Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits: 139a2cbf by Moritz Muehlenhoff at 2019-02-26T21:49:40Z stretch triage - - - - - 2 changed files: - data/CVE/list - data/dsa-needed.txt Changes: ===================================== data/CVE/list ===================================== @@ -115,11 +115,9 @@ CVE-2019-9153 CVE-2019-9152 (An issue was discovered in the HDF HDF5 1.10.4 library. There is an out ...) - hdf5 <undetermined> NOTE: https://github.com/magicSwordsMan/PAAFS/tree/master/vul8 - TODO: check CVE-2019-9151 (An issue was discovered in the HDF HDF5 1.10.4 library. There is an out ...) - hdf5 <undetermined> NOTE: https://github.com/magicSwordsMan/PAAFS/tree/master/vul7 - TODO: check CVE-2019-9150 RESERVED CVE-2019-9149 @@ -1827,15 +1825,12 @@ CVE-2019-8399 CVE-2019-8398 (An issue was discovered in the HDF HDF5 1.10.4 library. There is an out ...) - hdf5 <undetermined> NOTE: https://github.com/magicSwordsMan/PAAFS/tree/master/vul6 - TODO: check CVE-2019-8397 (An issue was discovered in the HDF HDF5 1.10.4 library. There is an out ...) - hdf5 <undetermined> NOTE: https://github.com/magicSwordsMan/PAAFS/tree/master/vul5 - TODO: check CVE-2019-8396 (A buffer overflow in H5O__layout_encode in H5Olayout.c in the HDF HDF5 ...) - hdf5 <undetermined> NOTE: https://github.com/magicSwordsMan/PAAFS/tree/master/vul4 - TODO: check CVE-2019-8395 (An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ...) NOT-FOR-US: Zoho ManageEngine ServiceDesk Plus CVE-2019-8394 (Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows ...) @@ -20084,6 +20079,7 @@ CVE-2018-19609 (ShowDoc 2.4.1 allows remote attackers to obtain sensitive inform NOT-FOR-US: ShowDoc CVE-2018-19608 (Arm Mbed TLS before 2.14.1, before 2.7.8, and before 2.1.17 allows a ...) - mbedtls 2.14.1-1 (bug #915796) + [stretch] - mbedtls <no-dsa> (Minor issue) - polarssl <removed> NOTE: http://cat.eyalro.net/ NOTE: https://tls.mbed.org/tech-updates/releases/mbedtls-2.14.1-2.7.8-and-2.1.17-released @@ -33057,6 +33053,7 @@ CVE-2018-15757 REJECTED CVE-2018-15756 (Spring Framework, version 5.1, versions 5.0.x prior to 5.0.10, ...) - libspring-java 4.3.21-1 (bug #911786) + [stretch] - libspring-java <no-dsa> (Minor issue) [jessie] - libspring-java <not-affected> (vulnerable code introduced in later version) NOTE: https://pivotal.io/security/cve-2018-15756 CVE-2018-15755 (Cloud Foundry CF Networking Release, versions 2.11.0 prior to 2.16.0, ...) @@ -45472,10 +45469,12 @@ CVE-2018-11041 (Cloud Foundry UAA, versions later than 4.6.0 and prior to 4.19.0 NOT-FOR-US: Cloud Foundry CVE-2018-11040 (Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to ...) - libspring-java 4.3.19-1 + [stretch] - libspring-java <no-dsa> (Minor issue) [jessie] - libspring-java <no-dsa> (unable to find relevant commits) NOTE: https://pivotal.io/security/cve-2018-11040 CVE-2018-11039 (Spring Framework (versions 5.0.x prior to 5.0.7, versions 4.3.x prior ...) - libspring-java 4.3.19-1 + [stretch] - libspring-java <no-dsa> (Minor issue) [jessie] - libspring-java <no-dsa> (Minor issue) NOTE: https://pivotal.io/security/cve-2018-11039 CVE-2017-18270 (In the Linux kernel before 4.13.5, a local user could create keyrings ...) @@ -73518,6 +73517,7 @@ CVE-2018-1273 (Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2. NOT-FOR-US: Spring Data Commons CVE-2018-1272 (Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior ...) - libspring-java 4.3.19-1 (bug #895114) + [stretch] - libspring-java <no-dsa> (Minor issue) [jessie] - libspring-java <not-affected> (vulnerable code not found) [wheezy] - libspring-java <not-affected> (Vulnerable broker code introduced in various commits re. https://github.com/spring-projects/spring-framework/blame/0009806debb578e884f6dc98bd1f2dc668020021/spring-messaging/src/main/java/org/springframework/messaging/simp/broker/DefaultSubscriptionRegistry.java) NOTE: https://pivotal.io/security/cve-2018-1272 @@ -73526,6 +73526,7 @@ CVE-2018-1271 (Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 pr NOTE: https://pivotal.io/security/cve-2018-1271 CVE-2018-1270 (Spring Framework, versions 5.0 prior to 5.0.5 and versions 4.3 prior ...) - libspring-java 4.3.19-1 (bug #895114) + [stretch] - libspring-java <no-dsa> (Minor issue) [jessie] - libspring-java <not-affected> (vulnerable code not found) [wheezy] - libspring-java <not-affected> (Vulnerable broker code introduced in various commits re. https://github.com/spring-projects/spring-framework/blame/0009806debb578e884f6dc98bd1f2dc668020021/spring-messaging/src/main/java/org/springframework/messaging/simp/broker/DefaultSubscriptionRegistry.java) NOTE: https://pivotal.io/security/cve-2018-1270 @@ -73677,6 +73678,7 @@ CVE-2018-1200 (Apps Manager for PCF (Pivotal Application Service 1.11.x before . NOT-FOR-US: Pivotal CVE-2018-1199 (Spring Security (Spring Security 4.1.x before 4.1.5, 4.2.x before ...) - libspring-java 4.3.14-1 (bug #890001) + [stretch] - libspring-java <no-dsa> (Minor issue) [wheezy] - libspring-java <ignored> (Too intrusive to fix by upgrade) [jessie] - libspring-java <no-dsa> (fix for spring-security available but not for springframework) - libspring-security-java <itp> (bug #582181) ===================================== data/dsa-needed.txt ===================================== @@ -30,16 +30,12 @@ libidn libpng1.6 wait for final patch -- -libspring-java --- linux Wait until more issues have piled up -- mariadb-10.1 https://alioth-lists.debian.net/pipermail/pkg-mysql-maint/2019-February/012771.html -- -mbedtls --- mercurial mumble @@ -55,6 +51,8 @@ openjpeg2 (luciano) -- passenger -- +php7.0 (jmm) +-- runc -- simplesamlphp View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/139a2cbf8955aed5411a088dab2834dbe084ca68 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/139a2cbf8955aed5411a088dab2834dbe084ca68 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits