date:20230731

[Git][security-tracker-team/security-tracker][master] Reserve DLA-3513-1 for tiff

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
07695d06 by Adrian Bunk at 2023-07-31T23:46:12+00:00
Reserve DLA-3513-1 for tiff

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/CVE/list
=
@@ -4945,7 +4945,6 @@ CVE-2023-3316 (A NULL pointer dereference in TIFFClose() 
is caused by a failure
- tiff 4.5.1~rc3-1
[bookworm] - tiff  (Minor issue)
[bullseye] - tiff  (Minor issue)
-   [buster] - tiff  (Minor issue, DoS, PoC doesn't segfault)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/515
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/468
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/d63de61b1ec3385f6383ef9a1f453e4b8b11d536
 (v4.5.1rc1)
@@ -4996,7 +4995,6 @@ CVE-2023-2908 (A null pointer dereference issue was found 
in Libtiff's tif_dir.c
- tiff 4.5.1~rc3-1
[bookworm] - tiff  (Minor issue)
[bullseye] - tiff  (Minor issue)
-   [buster] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/479
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f
 (v4.5.1rc1)
NOTE: Introduced by the fix for 
CVE-2022-3599/CVE-2022-4645/CVE-2023-30086/CVE-2023-30774:


=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[31 Jul 2023] DLA-3513-1 tiff - security update
+   {CVE-2023-2908 CVE-2023-3316 CVE-2023-3618 CVE-2023-25433 
CVE-2023-26965 CVE-2023-26966 CVE-2023-38288 CVE-2023-38289}
+   [buster] - tiff 4.1.0+git191117-2~deb10u8
 [31 Jul 2023] DLA-3512-1 linux-5.10 - security update
{CVE-2023-2156 CVE-2023-3390 CVE-2023-3610 CVE-2023-20593 
CVE-2023-31248 CVE-2023-35001}
[buster] - linux-5.10 5.10.179-3~deb10u1


=
data/dla-needed.txt
=
@@ -198,11 +198,6 @@ suricata (Adrian Bunk)
   NOTE: 20230714: Still reviewing+testing CVEs. (bunk)
   NOTE: 20230731: Still reviewing+testing CVEs. (bunk)
 --
-tiff (Adrian Bunk)
-  NOTE: 20230702: Added by Front-Desk (ta)
-  NOTE: 20230714: Waiting for upstream reaction on CVE-2023-3618. (bunk)
-  NOTE: 20230731: Resumed working on tiff, DLA soon. (bunk)
---
 xqilla (tobi)
   NOTE: 20230706: Added by Front-Desk (gladk)
   NOTE: 20230715: not vulnerable, the embedded yajl is ancient (around 0.2.2), 
not having the vulnerable code.



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/07695d0692d7c0f4738a14a4554a2ccaf25b3aeb

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/07695d0692d7c0f4738a14a4554a2ccaf25b3aeb
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Reserve DLA-3512-1 for linux-5.10

2023-07-31 Thread Ben Hutchings (@benh)



Ben Hutchings pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
2f617ff9 by Ben Hutchings at 2023-07-31T22:59:03+02:00
Reserve DLA-3512-1 for linux-5.10

- - - - -


1 changed file:

- data/DLA/list


Changes:

=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[31 Jul 2023] DLA-3512-1 linux-5.10 - security update
+   {CVE-2023-2156 CVE-2023-3390 CVE-2023-3610 CVE-2023-20593 
CVE-2023-31248 CVE-2023-35001}
+   [buster] - linux-5.10 5.10.179-3~deb10u1
 [31 Jul 2023] DLA-3511-1 amd64-microcode - security update
{CVE-2019-9836 CVE-2023-20593}
[buster] - amd64-microcode 3.20230719.1~deb10u1



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2f617ff9311ee4f7685f41314c66750e2ecd0cc2

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2f617ff9311ee4f7685f41314c66750e2ecd0cc2
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] automatic update

2023-07-31 Thread Salvatore Bonaccorso (@carnil)



Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
477f64e6 by security tracker role at 2023-07-31T20:12:10+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1,3 +1,83 @@
+CVE-2023-4026
+   REJECTED
+CVE-2023-4010 (A flaw was found in the USB Host Controller Driver framework in 
the Li ...)
+   TODO: check
+CVE-2023-3997 (Splunk SOAR versions 6.0.2 and earlier are indirectly affected 
by a po ...)
+   TODO: check
+CVE-2023-3983 (An authenticated SQL injection vulnerability exists in 
Advantech iView ...)
+   TODO: check
+CVE-2023-3817 (Issue summary: Checking excessively long DH keys or parameters 
may be  ...)
+   TODO: check
+CVE-2023-3508 (The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a 
flawed  ...)
+   TODO: check
+CVE-2023-3507 (The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a 
flawed  ...)
+   TODO: check
+CVE-2023-3345 (The LMS by Masteriyo WordPress plugin before 1.6.8 does not 
properly s ...)
+   TODO: check
+CVE-2023-3292 (The grid-kit-premium WordPress plugin before 2.2.0 does not 
escape som ...)
+   TODO: check
+CVE-2023-3134 (The Forminator WordPress plugin before 1.24.4 does not properly 
escape ...)
+   TODO: check
+CVE-2023-3130 (The Short URL WordPress plugin before 1.6.5 does not sanitise 
and esca ...)
+   TODO: check
+CVE-2023-38989 (An issue in the delete function in the UserController class of 
jeesite ...)
+   TODO: check
+CVE-2023-38750 (In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 
before 9.0.0 ...)
+   TODO: check
+CVE-2023-38311 (An issue was discovered in Webmin 2.021. A Stored Cross-Site 
Scripting ...)
+   TODO: check
+CVE-2023-38310 (An issue was discovered in Webmin 2.021. A Stored Cross-Site 
Scripting ...)
+   TODO: check
+CVE-2023-38309 (An issue was discovered in Webmin 2.021. A Reflected 
Cross-Site Script ...)
+   TODO: check
+CVE-2023-38308 (An issue was discovered in Webmin 2.021. A Cross-Site 
Scripting (XSS)  ...)
+   TODO: check
+CVE-2023-38307 (An issue was discovered in Webmin 2.021. A Stored Cross-Site 
Scripting ...)
+   TODO: check
+CVE-2023-38306 (An issue was discovered in Webmin 2.021. A Cross-site 
Scripting (XSS)  ...)
+   TODO: check
+CVE-2023-38305 (An issue was discovered in Webmin 2.021. The download 
functionality al ...)
+   TODO: check
+CVE-2023-38304 (An issue was discovered in Webmin 2.021. A Stored Cross-Site 
Scripting ...)
+   TODO: check
+CVE-2023-38303 (An issue was discovered in Webmin 2.021. One can exploit a 
stored Cros ...)
+   TODO: check
+CVE-2023-37771 (Art Gallery Management System v1.0 contains a SQL injection 
vulnerabil ...)
+   TODO: check
+CVE-2023-37647 (SEMCMS v1.5 was discovered to contain a SQL injection 
vulnerability vi ...)
+   TODO: check
+CVE-2023-37580 (Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS 
in the  ...)
+   TODO: check
+CVE-2023-36092 (Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 
allows  ...)
+   TODO: check
+CVE-2023-36091 (Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 
allows  ...)
+   TODO: check
+CVE-2023-36090 (Authentication Bypass vulnerability in D-Link DIR-885L 
FW102b01 allows ...)
+   TODO: check
+CVE-2023-36089 (Authentication Bypass vulnerability in D-Link DIR-645 firmware 
version ...)
+   TODO: check
+CVE-2023-35861 (A shell-injection vulnerability in email notifications on 
Supermicro m ...)
+   TODO: check
+CVE-2023-35792 (Vound Intella Connect 2.6.0.3 is vulnerable to stored 
Cross-site Scrip ...)
+   TODO: check
+CVE-2023-35791 (Vound Intella Connect 2.6.0.3 has an Open Redirect 
vulnerability.)
+   TODO: check
+CVE-2023-34917 (Fuge CMS v1.0 contains an Open Redirect vulnerability in 
member/Regist ...)
+   TODO: check
+CVE-2023-34916 (Fuge CMS v1.0 contains an Open Redirect vulnerability via 
/front/Proce ...)
+   TODO: check
+CVE-2023-34872 (A vulnerability in Outline.cc for Poppler prior to 23.06.0 
allows a re ...)
+   TODO: check
+CVE-2023-34842 (Remote Code Execution vulnerability in DedeCMS through 5.7.109 
allows  ...)
+   TODO: check
+CVE-2023-34644 (Remote code execution vulnerability in Ruijie Networks 
Product: RG-EW  ...)
+   TODO: check
+CVE-2023-34635 (Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to 
SQL Injec ...)
+   TODO: check
+CVE-2023-33534 (A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei 
Intellig ...)
+   TODO: check
+CVE-2020-36763 (Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows 
remote a ...)
+   TODO: check
 CVE-2023-4007 (Cross-site Scripting (XSS) - Stored in GitHub repository 
thorsten/phpm ...)
NOT-FOR-US: phpmyfaq
 CVE-2023-4006 (Improper Neutralization of Formula Elements in a

[Git][security-tracker-team/security-tracker][master] CVE-2023-30774/tiff also has the same fix as CVE-2022-3599/...

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
abcbb6d1 by Adrian Bunk at 2023-07-31T23:06:59+03:00
CVE-2023-30774/tiff also has the same fix as CVE-2022-3599/...

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -4919,7 +4919,7 @@ CVE-2023-2908 (A null pointer dereference issue was found 
in Libtiff's tif_dir.c
[buster] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/479
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f
 (v4.5.1rc1)
-   NOTE: Introduced by the fix for 
CVE-2022-3599/CVE-2022-4645/CVE-2023-30086:
+   NOTE: Introduced by the fix for 
CVE-2022-3599/CVE-2022-4645/CVE-2023-30086/CVE-2023-30774:
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
 (v4.5.0rc1)
 CVE-2023-2907 (Improper Neutralization of Special Elements used in an SQL 
Command ('S ...)
NOT-FOR-US: Marksoft
@@ -11202,11 +11202,13 @@ CVE-2023-30775 (A vulnerability was found in the 
libtiff library. This security
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/afd7086090dafd3949afd172822cbcec4ed17d56
 (v4.5.0rc1)
NOTE: Crash in CLI tool, no security impact
 CVE-2023-30774 (A vulnerability was found in the libtiff library. This flaw 
causes a h ...)
-   - tiff 4.5.0-2
-   [bullseye] - tiff  (Minor issue)
-   [buster] - tiff  (Minor issue)
+   - tiff 4.4.0-5
+   [bullseye] - tiff 4.2.0-1+deb11u3
+   [buster] - tiff 4.1.0+git191117-2~deb10u5
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/463
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/f00484b9519df933723deb38fff943dc291a793d
 (v4.5.0rc1)
+   NOTE: Same fix as for CVE-2022-3599, CVE-2022-4645 and CVE-2023-30086.
+   NOTE: The fix causes CVE-2023-2908.
 CVE-2023-2109 (Cross-site Scripting (XSS) - DOM in GitHub repository 
chatwoot/chatwoo ...)
NOT-FOR-US: chatwoot
 CVE-2023-2108 (A vulnerability has been found in SourceCodester Judging 
Management Sy ...)
@@ -13162,7 +13164,7 @@ CVE-2023-30086 (Buffer Overflow vulnerability found in 
Libtiff V.4.0.7 allows a
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/538
NOTE: Likely fixed by: 
https://gitlab.com/libtiff/libtiff/-/merge_requests/385
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/f00484b9519df933723deb38fff943dc291a793d
 (v4.5.0rc1)
-   NOTE: Same fix as for CVE-2022-3599 and CVE-2023-30086.
+   NOTE: Same fix as for CVE-2022-3599, CVE-2023-30086 and CVE-2023-30774.
NOTE: The fix causes CVE-2023-2908.
 CVE-2023-30085 (Buffer Overflow vulnerability found in Libming swftophp 
v.0.4.8 allows ...)
- ming 
@@ -38325,7 +38327,7 @@ CVE-2022-4645 (LibTIFF 4.4.0 has an out-of-bounds read 
in tiffcp in tools/tiffcp
[buster] - tiff 4.1.0+git191117-2~deb10u5
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/277
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
-   NOTE: Same fix as for CVE-2022-3599 and CVE-2023-30086.
+   NOTE: Same fix as for CVE-2022-3599, CVE-2023-30086 and CVE-2023-30774.
NOTE: The fix causes CVE-2023-2908.
 CVE-2022-4644 (Open Redirect in GitHub repository ikus060/rdiffweb prior to 
2.5.4.)
- rdiffweb  (bug #969974)
@@ -55515,7 +55517,7 @@ CVE-2022-3599 (LibTIFF 4.4.0 has an out-of-bounds read 
in writeSingleSection in
- tiff 4.4.0-5 (bug #1022555)
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/398
-   NOTE: Same fix as for CVE-2022-4645 and CVE-2023-30086.
+   NOTE: Same fix as for CVE-2022-4645, CVE-2023-30086 and CVE-2023-30774.
NOTE: The fix causes CVE-2023-2908.
 CVE-2022-3598 (LibTIFF 4.4.0 has an out-of-bounds write in 
extractContigSamplesShifte ...)
{DSA-5333-1 DLA-3278-1}



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abcbb6d1bc237611167433d33b57387c0bab0c1e

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abcbb6d1bc237611167433d33b57387c0bab0c1e
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] CVE-2023-25434/CVE-2023-25435: fix my off-by-one in the releases

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ab2fcbbf by Adrian Bunk at 2023-07-31T22:54:32+03:00
CVE-2023-25434/CVE-2023-25435: fix my off-by-one in the releases

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -27523,14 +27523,14 @@ CVE-2023-25436
RESERVED
 CVE-2023-25435 (libtiff 4.5.0 is vulnerable to Buffer Overflow via 
extractContigSample ...)
- tiff 4.5.0-5
-   [bookworm] - tiff 4.2.0-1+deb11u4
-   [bullseye] - tiff 4.1.0+git191117-2~deb10u7
+   [bullseye] - tiff 4.2.0-1+deb11u4
+   [buster] - tiff 4.1.0+git191117-2~deb10u7
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/518
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38
 (v4.5.1rc1)
 CVE-2023-25434 (libtiff 4.5.0 is vulnerable to Buffer Overflow via 
extractContigSample ...)
- tiff 4.5.0-5
-   [bookworm] - tiff 4.2.0-1+deb11u4
-   [bullseye] - tiff  4.1.0+git191117-2~deb10u7
+   [bullseye] - tiff 4.2.0-1+deb11u4
+   [buster] - tiff 4.1.0+git191117-2~deb10u7
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/519
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38
 (v4.5.1rc1)
NOTE: Same fix as CVE-2023-0795.



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab2fcbbfc1589e1b254acd20929c1a4347da2665

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab2fcbbfc1589e1b254acd20929c1a4347da2665
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2023-0330/qemu: fix is available, update buster triage

2023-07-31 Thread Sylvain Beucler (@beuc)



Sylvain Beucler pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
d7614158 by Sylvain Beucler at 2023-07-31T19:46:32+02:00
CVE-2023-0330/qemu: fix is available, update buster triage

- - - - -
18cf48d9 by Sylvain Beucler at 2023-07-31T19:46:34+02:00
CVE-2021-3750/qemu: reference final generic reentrancy fix, update buster triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -32662,10 +32662,11 @@ CVE-2023-0330 (A vulnerability in the lsi53c895a 
device affects the latest versi
- qemu 1:8.0.2+dfsg-1 (bug #1029155)
[bookworm] - qemu 1:7.2+dfsg-7+deb12u1
[bullseye] - qemu  (Minor issue)
-   [buster] - qemu  (Minor issue, waiting for sanctioned patch)
+   [buster] - qemu  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2160151
NOTE: Proposed patch: 
https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html
NOTE: Fixed by: 
https://gitlab.com/qemu-project/qemu/-/commit/e49884a90987744ddb54b2fadc770633eb6a4d62
 (v8.0.1)
+   NOTE: See also generic re-entrancy ground work at 
https://gitlab.com/qemu-project/qemu/-/issues/556
 CVE-2023-0329 (The Elementor Website Builder WordPress plugin before 3.12.2 
does not  ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-48261 (There is a misinterpretation of input vulnerability in 
BiSheng-WNM FW  ...)
@@ -138265,8 +138266,8 @@ CVE-2021-40320
 CVE-2021-3750 (A DMA reentrancy issue was found in the USB EHCI controller 
emulation  ...)
- qemu 1:7.0+dfsg-1
[bullseye] - qemu  (Minor issue)
-   [buster] - qemu  (Minor issue, unclear status, follow 
bullseye updates)
-   [stretch] - qemu  (Minor issue, unclear status, follow 
bullseye updates)
+   [buster] - qemu  (Minor issue, follow bullseye updates)
+   [stretch] - qemu  (Minor issue, follow bullseye updates)
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/541
NOTE: Fix for whole class of DMA MMIO reentrancy issues: 
https://gitlab.com/qemu-project/qemu/-/issues/556
NOTE: Patchset: 
https://lists.nongnu.org/archive/html/qemu-devel/2021-12/msg02356.html
@@ -138274,6 +138275,7 @@ CVE-2021-3750 (A DMA reentrancy issue was found in 
the USB EHCI controller emula
NOTE: 
https://gitlab.com/qemu-project/qemu/-/commit/58e74682baf4e1ad26b064d8c02e5bc99c75c5d9
 (v7.0.0-rc1)
NOTE: 
https://gitlab.com/qemu-project/qemu/-/commit/3ab6fdc91b72e156da22848f0003ff4225690ced
 (v7.0.0-rc1)
NOTE: Possibly incomplete patch set: 
https://gitlab.com/qemu-project/qemu/-/issues/541#note_1179940468
+   NOTE: Final fix: 
https://gitlab.com/qemu-project/qemu/-/commit/a2e1753b8054344f32cf94f31c6399a58794a380
 (v8.1.0-rc0)
 CVE-2021-3749 (axios is vulnerable to Inefficient Regular Expression 
Complexity)
- node-axios 0.21.3+dfsg-1
[bullseye] - node-axios 0.21.1+dfsg-1+deb11u1



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/abb15c014e2e7ee5f7971b14c4f4cb6a299642c9...18cf48d997b292b7e353b322d2f3cbcd04149f38

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/abb15c014e2e7ee5f7971b14c4f4cb6a299642c9...18cf48d997b292b7e353b322d2f3cbcd04149f38
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] CVE-2023-25435/tiff had the same fix as CVE-2023-0795

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
abb15c01 by Adrian Bunk at 2023-07-31T20:12:49+03:00
CVE-2023-25435/tiff had the same fix as CVE-2023-0795

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -27522,9 +27522,9 @@ CVE-2023-25437 (An issue was discovered in vTech VCS754 
version 1.1.1.A before 1
 CVE-2023-25436
RESERVED
 CVE-2023-25435 (libtiff 4.5.0 is vulnerable to Buffer Overflow via 
extractContigSample ...)
-   - tiff 4.5.1~rc3-1
-   [bookworm] - tiff  (Minor issue)
-   [bullseye] - tiff  (Minor issue)
+   - tiff 4.5.0-5
+   [bookworm] - tiff 4.2.0-1+deb11u4
+   [bullseye] - tiff 4.1.0+git191117-2~deb10u7
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/518
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38
 (v4.5.1rc1)
 CVE-2023-25434 (libtiff 4.5.0 is vulnerable to Buffer Overflow via 
extractContigSample ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abb15c014e2e7ee5f7971b14c4f4cb6a299642c9

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abb15c014e2e7ee5f7971b14c4f4cb6a299642c9
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2020-22402: mark as not-affected for buster

2023-07-31 Thread Anton Gladky (@gladk)



Anton Gladky pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
b285cbab by Anton Gladky at 2023-07-31T19:04:58+02:00
CVE-2020-22402: mark as not-affected for buster

- - - - -
20387165 by Anton Gladky at 2023-07-31T19:04:59+02:00
LTS: add bouncycastle

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=
data/CVE/list
=
@@ -214874,7 +214874,9 @@ CVE-2020-22403 (Cross Site Request Forgery (CSRF) 
vulnerability in Express cart
NOT-FOR-US: Node express-cart
 CVE-2020-22402 (Cross Site Scripting (XSS) vulnerability in SOGo Web Mail 
before 4.3.1 ...)
- sogo 4.3.2-1
+   [buster] - sogo  (Vulnerable code added later)
NOTE: https://bugs.sogo.nu//view.php?id=4979
+   NOTE: 
https://github.com/Alinto/sogo/commit/d1dbceb407b37aff6563d06194189965af39cf3e
 CVE-2020-22401
RESERVED
 CVE-2020-22400


=
data/dla-needed.txt
=
@@ -24,6 +24,9 @@ rather than remove/replace existing ones.
 amanda (Thorsten Alteholz)
   NOTE: 20230730: Added by Front-Desk (apo)
 --
+bouncycastle
+  NOTE: 20230731: Added by Front-Desk (gladk)
+--
 cairosvg (gladk)
   NOTE: 20230323: Added by Front-Desk (gladk)
   NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport 
the --unsafe switch, introduced in 1.0.21, might work (dleidert/inactive)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/abfb15aa3b763450b48fc626260a925efd9a79e8...203871654dfc7032aa83961ac891d40daea608a4

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/abfb15aa3b763450b48fc626260a925efd9a79e8...203871654dfc7032aa83961ac891d40daea608a4
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] CVE-2023-25434/tiff had the same fix as CVE-2023-0795

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
abfb15aa by Adrian Bunk at 2023-07-31T19:43:13+03:00
CVE-2023-25434/tiff had the same fix as CVE-2023-0795

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -27528,11 +27528,12 @@ CVE-2023-25435 (libtiff 4.5.0 is vulnerable to Buffer 
Overflow via extractContig
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/518
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38
 (v4.5.1rc1)
 CVE-2023-25434 (libtiff 4.5.0 is vulnerable to Buffer Overflow via 
extractContigSample ...)
-   - tiff 4.5.1~rc3-1
-   [bookworm] - tiff  (Minor issue)
-   [bullseye] - tiff  (Minor issue)
+   - tiff 4.5.0-5
+   [bookworm] - tiff 4.2.0-1+deb11u4
+   [bullseye] - tiff  4.1.0+git191117-2~deb10u7
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/519
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/69818e2f2d246e6631ac2a2da692c3706b849c38
 (v4.5.1rc1)
+   NOTE: Same fix as CVE-2023-0795.
 CVE-2023-25433 (libtiff 4.5.0 is vulnerable to Buffer Overflow via 
/libtiff/tools/tiff ...)
- tiff 4.5.1~rc3-1
[bookworm] - tiff  (Minor issue)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abfb15aa3b763450b48fc626260a925efd9a79e8

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abfb15aa3b763450b48fc626260a925efd9a79e8
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] LTS: take openssl

2023-07-31 Thread Anton Gladky (@gladk)



Anton Gladky pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
15ad4339 by Anton Gladky at 2023-07-31T18:37:51+02:00
LTS: take openssl

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
@@ -116,7 +116,7 @@ openjdk-11 (Emilio)
   NOTE: 20230612: sid updated, preparing backport (pochu)
   NOTE: 20230717: waiting for DSA, might wait for next CPU (pochu)
 --
-openssl
+openssl (gladk)
   NOTE: 20230731: Added by Front-Desk (apo)
 --
 orthanc (Chris Lamb)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/15ad4339f85321b3f8bc0154a0671aecf3d5f4b8

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/15ad4339f85321b3f8bc0154a0671aecf3d5f4b8
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] tiff: Fix the metadata for the CVE-2022-3599/CVE-2022-4645/CVE-2023-30086/CVE-2023-2908 mess

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
aba57172 by Adrian Bunk at 2023-07-31T18:33:26+03:00
tiff: Fix the metadata for the 
CVE-2022-3599/CVE-2022-4645/CVE-2023-30086/CVE-2023-2908 mess

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -4916,10 +4916,10 @@ CVE-2023-2908 (A null pointer dereference issue was 
found in Libtiff's tif_dir.c
- tiff 4.5.1~rc3-1
[bookworm] - tiff  (Minor issue)
[bullseye] - tiff  (Minor issue)
-   [buster] - tiff  (Vulnerable code introduced later)
+   [buster] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/479
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f
 (v4.5.1rc1)
-   NOTE: Introduced by the fix for CVE-2022-4645:
+   NOTE: Introduced by the fix for 
CVE-2022-3599/CVE-2022-4645/CVE-2023-30086:
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
 (v4.5.0rc1)
 CVE-2023-2907 (Improper Neutralization of Special Elements used in an SQL 
Command ('S ...)
NOT-FOR-US: Marksoft
@@ -13156,12 +13156,14 @@ CVE-2023-30088 (An issue found in Cesanta MJS v.1.26 
allows a local attacker to
 CVE-2023-30087 (Buffer Overflow vulnerability found in Cesanta MJS v.1.26 
allows a loc ...)
NOT-FOR-US: Cesenta MJS
 CVE-2023-30086 (Buffer Overflow vulnerability found in Libtiff V.4.0.7 allows 
a local  ...)
-   - tiff 4.5.0-2
-   [bullseye] - tiff  (Minor issue)
-   [buster] - tiff  (Minor issue)
+   - tiff 4.4.0-5
+   [bullseye] - tiff 4.2.0-1+deb11u3
+   [buster] - tiff 4.1.0+git191117-2~deb10u5
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/538
NOTE: Likely fixed by: 
https://gitlab.com/libtiff/libtiff/-/merge_requests/385
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/f00484b9519df933723deb38fff943dc291a793d
 (v4.5.0rc1)
+   NOTE: Same fix as for CVE-2022-3599 and CVE-2023-30086.
+   NOTE: The fix causes CVE-2023-2908.
 CVE-2023-30085 (Buffer Overflow vulnerability found in Libming swftophp 
v.0.4.8 allows ...)
- ming 
NOTE: https://github.com/libming/libming/issues/267
@@ -38318,9 +38320,10 @@ CVE-2022-4646 (Cross-Site Request Forgery (CSRF) in 
GitHub repository ikus060/rd
 CVE-2022-4645 (LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in 
tools/tiffcp.c:94 ...)
{DSA-5333-1}
- tiff 4.4.0-5
-   [buster] - tiff  (Minor issue, OOB read / DoS)
+   [buster] - tiff 4.1.0+git191117-2~deb10u5
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/277
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
+   NOTE: Same fix as for CVE-2022-3599 and CVE-2023-30086.
NOTE: The fix causes CVE-2023-2908.
 CVE-2022-4644 (Open Redirect in GitHub repository ikus060/rdiffweb prior to 
2.5.4.)
- rdiffweb  (bug #969974)
@@ -55510,6 +55513,8 @@ CVE-2022-3599 (LibTIFF 4.4.0 has an out-of-bounds read 
in writeSingleSection in
- tiff 4.4.0-5 (bug #1022555)
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/398
+   NOTE: Same fix as for CVE-2022-4645 and CVE-2023-30086.
+   NOTE: The fix causes CVE-2023-2908.
 CVE-2022-3598 (LibTIFF 4.4.0 has an out-of-bounds write in 
extractContigSamplesShifte ...)
{DSA-5333-1 DLA-3278-1}
- tiff 4.4.0-5 (bug #1022555)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aba5717204e2dd156330ae238163de0b0210fc6d

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aba5717204e2dd156330ae238163de0b0210fc6d
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] 3 commits: CVE-2023-32731/grpc: precise links + buster not-affected

2023-07-31 Thread Sylvain Beucler (@beuc)



Sylvain Beucler pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
5ee54b17 by Sylvain Beucler at 2023-07-31T17:07:55+02:00
CVE-2023-32731/grpc: precise links + buster not-affected

- - - - -
f320dc28 by Sylvain Beucler at 2023-07-31T17:21:02+02:00
CVE-2023-32732/grpc: mention CVE possible confusion + buster postponed

- - - - -
5f8c6de5 by Sylvain Beucler at 2023-07-31T17:21:38+02:00
dla: drop grpc (no more open issues)

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=
data/CVE/list
=
@@ -5910,13 +5910,16 @@ CVE-2023-32732 (gRPC contains a vulnerability whereby a 
client can cause a termi
- grpc 
[bookworm] - grpc  (Minor issue)
[bullseye] - grpc  (Minor issue)
+   [buster] - grpc  (Minor issue; request smuggling; recheck if 
fixed or introduced by #32309 when CVE description is updated)
NOTE: https://github.com/grpc/grpc/pull/32309
+   NOTE: CVE description and fix are sensible, but there seem to be 
confusion: https://github.com/grpc/grpc/pull/32309#issuecomment-1589703522
 CVE-2023-32731 (When gRPC HTTP2 stack raised a header size exceeded error, it 
skipped  ...)
- grpc 
[bookworm] - grpc  (Minor issue)
[bullseye] - grpc  (Minor issue)
-   NOTE: https://github.com/grpc/grpc/pull/32309
-   NOTE: https://github.com/grpc/grpc/pull/33005
+   [buster] - grpc  (Vulnerable code introduced later)
+   NOTE: Introduced by: 
https://github.com/grpc/grpc/pull/32309#issuecomment-1589561295 (v1.53.0-pre1)
+   NOTE: Fixed by: 
https://github.com/grpc/grpc/commit/65a2a895afaf1d2072447b9baf246374b182a946 
(v1.56.0-pre1)
 CVE-2023-32312 (UmbracoIdentityExtensions is an Umbraco add-on package that 
enables ea ...)
NOT-FOR-US: UmbracoIdentityExtensions
 CVE-2023-3177 (A vulnerability has been found in SourceCodester Lost and Found 
Inform ...)


=
data/dla-needed.txt
=
@@ -57,10 +57,6 @@ glib2.0 (santiago)
   NOTE: 20230710: WIP (santiago)
   NOTE: 20230724: buster should be ready. need if it's possible to run same 
reporter's fuzz test
 --
-grpc (Sylvain Beucler)
-  NOTE: 20230614: Added by Front-Desk (opal)
-  NOTE: 20230618: CVE-2023-32731 fix will need a massive rewrite (rouca)
---
 hdf5
   NOTE: 20230318: Added by Front-Desk (utkarsh)
   NOTE: 20230318: Consider fixing all the no-dsa and postponed issues as well. 
(utkarsh)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/9261a21b181ab264e7006e65a5e39c3f147cccba...5f8c6de5a54b2bd8c687cb7dfd51f42afa2f0c86

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/9261a21b181ab264e7006e65a5e39c3f147cccba...5f8c6de5a54b2bd8c687cb7dfd51f42afa2f0c86
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Properly fix DLA-3511-1

2023-07-31 Thread Jochen Sprickerhof (@jspricke)



Jochen Sprickerhof pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
9261a21b by Jochen Sprickerhof at 2023-07-31T16:52:32+02:00
Properly fix DLA-3511-1

Use sbuild --debbuildopt=-vversion to generate the correct changes
file.

- - - - -


2 changed files:

- data/CVE/list
- data/DLA/list


Changes:

=
data/CVE/list
=
@@ -302052,7 +302052,6 @@ CVE-2019-9837 (Doorkeeper::OpenidConnect (aka the 
OpenID Connect extension for D
 CVE-2019-9836 (Secure Encrypted Virtualization (SEV) on Advanced Micro Devices 
(AMD)  ...)
- amd64-microcode 3.20220411.1 (bug #970395)
[bullseye] - amd64-microcode 3.20230719.1~deb11u1
-   [buster] - amd64-microcode  (Minor issue)
NOTE: https://seclists.org/fulldisclosure/2019/Jun/46
 CVE-2019-9835 (The receiver (aka bridge) component of Fujitsu Wireless 
Keyboard Set L ...)
NOT-FOR-US: Fujitsu Wireless Keyboard Set LX901 GK900 devices


=
data/DLA/list
=
@@ -1,5 +1,5 @@
 [31 Jul 2023] DLA-3511-1 amd64-microcode - security update
-   {CVE-2023-20593}
+   {CVE-2019-9836 CVE-2023-20593}
[buster] - amd64-microcode 3.20230719.1~deb10u1
 [31 Jul 2023] DLA-3510-1 thunderbird - security update
{CVE-2023-3417}



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9261a21b181ab264e7006e65a5e39c3f147cccba

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9261a21b181ab264e7006e65a5e39c3f147cccba
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] amd64-microcode add missing CVE

2023-07-31 Thread Jochen Sprickerhof (@jspricke)



Jochen Sprickerhof pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
43bfd382 by Jochen Sprickerhof at 2023-07-31T16:38:45+02:00
amd64-microcode add missing CVE

Thanks Beuc.

- - - - -


1 changed file:

- data/DLA/list


Changes:

=
data/DLA/list
=
@@ -1,4 +1,5 @@
 [31 Jul 2023] DLA-3511-1 amd64-microcode - security update
+   {CVE-2023-20593}
[buster] - amd64-microcode 3.20230719.1~deb10u1
 [31 Jul 2023] DLA-3510-1 thunderbird - security update
{CVE-2023-3417}



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/43bfd3826f1d69f266711e4221dd3c437957bdbf

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/43bfd3826f1d69f266711e4221dd3c437957bdbf
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Fix amd64-microcode version

2023-07-31 Thread Jochen Sprickerhof (@jspricke)



Jochen Sprickerhof pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
bbb0f49d by Jochen Sprickerhof at 2023-07-31T16:37:24+02:00
Fix amd64-microcode version

- - - - -


1 changed file:

- data/DLA/list


Changes:

=
data/DLA/list
=
@@ -1,5 +1,5 @@
 [31 Jul 2023] DLA-3511-1 amd64-microcode - security update
-   [buster] - amd64-microcode 3.20230719.1+deb10u1
+   [buster] - amd64-microcode 3.20230719.1~deb10u1
 [31 Jul 2023] DLA-3510-1 thunderbird - security update
{CVE-2023-3417}
[buster] - thunderbird 1:102.13.1-1~deb10u1



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bbb0f49dbf822de437b0c562ece7989b59482780

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bbb0f49dbf822de437b0c562ece7989b59482780
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Add commit for fixing bouncycastle CVE-2023-33201

2023-07-31 Thread @rouca



Bastien Roucariès pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f0bfb35f by Bastien Roucariès at 2023-07-31T14:31:27+00:00
Add commit for fixing bouncycastle CVE-2023-33201

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -8175,6 +8175,7 @@ CVE-2023-33201 (Bouncy Castle For Java before 1.74 is 
affected by an LDAP inject
[bookworm] - bouncycastle  (Minor issue)
[bullseye] - bouncycastle  (Minor issue)
NOTE: https://github.com/bcgit/bc-java/wiki/CVE-2023-33201
+   NOTE: 
https://github.com/bcgit/bc-java/commit/e8c409a8389c815ea3fda5e8b94c92fdfe583bcc
 CVE-2023-31729 (TOTOLINK A3300R v17.0.0cu.557 is vulnerable to Command 
Injection.)
NOT-FOR-US: TOTOLINK
 CVE-2023-2780 (Path Traversal: '\..\filename' in GitHub repository 
mlflow/mlflow prio ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f0bfb35fa5d71a9a8185a05602d2c2839fc78740

