[Git][security-tracker-team/security-tracker][master] Add CVE-2022-2380/linux
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 586f7837 by Salvatore Bonaccorso at 2022-07-12T06:27:47+02:00 Add CVE-2022-2380/linux - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -12,8 +12,12 @@ CVE-2022-2382 RESERVED CVE-2022-2381 RESERVED -CVE-2022-2380 +CVE-2022-2380 [video: fbdev: sm712fb: Fix crash in smtcfb_read()] RESERVED + - linux 5.17.3-1 + [bullseye] - linux 5.10.113-1 + [buster] - linux 4.19.249-1 + NOTE: https://git.kernel.org/linus/bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8 (5.18-rc1) CVE-2022-2379 RESERVED CVE-2022-2378 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/586f78371ad2c9a8df652f990beaa844f70e3fa5 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/586f78371ad2c9a8df652f990beaa844f70e3fa5 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] 5 commits: Revert "Bulk added EOL for 2 CVEs for node-url-parse in buster LTS."
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 1edba366 by Salvatore Bonaccorso at 2022-07-12T06:10:29+02:00 Revert Bulk added EOL for 2 CVEs for node-url-parse in buster LTS. This reverts commit 583663396fc9650aeee8268259c04673b3cde231. - - - - - c70eefb3 by Salvatore Bonaccorso at 2022-07-12T06:10:52+02:00 Revert Bulk added EOL for 2 CVEs for node-tar in buster LTS. This reverts commit d3c2727d4120469e229327b285b475cabdfc619d. - - - - - 5b70ee07 by Salvatore Bonaccorso at 2022-07-12T06:11:06+02:00 Revert Bulk added EOL for 3 CVEs for libspring-java in buster LTS. This reverts commit a577308df34fa56f61220044ad76fe3aa887b04c. - - - - - 89996661 by Salvatore Bonaccorso at 2022-07-12T06:11:16+02:00 Revert Bulk added almost 70 EOL entries for gpac in LTS buster. This reverts commit 141f38d2a48de8ce04352dc8dfb2eea9443da94a. - - - - - ecce68b3 by Salvatore Bonaccorso at 2022-07-12T06:11:27+02:00 Revert Bulk added EOL entries for ckeditor3 for LTS buster. This reverts commit b4c0adda8191921274a1a82fa993f5ae5b9ebf1c. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -12052,7 +12052,6 @@ CVE-2022-1796 (Use After Free in GitHub repository vim/vim prior to 8.2.4979. .. NOTE: Crash in CLI tool, no security impact CVE-2022-1795 (Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. ...) - gpac - [buster] - gpac (No longer supported in LTS buster) [stretch] - gpac (No longer supported in LTS) NOTE: https://huntr.dev/bounties/9c312763-41a6-4fc7-827b-269eb86efcbc NOTE: https://github.com/gpac/gpac/commit/c535bad50d5812d27ee5b22b54371bddec411514 @@ -12111,7 +12110,6 @@ CVE-2022-1776 (The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPr NOT-FOR-US: WordPress plugin CVE-2022-30976 (GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed gf_utf8_wcsl ...) - gpac - [buster] - gpac (No longer supported in LTS buster) [stretch] - gpac (No longer supported in LTS) NOTE: https://github.com/gpac/gpac/issues/2179 NOTE: https://github.com/gpac/gpac/commit/915e2cba715f36b7cc29e2117831ca143d78 @@ -16303,7 +16301,6 @@ CVE-2022-29593 RESERVED CVE-2022-1441 (MP4Box is a component of GPAC-2.0.0, which is a widely-used third-part ...) - gpac - [buster] - gpac (No longer supported in LTS buster) [stretch] - gpac (No longer supported in LTS) NOTE: https://github.com/gpac/gpac/issues/2175 NOTE: https://github.com/gpac/gpac/commit/3dbe11b37d65c8472faf0654410068e5500b3adb @@ -19172,7 +19169,6 @@ CVE-2022-1223 (Improper Access Control in GitHub repository phpipam/phpipam prio - phpipam (bug #731713) CVE-2022-1222 (Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV. ...) - gpac - [buster] - gpac (No longer supported in LTS buster) [stretch] - gpac (No longer supported in LTS) NOTE: https://huntr.dev/bounties/f8cb85b8-7ff3-47f1-a9a6-7080eb371a3d NOTE: https://github.com/gpac/gpac/commit/7f060bbb72966cae80d6fee338d0b07fa3fc06e1 @@ -23039,7 +23035,6 @@ CVE-2022-1036 (Able to create an account with long password leads to memory corr NOT-FOR-US: microweber CVE-2022-1035 (Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpa ...) - gpac - [buster] - gpac (No longer supported in LTS buster) [stretch] - gpac (No longer supported in LTS) NOTE: https://huntr.dev/bounties/851942a4-1d64-4553-8fdc-9fccd167864b NOTE: https://github.com/gpac/gpac/commit/3718d583c6ade191dc7979c64f48c001ca6f0243 @@ -23610,25 +23605,21 @@ CVE-2022-27149 REJECTED CVE-2022-27148 (GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable to Integ ...) - gpac 2.0.0+dfsg1-2 - [buster] - gpac (No longer supported in LTS buster) [stretch] - gpac (No longer supported in LTS) NOTE: https://github.com/gpac/gpac/issues/2067 NOTE: https://github.com/gpac/gpac/commit/0cd19f4db70615d707e0e6202933c2ea0c1d36df (v2.0.0) CVE-2022-27147 (GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a use-after-free v ...) - gpac 2.0.0+dfsg1-2 - [buster] - gpac (No longer supported in LTS buster) [stretch] - gpac (No longer supported in LTS) NOTE: https://github.com/gpac/gpac/issues/2109 NOTE: https://github.com/gpac/gpac/commit/9723dd0955894f2cb7be13b94cf7a47f2754b893 (v2.0.0) CVE-2022-27146 (GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a heap-buffer-overflow vu ...) - gpac 2.0.0+dfsg1-2 - [buster] - gpac (No longer supported in LTS buster) [stretch] - gpac (No longer supported in LTS) NOTE: https://github.com/gpac/gpac/issues/2120 NOTE:
[Git][security-tracker-team/security-tracker][master] Revert "Bulk added EOL for 12 CVEs for nodejs in buster LTS."
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
70e33276 by Salvatore Bonaccorso at 2022-07-12T06:09:25+02:00
Revert Bulk added EOL for 12 CVEs for nodejs in buster LTS.
This reverts commit 22d9f630a6c2f2a80db5b748c40aea24d931cac3.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -8600,7 +8600,6 @@ CVE-2022-32216
CVE-2022-32215 [HTTP Request Smuggling - Incorrect Parsing of Multi-line
Transfer-Encoding]
RESERVED
- nodejs
- [buster] - nodejs (No longer supported in LTS buster)
- llhttp (bug #977716)
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-incorrect-parsing-of-multi-line-transfer-encoding-medium-cve-2022-32215
NOTE:
https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd
(v14.x)
@@ -8608,7 +8607,6 @@ CVE-2022-32215 [HTTP Request Smuggling - Incorrect
Parsing of Multi-line Transfe
CVE-2022-32214 [HTTP Request Smuggling - Improper Delimiting of Header Fields]
RESERVED
- nodejs
- [buster] - nodejs (No longer supported in LTS buster)
- llhttp (bug #977716)
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-improper-delimiting-of-header-fields-medium-cve-2022-32214
NOTE:
https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd
(v14.x)
@@ -8616,7 +8614,6 @@ CVE-2022-32214 [HTTP Request Smuggling - Improper
Delimiting of Header Fields]
CVE-2022-32213 [HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding]
RESERVED
- nodejs
- [buster] - nodejs (No longer supported in LTS buster)
- llhttp (bug #977716)
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-flawed-parsing-of-transfer-encoding-medium-cve-2022-32213
NOTE:
https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd
(v14.x)
@@ -8624,7 +8621,6 @@ CVE-2022-32213 [HTTP Request Smuggling - Flawed Parsing
of Transfer-Encoding]
CVE-2022-32212
RESERVED
- nodejs
- [buster] - nodejs (No longer supported in LTS buster)
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-ip-addresses-high-cve-2022-32212
NOTE:
https://github.com/nodejs/node/commit/48c5aa5cab718d04473fa2761d532657c84b8131
(v14.x)
NOTE:
https://github.com/nodejs/node/commit/1aa5036c31ac2a9b2a2528af454675ad412f1464
(main)
@@ -44969,7 +44965,6 @@ CVE-2021-44535
CVE-2022-21824 (Due to the formatting logic of the "console.table()" function
it was n ...)
{DSA-5170-1}
- nodejs 12.22.9~dfsg-1 (bug #1004177)
- [buster] - nodejs (No longer supported in LTS buster)
[stretch] - nodejs (Nodejs in stretch not covered by
security support)
NOTE:
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/#prototype-pollution-via-console-table-properties-low-cve-2022-21824
NOTE:
https://github.com/nodejs/node/commit/be69403528da99bf3df9e1dc47186f18ba59cb5e
(v12.x)
@@ -44978,21 +44973,18 @@ CVE-2021-44534
CVE-2021-44533 (Node.js 12.22.9, 14.18.3, 16.13.2, and
17.3.1 did ...)
{DSA-5170-1}
- nodejs 12.22.9~dfsg-1 (bug #1004177)
- [buster] - nodejs (No longer supported in LTS buster)
[stretch] - nodejs (Nodejs in stretch not covered by
security support)
NOTE:
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/#incorrect-handling-of-certificate-subject-and-issuer-fields-medium-cve-2021-44533
NOTE:
https://github.com/nodejs/node/commit/8c2db2c86baff110a1d905ed1e0dd4e1c4fd2dd1
(v12.x)
CVE-2021-44532 (Node.js 12.22.9, 14.18.3, 16.13.2, and
17.3.1 conv ...)
{DSA-5170-1}
- nodejs 12.22.9~dfsg-1 (bug #1004177)
- [buster] - nodejs (No longer supported in LTS buster)
[stretch] - nodejs (Nodejs in stretch not covered by
security support)
NOTE:
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/#certificate-verification-bypass-via-string-injection-medium-cve-2021-44532
NOTE:
https://github.com/nodejs/node/commit/19873abfb24dce75042efe76dc5633052677
(v12.x)
CVE-2021-44531 (Accepting arbitrary Subject Alternative Name (SAN) types,
unless a PKI ...)
{DSA-5170-1}
- nodejs 12.22.9~dfsg-1 (bug #1004177)
- [buster] - nodejs (No longer supported in LTS buster)
[stretch] - nodejs (Nodejs in stretch not covered by
security support)
NOTE:
https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/#improper-handling-of-uri-subject-alternative-names-medium-cve-2021-44531
NOTE:
[Git][security-tracker-team/security-tracker][master] Add upstream tag information for CVE-2022-25255
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: e60e02a5 by Salvatore Bonaccorso at 2022-07-12T06:07:09+02:00 Add upstream tag information for CVE-2022-25255 - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -28757,7 +28757,7 @@ CVE-2022-25255 (In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/393113 NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/394914 NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/396020 - NOTE: https://github.com/qt/qtbase/commit/ab6915f0efb12cfe48d1f126f4a828212f853ce5 (6.2) + NOTE: https://github.com/qt/qtbase/commit/ab6915f0efb12cfe48d1f126f4a828212f853ce5 (v6.2.4) NOTE: https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff NOTE: https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff NOTE: https://www.qt.io/blog/security-advisory-qprocess View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e60e02a591932cf5e91860eeaff93baec7bd451a -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e60e02a591932cf5e91860eeaff93baec7bd451a You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] lts: reclaim rust toolchain
Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker Commits: 119d1dfc by Emilio Pozuelo Monfort at 2022-07-12T00:36:27+02:00 lts: reclaim rust toolchain - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -18,6 +18,7 @@ curl -- linux (Ben Hutchings) -- -rustc +rustc (Emilio) NOTE: 20220614: backporting toolchain (rust, llvm...) for Firefox 102 ESR (pochu) + NOTE: 20220712: bullseye backports done, wip on buster updates (pochu) -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/119d1dfc7c6fbecc8b0ae26ca49be38672395364 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/119d1dfc7c6fbecc8b0ae26ca49be38672395364 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] 2 commits: Added curl to dla-needed since it is in DSA needed and at least one...
Ola Lundqvist pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
35e96a7a by Ola Lundqvist at 2022-07-12T00:10:36+02:00
Added curl to dla-needed since it is in DSA needed and at least one
vulnerability applies to buster as well.
- - - - -
587dc5e1 by Ola Lundqvist at 2022-07-12T00:18:32+02:00
Concluded that CVE-2022-24793 is not vulnerable in buster since the vulnerable
code does not exist. The file is not even present.
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=
data/CVE/list
=
@@ -30153,6 +30153,7 @@ CVE-2022-24794 (Express OpenID Connect is an Express JS
middleware implementing
CVE-2022-24793 (PJSIP is a free and open source multimedia communication
library writt ...)
{DLA-3036-1}
- asterisk
+ [buster] - asterisk (Vulnerable code not present)
[stretch] - asterisk (Vulnerable code not present)
- pjproject
- ring
=
data/dla-needed.txt
=
@@ -12,6 +12,9 @@
https://wiki.debian.org/LTS/Development#Triage_new_security_issues
To make it easier to see the entire history of an update, please append notes
rather than remove/replace existing ones.
+--
+curl
+ NOTE: 20220712: Have not checked whether all CVEs are appliable or not (ola)
--
linux (Ben Hutchings)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/22d9f630a6c2f2a80db5b748c40aea24d931cac3...587dc5e1d376b0b6c98ed4c616d69b4becef69ba
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/22d9f630a6c2f2a80db5b748c40aea24d931cac3...587dc5e1d376b0b6c98ed4c616d69b4becef69ba
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] 8 commits: Wrote a script to bulk add EOL entries for LTS buster.
Ola Lundqvist pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
55001d9c by Ola Lundqvist at 2022-07-11T23:23:41+02:00
Wrote a script to bulk add EOL entries for LTS buster.
- - - - -
b4c0adda by Ola Lundqvist at 2022-07-11T23:23:43+02:00
Bulk added EOL entries for ckeditor3 for LTS buster.
- - - - -
141f38d2 by Ola Lundqvist at 2022-07-11T23:23:44+02:00
Bulk added almost 70 EOL entries for gpac in LTS buster.
- - - - -
a577308d by Ola Lundqvist at 2022-07-11T23:23:45+02:00
Bulk added EOL for 3 CVEs for libspring-java in buster LTS.
- - - - -
d3c2727d by Ola Lundqvist at 2022-07-11T23:23:46+02:00
Bulk added EOL for 2 CVEs for node-tar in buster LTS.
- - - - -
58366339 by Ola Lundqvist at 2022-07-11T23:23:48+02:00
Bulk added EOL for 2 CVEs for node-url-parse in buster LTS.
- - - - -
021ec750 by Ola Lundqvist at 2022-07-11T23:23:48+02:00
One correction to the eol bulk add script. Also simplified the output to make
it less verbose.
- - - - -
22d9f630 by Ola Lundqvist at 2022-07-11T23:23:49+02:00
Bulk added EOL for 12 CVEs for nodejs in buster LTS.
- - - - -
2 changed files:
- + bin/lts-auto-eol
- data/CVE/list
Changes:
=
bin/lts-auto-eol
=
@@ -0,0 +1,68 @@
+#!/usr/bin/perl
+use File::Copy;
+my $pkg = $ARGV[0];
+shift @ARGV;
+while (my $cve = shift @ARGV) {
+($pkg, $cve);
+}
+exit;
+
+sub addEol {
+my ($pkg, $cve) = @_;
+#print "Searching for $cve\n";
+# Mode
+# d - default
+# c - cve found
+# p - pkg found
+# e - eol printed, just continue to end of file as we are done
+my $mode = "d";
+open IF, "data/CVE/list";
+open OF, ">data/CVE/list.x";
+while (my $line = ) {
+ if ($mode eq "e") {
+ print OF $line;
+ next;
+ }
+ if ($mode eq "d") {
+ if ($line =~ /$cve\s/) {
+# print " CVE $cve found\n";
+ $mode = "c";
+ print OF $line;
+ next;
+ }
+ }
+ if ($mode eq "c") {
+ if ($line =~ /^\s+- $pkg\s/) {
+ $mode = "p";
+# print " Package $pkg found\n";
+ print OF $line;
+ next;
+ }
+ }
+ if ($mode eq "p") {
+ if ($line =~ /^\s+\[buster\] - $pkg\s/) {
+ $mode = "e";
+ print "Existing LTS line found, skipping: $line";
+ print OF $line;
+ next;
+ }
+ if ($line =~ /^\s+\[bullseye\] - $pkg\s/ ||
+ $line =~ /^\s+\[bookworm\] - $pkg\s/ ||
+ $line =~ /^\s+\[trixie\] - $pkg\s/) {
+ # skipping through other distribution info
+ print OF $line;
+ next;
+ }
+ # End of package entry add EOL
+ print "EOL $cve for $pkg added.\n";
+ print OF "\t[buster] - $pkg (No longer supported in
LTS buster)\n";
+ print OF $line;
+ $mode = "e";
+ next;
+ }
+ print OF $line;
+}
+close IF;
+close OF;
+move ("data/CVE/list.x", "data/CVE/list");
+}
=
data/CVE/list
=
@@ -8600,6 +8600,7 @@ CVE-2022-32216
CVE-2022-32215 [HTTP Request Smuggling - Incorrect Parsing of Multi-line
Transfer-Encoding]
RESERVED
- nodejs
+ [buster] - nodejs (No longer supported in LTS buster)
- llhttp (bug #977716)
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-incorrect-parsing-of-multi-line-transfer-encoding-medium-cve-2022-32215
NOTE:
https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd
(v14.x)
@@ -8607,6 +8608,7 @@ CVE-2022-32215 [HTTP Request Smuggling - Incorrect
Parsing of Multi-line Transfe
CVE-2022-32214 [HTTP Request Smuggling - Improper Delimiting of Header Fields]
RESERVED
- nodejs
+ [buster] - nodejs (No longer supported in LTS buster)
- llhttp (bug #977716)
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-improper-delimiting-of-header-fields-medium-cve-2022-32214
NOTE:
https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd
(v14.x)
@@ -8614,6 +8616,7 @@ CVE-2022-32214 [HTTP Request Smuggling - Improper
Delimiting of Header Fields]
CVE-2022-32213 [HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding]
RESERVED
- nodejs
+ [buster] - nodejs (No longer supported in LTS buster)
- llhttp (bug #977716)
NOTE:
https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-flawed-parsing-of-transfer-encoding-medium-cve-2022-32213
NOTE:
https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd
(v14.x)
@@
[Git][security-tracker-team/security-tracker][master] libmatio, nouveau non issues
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 391fef27 by Moritz Muehlenhoff at 2022-07-11T23:21:42+02:00 libmatio, nouveau non issues mark old opencv report as NFU for Android, Android never really gave any information its most probably bogus anyway - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -182990,12 +182990,9 @@ CVE-2019-20020 (A stack-based buffer over-read was discovered in ReadNextStructF [jessie] - libmatio (Minor issue) NOTE: https://github.com/tbeu/matio/issues/128 CVE-2019-20019 (An attempted excessive memory allocation was discovered in Mat_VarRead ...) - - libmatio - [bullseye] - libmatio (Minor issue) - [buster] - libmatio (Minor issue) - [stretch] - libmatio (Minor issue) - [jessie] - libmatio (Minor issue) + - libmatio (unimportant) NOTE: https://github.com/tbeu/matio/issues/130 + NOTE: Negligible security impact CVE-2019-20018 (A stack-based buffer over-read was discovered in ReadNextCell in mat5. ...) [experimental] - libmatio 1.5.18-1 - libmatio 1.5.19-2 @@ -221434,7 +221431,6 @@ CVE-2019-10104 (In several JetBrains IntelliJ IDEA Ultimate versions, an Applica - intellij-idea (bug #747616) CVE-2019-10103 (JetBrains IntelliJ IDEA projects created using the Kotlin (JS Client/J ...) - intellij-idea (bug #747616) - - intellij-community-idea CVE-2019-10101 (JetBrains Kotlin versions before 1.3.30 were resolving artifacts using ...) - kotlin (Fixed before initial upload to Debian) CVE-2019-10100 (In JetBrains YouTrack Confluence plugin versions before 1.8.1.3, it wa ...) @@ -224494,8 +224490,7 @@ CVE-2019-9425 (In Bluetooth, there is a possible out of bounds read due to a mis CVE-2019-9424 (In the Screen Lock, there is a possible information disclosure due to ...) NOT-FOR-US: Android CVE-2019-9423 (In opencv calls that use libpng, there is a possible out of bounds wri ...) - - opencv - NOTE: Currently no further information available + NOT-FOR-US: Android CVE-2019-9422 (In Bluetooth, there is a possible out of bounds read due to a missing ...) NOT-FOR-US: Android CVE-2019-9421 (In libandroidfw, there is a possible OOB read due to an integer overfl ...) @@ -292900,12 +292895,9 @@ CVE-2018-3981 (An exploitable out-of-bounds write exists in the TIFF-parsing fun CVE-2018-3980 (An exploitable out-of-bounds write exists in the TIFF-parsing function ...) NOT-FOR-US: Canvas Draw CVE-2018-3979 (A remote denial-of-service vulnerability exists in the way the Nouveau ...) - - xserver-xorg-video-nouveau (low) - [bullseye] - xserver-xorg-video-nouveau (Minor issue) - [buster] - xserver-xorg-video-nouveau (Minor issue) - [stretch] - xserver-xorg-video-nouveau (Minor issue) - [jessie] - xserver-xorg-video-nouveau (Minor issue) + - xserver-xorg-video-nouveau (unimportant) NOTE: https://talosintelligence.com/vulnerability_reports/TALOS-2018-0647 + NOTE: Nouveau is a reverse-engineered, best effort driver, negligible security impact CVE-2018-3978 (An exploitable out-of-bounds write vulnerability exists in the Word Do ...) NOT-FOR-US: Atlantis Word Processor CVE-2018-3977 (An exploitable code execution vulnerability exists in the XCF image re ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/391fef271d0897389daf517a4c516f2536db6077 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/391fef271d0897389daf517a4c516f2536db6077 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] semi-automatic unclaim after 2 weeks of inactivity
Anton Gladky pushed to branch master at Debian Security Tracker / security-tracker Commits: 0411d591 by Anton Gladky at 2022-07-11T22:26:43+02:00 semi-automatic unclaim after 2 weeks of inactivity Signed-off-by: Anton Gladky gl...@debian.org - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -15,6 +15,6 @@ rather than remove/replace existing ones. -- linux (Ben Hutchings) -- -rustc (Emilio) +rustc NOTE: 20220614: backporting toolchain (rust, llvm...) for Firefox 102 ESR (pochu) -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0411d59117de14ebd4f1603317e8a63b303ef598 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0411d59117de14ebd4f1603317e8a63b303ef598 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Remove noes from CVE-2021-46815 (REJECTED, duplicate of CVE-2021-46789)
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: f8994f8b by Salvatore Bonaccorso at 2022-07-11T22:23:04+02:00 Remove noes from CVE-2021-46815 (REJECTED, duplicate of CVE-2021-46789) - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -9889,7 +9889,6 @@ CVE-2022-1900 (The Copify plugin for WordPress is vulnerable to Cross-Site Reque NOT-FOR-US: Copify plugin for WordPress CVE-2021-46815 REJECTED - NOT-FOR-US: Huawei CVE-2021-46814 (The video framework has an out-of-bounds memory read/write vulnerabili ...) NOT-FOR-US: Huawei CVE-2021-46813 (Vulnerability of residual files not being deleted after an update in t ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f8994f8b5f5311e2b92b0a4252beeb54fa039160 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f8994f8b5f5311e2b92b0a4252beeb54fa039160 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2022-2366/mattermost-server
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: a850955a by Salvatore Bonaccorso at 2022-07-11T22:18:17+02:00 Add CVE-2022-2366/mattermost-server - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -470,7 +470,7 @@ CVE-2022-35414 (softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitial NOTE: https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c NOTE: https://sick.codes/sick-2022-113 CVE-2022-2366 (Incorrect default configuration for trusted IP header in Mattermost ve ...) - TODO: check + - mattermost-server (bug #823556) CVE-2022-2365 (Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium ...) TODO: check CVE-2022-2364 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a850955ace177b74f0da010113f6851b61bed835 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a850955ace177b74f0da010113f6851b61bed835 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process some more NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: f2fa0826 by Salvatore Bonaccorso at 2022-07-11T22:17:49+02:00 Process some more NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -37,7 +37,7 @@ CVE-2022-2370 CVE-2022-2369 RESERVED CVE-2022-2368 (Business Logic Errors in GitHub repository microweber/microweber prior ...) - TODO: check + NOT-FOR-US: microweber CVE-2022-2367 RESERVED CVE-2022-35626 @@ -1606,7 +1606,7 @@ CVE-2022-2304 (Stack-based Buffer Overflow in GitHub repository vim/vim prior to CVE-2022-2303 RESERVED CVE-2022-2302 (Multiple Lenze products of the cabinet series skip the password verifi ...) - TODO: check + NOT-FOR-US: Lenze CVE-2022-2301 (Buffer Over-read in GitHub repository hpjansson/chafa prior to 1.10.3. ...) - chafa 1.10.3-1 (unimportant) NOTE: https://huntr.dev/bounties/f6b9114b-671d-4948-b946-ffe5c9aeb816/ @@ -2150,23 +2150,23 @@ CVE-2022-34747 CVE-2022-34746 RESERVED CVE-2022-34743 (The AT commands of the USB port have an out-of-bounds read vulnerabili ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-34742 (The system module has a read/write vulnerability. Successful exploitat ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-34741 (The NFC module has a buffer overflow vulnerability. Successful exploit ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-34740 (The NFC module has a buffer overflow vulnerability. Successful exploit ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-34739 (The fingerprint module has a vulnerability of overflow in arithmetic a ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-34738 (The SystemUI module has a vulnerability in permission control. If this ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-34737 (The application security module has a vulnerability in permission assi ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-34736 (The frame scheduling module has a null pointer dereference vulnerabili ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-34735 (The frame scheduling module has a null pointer dereference vulnerabili ...) - TODO: check + NOT-FOR-US: Huawei CVE-2022-2245 RESERVED CVE-2022-2244 (An improper authorization vulnerability in GitLab EE/CE affecting all ...) @@ -4564,7 +4564,7 @@ CVE-2022-33913 (In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04. CVE-2022-33912 (A permission issue affects users that deployed the shipped version of ...) NOT-FOR-US: Check MK as packaged by upstream CVE-2022-33911 (An issue was discovered in Couchbase Server 7.x before 7.0.4. Field na ...) - TODO: check + NOT-FOR-US: Couchbase Server CVE-2022-33910 (An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers ...) - mantis CVE-2022-33909 @@ -5046,63 +5046,63 @@ CVE-2022-33715 CVE-2022-33714 RESERVED CVE-2022-33713 (Implicit Intent hijacking vulnerability in Samsung Cloud prior to vers ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33712 (Intent redirection vulnerability using implict intent in Camera prior ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33711 (Improper validation of integrity check vulnerability in Samsung USB Dr ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33710 (Improper input validation vulnerability in BillingPackageInsraller in ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33709 (Improper input validation vulnerability in ApexPackageInstaller in Gal ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33708 (Improper input validation vulnerability in AppsPackageInstaller in Gal ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33707 (Improper identifier creation logic in Find My Mobile prior to version ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33706 (Improper access control vulnerability in Samsung Gallery prior to vers ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33705 (Information exposure in Calendar prior to version 12.3.05.1 allows ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33704 (Improper validation vulnerability in ucmRetParcelable of KnoxSDK prior ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33703 (Improper validation vulnerability in CACertificateInfo prior to SMR Ju ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33702 (Improper authorization vulnerability in Knoxguard prior to SMR Jul-202 ...) - TODO: check + NOT-FOR-US: Samsung CVE-2022-33701 (Improper access control vulnerability in KnoxCustomManagerService prio ...) - TODO: check + NOT-FOR-US: Samsung
[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 5b4376c8 by Salvatore Bonaccorso at 2022-07-11T22:14:34+02:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -4404,7 +4404,7 @@ CVE-2022-29921 CVE-2022-26084 RESERVED CVE-2022-2123 (The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF whi ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-2122 RESERVED CVE-2022-2121 (OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer derefer ...) @@ -4924,15 +4924,15 @@ CVE-2022-2095 CVE-2022-2094 RESERVED CVE-2022-2093 (The WP Duplicate Page WordPress plugin before 1.3 does not sanitize an ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-2092 (The WooCommerce PDF Invoices Packing Slips WordPress plugin befo ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-2091 (The Cache Images WordPress plugin before 3.2.1 does not implement nonc ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-2090 RESERVED CVE-2022-2089 (The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-33758 RESERVED CVE-2022-33757 @@ -6732,7 +6732,7 @@ CVE-2022-2052 CVE-2022-2051 RESERVED CVE-2022-2050 (The WP-Paginate WordPress plugin before 2.1.9 does not escape one of i ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-32957 RESERVED CVE-2022-32956 @@ -8887,9 +8887,9 @@ CVE-2022-1959 CVE-2022-1958 (A vulnerability classified as critical has been found in FileCloud. Af ...) NOT-FOR-US: FileCloud CVE-2022-1957 (The Comment License WordPress plugin before 1.4.0 does not have CSRF c ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-1956 (The Shortcut Macros WordPress plugin through 1.3 does not have authori ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-1955 (Session 1.13.0 allows an attacker with physical access to the victim's ...) NOT-FOR-US: oxen-io/session-android CVE-2022-1954 (A Regular Expression Denial of Service vulnerability in GitLab CE/EE a ...) @@ -8897,9 +8897,9 @@ CVE-2022-1954 (A Regular Expression Denial of Service vulnerability in GitLab CE CVE-2022-1953 (The Product Configurator for WooCommerce WordPress plugin before 1.2.3 ...) NOT-FOR-US: WordPress plugin CVE-2022-1952 (The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPres ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-1951 (The core plugin for kitestudio WordPress plugin before 2.3.1 does not ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-1950 RESERVED CVE-2022-1949 (An access control bypass vulnerability found in 389-ds-base. That mish ...) @@ -9653,9 +9653,9 @@ CVE-2022-1940 (A Stored Cross-Site Scripting vulnerability in Jira integration i CVE-2022-1939 (The Allow svg files WordPress plugin before 1.1 does not properly vali ...) NOT-FOR-US: WordPress plugin CVE-2022-1938 (The Awin Data Feed WordPress plugin through 1.6 does not sanitise and ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-1937 (The Awin Data Feed WordPress plugin through 1.6 does not sanitise and ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022- [Sanitizing and other XSS protections] - spip 4.1.2+dfsg-1 [bullseye] - spip 3.2.11-3+deb11u4 @@ -9831,7 +9831,7 @@ CVE-2022-1912 CVE-2022-1911 RESERVED CVE-2022-1910 (The Shortcodes and extra features for Phlox WordPress plugin before 2. ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2022-1909 (Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organ ...) NOT-FOR-US: organizr CVE-2022-1908 (Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0. ...) @@ -10027,7 +10027,7 @@ CVE-2022-1896 (The underConstruction WordPress plugin before 1.21 does not sanit CVE-2022-1895 (The underConstruction WordPress plugin before 1.20 does not have CSRF ...) NOT-FOR-US: WordPress plugin CVE-2022-1894 (The Popup Builder WordPress plugin before 4.1.11 does not escape and s ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2021-4232 (A vulnerability classified as problematic has been found in Zoo Manage ...) NOT-FOR-US: Zoo Management System CVE-2022-31733 @@ -12174,7 +12174,7 @@ CVE-2022-1759 (The RB Internal Links WordPress plugin through 2.0.16 does not ha CVE-2022-1758 (The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not ...) NOT-FOR-US: WordPress plugin CVE-2022-1757 (The Pagebar WordPress plugin through 2.65 does not have CSRF check in ...) -
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
15d4bf7e by security tracker role at 2022-07-11T20:10:24+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -1,3 +1,45 @@
+CVE-2022-35628
+ RESERVED
+CVE-2022-35627
+ RESERVED
+CVE-2022-2385
+ RESERVED
+CVE-2022-2384
+ RESERVED
+CVE-2022-2383
+ RESERVED
+CVE-2022-2382
+ RESERVED
+CVE-2022-2381
+ RESERVED
+CVE-2022-2380
+ RESERVED
+CVE-2022-2379
+ RESERVED
+CVE-2022-2378
+ RESERVED
+CVE-2022-2377
+ RESERVED
+CVE-2022-2376
+ RESERVED
+CVE-2022-2375
+ RESERVED
+CVE-2022-2374
+ RESERVED
+CVE-2022-2373
+ RESERVED
+CVE-2022-2372
+ RESERVED
+CVE-2022-2371
+ RESERVED
+CVE-2022-2370
+ RESERVED
+CVE-2022-2369
+ RESERVED
+CVE-2022-2368 (Business Logic Errors in GitHub repository
microweber/microweber prior ...)
