Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 90fa4009 by security tracker role at 2018-07-19T20:10:18+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== --- a/data/CVE/list +++ b/data/CVE/list @@ -1,3 +1,45 @@ +CVE-2018-14424 + RESERVED +CVE-2018-14423 (Division-by-zero vulnerabilities in the functions pi_next_pcrl, ...) + TODO: check +CVE-2018-14422 (blog/index.php in SansCMS 0.7 has XSS via the q parameter. ...) + TODO: check +CVE-2018-14421 (SeaCMS v6.61 allows Remote Code execution by placing PHP code in a ...) + TODO: check +CVE-2018-14420 (MetInfo 6.0.0 allows a CSRF attack to add a user account via a ...) + TODO: check +CVE-2018-14419 (MetInfo 6.0.0 allows XSS via a modified name of the navigation bar on ...) + TODO: check +CVE-2018-14418 (In Msvod Cms v10, SQL Injection exists via an images/lists?cid= URI. ...) + TODO: check +CVE-2018-14417 + RESERVED +CVE-2018-14416 + RESERVED +CVE-2018-14415 (An issue was discovered in idreamsoft iCMS before 7.0.10. XSS exists ...) + TODO: check +CVE-2018-14414 + RESERVED +CVE-2018-14413 + RESERVED +CVE-2018-14412 + RESERVED +CVE-2018-14411 + RESERVED +CVE-2018-14410 + RESERVED +CVE-2018-14409 + RESERVED +CVE-2018-14408 + RESERVED +CVE-2018-14407 + RESERVED +CVE-2018-14406 + RESERVED +CVE-2018-14405 + RESERVED +CVE-2018-14404 (A NULL pointer dereference vulnerability exists in the ...) + TODO: check CVE-2018-14403 (MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings ...) - mp4v2 <unfixed> [stretch] - mp4v2 <no-dsa> (Minor issue) @@ -274,8 +316,8 @@ CVE-2018-14334 (manager/editor/upload.php in joyplus-cms 1.6.0 allows arbitrary NOT-FOR-US: joyplus-cms CVE-2018-14333 (TeamViewer through 13.1.1548 stores a password in Unicode format within ...) NOT-FOR-US: TeamViewer -CVE-2018-14332 - RESERVED +CVE-2018-14332 (An issue was discovered in Clementine Music Player 1.3.1. ...) + TODO: check CVE-2018-14331 (An issue was discovered in XiaoCms X1 v20140305. There is a CSRF ...) NOT-FOR-US: XiaoCms CVE-2018-14330 @@ -3389,9 +3431,9 @@ CVE-2018-12913 (In Miniz 2.0.7, tinfl_decompress in miniz_tinfl.c has an infinit NOT-FOR-US: Miniz CVE-2018-12912 (An issue wan discovered in admin\controllers\database.php in HongCMS ...) NOT-FOR-US: HongCMS -CVE-2018-12911 - RESERVED -CVE-2018-12910 (soup_cookie_jar_get_cookies in soup-cookie-jar.c in libsoup allows ...) +CVE-2018-12911 (WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant ...) + TODO: check +CVE-2018-12910 (The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows ...) {DSA-4241-1 DLA-1416-1} - libsoup2.4 2.62.2-2 NOTE: https://gitlab.gnome.org/GNOME/libsoup/commit/db2b0d5809d5f8226d47312b40992cadbcde439f @@ -9521,8 +9563,8 @@ CVE-2018-10622 RESERVED CVE-2018-10621 (Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 ...) NOT-FOR-US: Delta Electronics Delta Industrial Automation DOPSoft -CVE-2018-10620 - RESERVED +CVE-2018-10620 (AVEVA InduSoft Web Studio v8.1 and v8.1SP1, and InTouch Machine ...) + TODO: check CVE-2018-10619 (An unquoted search path or element in RSLinx Classic Versions 3.90.01 ...) NOT-FOR-US: RSLinx CVE-2018-10618 @@ -13378,7 +13420,7 @@ CVE-2018-9064 CVE-2018-9063 (MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In Lenovo ...) NOT-FOR-US: Lenovo CVE-2018-9062 - RESERVED + REJECTED CVE-2018-9061 RESERVED CVE-2018-9060 @@ -15946,8 +15988,7 @@ CVE-2018-8020 RESERVED CVE-2018-8019 RESERVED -CVE-2018-8018 - RESERVED +CVE-2018-8018 (Apache Ignite 2.5 and earlier serialization mechanism does not have a ...) NOT-FOR-US: Apache Ignite CVE-2018-8017 RESERVED @@ -17130,8 +17171,7 @@ CVE-2018-7604 RESERVED CVE-2018-7603 RESERVED -CVE-2018-7602 [SA-CORE-2018-004] - RESERVED +CVE-2018-7602 (A remote code execution vulnerability exists within multiple ...) {DSA-4180-1 DLA-1365-1} - drupal7 <removed> (bug #896701) NOTE: https://www.drupal.org/psa-2018-003 @@ -23862,8 +23902,8 @@ CVE-2018-5542 RESERVED CVE-2018-5541 RESERVED -CVE-2018-5540 - RESERVED +CVE-2018-5540 (On F5 BIG-IP 13.0.0-13.0.1, 12.1.0-12.1.3.3, 11.6.0-11.6.3.1, or ...) + TODO: check CVE-2018-5539 RESERVED CVE-2018-5538 @@ -23872,14 +23912,14 @@ CVE-2018-5537 RESERVED CVE-2018-5536 RESERVED -CVE-2018-5535 - RESERVED -CVE-2018-5534 - RESERVED -CVE-2018-5533 - RESERVED -CVE-2018-5532 - RESERVED +CVE-2018-5535 (On F5 BIG-IP 13.0.0-13.1.0, 12.1.0-12.1.3, or 11.2.1-11.6.3 ...) + TODO: check +CVE-2018-5534 (Under certain conditions on F5 BIG-IP 13.1.0-13.1.0.5, 13.0.0, ...) + TODO: check +CVE-2018-5533 (Under certain conditions on F5 BIG-IP 13.0.0, 12.1.0-12.1.2, ...) + TODO: check +CVE-2018-5532 (On F5 BIG-IP 13.0.0, 12.1.0-12.1.2, 11.6.0-11.6.3.1, or 11.2.1-11.5.6 ...) + TODO: check CVE-2018-5531 RESERVED CVE-2018-5530 @@ -27887,10 +27927,10 @@ CVE-2018-3873 RESERVED CVE-2018-3872 RESERVED -CVE-2018-3871 - RESERVED -CVE-2018-3870 - RESERVED +CVE-2018-3871 (An exploitable out-of-bounds write exists in the PCX parsing ...) + TODO: check +CVE-2018-3870 (An exploitable out-of-bounds write exists in the PCX parsing ...) + TODO: check CVE-2018-3869 RESERVED CVE-2018-3868 (A specially crafted TIFF image processed via the application can lead ...) @@ -27909,14 +27949,14 @@ CVE-2018-3862 (A specially crafted TIFF image processed via the application can NOT-FOR-US: Computerinsel Photoline CVE-2018-3861 (A specially crafted TIFF image processed via the application can lead ...) NOT-FOR-US: Computerinsel Photoline -CVE-2018-3860 - RESERVED -CVE-2018-3859 - RESERVED -CVE-2018-3858 - RESERVED -CVE-2018-3857 - RESERVED +CVE-2018-3860 (An exploitable out-of-bounds write exists in the TIFF parsing ...) + TODO: check +CVE-2018-3859 (An exploitable out-of-bounds write exists in the TIFF parsing ...) + TODO: check +CVE-2018-3858 (An exploitable heap overflow exists in the TIFF parsing functionality ...) + TODO: check +CVE-2018-3857 (An exploitable heap overflow exists in the TIFF parsing functionality ...) + TODO: check CVE-2018-3856 RESERVED CVE-2018-3855 (In Hyland Perceptive Document Filters 11.4.0.2647 - x86/x64 ...) @@ -34150,12 +34190,12 @@ CVE-2018-1589 RESERVED CVE-2018-1588 RESERVED -CVE-2018-1587 - RESERVED +CVE-2018-1587 (IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through ...) + TODO: check CVE-2018-1586 RESERVED -CVE-2018-1585 - RESERVED +CVE-2018-1585 (IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through ...) + TODO: check CVE-2018-1584 RESERVED CVE-2018-1583 (IBM StoredIQ 7.6 could allow an authenticated attacker to bypass ...) @@ -34252,10 +34292,10 @@ CVE-2018-1538 RESERVED CVE-2018-1537 RESERVED -CVE-2018-1536 - RESERVED -CVE-2018-1535 - RESERVED +CVE-2018-1536 (IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through ...) + TODO: check +CVE-2018-1535 (IBM Rational Rhapsody Design Manager 5.0 through 5.0.2 and 6.0 through ...) + TODO: check CVE-2018-1534 RESERVED CVE-2018-1533 @@ -34266,8 +34306,8 @@ CVE-2018-1531 RESERVED CVE-2018-1530 RESERVED -CVE-2018-1529 - RESERVED +CVE-2018-1529 (IBM Rational DOORS Next Generation 5.0 through 5.0.2, 6.0 through ...) + TODO: check CVE-2018-1528 RESERVED CVE-2018-1527 @@ -68947,8 +68987,7 @@ CVE-2017-7482 {DSA-3945-1 DSA-3927-1 DLA-1099-1} - linux 4.11.11-1 NOTE: Fixed by: https://git.kernel.org/linus/5f2f97656ada8d811d3c1bef503ced266fcd53a0 -CVE-2017-7481 [Security issue with lookup return not tainting the jinja2 environment] - RESERVED +CVE-2017-7481 (Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark ...) - ansible 2.3.1.0+dfsg-1 (bug #862666) [stretch] - ansible <no-dsa> (Minor issue) [jessie] - ansible <no-dsa> (Minor issue) @@ -83862,8 +83901,7 @@ CVE-2017-2675 (Little Snitch version 3.0 through 3.7.3 suffer from a local privi CVE-2017-2674 RESERVED NOT-FOR-US: Red Hat business central -CVE-2017-2673 [federated user gets wrong role] - RESERVED +CVE-2017-2673 (An authorization-check flaw was discovered in federation ...) - keystone 2:10.0.0-9 (bug #861189) [jessie] - keystone <not-affected> (Vulnerable code not present) [wheezy] - keystone <not-affected> (Vulnerable code not present) @@ -89692,8 +89730,7 @@ CVE-2016-9575 (Ipa versions 4.2.x, 4.3.x before 4.3.3 and 4.4.x before 4.4.3 did NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1395311 NOTE: https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=fec4c32ff15 NOTE: https://fedorahosted.org/freeipa/ticket/6560 -CVE-2016-9574 [Remote DoS during session handshake when using SessionTicket extention and ECDHE-ECDSA] - RESERVED +CVE-2016-9574 (nss before version 3.30 is vulnerable to a remote denial of service ...) - nss 2:3.25-1 NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=1320695 NOTE: The CVE is specific to the segfault resulting from the reproducing steps @@ -165690,8 +165727,8 @@ CVE-2014-2304 RESERVED CVE-2014-2303 (Multiple SQL injection vulnerabilities in the file browser component ...) NOT-FOR-US: webEdition CMS -CVE-2014-2302 - RESERVED +CVE-2014-2302 (The installer script in webEdition CMS before 6.2.7-s1 and 6.3.x ...) + TODO: check CVE-2014-2301 (OrbiTeam BSCW before 5.0.8 allows remote attackers to obtain sensitive ...) NOT-FOR-US: OrbiTeam BSCW CVE-2014-2300 @@ -171811,8 +171848,7 @@ CVE-2014-0244 (The sys_recvfrom function in nmbd in Samba 3.6.x before 3.6.24, 4 - samba4 4.0.0~beta2+dfsg1-3.2+deb7u2 NOTE: AD-related packages removed from src:samba4 in 4.0.0~beta2+dfsg1-3.2+deb7u2 NOTE: https://www.samba.org/samba/security/CVE-2014-0244 -CVE-2014-0243 [check-mk: arbitrary file disclosure] - RESERVED +CVE-2014-0243 (Check_MK through 1.2.5i2p1 allows local users to read arbitrary files ...) - check-mk <not-affected> (Vulnerable code not present) NOTE: https://www.lsexperts.de/advisories/lse-2014-05-21.txt CVE-2014-0242 [information disclosure via Content-Type response header] View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/90fa400975cb178169b246c2617771cd9ff0824c -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/90fa400975cb178169b246c2617771cd9ff0824c You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits