Sylvain Beucler pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d7614158 by Sylvain Beucler at 2023-07-31T19:46:32+02:00
CVE-2023-0330/qemu: fix is available, update buster triage
- - - - -
18cf48d9 by Sylvain Beucler at 2023-07-31T19:46:34+02:00
CVE-2021-3750/qemu: reference final generic reentrancy fix, update buster triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -32662,10 +32662,11 @@ CVE-2023-0330 (A vulnerability in the lsi53c895a
device affects the latest versi
- qemu 1:8.0.2+dfsg-1 (bug #1029155)
[bookworm] - qemu 1:7.2+dfsg-7+deb12u1
[bullseye] - qemu <no-dsa> (Minor issue)
- [buster] - qemu <postponed> (Minor issue, waiting for sanctioned patch)
+ [buster] - qemu <postponed> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2160151
NOTE: Proposed patch:
https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html
NOTE: Fixed by:
https://gitlab.com/qemu-project/qemu/-/commit/e49884a90987744ddb54b2fadc770633eb6a4d62
(v8.0.1)
+ NOTE: See also generic re-entrancy ground work at
https://gitlab.com/qemu-project/qemu/-/issues/556
CVE-2023-0329 (The Elementor Website Builder WordPress plugin before 3.12.2
does not ...)
NOT-FOR-US: WordPress plugin
CVE-2022-48261 (There is a misinterpretation of input vulnerability in
BiSheng-WNM FW ...)
@@ -138265,8 +138266,8 @@ CVE-2021-40320
CVE-2021-3750 (A DMA reentrancy issue was found in the USB EHCI controller
emulation ...)
- qemu 1:7.0+dfsg-1
[bullseye] - qemu <no-dsa> (Minor issue)
- [buster] - qemu <postponed> (Minor issue, unclear status, follow
bullseye updates)
- [stretch] - qemu <postponed> (Minor issue, unclear status, follow
bullseye updates)
+ [buster] - qemu <postponed> (Minor issue, follow bullseye updates)
+ [stretch] - qemu <postponed> (Minor issue, follow bullseye updates)
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/541
NOTE: Fix for whole class of DMA MMIO reentrancy issues:
https://gitlab.com/qemu-project/qemu/-/issues/556
NOTE: Patchset:
https://lists.nongnu.org/archive/html/qemu-devel/2021-12/msg02356.html
@@ -138274,6 +138275,7 @@ CVE-2021-3750 (A DMA reentrancy issue was found in
the USB EHCI controller emula
NOTE:
https://gitlab.com/qemu-project/qemu/-/commit/58e74682baf4e1ad26b064d8c02e5bc99c75c5d9
(v7.0.0-rc1)
NOTE:
https://gitlab.com/qemu-project/qemu/-/commit/3ab6fdc91b72e156da22848f0003ff4225690ced
(v7.0.0-rc1)
NOTE: Possibly incomplete patch set:
https://gitlab.com/qemu-project/qemu/-/issues/541#note_1179940468
+ NOTE: Final fix:
https://gitlab.com/qemu-project/qemu/-/commit/a2e1753b8054344f32cf94f31c6399a58794a380
(v8.1.0-rc0)
CVE-2021-3749 (axios is vulnerable to Inefficient Regular Expression
Complexity)
- node-axios 0.21.3+dfsg-1
[bullseye] - node-axios 0.21.1+dfsg-1+deb11u1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/abb15c014e2e7ee5f7971b14c4f4cb6a299642c9...18cf48d997b292b7e353b322d2f3cbcd04149f38
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/abb15c014e2e7ee5f7971b14c4f4cb6a299642c9...18cf48d997b292b7e353b322d2f3cbcd04149f38
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