+ TODO: check
+CVE-2022-2367
+ RESERVED
CVE-2022-35626
RESERVED
CVE-2022-35625
@@ -427,8 +469,8 @@ CVE-2022-35414 (softmmu/physmem.c in QEMU through 7.0.0 can
perform an uninitial
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/1065
NOTE:
https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c
NOTE: https://sick.codes/sick-2022-113
-CVE-2022-2366
- RESERVED
+CVE-2022-2366 (Incorrect default configuration for trusted IP header in
Mattermost ve ...)
+ TODO: check
CVE-2022-2365 (Cross-site Scripting (XSS) - Stored in GitHub repository
zadam/trilium ...)
TODO: check
CVE-2022-2364
@@ -1563,8 +1605,8 @@ CVE-2022-2304 (Stack-based Buffer Overflow in GitHub
repository vim/vim prior to
NOTE:
https://github.com/vim/vim/commit/54e5fed6d27b747ff152cdb6edfb72ff60e70939
(v9.0.0035)
CVE-2022-2303
RESERVED
-CVE-2022-2302
- RESERVED
+CVE-2022-2302 (Multiple Lenze products of the cabinet series skip the password
verifi ...)
+ TODO: check
CVE-2022-2301 (Buffer Over-read in GitHub repository hpjansson/chafa prior to
1.10.3. ...)
- chafa 1.10.3-1 (unimportant)
NOTE: https://huntr.dev/bounties/f6b9114b-671d-4948-b946-ffe5c9aeb816/
@@ -1581,16 +1623,19 @@ CVE-2022-2297
RESERVED
CVE-2022-2296
RESERVED
+ {DSA-5180-1}
- chromium 103.0.5060.114-1
[buster] - chromium (see DSA 5046)
[stretch] - chromium (see DSA 4562)
CVE-2022-2295
RESERVED
+ {DSA-5180-1}
- chromium 103.0.5060.114-1
[buster] - chromium (see DSA 5046)
[stretch] - chromium (see DSA 4562)
CVE-2022-2294
RESERVED
+ {DSA-5180-1}
- chromium 103.0.5060.114-1
[buster] - chromium (see DSA 5046)
[stretch] - chromium (see DSA 4562)
@@ -2104,24 +2149,24 @@ CVE-2022-34747
RESERVED
CVE-2022-34746
RESERVED
-CVE-2022-34743
- RESERVED
-CVE-2022-34742
- RESERVED
-CVE-2022-34741
- RESERVED
-CVE-2022-34740
- RESERVED
-CVE-2022-34739
- RESERVED
-CVE-2022-34738
- RESERVED
-CVE-2022-34737
- RESERVED
-CVE-2022-34736
- RESERVED
-CVE-2022-34735
- RESERVED
+CVE-2022-34743 (The AT commands of the USB port have an out-of-bounds read
vulnerabili ...)
+ TODO: check
+CVE-2022-34742 (The system module has a read/write vulnerability. Successful
exploitat ...)
+ TODO: check
+CVE-2022-34741 (The NFC module has a buffer overflow vulnerability. Successful
exploit ...)
+ TODO: check
+CVE-2022-34740 (The NFC module has a buffer overflow vulnerability. Successful
exploit ...)
+ TODO: check
+CVE-2022-34739 (The fingerprint module has a vulnerability of overflow in
arithmetic a ...)
+ TODO: check
+CVE-2022-34738 (The SystemUI module has a vulnerability in permission control.
If this ...)
+ TODO: check
+CVE-2022-34737 (The application security module has a vulnerability in
permission assi ...)
+ TODO: check
+CVE-2022-34736 (The frame scheduling module has a null pointer dereference
vulnerabili ...)
+ TODO: check
+CVE-2022-34735 (The frame scheduling module has a null pointer dereference
vulnerabili ...)
+ TODO: check
CVE-2022-2245
RESERVED
CVE-2022-2244 (An improper authorization vulnerability in GitLab EE/CE
affecting all ...)
@@ -4358,8 +4403,8 @@ CVE-2022-29921
RESERVED
CVE-2022-26084
RESERVED
-CVE-2022-2123
- RESERVED
+CVE-2022-2123 (The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to
CSRF whi ...)
+ TODO: check
CVE-2022-2122
RESERVED
CVE-2022-2121 (OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer
derefer ...)
@@ -4518,8 +4563,8 @@ CVE-2022-33913 (In Mahara 21.04 before 21.04.6, 21.10
before 21.10.4, and 22.04.
- mahara
CVE-2022-33912 (A permission issue affects users that deployed
[Git][security-tracker-team/security-tracker][master] qtbase-opensource-src-gles, qt6-base fixed in sid
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 6ff94ec6 by Moritz Muehlenhoff at 2022-07-11T21:48:21+02:00 qtbase-opensource-src-gles, qt6-base fixed in sid - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -28686,17 +28686,18 @@ CVE-2022-25257 CVE-2022-25256 (SAS Web Report Studio 4.4 allows XSS. /SASWebReportStudio/logonAndRend ...) NOT-FOR-US: SAS Web Report Studio CVE-2022-25255 (In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux ...) - - qt6-base + - qt6-base 6.2.4+dfsg-4 - qtbase-opensource-src 5.15.2+dfsg-15 [bullseye] - qtbase-opensource-src (Minor issue) [buster] - qtbase-opensource-src (Breaks existing behaviour and upstream also skipped from 5.12 branch) [stretch] - qtbase-opensource-src (Vulnerable code introduced later) - - qtbase-opensource-src-gles + - qtbase-opensource-src-gles 5.15.4+dfsg-2 [bullseye] - qtbase-opensource-src-gles (Minor issue) [buster] - qtbase-opensource-src-gles (Breaks existing behaviour and upstream also skipped from 5.12 branch) NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/393113 NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/394914 NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/396020 + NOTE: https://github.com/qt/qtbase/commit/ab6915f0efb12cfe48d1f126f4a828212f853ce5 (6.2) NOTE: https://download.qt.io/official_releases/qt/5.15/qprocess5-15.diff NOTE: https://download.qt.io/official_releases/qt/6.2/qprocess6-2.diff NOTE: https://www.qt.io/blog/security-advisory-qprocess View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ff94ec650cddcc5a624d1f534e2083031222574 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ff94ec650cddcc5a624d1f534e2083031222574 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] bugnums
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: deac0a55 by Moritz Muehlenhoff at 2022-07-11T21:42:19+02:00 bugnums - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -26529,7 +26529,7 @@ CVE-2022-0761 CVE-2022-0760 (The Simple Link Directory WordPress plugin before 7.7.2 does not valid ...) NOT-FOR-US: WordPress plugin CVE-2022-0759 (A flaw was found in all versions of kubeclient up to (but not includin ...) - - ruby-kubeclient + - ruby-kubeclient (bug #1014780) [bullseye] - ruby-kubeclient (Minor issue) [buster] - ruby-kubeclient (Minor issue) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2058404 @@ -26843,7 +26843,7 @@ CVE-2022-25846 CVE-2022-25845 (The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deser ...) NOT-FOR-US: com.alibaba:fastjson CVE-2022-25844 (The package angular after 1.7.0 are vulnerable to Regular Expression D ...) - - angular.js + - angular.js (bug #1014779) [stretch] - angular.js (Nodejs in stretch not covered by security support) NOTE: https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735 CVE-2022-25843 @@ -78398,7 +78398,7 @@ CVE-2021-32753 (EdgeX Foundry is an open source project for building a common op CVE-2021-32752 (Ether Logs is a package that allows one to check one's logs in the Cra ...) NOT-FOR-US: Ether Logs CVE-2021-32751 (Gradle is a build tool with a focus on build automation. In versions p ...) - - gradle + - gradle (bug #1014778) [bullseye] - gradle (Minor issue) [buster] - gradle (Minor issue) [stretch] - gradle (Minor issue) @@ -79579,7 +79579,7 @@ CVE-2021-32296 CVE-2021-32295 RESERVED CVE-2021-32294 (An issue was discovered in libgig through 20200507. A heap-buffer-over ...) - - libgig + - libgig (bug #1014777) [bullseye] - libgig (Minor issue) [buster] - libgig (Minor issue) [stretch] - libgig (Minor issue, revisit when/if fixed upstream) @@ -100968,7 +100968,7 @@ CVE-2021-23922 (An issue was discovered in Devolutions Remote Desktop Manager be CVE-2021-23921 (An issue was discovered in Devolutions Server before 2020.3. There is ...) NOT-FOR-US: Devolutions Server CVE-2020-36191 (JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lac ...) - - jupyterhub + - jupyterhub (bug #1014774) NOTE: https://github.com/jupyterhub/jupyterhub/issues/3304 CVE-2020-36190 (RailsAdmin (aka rails_admin) before 1.4.3 and 2.x before 2.0.2 allows ...) NOT-FOR-US: RailsAdmin @@ -118799,7 +118799,7 @@ CVE-2020-28590 (An out-of-bounds read vulnerability exists in the Obj File Trian NOTE: https://github.com/slic3r/Slic3r/issues/5074 NOTE: Crash in enduser application, no security impact CVE-2020-28589 (An improper array index validation vulnerability exists in the LoadObj ...) - - tinyobjloader + - tinyobjloader (bug #1014776) NOTE: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1212 CVE-2020-28588 (An information disclosure vulnerability exists in the /proc/pid/syscal ...) - linux 5.9.15-1 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/deac0a55ef18280add910102379bbfbbe068531b -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/deac0a55ef18280add910102379bbfbbe068531b You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] 3 commits: Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: b0118c06 by Salvatore Bonaccorso at 2022-07-11T21:37:32+02:00 Process some NFUs - - - - - c729c039 by Salvatore Bonaccorso at 2022-07-11T21:37:33+02:00 Add CVE-2022-33980/commons-configuration2 - - - - - f71e4e3b by Salvatore Bonaccorso at 2022-07-11T21:37:35+02:00 Add CVE-2022-32061/snipe-it - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -2441,7 +2441,7 @@ CVE-2022-30692 