[Git][security-tracker-team/security-tracker][master] Reserve DLA-3513-1 for tiff

Bunk) NOTE: 20230714: Still reviewing+testing CVEs. (bunk) NOTE: 20230731: Still reviewing+testing CVEs. (bunk) -- -tiff (Adrian Bunk) - NOTE: 20230702: Added by Front-Desk (ta) - NOTE: 20230714: Waiting for upstream reaction on CVE-2023-3618. (bunk) - NOTE: 20230731: Resumed working on tiff

[Git][security-tracker-team/security-tracker][master] Reserve DLA-3512-1 for linux-5.10

Ben Hutchings pushed to branch master at Debian Security Tracker / security-tracker Commits: 2f617ff9 by Ben Hutchings at 2023-07-31T22:59:03+02:00 Reserve DLA-3512-1 for linux-5.10 - - - - - 1 changed file: - data/DLA/list Changes: = data/DLA/list

[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 477f64e6 by security tracker role at 2023-07-31T20:12:10+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] CVE-2023-30774/tiff also has the same fix as CVE-2022-3599/...

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: abcbb6d1 by Adrian Bunk at 2023-07-31T23:06:59+03:00 CVE-2023-30774/tiff also has the same fix as CVE-2022-3599/... - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] CVE-2023-25434/CVE-2023-25435: fix my off-by-one in the releases

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: ab2fcbbf by Adrian Bunk at 2023-07-31T22:54:32+03:00 CVE-2023-25434/CVE-2023-25435: fix my off-by-one in the releases - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2023-0330/qemu: fix is available, update buster triage

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker Commits: d7614158 by Sylvain Beucler at 2023-07-31T19:46:32+02:00 CVE-2023-0330/qemu: fix is available, update buster triage - - - - - 18cf48d9 by Sylvain Beucler at 2023-07-31T19:46:34+02:00

[Git][security-tracker-team/security-tracker][master] CVE-2023-25435/tiff had the same fix as CVE-2023-0795

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: abb15c01 by Adrian Bunk at 2023-07-31T20:12:49+03:00 CVE-2023-25435/tiff had the same fix as CVE-2023-0795 - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2020-22402: mark as not-affected for buster

(apo) -- +bouncycastle + NOTE: 20230731: Added by Front-Desk (gladk) +-- cairosvg (gladk) NOTE: 20230323: Added by Front-Desk (gladk) NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport the --unsafe switch, introduced in 1.0.21, might work (dleidert/inactive) View

[Git][security-tracker-team/security-tracker][master] CVE-2023-25434/tiff had the same fix as CVE-2023-0795

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: abfb15aa by Adrian Bunk at 2023-07-31T19:43:13+03:00 CVE-2023-25434/tiff had the same fix as CVE-2023-0795 - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] LTS: take openssl

= @@ -116,7 +116,7 @@ openjdk-11 (Emilio) NOTE: 20230612: sid updated, preparing backport (pochu) NOTE: 20230717: waiting for DSA, might wait for next CPU (pochu) -- -openssl +openssl (gladk) NOTE: 20230731: Added by Front-Desk (apo) -- orthanc (Chris Lamb

[Git][security-tracker-team/security-tracker][master] tiff: Fix the metadata for the CVE-2022-3599/CVE-2022-4645/CVE-2023-30086/CVE-2023-2908 mess

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: aba57172 by Adrian Bunk at 2023-07-31T18:33:26+03:00 tiff: Fix the metadata for the CVE-2022-3599/CVE-2022-4645/CVE-2023-30086/CVE-2023-2908 mess - - - - - 1 changed file: - data/CVE/list

[Git][security-tracker-team/security-tracker][master] 3 commits: CVE-2023-32731/grpc: precise links + buster not-affected

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker Commits: 5ee54b17 by Sylvain Beucler at 2023-07-31T17:07:55+02:00 CVE-2023-32731/grpc: precise links + buster not-affected - - - - - f320dc28 by Sylvain Beucler at 2023-07-31T17:21:02+02:00

[Git][security-tracker-team/security-tracker][master] Properly fix DLA-3511-1

Jochen Sprickerhof pushed to branch master at Debian Security Tracker / security-tracker Commits: 9261a21b by Jochen Sprickerhof at 2023-07-31T16:52:32+02:00 Properly fix DLA-3511-1 Use sbuild --debbuildopt=-vversion to generate the correct changes file. - - - - - 2 changed files: -

[Git][security-tracker-team/security-tracker][master] amd64-microcode add missing CVE

Jochen Sprickerhof pushed to branch master at Debian Security Tracker / security-tracker Commits: 43bfd382 by Jochen Sprickerhof at 2023-07-31T16:38:45+02:00 amd64-microcode add missing CVE Thanks Beuc. - - - - - 1 changed file: - data/DLA/list Changes:

[Git][security-tracker-team/security-tracker][master] Fix amd64-microcode version

Jochen Sprickerhof pushed to branch master at Debian Security Tracker / security-tracker Commits: bbb0f49d by Jochen Sprickerhof at 2023-07-31T16:37:24+02:00 Fix amd64-microcode version - - - - - 1 changed file: - data/DLA/list Changes: =

[Git][security-tracker-team/security-tracker][master] Add commit for fixing bouncycastle CVE-2023-33201

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: f0bfb35f by Bastien Roucariès at 2023-07-31T14:31:27+00:00 Add commit for fixing bouncycastle CVE-2023-33201 - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Take chef

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 211359e4 by Bastien Roucariès at 2023-07-31T14:29:16+00:00 Take chef - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt

[Git][security-tracker-team/security-tracker][master] data/dla-needed.txt: claim open-vm-tools

n-vm-tools +open-vm-tools (Abhijith PA) NOTE: 20230731: Added by Front-Desk (apo) -- openimageio (Markus Koschany) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ddd968cfa0f306986a803b4b22de1644057f84eb -- View it on GitLab: https://salsa.

[Git][security-tracker-team/security-tracker][master] dla: update notes

reviewing+testing CVEs. (bunk) + NOTE: 20230731: Still reviewing+testing CVEs. (bunk) -- tiff (Adrian Bunk) NOTE: 20230702: Added by Front-Desk (ta) NOTE: 20230714: Waiting for upstream reaction on CVE-2023-3618. (bunk) + NOTE: 20230731: Resumed working on tiff, DLA soon. (bunk

[Git][security-tracker-team/security-tracker][master] new quartz issue

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 3a3a0e3e by Moritz Muehlenhoff at 2023-07-31T14:38:24+02:00 new quartz issue - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] bullseye/bookworm triage

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 8fd8ff2d by Moritz Muehlenhoff at 2023-07-31T14:20:22+02:00 bullseye/bookworm triage - - - - - 2 changed files: - data/CVE/list - data/dsa-needed.txt Changes:

[Git][security-tracker-team/security-tracker][master] Reserve DLA-3511-1 for amd64-microcode

) - NOTE: 20230731: Added by Front-Desk (apo) --- cairosvg (gladk) NOTE: 20230323: Added by Front-Desk (gladk) NOTE: 20230411: Proposed solution for CVE-2023-27586 in Buster to backport the --unsafe switch, introduced in 1.0.21, might work (dleidert/inactive) View it on GitLab: https

[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 2e5e8a1d by Moritz Muehlenhoff at 2023-07-31T12:25:08+02:00 NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] two Ubuntu-specific Linux issues

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: bfaba592 by Moritz Muehlenhoff at 2023-07-31T12:21:07+02:00 two Ubuntu-specific Linux issues - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] CVE-2023-2908/tiff does not affect buster

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: ab46acb3 by Adrian Bunk at 2023-07-31T12:10:52+03:00 CVE-2023-2908/tiff does not affect buster - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] Claim amd64-microcode

-needed.txt = @@ -24,7 +24,7 @@ rather than remove/replace existing ones. amanda (Thorsten Alteholz) NOTE: 20230730: Added by Front-Desk (apo) -- -amd64-microcode +amd64-microcode (jspricke) NOTE: 20230731: Added by Front-Desk (apo) -- cairosvg (gladk

[Git][security-tracker-team/security-tracker][master] CVE-2023-2731/tiff does not affect buster or bullseye

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: bf9c5e09 by Adrian Bunk at 2023-07-31T11:47:52+03:00 CVE-2023-2731/tiff does not affect buster or bullseye - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] data/dla-needed.txt: Claim orthanc.

-needed.txt = @@ -126,7 +126,7 @@ openjdk-11 (Emilio) openssl NOTE: 20230731: Added by Front-Desk (apo) -- -orthanc +orthanc (Chris Lamb) NOTE: 20230731: Added by Front-Desk (apo) -- pdfcrack (Adrian Bunk) View it on GitLab: https://salsa.debian.org

[Git][security-tracker-team/security-tracker][master] NFUs

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 3e10d7ed by Moritz Muehlenhoff at 2023-07-31T10:15:21+02:00 NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 4ae91f99 by security tracker role at 2023-07-31T08:12:17+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] CVE-2014-8130/tiff is fixed since 4.0.5-1 (or earlier)

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: abd360eb by Adrian Bunk at 2023-07-31T10:54:47+03:00 CVE-2014-8130/tiff is fixed since 4.0.5-1 (or earlier) 3. Fix -- Fixed in CVS HEAD since at least 21/12/2014. - - - - - 1 changed file: -

[Git][security-tracker-team/security-tracker][master] Reserve DLA-3510-1 for thunderbird

Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker Commits: 9ee597d7 by Emilio Pozuelo Monfort at 2023-07-31T09:36:19+02:00 Reserve DLA-3510-1 for thunderbird - - - - - 1 changed file: - data/DLA/list Changes:

[Git][security-tracker-team/security-tracker][master] dla: take pdfcrack

= @@ -129,7 +129,7 @@ openssl orthanc NOTE: 20230731: Added by Front-Desk (apo) -- -pdfcrack +pdfcrack (Adrian Bunk) NOTE: 20230731: Added by Front-Desk (apo) -- python-glance-store View it on GitLab: https://salsa.debian.org/security-tracker-team/security

[Git][security-tracker-team/security-tracker][master] Add CVE-2023-4004/linux

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: ede458b4 by Salvatore Bonaccorso at 2023-07-31T09:17:53+02:00 Add CVE-2023-4004/linux - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] claim frr

Aron Xu pushed to branch master at Debian Security Tracker / security-tracker Commits: ff097dc8 by Aron Xu at 2023-07-31T15:14:58+08:00 claim frr - - - - - 1 changed file: - data/dsa-needed.txt Changes: = data/dsa-needed.txt

[Git][security-tracker-team/security-tracker][master] NFU

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 162485a6 by Moritz Muehlenhoff at 2023-07-31T08:38:33+02:00 NFU - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] change jackrabit to unimportant severity

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: f19c6dfe by Moritz Muehlenhoff at 2023-07-31T08:21:28+02:00 change jackrabit to unimportant severity - - - - - 1 changed file: - data/CVE/list Changes: