -318504,7 +318504,6 @@ CVE-2017-5970 (The ipv4_pktinfo_prepare function in
net/ipv4/ip_sockglue.c in th
NOTE: Introduced by:
https://github.com/torvalds/linux/commit/f84af32cbca70a3c6d30463dc08c7984af11c277
(v2.6.35-rc1)
CVE-2017-5969 (** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows
remote ...)
- libxml2 2.9.4+dfsg1-5.1 (bug #855001)
- [stretch] - libxml2 <no-dsa> (Minor issue, only a denial-of-service
when using recover mode)
[jessie] - libxml2 <no-dsa> (Minor issue, only a denial-of-service when
using recover mode)
[wheezy] - libxml2 <no-dsa> (Minor issue, only a denial-of-service when
using recover mode)
NOTE: https://www.openwall.com/lists/oss-security/2016/11/05/3
@@ -321681,7 +321680,6 @@ CVE-2017-5131 (An integer overflow in Skia in Google
Chrome prior to 62.0.3202.6
CVE-2017-5130 (An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as
used in ...)
{DLA-1188-1}
- libxml2 2.9.4+dfsg1-5.1 (bug #880000)
- [stretch] - libxml2 <no-dsa> (Minor issue)
[jessie] - libxml2 <no-dsa> (Minor issue)
- chromium-browser 62.0.3202.75-1 (unimportant)
NOTE: chromium-browser uses system libxml2.
=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[08 Apr 2022] DLA-2972-1 libxml2 - security update
+ {CVE-2016-9318 CVE-2017-5130 CVE-2017-5969 CVE-2017-16932
CVE-2022-23308}
+ [stretch] - libxml2 2.9.4+dfsg1-2.2+deb9u6
[07 Apr 2022] DLA-2971-1 firefox-esr - security update
{CVE-2022-1097 CVE-2022-1196 CVE-2022-24713 CVE-2022-28281
CVE-2022-28282 CVE-2022-28285 CVE-2022-28286 CVE-2022-28289}
[stretch] - firefox-esr 91.8.0esr-1~deb9u1
=====================================
data/dla-needed.txt
=====================================
@@ -81,9 +81,6 @@ libpgjava
--
libvirt (Thorsten Alteholz)
--
-libxml2 (Anton)
- NOTE: 20220403: https://salsa.debian.org/lts-team/packages/libxml2
---
libz-mingw-w64
NOTE: 20220231: upcoming DSA (Beuc)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5bb2ad15d34da923b5e32476986ffe569f00c892
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5bb2ad15d34da923b5e32476986ffe569f00c892
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