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f0bfb35fa5d71a9a8185a05602d2c2839fc78740
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Take chef

2023-07-31 Thread @rouca



Bastien Roucariès pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
211359e4 by Bastien Roucariès at 2023-07-31T14:29:16+00:00
Take chef

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
@@ -28,7 +28,7 @@ cairosvg (gladk)
   NOTE: 20230323: Added by Front-Desk (gladk)
   NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport 
the --unsafe switch, introduced in 1.0.21, might work (dleidert/inactive)
 --
-chef
+chef (rouca)
   NOTE: 20230730: Added by Front-Desk (apo)
   NOTE: 20230730: We could just change the directory permissions to fix this 
problem. (apo)
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/211359e425607661b38aa6b7cfbd048541fed1e4

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/211359e425607661b38aa6b7cfbd048541fed1e4
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] data/dla-needed.txt: claim open-vm-tools

2023-07-31 Thread Abhijith PA (@abhijith)



Abhijith PA pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ddd968cf by Abhijith PA at 2023-07-31T19:35:12+05:30
data/dla-needed.txt: claim open-vm-tools

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
@@ -107,7 +107,7 @@ nvidia-cuda-toolkit
   NOTE: 20230610: Details: 
https://lists.debian.org/debian-lts/2023/06/msg00032.html
   NOTE: 20230610: my recommendation would be to put the package on the 
"not-supported" list. (tobi)
 --
-open-vm-tools
+open-vm-tools (Abhijith PA)
   NOTE: 20230731: Added by Front-Desk (apo)
 --
 openimageio (Markus Koschany)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddd968cfa0f306986a803b4b22de1644057f84eb

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddd968cfa0f306986a803b4b22de1644057f84eb
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] dla: update notes

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ab442da3 by Adrian Bunk at 2023-07-31T16:02:44+03:00
dla: update notes

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
@@ -197,10 +197,12 @@ suricata (Adrian Bunk)
   NOTE: 20230620: I'd suggest reviewing the CVEs, precise the triage 
(postponed/ignored),
   NOTE: 20230620: and possibly issue a DSA with a few CVEs that were fixed in 
later dists (Beuc/front-desk)
   NOTE: 20230714: Still reviewing+testing CVEs. (bunk)
+  NOTE: 20230731: Still reviewing+testing CVEs. (bunk)
 --
 tiff (Adrian Bunk)
   NOTE: 20230702: Added by Front-Desk (ta)
   NOTE: 20230714: Waiting for upstream reaction on CVE-2023-3618. (bunk)
+  NOTE: 20230731: Resumed working on tiff, DLA soon. (bunk)
 --
 xqilla (tobi)
   NOTE: 20230706: Added by Front-Desk (gladk)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab442da3f54d65134258a601b52885b51ae48492

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab442da3f54d65134258a601b52885b51ae48492
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] new quartz issue

2023-07-31 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
3a3a0e3e by Moritz Muehlenhoff at 2023-07-31T14:38:24+02:00
new quartz issue

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -66,7 +66,9 @@ CVE-2023-39020 (stanford-parser v3.9.2 and below was 
discovered to contain a cod
 CVE-2023-39018 (FFmpeg 0.7.0 and below was discovered to contain a code 
injection vuln ...)
NOT-FOR-US: ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI)
 CVE-2023-39017 (quartz-jobs 2.3.2 and below was discovered to contain a code 
injection ...)
-   TODO: check
+   - libquartz2-java 
+   - libquartz-java 
+   NOTE: https://github.com/quartz-scheduler/quartz/issues/943
 CVE-2023-39016 (bboss-persistent v6.0.9 and below was discovered to contain a 
code inj ...)
NOT-FOR-US: bboss-persistent
 CVE-2023-39015 (webmagic-extension v0.9.0 and below was discovered to contain 
a code i ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a3a0e3e2dba8e1edb195cddb1a3eead4d923113

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3a3a0e3e2dba8e1edb195cddb1a3eead4d923113
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye/bookworm triage

2023-07-31 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
8fd8ff2d by Moritz Muehlenhoff at 2023-07-31T14:20:22+02:00
bullseye/bookworm triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -940,6 +940,8 @@ CVE-2023-35134 (Weintek Weincloud v0.13.6   could allow an 
attacker to reset a p
NOT-FOR-US: Weincloud
 CVE-2023-34478 (Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be 
susceptible to a  ...)
- shiro 
+   [bookworm] - shiro  (Minor issue)
+   [bullseye] - shiro  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/07/24/4
 CVE-2023-34429 (Weintek Weincloud v0.13.6 could allow an attacker to cause 
a denia ...)
NOT-FOR-US: Weincloud
@@ -60322,6 +60324,7 @@ CVE-2022-41725 (A denial of service is possible from 
excessive resource consumpt
[experimental] - golang-1.19 1.19.6-1
- golang-1.19 1.19.6-2
- golang-1.15 
+   [bullseye] - golang-1.15  (Minor issue)
- golang-1.11 
[buster] - golang-1.11  (Limited support, follow bullseye 
DSAs/point-releases)
NOTE: https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
@@ -60331,6 +60334,7 @@ CVE-2022-41724 (Large handshake records may cause 
panics in crypto/tls. Both cli
[experimental] - golang-1.19 1.19.6-1
- golang-1.19 1.19.6-2
- golang-1.15 
+   [bullseye] - golang-1.15  (Minor issue)
- golang-1.11  (Vulnerable code introduced later)
NOTE: https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E
NOTE: https://go.dev/issue/58001
@@ -60342,6 +60346,7 @@ CVE-2022-41723 (A maliciously crafted HTTP/2 stream 
could cause excessive CPU co
[experimental] - golang-1.19 1.19.6-1
- golang-1.19 1.19.6-2
- golang-1.15 
+   [bullseye] - golang-1.15  (Minor issue)
- golang-1.11 
[buster] - golang-1.11  (Limited support, follow bullseye 
DSAs/point-releases)
- golang-golang-x-net 1:0.7.0+dfsg-1
@@ -60381,6 +60386,7 @@ CVE-2022-41717 (An attacker can cause excessive memory 
growth in a Go server acc
- golang-1.19 1.19.4-1
- golang-1.18 1.18.9-1
- golang-1.15 
+   [bullseye] - golang-1.15  (Minor issue)
- golang-1.11 
[buster] - golang-1.11  (Limited support, follow bullseye 
DSAs/point-releases)
- golang-golang-x-net 1:0.4.0+dfsg-1


=
data/dsa-needed.txt
=
@@ -21,6 +21,8 @@ cinder/oldstable
 frr (aron)
   maintainer proposed to update to 8.4.4 for bookworm, which might be a good 
idea
 --
+librsvg
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more recent v5.10.y and 6.1.y versions
@@ -42,7 +44,10 @@ ntpsec (carnil)
 openjdk-11/oldstable (jmm)
   needs asmtools backport in bullseye
 --
+openjdk-17/oldstable (jmm)
+--
 orthanc (jmm)
+  needs ca-certificates-java fix for bookworm
 --
 php-cas/oldstable
 --
@@ -87,7 +92,9 @@ sox
   all issues unfixed upstream
   for CVE-2023-34432, rest can be ignored
 --
-wpewebkit
+tiff
+--
+wpewebkit/oldstable
 --
 xrdp/oldstable
   needs some additional clarification, tentatively DSA worthy



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8fd8ff2d62d95782afe0e51e5835d12f9cfc63bc

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8fd8ff2d62d95782afe0e51e5835d12f9cfc63bc
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Reserve DLA-3511-1 for amd64-microcode

2023-07-31 Thread Jochen Sprickerhof (@jspricke)



Jochen Sprickerhof pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
7ae00408 by Jochen Sprickerhof at 2023-07-31T14:09:50+02:00
Reserve DLA-3511-1 for amd64-microcode

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
@@ -1,3 +1,5 @@
+[31 Jul 2023] DLA-3511-1 amd64-microcode - security update
+   [buster] - amd64-microcode 3.20230719.1+deb10u1
 [31 Jul 2023] DLA-3510-1 thunderbird - security update
{CVE-2023-3417}
[buster] - thunderbird 1:102.13.1-1~deb10u1


=
data/dla-needed.txt
=
@@ -24,9 +24,6 @@ rather than remove/replace existing ones.
 amanda (Thorsten Alteholz)
   NOTE: 20230730: Added by Front-Desk (apo)
 --
-amd64-microcode (jspricke)
-  NOTE: 20230731: Added by Front-Desk (apo)
---
 cairosvg (gladk)
   NOTE: 20230323: Added by Front-Desk (gladk)
   NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport 
the --unsafe switch, introduced in 1.0.21, might work (dleidert/inactive)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ae004084cc845bb7d750365a642552313f8f999

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ae004084cc845bb7d750365a642552313f8f999
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] NFUs