CVE-2022-29514 RESERVED CVE-2022-27168 (Cross-site scripting vulnerability in LiteCart versions prior to 2.4.2 ...) - TODO: check + NOT-FOR-US: LiteCart CVE-2022-2214 (A vulnerability was found in SourceCodester Library Management System ...) NOT-FOR-US: SourceCodester Library Management System CVE-2022-2213 (A vulnerability was found in SourceCodester Library Management System ...) @@ -4191,7 +4191,8 @@ CVE-2022-33981 (drivers/block/floppy.c in the Linux kernel before 5.17.6 is vuln NOTE: https://www.openwall.com/lists/oss-security/2022/04/28/1 NOTE: https://git.kernel.org/linus/233087ca063686964a53c829d547c7571e3f67bf (5.18-rc5) CVE-2022-33980 (Apache Commons Configuration performs variable interpolation, allowing ...) - TODO: check + - commons-configuration2 + NOTE: https://www.openwall.com/lists/oss-security/2022/07/06/5 CVE-2022-2129 (Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. ...) - vim [stretch] - vim (Minor issue) @@ -7472,7 +7473,7 @@ CVE-2022-32569 CVE-2022-32568 RESERVED CVE-2022-32567 (The Appfire Jira Misc Custom Fields (JMCF) app 2.4.6 for Atlassian Jir ...) - TODO: check + NOT-FOR-US: Appfire Jira Misc Custom Fields (JMCF) app CVE-2022-32566 RESERVED CVE-2022-32565 (An issue was discovered in Couchbase Server before 7.0.4. The Backup S ...) @@ -7926,7 +7927,7 @@ CVE-2022-32443 CVE-2022-32442 (u5cms version 8.3.5 is vulnerable to Cross Site Scripting (XSS). When ...) NOT-FOR-US: u5cms CVE-2022-32441 (A memory corruption in Hex Rays Ida Pro v6.6 allows attackers to cause ...) - TODO: check + NOT-FOR-US: Hex Rays Ida Pro CVE-2022-32440 RESERVED CVE-2022-32439 @@ -8218,7 +8219,7 @@ CVE-2022-32297 CVE-2022-32295 (On Ampere Altra and AltraMax devices before SRP 1.09, the the Altra re ...) NOT-FOR-US: Ampere devices CVE-2022-32294 (Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-l ...) - TODO: check + NOT-FOR-US: Zimbra CVE-2022-32293 RESERVED CVE-2022-32292 @@ -8491,13 +8492,13 @@ CVE-2022-1986 (OS Command Injection in GitHub repository gogs/gogs prior to 0.12 CVE-2022-32234 RESERVED CVE-2022-30943 (Browsing restriction bypass vulnerability in Bulletin of Cybozu Garoon ...) - TODO: check + NOT-FOR-US: Cybozu CVE-2022-30602 (Operation restriction bypass in multiple applications of Cybozu Garoon ...) - TODO: check + NOT-FOR-US: Cybozu CVE-2022-29926 RESERVED CVE-2022-29512 (Exposure of sensitive information to an unauthorized actor issue in mu ...) - TODO: check + NOT-FOR-US: Cybozu CVE-2022-1985 (The Download Manager Plugin for WordPress is vulnerable to reflected C ...) NOT-FOR-US: WordPress plugin CVE-2022-1984 @@ -9043,7 +9044,7 @@ CVE-2022-32063 CVE-2022-32062 RESERVED CVE-2022-32061 (An arbitrary file upload vulnerability in the Select User function und ...) - TODO: check + - snipe-it (bug #1005172) CVE-2022-32060 (An arbitrary file upload vulnerability in the Update Branding Settings ...) - snipe-it (bug #1005172) CVE-2022-32059 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/6b3e374505c297f9ac83178fa1db2d60f833d287...f71e4e3bd346cb01a2be751d9c51fa5290be7023 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/6b3e374505c297f9ac83178fa1db2d60f833d287...f71e4e3bd346cb01a2be751d9c51fa5290be7023 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] NFU
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 6b3e3745 by Moritz Muehlenhoff at 2022-07-11T21:31:19+02:00 NFU - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -49248,9 +49248,7 @@ CVE-2021-43505 (Multiple Cross Site Scripting (XSS) vulnerabilities exist in Sso CVE-2021-43504 RESERVED CVE-2021-43503 (A Remote Code Execution (RCE) vulnerability exists in h laravel 5.8.38 ...) - - php-laravel-framework - NOTE: https://github.com/guoyanan1g/Laravel-vul/issues/2#issue-1045655892 - TODO: check, unclear status of report to upstream + NOTE: Disputed Laravel issue CVE-2021-43502 RESERVED CVE-2021-43501 @@ -126259,10 +126257,8 @@ CVE-2020-26557 (Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 ma NOTE: https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/predicatable-authvalue/ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1960009 CVE-2020-26556 (Mesh Provisioning in the Bluetooth Mesh profile 1.0 and 1.0.1 may perm ...) - - bluez - [bullseye] - bluez (Minor issue) - [buster] - bluez (Minor issue) - [stretch] - bluez (Mesh support introduced later) + NOT-FOR-US: Bluetooth + NOTE: There's no indication that any Bluetooth software in Debian is affected NOTE: https://kb.cert.org/vuls/id/799380 NOTE: https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/malleable/ NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1960012 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6b3e374505c297f9ac83178fa1db2d60f833d287 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6b3e374505c297f9ac83178fa1db2d60f833d287 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add mat2 to dsa-needed list
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 6a668131 by Salvatore Bonaccorso at 2022-07-11T21:25:30+02:00 Add mat2 to dsa-needed list - - - - - 1 changed file: - data/dsa-needed.txt Changes: = data/dsa-needed.txt = @@ -34,6 +34,9 @@ linux (carnil) Wait until more issues have piled up, though try to regulary rebase for point releases to more recent v4.19.y versions. -- +mat2 + Maintainer is going to prepare updates +-- ndpi/oldstable -- netatalk View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6a6681314ebb9750c5678d4c990f71c5a30e95d2 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6a6681314ebb9750c5678d4c990f71c5a30e95d2 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] glances fixed in sid
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 03b0e854 by Moritz Muehlenhoff at 2022-07-11T21:20:39+02:00 glances fixed in sid - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -102136,7 +102136,7 @@ CVE-2021-23420 (This affects the package codeception/codeception from 4.0.0 and CVE-2021-23419 (This affects the package open-graph before 0.2.6. The function parse c ...) NOT-FOR-US: Node open-graph CVE-2021-23418 (The package glances before 3.2.1 are vulnerable to XML External Entity ...) - - glances + - glances 3.2.3.1+dfsg-1 [bullseye] - glances (Minor issue) [buster] - glances (Minor issue) [stretch] - glances (Minor issue) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/03b0e85499a9da490d844bf35f86aaeb54f5c9b0 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/03b0e85499a9da490d844bf35f86aaeb54f5c9b0 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] python-reportlab fixed in sid
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: bca79971 by Moritz Muehlenhoff at 2022-07-11T21:19:27+02:00 python-reportlab fixed in sid - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -119313,13 +119313,12 @@ CVE-2020-28465 CVE-2020-28464 (This affects the package djv before 2.1.4. By controlling the schema f ...) NOT-FOR-US: Node djv CVE-2020-28463 (All versions of package reportlab are vulnerable to Server-side Reques ...) - - python-reportlab - [bullseye] - python-reportlab (Minor issue) + - python-reportlab 3.5.55-1 [buster] - python-reportlab (Minor issue) [stretch] - python-reportlab (Can be fixed in next DLA) NOTE: https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145 NOTE: Starting in 3.5.55 trustedSchemes and trustedHosts rl_config variables are introduced - NOTE: which can be used to mitigate the issue. + NOTE: which can be used to mitigate the issue, treating this as the fixed version CVE-2020-28462 RESERVED CVE-2020-28461 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bca79971c11cedd40e6f22da2bc3c594389b8dbf -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bca79971c11cedd40e6f22da2bc3c594389b8dbf You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] gnome-shell n/a
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6ce6a58c by Moritz Muehlenhoff at 2022-07-11T21:10:21+02:00
gnome-shell n/a
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -111099,9 +111099,8 @@ CVE-2021-20316
NOTE: https://www.samba.org/samba/security/CVE-2021-20316.html
NOTE: https://bugzilla.samba.org/show_bug.cgi?id=14842
CVE-2021-20315 (A locking protection bypass flaw was found in some versions of
gnome-s ...)
- - gnome-shell
+ - gnome-shell (Red Hat-specific backport error to CentOS
8 Streams)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2006285
- TODO: check, possibly Red Hat specific as issue introduced of
backporting features to CentOS 8 Streams
CVE-2021-20314 (Stack buffer overflow in libspf2 versions below 1.2.11 when
processing ...)
{DSA-4955-1 DLA-2739-1}
- libspf2 1.2.10-7.1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ce6a58c415d25d1708386b6c525fb5f7abc7825
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ce6a58c415d25d1708386b6c525fb5f7abc7825
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] two Intel NFUs, there's no actionable information indicating this affects any...
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 083c5cf4 by Moritz Muehlenhoff at 2022-07-11T21:08:58+02:00 two Intel NFUs, theres no actionable information indicating this affects any firmware shipped in Debian - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -77390,9 +77390,7 @@ CVE-2021-33157 CVE-2021-33156 RESERVED CVE-2021-33155 (Improper input validation in firmware for some Intel(R) Wireless Bluet ...) - - firmware-nonfree - NOTE: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00604.html - TODO: check in which firmware versions fixed + NOT-FOR-US: Intel CVE-2021-33154 RESERVED CVE-2021-33153 @@ -77424,9 +77422,7 @@ CVE-2021-33141 CVE-2021-33140 RESERVED CVE-2021-33139 (Improper conditions check in firmware for some Intel(R) Wireless Bluet ...) - - firmware-nonfree - NOTE: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00604.html - TODO: check in which firmware versions fixed + NOT-FOR-US: Intel CVE-2021-33138 RESERVED CVE-2021-33137 (Out-of-bounds write in the Intel(R) Kernelflinger project may allow an ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/083c5cf49d4e0f03639f37e449826e2c8d118caa -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/083c5cf49d4e0f03639f37e449826e2c8d118caa You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2022-35414/qemu
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: ed5f50e8 by Salvatore Bonaccorso at 2022-07-11T20:57:43+02:00 Add CVE-2022-35414/qemu - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -423,7 +423,10 @@ CVE-2022-35416 (H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnl CVE-2022-35415 RESERVED CVE-2022-35414 (softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized r ...) - TODO: check + - qemu + NOTE: https://gitlab.com/qemu-project/qemu/-/issues/1065 + NOTE: https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c + NOTE: https://sick.codes/sick-2022-113 CVE-2022-2366 RESERVED CVE-2022-2365 (Cross-site Scripting (XSS) - Stored in GitHub repository zadam/trilium ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed5f50e8f6f4fe004cafe6f951159c2ff36b86fd -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ed5f50e8f6f4fe004cafe6f951159c2ff36b86fd You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process one NFU
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 9ea8b066 by Salvatore Bonaccorso at 2022-07-11T20:53:12+02:00 Process one NFU - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -419,7 +419,7 @@ CVE-2022-35418 CVE-2022-35417 RESERVED CVE-2022-35416 (H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang co ...) - TODO: check + NOT-FOR-US: H3C SSL VPN CVE-2022-35415 RESERVED CVE-2022-35414 (softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized r ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ea8b0660db33fa1819d9219ddaa5b2aa912e326 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ea8b0660db33fa1819d9219ddaa5b2aa912e326 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Track fixed version for CVE-2022-29217/pyjwt via unstable
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8133f0cb by Salvatore Bonaccorso at 2022-07-11T20:51:16+02:00 Track fixed version for CVE-2022-29217/pyjwt via unstable - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -17369,7 +17369,7 @@ CVE-2022-29219 (Lodestar is a TypeScript implementation of the Ethereum Consensu CVE-2022-29218 (RubyGems is a package registry used to supply software for the Ruby la ...) NOT-FOR-US: rubygems/rubygems.org CVE-2022-29217 (PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple ...) - - pyjwt (bug #1011747) + - pyjwt 2.4.0-1 (bug #1011747) [bullseye] - pyjwt (Vulnerable code not present) [buster] - pyjwt (Vulnerable code not present) [stretch] - pyjwt (Vulnerable code not present) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8133f0cbee3aaf8516925d999834d9e706825212 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8133f0cbee3aaf8516925d999834d9e706825212 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] bugnums
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 1780cc4c by Moritz Muehlenhoff at 2022-07-11T20:39:36+02:00 bugnums - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -30237,7 +30237,7 @@ CVE-2022-24760 (Parse Server is an open source http web server backend. In versi CVE-2022-24759 (`@chainsafe/libp2p-noise` contains TypeScript implementation of noise ...) NOT-FOR-US: chainsafe/libp2p-noise CVE-2022-24758 (The Jupyter notebook is a web-based notebook environment for interacti ...) - - jupyter-notebook + - jupyter-notebook (bug #1014771) [bullseye] - jupyter-notebook (Minor issue) [buster] - jupyter-notebook (Minor issue) NOTE: https://github.com/jupyter/notebook/security/advisories/GHSA-m87f-39q9-6f55 @@ -33212,7 +33212,7 @@ CVE-2021-4214 NOTE: Crash in CLI package, not shipped in binary packages CVE-2021-4213 RESERVED - - jss + - jss (bug #1014770) [bullseye] - jss (Minor issue) [buster] - jss (Minor issue) [stretch] - jss (revisit when/if fix is complete) @@ -67765,14 +67765,14 @@ CVE-2021-37139 CVE-2021-37138 RESERVED CVE-2021-37137 (The Snappy frame decoder function doesn't restrict the chunk length wh ...) - - netty + - netty (bug #1014769) [bullseye] - netty (Minor issue) [buster] - netty (Minor issue) [stretch] - netty (Minor issue) NOTE: https://github.com/netty/netty/security/advisories/GHSA-9vjp-v76f-g363 NOTE: Fixed by: https://github.com/netty/netty/commit/6da4956b31023ae967451e1d94ff51a746a9194f (netty-4.1.68.Final) CVE-2021-37136 (The Bzip2 decompression decoder function doesn't allow setting size re ...) - - netty + - netty (bug #1014769) [bullseye] - netty (Minor issue) [buster] - netty (Minor issue) [stretch] - netty (Minor issue) @@ -93278,7 +93278,7 @@ CVE-2021-27027 (An Out-Of-Bounds Read Vulnerability in Autodesk FBX Review versi CVE-2021-27026 (A flaw was divered in Puppet Enterprise and other Puppet products wher ...) NOT-FOR-US: Puppet Enterprise CVE-2021-27025 (A flaw was discovered in Puppet Agent where the agent may silently ign ...) - - puppet + - puppet (bug #1014772) [bullseye] - puppet (Minor issue, too intrusive to backport) [buster] - puppet (Minor issue, too intrusive to backport) [stretch] - puppet (Minor issue, too intrusive to backport) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1780cc4c8cdff45f3736b49b901620c67515f4ae -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1780cc4c8cdff45f3736b49b901620c67515f4ae You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] two mxml non issues
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 6b37e26e by Moritz Muehlenhoff at 2022-07-11T20:28:04+02:00 two mxml non issues - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -46520,6 +46520,7 @@ CVE-2021-3979 [ceph: Ceph volume does not honour osd_dmcrypt_key_size] [buster] - ceph (Minor issue) [stretch] - ceph (Minor issue) NOTE: https://www.openwall.com/lists/oss-security/2022/01/11/5 + NOTE: https://github.com/ceph/ceph/commit/47c33179f9a15ae95cc1579a421be89378602656 CVE-2021-44034 RESERVED CVE-2021-44033 (In Ionic Identity Vault before 5.0.5, the protection mechanism for inv ...) @@ -51876,13 +51877,9 @@ CVE-2021-42862 CVE-2021-42861 RESERVED CVE-2021-42860 (** DISPUTED ** A stack buffer overflow exists in Mini-XML v3.2. When i ...) - - mxml - NOTE: https://github.com/michaelrsweet/mxml/issues/286 - TODO: check, unclear details from reporter and upstream cannot reproduce on current master + NOTE: Disputed mxml issue CVE-2021-42859 (** DISPUTED ** A memory leak issue was discovered in Mini-XML v3.2 tha ...) - - mxml - NOTE: https://github.com/michaelrsweet/mxml/issues/286 - TODO: check, unclear details from reporter and upstream cannot reproduce on current master + NOTE: Disputed mxml issue CVE-2021-42858 RESERVED CVE-2021-42857 (It was discovered that the SteelCentral AppInternals Dynamic Sampling ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6b37e26e3a1574924e022e2f41a154445b0d253c -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6b37e26e3a1574924e022e2f41a154445b0d253c You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] bugnums
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 0865458b by Moritz Muehlenhoff at 2022-07-11T20:23:13+02:00 bugnums - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -933,7 +933,7 @@ CVE-2022-2311 CVE-2022-2310 RESERVED CVE-2022-2309 (NULL Pointer Dereference allows attackers to cause a denial of service ...) - - lxml + - lxml (bug #1014766) [bullseye] - lxml (Minor issue) [buster] - lxml (Minor issue) NOTE: https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba/ @@ -2762,7 +2762,7 @@ CVE-2022-2211 [Buffer overflow in get_keys leads to Dos] - libguestfs 1:1.46.2-1 [bullseye] - libguestfs (Minor issue) [buster] - libguestfs (Minor issue) - - guestfs-tools + - guestfs-tools (bug #1014764) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2100862 NOTE: In 1:1.46.2-1 of src:libguestfs the tools were split out to src:guestfs-tools, marking that as fixed version NOTE: https://listman.redhat.com/archives/libguestfs/2022-June/029274.html @@ -31958,7 +31958,7 @@ CVE-2022-0432 (Prototype Pollution in GitHub repository mastodon/mastodon prior CVE-2022-0431 (The Insights from Google PageSpeed WordPress plugin before 4.0.4 does ...) NOT-FOR-US: WordPress plugin CVE-2022-0430 (Exposure of Sensitive Information to an Unauthorized Actor in GitHub r ...) - - httpie + - httpie (bug #1014765) [bullseye] - httpie (Minor issue) [buster] - httpie (Minor issue) [stretch] - httpie (Minor issue) @@ -60301,7 +60301,7 @@ CVE-2021-3739 (A NULL pointer dereference flaw was found in the btrfs_rm_device NOTE: https://www.openwall.com/lists/oss-security/2021/08/25/3 CVE-2021-3735 [ahci: deadlock issue leads to denial of service] RESERVED - - qemu + - qemu (bug #1014767) [bullseye] - qemu (Minor issue) [buster] - qemu (Minor issue) [stretch] - qemu (Fix along with a future DLA) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0865458b5413b5d3ab00bb418841adf9b4e35a8d -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0865458b5413b5d3ab00bb418841adf9b4e35a8d You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] slic3r non issues
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: b0fb7d5b by Moritz Muehlenhoff at 2022-07-11T20:05:34+02:00 slic3r non issues - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -40212,13 +40212,15 @@ CVE-2021-45849 CVE-2021-45848 (Denial of service (DoS) vulnerability in Nicotine+ 3.0.3 and later all ...) - nicotine-plus (bug #966000) CVE-2021-45847 (Several missing input validations in the 3MF parser component of Slic3 ...) - - slic3r + - slic3r (unimportant) NOTE: https://github.com/slic3r/Slic3r/issues/5118 NOTE: https://github.com/slic3r/Slic3r/issues/5119 NOTE: https://github.com/slic3r/Slic3r/issues/5120 + NOTE: Crash in GUI tool, no security impact CVE-2021-45846 (A flaw in the AMF parser of Slic3r libslic3r 1.3.0 allows an attacker ...) - - slic3r + - slic3r (unimportant) NOTE: https://github.com/slic3r/Slic3r/issues/5117 + NOTE: Crash in GUI tool, no security impact CVE-2021-45845 (The Path Sanity Check script of FreeCAD 0.19 is vulnerable to OS comma ...) - freecad 0.19.4+dfsg1-1 [stretch] - freecad (Vulnerable code introduced in 0.17) @@ -43482,13 +43484,13 @@ CVE-2021-44964 (Use after free in garbage collector and finalizer of lgc.c in Lu CVE-2021-44963 RESERVED CVE-2021-44962 (An out-of-bounds read vulnerability exists in the GCode::extrude() fun ...) - - slic3r + - slic3r (unimportant) NOTE: https://hackmd.io/KSI1bwGfSyO7T8UCf0HeTw - TODO: check upstream fix + NOTE: Crash in GUI tool, no security impact CVE-2021-44961 (A memory leakage flaw exists in the class PerimeterGenerator of Slic3r ...) - - slic3r + - slic3r (unimportant) NOTE: https://hackmd.io/nDT_UKLyRQendxDwil9A4w - TODO: check upstream commit + NOTE: memory overusage in GUI tool, no security impact CVE-2021-44960 (In SVGPP SVG++ library 1.3.0, the XMLDocument::getRoot function in the ...) - svgpp (bug #1014599) [bullseye] - svgpp (Minor issue) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b0fb7d5be622ad4f8f8fea62f72d8d7c1c5eb467 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b0fb7d5be622ad4f8f8fea62f72d8d7c1c5eb467 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] gdal fixed in sid
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0a3f1079 by Moritz Muehlenhoff at 2022-07-11T19:55:11+02:00
gdal fixed in sid
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -39650,7 +39650,7 @@ CVE-2021-45944 (Ghostscript GhostPDL 9.50 through
9.53.3 has a use-after-free in
CVE-2021-45943 (GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in
PCIDSK::C ...)
{DLA-2877-1}
[experimental] - gdal 3.4.1~rc1+dfsg-1~exp1
- - gdal
+ - gdal 3.4.1+dfsg-1
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=41993
NOTE: https://github.com/OSGeo/gdal/pull/4944
NOTE:
https://github.com/OSGeo/gdal/commit/93913a849dc1d217a40dbf9d6e6a3a23c42b61a6
(master)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a3f1079447b8d7f99443649bca3545e2a216d38
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0a3f1079447b8d7f99443649bca3545e2a216d38
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] libbpf fixed in sid
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: caf8187f by Moritz Muehlenhoff at 2022-07-11T19:54:35+02:00 libbpf fixed in sid - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -39666,15 +39666,23 @@ CVE-2021-45942 (OpenEXR 3.1.x before 3.1.4 has a heap-based buffer overflow in I NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/1209 NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e CVE-2021-45941 (libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (8 bytes) in _ ...) - - libbpf + - libbpf 0.7.0-2 + [bullseye] - libbpf (No actionable information, revisit when/if more details available) NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40957 NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libbpf/OSV-2021-1576.yaml - TODO: check details on fixing commit upstream, furthermore intorducing commit is only when oss-fuzz started + NOTE: Fixed in 0.7.0 upstream per identified range of commits + NOTE: It's unclear if 0.3 is affected, the introducing commit presented by oss-fuzz is misleading + NOTE: since that refers to the first version when oss-fuzz started to test libbpf. If anyone confirms + NOTE: via bisecting that 0.3.0 is affected, this can be revisited CVE-2021-45940 (libbpf 0.6.0 and 0.6.1 has a heap-based buffer overflow (4 bytes) in _ ...) - - libbpf + - libbpf 0.7.0-2 + [bullseye] - libbpf (No actionable information, revisit when/if more details available) NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40868 NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libbpf/OSV-2021-1562.yaml - TODO: check details on fixing commit upstream, furthermore intorducing commit is only when oss-fuzz started + NOTE: Fixed in 0.7.0 upstream per identified range of commits + NOTE: It's unclear if 0.3 is affected, the introducing commit presented by oss-fuzz is misleading + NOTE: since that refers to the first version when oss-fuzz started to test libbpf. If anyone confirms + NOTE: via bisecting that 0.3.0 is affected, this can be revisited CVE-2021-45939 (wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_De ...) NOT-FOR-US: uWebSockets CVE-2021-45938 (wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow in MqttClient_De ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/caf8187f8a7db3d457c1caf4785be7ae0d8bf908 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/caf8187f8a7db3d457c1caf4785be7ae0d8bf908 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] chromium DSA
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
38525ad2 by Moritz Mühlenhoff at 2022-07-11T19:40:52+02:00
chromium DSA
- - - - -
2 changed files:
- data/DSA/list
- data/dsa-needed.txt
Changes:
=
data/DSA/list
=
@@ -1,3 +1,6 @@
+[11 Jul 2022] DSA-5180-1 chromium - security update
+ {CVE-2022-2294 CVE-2022-2295 CVE-2022-2296}
+ [bullseye] - chromium 103.0.5060.114-1~deb11u1
[08 Jul 2022] DSA-5179-1 php7.4 - security update
{CVE-2022-31625 CVE-2022-31626}
[bullseye] - php7.4 7.4.30-1+deb11u1
=
data/dsa-needed.txt
=
@@ -14,8 +14,6 @@ If needed, specify the release by adding a slash after the
name of the source pa
--
asterisk
--
-chromium (jmm)
---
curl (apo)
--
epiphany-browser
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/38525ad2d9b89584197040ea159aa8caffaeb68f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/38525ad2d9b89584197040ea159aa8caffaeb68f
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] buster/bullseye triage
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 95af1295 by Moritz Muehlenhoff at 2022-07-11T14:31:35+02:00 buster/bullseye triage - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -698,9 +698,10 @@ CVE-2022-33939 CVE-2022-2346 RESERVED CVE-2022-2345 (Use After Free in GitHub repository vim/vim prior to 9.0.0046. ...) - - vim + - vim (unimportant) NOTE: https://huntr.dev/bounties/1eed7009-db6d-487b-bc41-8f2fd260483f NOTE: https://github.com/vim/vim/commit/32acf1f1a72ebb9d8942b9c9d80023bf1bb668ea (v9.0.0047) + NOTE: Crash in CLI tool, no security impact CVE-2022-2344 (Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0 ...) - vim (unimportant) NOTE: https://huntr.dev/bounties/4a095ed9-3125-464a-b656-c31b437e1996 @@ -17369,6 +17370,8 @@ CVE-2022-29218 (RubyGems is a package registry used to supply software for the R NOT-FOR-US: rubygems/rubygems.org CVE-2022-29217 (PyJWT is a Python implementation of RFC 7519. PyJWT supports multiple ...) - pyjwt (bug #1011747) + [bullseye] - pyjwt (Vulnerable code not present) + [buster] - pyjwt (Vulnerable code not present) [stretch] - pyjwt (Vulnerable code not present) NOTE: https://github.com/jpadilla/pyjwt/security/advisories/GHSA-ffqj-6fqr-9h24 NOTE: https://github.com/jpadilla/pyjwt/commit/9c528670c455b8d948aff95ed50e22940d1ad3fc (2.4.0) @@ -51853,6 +51856,7 @@ CVE-2021-42864 RESERVED CVE-2021-42863 (A buffer overflow in ecma_builtin_typedarray_prototype_filter() in Jer ...) - iotjs + [bullseye] - iotjs (Minor issue) [buster] - iotjs (Vulnerable code introduced later) NOTE: https://github.com/jerryscript-project/jerryscript/issues/4793 NOTE: https://github.com/jerryscript-project/jerryscript/pull/4794 @@ -89411,6 +89415,8 @@ CVE-2021-3448 (A flaw was found in dnsmasq in versions before 2.85. When configu NOTE: https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=74d4fcd756a85bc1823232ea74334f7ccfb9d5d2 CVE-2021-3447 (A flaw was found in several ansible modules, where parameters containi ...) - ansible (bug #1014721) + [bullseye] - ansible (Minor issue) + [buster] - ansible (Minor issue) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1939349 CVE-2021-3446 (A flaw was found in libtpms in versions before 0.8.2. The commonly use ...) - libtpms 0.8.2-1 (bug #986799) @@ -223002,6 +223008,8 @@ CVE-2019-9837 (Doorkeeper::OpenidConnect (aka the OpenID Connect extension for D NOTE: https://github.com/doorkeeper-gem/doorkeeper-openid_connect/pull/66 CVE-2019-9836 (Secure Encrypted Virtualization (SEV) on Advanced Micro Devices (AMD) ...) - amd64-microcode 3.20220411.1 (bug #970395) + [bullseye] - amd64-microcode (Minor issue) + [buster] - amd64-microcode (Minor issue) NOTE: https://seclists.org/fulldisclosure/2019/Jun/46 CVE-2019-9835 (The receiver (aka bridge) component of Fujitsu Wireless Keyboard Set L ...) NOT-FOR-US: Fujitsu Wireless Keyboard Set LX901 GK900 devices View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/95af129517bafdc93b341e034302398063884e67 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/95af129517bafdc93b341e034302398063884e67 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] two xen issues only for src:linux
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: ff972746 by Moritz Muehlenhoff at 2022-07-11T14:01:07+02:00 two xen issues only for src:linux - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -4913,15 +4913,9 @@ CVE-2022-33745 RESERVED CVE-2022-33744 (Arm guests can cause Dom0 DoS via PV devices When mapping pages of gue ...) - linux - - xen - [buster] - xen (DSA 4677-1) - [stretch] - xen (DSA 4602-1) NOTE: https://xenbits.xen.org/xsa/advisory-406.html CVE-2022-33743 (network backend may cause Linux netfront to use freed SKBs While addin ...) - linux - - xen - [buster] - xen (DSA 4677-1) - [stretch] - xen (DSA 4602-1) NOTE: https://xenbits.xen.org/xsa/advisory-405.html CVE-2022-33742 (Linux disk/nic frontends data leaks T[his CNA information record relat ...) - linux View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ff9727469d89e076257b2edf706b3bd610a85912 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ff9727469d89e076257b2edf706b3bd610a85912 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] nodejs updates
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 3a10a9dc by Moritz Muehlenhoff at 2022-07-11T13:58:18+02:00 nodejs updates - - - - - 2 changed files: - data/CVE/list - data/dsa-needed.txt Changes: = data/CVE/list = @@ -8538,9 +8538,9 @@ CVE-2022-32223 NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#dll-hijacking-on-windows-high-cve-2022-32223 CVE-2022-3 RESERVED - - nodejs + - nodejs (Specific to Node 18 and nodejs-distributed binaries) NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#attempt-to-read-openssl-cnf-from-home-iojs-build-upon-startup-medium-cve-2022-3 - TODO: check if there affects Debian builds + NOTE: https://github.com/nodejs/node/commit/a5fc2deb43f85dc2195a1fe1683b9c2e7443b001 CVE-2022-32221 RESERVED CVE-2022-32220 @@ -8558,20 +8558,28 @@ CVE-2022-32215 [HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfe - nodejs - llhttp (bug #977716) NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-incorrect-parsing-of-multi-line-transfer-encoding-medium-cve-2022-32215 + NOTE: https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd (v14.x) + NOTE: https://github.com/nodejs/node/commit/d9b71f4c241fa31cc2a48331a4fc28c15937875a (main) CVE-2022-32214 [HTTP Request Smuggling - Improper Delimiting of Header Fields] RESERVED - nodejs - llhttp (bug #977716) NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-improper-delimiting-of-header-fields-medium-cve-2022-32214 + NOTE: https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd (v14.x) + NOTE: https://github.com/nodejs/node/commit/d9b71f4c241fa31cc2a48331a4fc28c15937875a (main) CVE-2022-32213 [HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding] RESERVED - nodejs - llhttp (bug #977716) NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-flawed-parsing-of-transfer-encoding-medium-cve-2022-32213 + NOTE: https://github.com/nodejs/node/commit/da0fda0fe81d372e24c0cb11aec37534985708dd (v14.x) + NOTE: https://github.com/nodejs/node/commit/d9b71f4c241fa31cc2a48331a4fc28c15937875a (main) CVE-2022-32212 RESERVED - nodejs NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-ip-addresses-high-cve-2022-32212 + NOTE: https://github.com/nodejs/node/commit/48c5aa5cab718d04473fa2761d532657c84b8131 (v14.x) + NOTE: https://github.com/nodejs/node/commit/1aa5036c31ac2a9b2a2528af454675ad412f1464 (main) CVE-2022-32211 RESERVED CVE-2022-32210 = data/dsa-needed.txt = @@ -41,6 +41,8 @@ ndpi/oldstable netatalk open regression with MacOS, tentative patch not yet merged upstream -- +nodejs/stable +-- nodejs/oldstable one of the upstream fixes doesn't address the security issue -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a10a9dc7672ca8ea108dfd7258fa8b4938a1eba -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a10a9dc7672ca8ea108dfd7258fa8b4938a1eba You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] libsdl2 fixed in sid