2023-07-31 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
2e5e8a1d by Moritz Muehlenhoff at 2023-07-31T12:25:08+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1,19 +1,19 @@
 CVE-2023-4007 (Cross-site Scripting (XSS) - Stored in GitHub repository 
thorsten/phpm ...)
-   TODO: check
+   NOT-FOR-US: phpmyfaq
 CVE-2023-4006 (Improper Neutralization of Formula Elements in a CSV File in 
GitHub re ...)
-   TODO: check
+   NOT-FOR-US: phpmyfaq
 CVE-2023-4005 (Insufficient Session Expiration in GitHub repository 
fossbilling/fossb ...)
-   TODO: check
+   NOT-FOR-US: fossbilling
 CVE-2023-35019 (IBM Security Verify Governance, Identity Manager 10.0 could 
allow a re ...)
-   TODO: check
+   NOT-FOR-US: IBM
 CVE-2023-35016 (IBM Security Verify Governance, Identity Manager 10.0 could 
allow a re ...)
-   TODO: check
+   NOT-FOR-US: IBM
 CVE-2023-34360 (A stored cross-site scripting (XSS) issue was discovered 
within the Cu ...)
-   TODO: check
+   NOT-FOR-US: ASUS
 CVE-2023-34359 (ASUS RT-AX88U's httpd is subject to an unauthenticated DoS 
condition.  ...)
-   TODO: check
+   NOT-FOR-US: ASUS
 CVE-2023-34358 (ASUS RT-AX88U's httpd is subject to an unauthenticated DoS 
condition.  ...)
-   TODO: check
+   NOT-FOR-US: ASUS
 CVE-2023-4004
- linux 
[buster] - linux  (Vulnerable code not present)
@@ -68,13 +68,13 @@ CVE-2023-39018 (FFmpeg 0.7.0 and below was discovered to 
contain a code injectio
 CVE-2023-39017 (quartz-jobs 2.3.2 and below was discovered to contain a code 
injection ...)
TODO: check
 CVE-2023-39016 (bboss-persistent v6.0.9 and below was discovered to contain a 
code inj ...)
-   TODO: check
+   NOT-FOR-US: bboss-persistent
 CVE-2023-39015 (webmagic-extension v0.9.0 and below was discovered to contain 
a code i ...)
-   TODO: check
+   NOT-FOR-US: webmagic-extension
 CVE-2023-39013 (Duke v1.2 and below was discovered to contain a code injection 
vulnera ...)
-   TODO: check
+   NOT-FOR-US: Duke
 CVE-2023-39010 (BoofCV 0.42 was discovered to contain a code injection 
vulnerability v ...)
-   TODO: check
+   NOT-FOR-US: BoofCV
 CVE-2023-38992 (jeecg-boot v3.5.1 was discovered to contain a SQL injection 
vulnerabil ...)
NOT-FOR-US: jeecg-boot
 CVE-2023-38685 (Discourse is an open source discussion platform. Prior to 
version 3.0. ...)
@@ -28766,7 +28766,7 @@ CVE-2023-24973
 CVE-2023-24972
RESERVED
 CVE-2023-24971 (IBM B2B Advanced Communications 1.0.0.0 and IBM 
Multi-Enterprise Integ ...)
-   TODO: check
+   NOT-FOR-US: IBM
 CVE-2023-24970
RESERVED
 CVE-2023-24969
@@ -36377,7 +36377,7 @@ CVE-2023-22597 (InHand Networks InRouter 302, prior to 
version IR302 V3.5.56, an
 CVE-2023-22596
RESERVED
 CVE-2023-22595 (IBM B2B Advanced Communications 1.0.0.0 and IBM 
Multi-Enterprise Integ ...)
-   TODO: check
+   NOT-FOR-US: IBM
 CVE-2023-22594 (IBM Robotic Process Automation for Cloud Pak 20.12.0 through 
21.0.4 is ...)
NOT-FOR-US: IBM
 CVE-2023-22593 (IBM Robotic Process Automation for Cloud Pak 21.0.1 through 
21.0.7.3 a ...)
@@ -54254,7 +54254,7 @@ CVE-2022-43833
 CVE-2022-43832
RESERVED
 CVE-2022-43831 (IBM Storage Scale Container Native Storage Access 5.1.2.1 
through 5.1. ...)
-   TODO: check
+   NOT-FOR-US: IBM
 CVE-2022-43830
REJECTED
 CVE-2022-43829
@@ -259723,7 +259723,7 @@ CVE-2020-4870 (IBM MQ 9.2 CD and LTS are vulnerable 
to a denial of service attac
 CVE-2020-4869 (IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial 
of servi ...)
NOT-FOR-US: IBM
 CVE-2020-4868 (IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to 
obtain  ...)
-   TODO: check
+   NOT-FOR-US: IBM
 CVE-2020-4867
RESERVED
 CVE-2020-4866 (IBM Engineering products are vulnerable to cross-site 
scripting. This  ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e5e8a1d61fd31d5ca32de85d4b189bf2ba4c0e2

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2e5e8a1d61fd31d5ca32de85d4b189bf2ba4c0e2
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] two Ubuntu-specific Linux issues

2023-07-31 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
bfaba592 by Moritz Muehlenhoff at 2023-07-31T12:21:07+02:00
two Ubuntu-specific Linux issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -503,13 +503,13 @@ CVE-2023-34017 (Unauth. Reflected Cross-Site Scripting 
(XSS) vulnerability in Fi
 CVE-2023-33925 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in 
PluginFo ...)
NOT-FOR-US: WordPress plugin
 CVE-2023-32629 (Local privilege escalation vulnerability in Ubuntu Kernels 
overlayfs o ...)
-   TODO: check
+   - linux  (Ubuntu-specific issue)
 CVE-2023-32468 (Dell ECS Streamer, versions prior to 2.0.7.1, contain an 
insertion of  ...)
NOT-FOR-US: Dell
 CVE-2023-2850 (NodeBB is affected by a Cross-Site WebSocket Hijacking 
vulnerability d ...)
NOT-FOR-US: NodeBB
 CVE-2023-2640 (On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: 
SAUCE: overl ...)
-   TODO: check
+   - linux  (Ubuntu-specific issue)
 CVE-2023-2626 (There exists an authentication bypass vulnerability in 
OpenThread bord ...)
NOT-FOR-US: OpenThread
 CVE-2023-3773 (A flaw was found in the Linux kernel\u2019s IP framework for 
transform ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bfaba592b68f25dff767f99a4b2663bd4f0b4549

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bfaba592b68f25dff767f99a4b2663bd4f0b4549
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] CVE-2023-2908/tiff does not affect buster

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ab46acb3 by Adrian Bunk at 2023-07-31T12:10:52+03:00
CVE-2023-2908/tiff does not affect buster

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -4912,8 +4912,11 @@ CVE-2023-2908 (A null pointer dereference issue was 
found in Libtiff's tif_dir.c
- tiff 4.5.1~rc3-1
[bookworm] - tiff  (Minor issue)
[bullseye] - tiff  (Minor issue)
+   [buster] - tiff  (Vulnerable code introduced later)
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/479
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/9bd48f0dbd64fb94dc2b5b05238fde0bfdd4ff3f
 (v4.5.1rc1)
+   NOTE: Introduced by the fix for CVE-2022-4645:
+   NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
 (v4.5.0rc1)
 CVE-2023-2907 (Improper Neutralization of Special Elements used in an SQL 
Command ('S ...)
NOT-FOR-US: Marksoft
 CVE-2023-2899 (The Google Map Shortcode WordPress plugin through 3.1.2 does 
not valid ...)
@@ -38310,6 +38313,7 @@ CVE-2022-4645 (LibTIFF 4.4.0 has an out-of-bounds read 
in tiffcp in tools/tiffcp
[buster] - tiff  (Minor issue, OOB read / DoS)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/277
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/e813112545942107551433d61afd16ac094ff246
+   NOTE: The fix causes CVE-2023-2908.
 CVE-2022-4644 (Open Redirect in GitHub repository ikus060/rdiffweb prior to 
2.5.4.)
- rdiffweb  (bug #969974)
 CVE-2022-4643 (A vulnerability was found in docconv up to 1.2.0. It has been 
declared ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab46acb38c63c1088a93ffb353f18746761f2689

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab46acb38c63c1088a93ffb353f18746761f2689
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Claim amd64-microcode

2023-07-31 Thread Jochen Sprickerhof (@jspricke)



Jochen Sprickerhof pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ab7284dc by Jochen Sprickerhof at 2023-07-31T10:58:55+02:00
Claim amd64-microcode

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
@@ -24,7 +24,7 @@ rather than remove/replace existing ones.
 amanda (Thorsten Alteholz)
   NOTE: 20230730: Added by Front-Desk (apo)
 --
-amd64-microcode
+amd64-microcode (jspricke)
   NOTE: 20230731: Added by Front-Desk (apo)
 --
 cairosvg (gladk)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab7284dc7471705899bfb237746ad13efdd2b06b

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab7284dc7471705899bfb237746ad13efdd2b06b
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] CVE-2023-2731/tiff does not affect buster or bullseye

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
bf9c5e09 by Adrian Bunk at 2023-07-31T11:47:52+03:00
CVE-2023-2731/tiff does not affect buster or bullseye

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -8320,10 +8320,11 @@ CVE-2023-2738 (A vulnerability classified as critical 
has been found in Tongda O
NOT-FOR-US: Tongda
 CVE-2023-2731 (A NULL pointer dereference flaw was found in Libtiff's 
LZWDecode() fun ...)
- tiff 4.5.0-6 (bug #1036282)
-   [bullseye] - tiff  (Minor issue)
-   [buster] - tiff  (Minor issue)
+   [bullseye] - tiff  (Vulnerable code introduced later)
+   [buster] - tiff  (Vulnerable code introduced later)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/548
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/9be22b639ea69e102d3847dca4c53ef025e9527b
+   NOTE: Introduced by: 
https://gitlab.com/libtiff/libtiff/-/commit/3079627ea0dee150e6a208cec8381de611bb842b
 (v4.4.0rc1)
 CVE-2023-2730 (Cross-site Scripting (XSS) - Stored in GitHub repository 
pimcore/pimco ...)
NOT-FOR-US: pimcore
 CVE-2023-2726 (Inappropriate implementation in WebApp Installs in Google 
Chrome prior ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bf9c5e09d1f44a8bcdca39ea723cf43870864b99

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bf9c5e09d1f44a8bcdca39ea723cf43870864b99
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] data/dla-needed.txt: Claim orthanc.

2023-07-31 Thread Chris Lamb (@lamby)



Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a673df13 by Chris Lamb at 2023-07-31T09:31:29+01:00
data/dla-needed.txt: Claim orthanc.

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
@@ -126,7 +126,7 @@ openjdk-11 (Emilio)
 openssl
   NOTE: 20230731: Added by Front-Desk (apo)
 --
-orthanc
+orthanc (Chris Lamb)
   NOTE: 20230731: Added by Front-Desk (apo)
 --
 pdfcrack (Adrian Bunk)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a673df1353a75916ee1c7698e56d701fa3d14cad

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a673df1353a75916ee1c7698e56d701fa3d14cad
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] NFUs

2023-07-31 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
3e10d7ed by Moritz Muehlenhoff at 2023-07-31T10:15:21+02:00
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -58,11 +58,11 @@ CVE-2023-39190
 CVE-2023-39023 (university compass v2.2.0 and below was discovered to contain 
a code i ...)
NOT-FOR-US: university compass
 CVE-2023-39022 (oscore v2.2.6 and below was discovered to contain a code 
injection vul ...)
-   TODO: check
+   NOT-FOR-US: oscore
 CVE-2023-39021 (wix-embedded-mysql v4.6.1 and below was discovered to contain 
a code i ...)
NOT-FOR-US: wix-embedded-mysql
 CVE-2023-39020 (stanford-parser v3.9.2 and below was discovered to contain a 
code inje ...)
-   TODO: check
+   NOT-FOR-US: stanford-parser
 CVE-2023-39018 (FFmpeg 0.7.0 and below was discovered to contain a code 
injection vuln ...)
NOT-FOR-US: ffmpeg-cli-wrapper (Java wrapper around the FFmpeg CLI)
 CVE-2023-39017 (quartz-jobs 2.3.2 and below was discovered to contain a code 
injection ...)
@@ -76,7 +76,7 @@ CVE-2023-39013 (Duke v1.2 and below was discovered to contain 
a code injection v
 CVE-2023-39010 (BoofCV 0.42 was discovered to contain a code injection 
vulnerability v ...)
TODO: check
 CVE-2023-38992 (jeecg-boot v3.5.1 was discovered to contain a SQL injection 
vulnerabil ...)
-   TODO: check
+   NOT-FOR-US: jeecg-boot
 CVE-2023-38685 (Discourse is an open source discussion platform. Prior to 
version 3.0. ...)
NOT-FOR-US: Discourse
 CVE-2023-38684 (Discourse is an open source discussion platform. Prior to 
version 3.0. ...)
@@ -104,7 +104,7 @@ CVE-2023-31933 (Sql injection vulnerability found in Rail 
Pass Management System
 CVE-2023-31932 (Sql injection vulnerability found in Rail Pass Management 
System v.1.0 ...)
NOT-FOR-US: Rail Pass Management System
 CVE-2023-2685 (A vulnerability was found in AO-OPC server versions mentioned 
above. A ...)
-   TODO: check
+   NOT-FOR-US: ABB AO-OPC
 CVE-2023-3990 (A vulnerability classified as problematic has been found in 
Mingsoft M ...)
NOT-FOR-US: Mingsoft MCMS
 CVE-2023-3989 (A vulnerability was found in SourceCodester Jewelry Store 
System 1.0.  ...)
@@ -126,29 +126,29 @@ CVE-2023-3774 (An unhandled error in Vault Enterprise's 
namespace creation may c
 CVE-2023-3670 (In CODESYS Development System 3.5.9.0 to3.5.17.0 andCODESYS 
Scripting4 ...)
NOT-FOR-US: CODESYS
 CVE-2023-38609 (An injection issue was addressed with improved input 
validation. This  ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-38604 (An out-of-bounds write issue was addressed with improved input 
validat ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-38601 (This issue was addressed by removing the vulnerable code. This 
issue i ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-38599 (A logic issue was addressed with improved state management. 
This issue ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-38598 (A use-after-free issue was addressed with improved memory 
management.  ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-38592 (A logic issue was addressed with improved restrictions. This 
issue is  ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-38590 (A buffer overflow issue was addressed with improved memory 
handling. T ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-38571 (This issue was addressed with improved validation of symlinks. 
This is ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-38331 (Zoho ManageEngine Support Center Plus 14001 and below is 
vulnerable to ...)
NOT-FOR-US: Zoho ManageEngine
 CVE-2023-37285 (An out-of-bounds read was addressed with improved bounds 
checking. Thi ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-36495 (An integer overflow was addressed with improved input 
validation. This ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-34425 (The issue was addressed with improved memory handling. This 
issue is f ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-33745 (TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to 
Improper P ...)
NOT-FOR-US: TeleAdapt RoomCast TA-2400
 CVE-2023-33744 (TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of 
a Hard- ...)
@@ -158,13 +158,13 @@ CVE-2023-33743 (TeleAdapt RoomCast TA-2400 1.0 through 
3.1 is vulnerable to Impr
 CVE-2023-33742 (TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from 
Cleartext Stor ...)
NOT-FOR-US: TeleAdapt RoomCast TA-2400
 CVE-2023-32654 (A logic issue was addressed with improved state management. 
This issue ...)
-   TODO: check
+   NOT-FOR-US: Apple
 CVE-2023-32445 (This issue was addressed with improved checks. This issue is 
fixed in  ...)
-   TODO: check
+

[Git][security-tracker-team/security-tracker][master] automatic update

2023-07-31 Thread Salvatore Bonaccorso (@carnil)



Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
4ae91f99 by security tracker role at 2023-07-31T08:12:17+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1,3 +1,19 @@
+CVE-2023-4007 (Cross-site Scripting (XSS) - Stored in GitHub repository 
thorsten/phpm ...)
+   TODO: check
+CVE-2023-4006 (Improper Neutralization of Formula Elements in a CSV File in 
GitHub re ...)
+   TODO: check
+CVE-2023-4005 (Insufficient Session Expiration in GitHub repository 
fossbilling/fossb ...)
+   TODO: check
+CVE-2023-35019 (IBM Security Verify Governance, Identity Manager 10.0 could 
allow a re ...)
+   TODO: check
+CVE-2023-35016 (IBM Security Verify Governance, Identity Manager 10.0 could 
allow a re ...)
+   TODO: check
+CVE-2023-34360 (A stored cross-site scripting (XSS) issue was discovered 
within the Cu ...)
+   TODO: check
+CVE-2023-34359 (ASUS RT-AX88U's httpd is subject to an unauthenticated DoS 
condition.  ...)
+   TODO: check
+CVE-2023-34358 (ASUS RT-AX88U's httpd is subject to an unauthenticated DoS 
condition.  ...)
+   TODO: check
 CVE-2023-4004
- linux 
[buster] - linux  (Vulnerable code not present)
@@ -2687,7 +2703,7 @@ CVE-2023-31405 (SAP NetWeaver AS for Java - versions 
ENGINEAPI 7.50, SERVERCORE
 CVE-2023-3605 (A vulnerability was found in PHPGurukul Online Shopping Portal 
1.0. It ...)
NOT-FOR-US: PHPGurukul Online Shopping Portal
 CVE-2023-3417 (Thunderbird allowed the Text Direction Override Unicode 
Character in f ...)
-   {DSA-5463-1}
+   {DSA-5463-1 DLA-3510-1}
- thunderbird 1:102.13.1-1
NOTE: 
https://www.mozilla.org/en-US/security/advisories/mfsa2023-27/#CVE-2023-3417
NOTE: 
https://www.mozilla.org/en-US/security/advisories/mfsa2023-28/#CVE-2023-3417
@@ -28745,8 +28761,8 @@ CVE-2023-24973
RESERVED
 CVE-2023-24972
RESERVED
-CVE-2023-24971
-   RESERVED
+CVE-2023-24971 (IBM B2B Advanced Communications 1.0.0.0 and IBM 
Multi-Enterprise Integ ...)
+   TODO: check
 CVE-2023-24970
RESERVED
 CVE-2023-24969
@@ -36356,8 +36372,8 @@ CVE-2023-22597 (InHand Networks InRouter 302, prior to 
version IR302 V3.5.56, an
NOT-FOR-US: InHand Networks InRouter
 CVE-2023-22596
RESERVED
-CVE-2023-22595
-   RESERVED
+CVE-2023-22595 (IBM B2B Advanced Communications 1.0.0.0 and IBM 
Multi-Enterprise Integ ...)
+   TODO: check
 CVE-2023-22594 (IBM Robotic Process Automation for Cloud Pak 20.12.0 through 
21.0.4 is ...)
NOT-FOR-US: IBM
 CVE-2023-22593 (IBM Robotic Process Automation for Cloud Pak 21.0.1 through 
21.0.7.3 a ...)
@@ -54232,8 +54248,8 @@ CVE-2022-43833
RESERVED
 CVE-2022-43832
RESERVED
-CVE-2022-43831
-   RESERVED
+CVE-2022-43831 (IBM Storage Scale Container Native Storage Access 5.1.2.1 
through 5.1. ...)
+   TODO: check
 CVE-2022-43830
REJECTED
 CVE-2022-43829
@@ -259701,8 +259717,8 @@ CVE-2020-4870 (IBM MQ 9.2 CD and LTS are vulnerable 
to a denial of service attac
NOT-FOR-US: IBM
 CVE-2020-4869 (IBM MQ Appliance 9.2 CD and 9.2 LTS is vulnerable to a denial 
of servi ...)
NOT-FOR-US: IBM
-CVE-2020-4868
-   RESERVED
+CVE-2020-4868 (IBM TRIRIGA 3.0, 4.0, and 4.4 could allow a remote attacker to 
obtain  ...)
+   TODO: check
 CVE-2020-4867
RESERVED
 CVE-2020-4866 (IBM Engineering products are vulnerable to cross-site 
scripting. This  ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4ae91f99ab742884140af91860e4465198189508

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4ae91f99ab742884140af91860e4465198189508
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] CVE-2014-8130/tiff is fixed since 4.0.5-1 (or earlier)

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
abd360eb by Adrian Bunk at 2023-07-31T10:54:47+03:00
CVE-2014-8130/tiff is fixed since 4.0.5-1 (or earlier)

3. Fix
--
Fixed in CVS HEAD since at least 21/12/2014.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -495301,7 +495301,7 @@ CVE-2014-8131 (The qemu implementation of 
virConnectGetAllDomainStats in libvirt
NOTE: 
https://www.redhat.com/archives/libvir-list/2014-December/msg00551.html
NOTE: 
https://www.redhat.com/archives/libvir-list/2014-December/msg00600.html
 CVE-2014-8130 (The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does 
not rejec ...)
-   - tiff  (unimportant; bug #776185)
+   - tiff 4.0.5-1 (unimportant; bug #776185)
- tiff3  (The tiff3 source package doesn't build the TIFF 
tools)
NOTE: Advisory: 
http://www.conostix.com/pub/adv/CVE-2014-8130-LibTIFF-Division_By_Zero.txt
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2483



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abd360eb2ac715109c777d4a00e13c789a6249e9

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abd360eb2ac715109c777d4a00e13c789a6249e9
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Reserve DLA-3510-1 for thunderbird

2023-07-31 Thread Emilio Pozuelo Monfort (@pochu)



Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
9ee597d7 by Emilio Pozuelo Monfort at 2023-07-31T09:36:19+02:00
Reserve DLA-3510-1 for thunderbird

- - - - -


1 changed file:

- data/DLA/list


Changes:

=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[31 Jul 2023] DLA-3510-1 thunderbird - security update
+   {CVE-2023-3417}
+   [buster] - thunderbird 1:102.13.1-1~deb10u1
 [27 Jul 2023] DLA-3509-1 libmail-dkim-perl - security update
[buster] - libmail-dkim-perl 0.54-1+deb10u1
 [27 Jul 2023] DLA-3508-1 linux - security update



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ee597d76111bebd32bf0803cb5c1463136993ae

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ee597d76111bebd32bf0803cb5c1463136993ae
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] dla: take pdfcrack

2023-07-31 Thread Adrian Bunk (@bunk)



Adrian Bunk pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ab694046 by Adrian Bunk at 2023-07-31T10:21:30+03:00
dla: take pdfcrack

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
@@ -129,7 +129,7 @@ openssl
 orthanc
   NOTE: 20230731: Added by Front-Desk (apo)
 --
-pdfcrack
+pdfcrack (Adrian Bunk)
   NOTE: 20230731: Added by Front-Desk (apo)
 --
 python-glance-store



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab694046c104fac22ce41be51bfa9d85c27e049a

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ab694046c104fac22ce41be51bfa9d85c27e049a
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] Add CVE-2023-4004/linux

2023-07-31 Thread Salvatore Bonaccorso (@carnil)



Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ede458b4 by Salvatore Bonaccorso at 2023-07-31T09:17:53+02:00
Add CVE-2023-4004/linux

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1,3 +1,7 @@
+CVE-2023-4004
+   - linux 
+   [buster] - linux  (Vulnerable code not present)
+   NOTE: 
https://git.kernel.org/linus/87b5a5c209405cb6b57424cdfa226a6dbd349232 (6.5-rc3)
 CVE-2023-3976
NOT-FOR-US: Red Hat OpenStack Platform
 CVE-2023-37219 (Tadiran Telecom Composit - CWE-1236: Improper Neutralization 
of Formul ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ede458b44d9f942a1c1258d2cd477c84f51f278c

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ede458b44d9f942a1c1258d2cd477c84f51f278c
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] claim frr

2023-07-31 Thread Aron Xu (@aron)



Aron Xu pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ff097dc8 by Aron Xu at 2023-07-31T15:14:58+08:00
claim frr

- - - - -


1 changed file:

- data/dsa-needed.txt


Changes:

=
data/dsa-needed.txt
=
@@ -18,7 +18,7 @@ cjose
 --
 cinder/oldstable
 --
-frr
+frr (aron)
   maintainer proposed to update to 8.4.4 for bookworm, which might be a good 
idea
 --
 linux (carnil)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ff097dc864d056ec5f9f8800a1890fd6057714b7

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ff097dc864d056ec5f9f8800a1890fd6057714b7
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] NFU

2023-07-31 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
162485a6 by Moritz Muehlenhoff at 2023-07-31T08:38:33+02:00
NFU

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1,3 +1,5 @@
+CVE-2023-3976
+   NOT-FOR-US: Red Hat OpenStack Platform
 CVE-2023-37219 (Tadiran Telecom Composit - CWE-1236: Improper Neutralization 
of Formul ...)
NOT-FOR-US: Tadiran Telecom Composit
 CVE-2023-37218 (Tadiran Telecom Aeonix - CWE-22 Improper Limitation of a 
Pathname to a ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/162485a66176994643c03e08b93c4113f01f1879

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/162485a66176994643c03e08b93c4113f01f1879
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] change jackrabit to unimportant severity

2023-07-31 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f19c6dfe by Moritz Muehlenhoff at 2023-07-31T08:21:28+02:00
change jackrabit to unimportant severity

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -498,11 +498,9 @@ CVE-2023-3772 (A flaw was found in the Linux kernel\u2019s 
IP framework for tran
- linux 
NOTE: 
https://lore.kernel.org/netdev/20230721145103.2714073-1-li...@zju.edu.cn/
 CVE-2023-37895 (Java object deserialization issue in Jackrabbit 
webapp/standalone on a ...)
-   - jackrabbit 2.20.11-1
-   [bookworm] - jackrabbit  (Minor issue; standalone and webapp 
modules are not enabled)
-   [bullseye] - jackrabbit  (Minor issue; standalone and webapp 
modules are not enabled)
-   [buster] - jackrabbit  (Minor issue; standalone and webapp 
modules are not enabled)
+   - jackrabbit 2.20.11-1 (unimportant)
NOTE: https://www.openwall.com/lists/oss-security/2023/07/25/8
+   NOTE: standalone and webapp modules are not enabled in Debian packages
 CVE-2023-3888 (A vulnerability was found in Campcodes Beauty Salon Management 
System  ...)
NOT-FOR-US: Campcodes Beauty Salon Management System
 CVE-2023-3887 (A vulnerability was found in Campcodes Beauty Salon Management 
System  ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f19c6dfeae5c13c7ff2ddacbacc54011c095b431

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f19c6dfeae5c13c7ff2ddacbacc54011c095b431
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

37 matches

Mail list logo