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: ceb3b319 by Moritz Muehlenhoff at 2022-07-11T13:33:35+02:00 libsdl2 fixed in sid - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -76074,7 +76074,7 @@ CVE-2021-33659 (SAP 3D Visual Enterprise Viewer, version - 9, allows a user to o CVE-2021-33658 (atune before 0.3-0.8 log in as a local user and run the curl command t ...) NOT-FOR-US: A-Tune OS tuning engine CVE-2021-33657 (There is a heap overflow problem in video/SDL_pixels.c in SDL (Simple ...) - - libsdl1.2 (bug #1014577) + - libsdl1.2 1.2.15+dfsg2-7 (bug #1014577) [bullseye] - libsdl1.2 (Minor issue) [buster] - libsdl1.2 (Minor issue) [stretch] - libsdl1.2 (Minor issue) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ceb3b31904c76bf0625e84fede297affafce0528 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ceb3b31904c76bf0625e84fede297affafce0528 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2022-32222 and mark it undetermined with a TODO
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 5942bb5c by Salvatore Bonaccorso at 2022-07-11T11:13:22+02:00 Add CVE-2022-3 and mark it undetermined with a TODO - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -8538,6 +8538,9 @@ CVE-2022-32223 NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#dll-hijacking-on-windows-high-cve-2022-32223 CVE-2022-3 RESERVED + - nodejs + NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#attempt-to-read-openssl-cnf-from-home-iojs-build-upon-startup-medium-cve-2022-3 + TODO: check if there affects Debian builds CVE-2022-32221 RESERVED CVE-2022-32220 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5942bb5c4e7078cd7d01a0d678620e94e6ee8459 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5942bb5c4e7078cd7d01a0d678620e94e6ee8459 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2022-32223/nodejs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8cd053f1 by Salvatore Bonaccorso at 2022-07-11T11:11:42+02:00 Add CVE-2022-32223/nodejs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -8534,6 +8534,8 @@ CVE-2022-32224 RESERVED CVE-2022-32223 RESERVED + - nodejs (Only affects Windows) + NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#dll-hijacking-on-windows-high-cve-2022-32223 CVE-2022-3 RESERVED CVE-2022-32221 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cd053f1b27ef8c8a3cfedceda86a14cd7c6fc01 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8cd053f1b27ef8c8a3cfedceda86a14cd7c6fc01 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2022-32212/nodejs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c9720fc0 by Salvatore Bonaccorso at 2022-07-11T11:09:57+02:00 Add CVE-2022-32212/nodejs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -8565,6 +8565,8 @@ CVE-2022-32213 [HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding] NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-flawed-parsing-of-transfer-encoding-medium-cve-2022-32213 CVE-2022-32212 RESERVED + - nodejs + NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#dns-rebinding-in-inspect-via-invalid-ip-addresses-high-cve-2022-32212 CVE-2022-32211 RESERVED CVE-2022-32210 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c9720fc036fc466c7e46a756a060ac8fc76886d7 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c9720fc036fc466c7e46a756a060ac8fc76886d7 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2022-32215/nodejs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: cfacd2c8 by Salvatore Bonaccorso at 2022-07-11T11:08:21+02:00 Add CVE-2022-32215/nodejs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -8548,8 +8548,11 @@ CVE-2022-32217 RESERVED CVE-2022-32216 RESERVED -CVE-2022-32215 +CVE-2022-32215 [HTTP Request Smuggling - Incorrect Parsing of Multi-line Transfer-Encoding] RESERVED + - nodejs + - llhttp (bug #977716) + NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-incorrect-parsing-of-multi-line-transfer-encoding-medium-cve-2022-32215 CVE-2022-32214 [HTTP Request Smuggling - Improper Delimiting of Header Fields] RESERVED - nodejs View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cfacd2c84a29b9891b59288d2ce62350b21d0fef -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cfacd2c84a29b9891b59288d2ce62350b21d0fef You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2022-32214/nodejs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 13ac10c7 by Salvatore Bonaccorso at 2022-07-11T10:10:58+02:00 Add CVE-2022-32214/nodejs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -8550,8 +8550,11 @@ CVE-2022-32216 RESERVED CVE-2022-32215 RESERVED -CVE-2022-32214 +CVE-2022-32214 [HTTP Request Smuggling - Improper Delimiting of Header Fields] RESERVED + - nodejs + - llhttp (bug #977716) + NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-improper-delimiting-of-header-fields-medium-cve-2022-32214 CVE-2022-32213 [HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding] RESERVED - nodejs View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/13ac10c7dd2cc045bf5977cb0cff1011c1921ba9 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/13ac10c7dd2cc045bf5977cb0cff1011c1921ba9 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: f77f5a2e by security tracker role at 2022-07-11T08:10:15+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,3 +1,433 @@ +CVE-2022-35626 + RESERVED +CVE-2022-35625 + RESERVED +CVE-2022-35624 + RESERVED +CVE-2022-35623 + RESERVED +CVE-2022-35622 + RESERVED +CVE-2022-35621 + RESERVED +CVE-2022-35620 + RESERVED +CVE-2022-35619 + RESERVED +CVE-2022-35618 + RESERVED +CVE-2022-35617 + RESERVED +CVE-2022-35616 + RESERVED +CVE-2022-35615 + RESERVED +CVE-2022-35614 + RESERVED +CVE-2022-35613 + RESERVED +CVE-2022-35612 + RESERVED +CVE-2022-35611 + RESERVED +CVE-2022-35610 + RESERVED +CVE-2022-35609 + RESERVED +CVE-2022-35608 + RESERVED +CVE-2022-35607 + RESERVED +CVE-2022-35606 + RESERVED +CVE-2022-35605 + RESERVED +CVE-2022-35604 + RESERVED +CVE-2022-35603 + RESERVED +CVE-2022-35602 + RESERVED +CVE-2022-35601 + RESERVED +CVE-2022-35600 + RESERVED +CVE-2022-35599 + RESERVED +CVE-2022-35598 + RESERVED +CVE-2022-35597 + RESERVED +CVE-2022-35596 + RESERVED +CVE-2022-35595 + RESERVED +CVE-2022-35594 + RESERVED +CVE-2022-35593 + RESERVED +CVE-2022-35592 + RESERVED +CVE-2022-35591 + RESERVED +CVE-2022-35590 + RESERVED +CVE-2022-35589 + RESERVED +CVE-2022-35588 + RESERVED +CVE-2022-35587 + RESERVED +CVE-2022-35586 + RESERVED +CVE-2022-35585 + RESERVED +CVE-2022-35584 + RESERVED +CVE-2022-35583 + RESERVED +CVE-2022-35582 + RESERVED +CVE-2022-35581 + RESERVED +CVE-2022-35580 + RESERVED +CVE-2022-35579 + RESERVED +CVE-2022-35578 + RESERVED +CVE-2022-35577 + RESERVED +CVE-2022-35576 + RESERVED +CVE-2022-35575 + RESERVED +CVE-2022-35574 + RESERVED +CVE-2022-35573 + RESERVED +CVE-2022-35572 + RESERVED +CVE-2022-35571 + RESERVED +CVE-2022-35570 + RESERVED +CVE-2022-35569 + RESERVED +CVE-2022-35568 + RESERVED +CVE-2022-35567 + RESERVED +CVE-2022-35566 + RESERVED +CVE-2022-35565 + RESERVED +CVE-2022-35564 + RESERVED +CVE-2022-35563 + RESERVED +CVE-2022-35562 + RESERVED +CVE-2022-35561 + RESERVED +CVE-2022-35560 + RESERVED +CVE-2022-35559 + RESERVED +CVE-2022-35558 + RESERVED +CVE-2022-35557 + RESERVED +CVE-2022-35556 + RESERVED +CVE-2022-3 + RESERVED +CVE-2022-35554 + RESERVED +CVE-2022-35553 + RESERVED +CVE-2022-35552 + RESERVED +CVE-2022-35551 + RESERVED +CVE-2022-35550 + RESERVED +CVE-2022-35549 + RESERVED +CVE-2022-35548 + RESERVED +CVE-2022-35547 + RESERVED +CVE-2022-35546 + RESERVED +CVE-2022-35545 + RESERVED +CVE-2022-35544 + RESERVED +CVE-2022-35543 + RESERVED +CVE-2022-35542 + RESERVED +CVE-2022-35541 + RESERVED +CVE-2022-35540 + RESERVED +CVE-2022-35539 + RESERVED +CVE-2022-35538 + RESERVED +CVE-2022-35537 + RESERVED +CVE-2022-35536 + RESERVED +CVE-2022-35535 + RESERVED +CVE-2022-35534 + RESERVED +CVE-2022-35533 + RESERVED +CVE-2022-35532 + RESERVED +CVE-2022-35531 + RESERVED +CVE-2022-35530 + RESERVED +CVE-2022-35529 + RESERVED +CVE-2022-35528 + RESERVED +CVE-2022-35527 + RESERVED +CVE-2022-35526 + RESERVED +CVE-2022-35525 + RESERVED +CVE-2022-35524 + RESERVED +CVE-2022-35523 + RESERVED +CVE-2022-35522 + RESERVED +CVE-2022-35521 + RESERVED +CVE-2022-35520 + RESERVED +CVE-2022-35519 + RESERVED +CVE-2022-35518 + RESERVED +CVE-2022-35517 + RESERVED +CVE-2022-35516 + RESERVED +CVE-2022-35515 + RESERVED +CVE-2022-35514 + RESERVED +CVE-2022-35513 + RESERVED +CVE-2022-35512 + RESERVED +CVE-2022-35511 + RESERVED +CVE-2022-35510 + RESERVED +CVE-2022-35509 + RESERVED +CVE-2022-35508 + RESERVED +CVE-2022-35507 + RESERVED +CVE-2022-35506 + RESERVED +CVE-2022-35505 + RESERVED +CVE-2022-35504 + RESERVED +CVE-2022-35503 + RESERVED +CVE-2022-35502 + RESERVED +CVE-2022-35501 + RESERVED +CVE-2022-35500 + RESERVED +CVE-2022-35499 + RESERVED +CVE-2022-35498 + RESERVED +CVE-2022-35497 + RESERVED +CVE-2022-35496 + RESERVED +CVE-2022-35495 + RESERVED +CVE-2022-35494 + RESERVED +CVE-2022-35493 + RESERVED +CVE-2022-35492 + RESERVED +CVE-2022-35491 + RESERVED +CVE-2022-35490 + RESERVED +CVE-2022-35489 + RESERVED +CVE-2022-35488 + RESERVED +CVE-2022-35487 + RESERVED +CVE-2022-35486 +
[Git][security-tracker-team/security-tracker][master] Add CVE-2022-32213/nodejs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 1c40daa0 by Salvatore Bonaccorso at 2022-07-11T10:09:41+02:00 Add CVE-2022-32213/nodejs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -8122,8 +8122,11 @@ CVE-2022-32215 RESERVED CVE-2022-32214 RESERVED -CVE-2022-32213 +CVE-2022-32213 [HTTP Request Smuggling - Flawed Parsing of Transfer-Encoding] RESERVED + - nodejs + - llhttp (bug #977716) + NOTE: https://nodejs.org/en/blog/vulnerability/july-2022-security-releases/#http-request-smuggling-flawed-parsing-of-transfer-encoding-medium-cve-2022-32213 CVE-2022-32212 RESERVED CVE-2022-32211 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1c40daa0ef412f820c9ccd0323adb86a83e3ec18 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1c40daa0ef412f820c9ccd0323adb86a83e3ec18 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
