Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
448cc3d0 by Moritz Muehlenhoff at 2019-03-20T21:43:12Z
stretch triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -753,7 +753,8 @@ CVE-2018-20808 (An XSS issue has been found with rd.cgi in
Pulse Secure Pulse Co
CVE-2018-20807 (An XSS issue has been found in welcome.cgi in Pulse Secure
Pulse Conne ...)
NOT-FOR-US: Pulse Secure Pulse Connect Secure
CVE-2018-20806 (Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS
via the ...)
- - phamm <unfixed> (bug #924731)
+ - phamm <unfixed> (low; bug #924731)
+ [stretch] - phamm <no-dsa> (Minor issue)
NOTE: https://github.com/lota/phamm/issues/24
CVE-2019-9839
RESERVED
@@ -1016,16 +1017,19 @@ CVE-2019-9753
CVE-2019-9752 (An issue was discovered in Open Ticket Request System (OTRS)
5.x befor ...)
{DLA-1721-1}
- otrs2 6.0.16-1
+ [stretch] - otrs2 <no-dsa> (Non-free not supported)
NOTE:
https://community.otrs.com/security-advisory-2019-01-security-update-for-otrs-framework/
NOTE: OTRS 6:
https://github.com/OTRS/otrs/commit/341c4096222819a108feb02256aba878943bf810
NOTE: OTRS 5:
https://github.com/OTRS/otrs/commit/d4e3dfbaa054762b29df54705aa412685dd37e15
CVE-2019-9751 (An issue was discovered in Open Ticket Request System (OTRS)
6.x befor ...)
- otrs2 6.0.17-1
+ [stretch] - otrs2 <no-dsa> (Non-free not supported)
[jessie] - otrs2 <not-affected> (Vulnerable code not present)
NOTE:
https://community.otrs.com/security-advisory-2019-02-security-update-for-otrs-framework
NOTE: OTRS 6:
https://github.com/OTRS/otrs/commit/1afb2b995e59551b927c2105e234e8b87efcc37a
CVE-2018-20800 (An issue was discovered in Open Ticket Request System (OTRS)
5.0.31 an ...)
- otrs2 6.0.14-1
+ [stretch] - otrs2 <no-dsa> (Non-free not supported)
[jessie] - otrs2 <not-affected> (Vulnerable code not present)
NOTE:
https://community.otrs.com/security-advisory-2018-10-security-update-for-otrs-framework/
NOTE: OTRS 6:
https://github.com/OTRS/otrs/commit/8d17d58029efbb0bba25c4208e09e2d320eeb0c3
@@ -1055,7 +1059,9 @@ CVE-2019-9741 (An issue was discovered in net/http in Go
1.11.5. CRLF injection
- golang-1.12 1.12-1
- golang-1.11 1.11.6-1 (bug #924630)
- golang-1.8 <removed>
+ [stretch] - golang-1.8 <postponed> (Minor issue, can be fixed along in
future DSA)
- golang-1.7 <removed>
+ [stretch] - golang-1.7 <postponed> (Minor issue, can be fixed along in
future DSA)
- golang <removed>
NOTE: https://github.com/golang/go/issues/30794
NOTE:
https://github.com/golang/go/commit/829c5df58694b3345cb5ea41206783c8ccf5c3ca#diff-b97af51863ce82bf2a13003b52034aa9
@@ -1109,13 +1115,15 @@ CVE-2019-9722
RESERVED
CVE-2019-9721 (A denial of service in the subtitle decoder in FFmpeg 4.1
allows attac ...)
- ffmpeg <unfixed>
+ [stretch] - ffmpeg <not-affected> (Vulnerable code not present)
NOTE:
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/894995c41e0795c7a44f81adc4838dedc3932e65
CVE-2019-9720
RESERVED
CVE-2019-9719
RESERVED
CVE-2019-9718 (In FFmpeg 4.1, a denial of service in the subtitle decoder
allows atta ...)
- - ffmpeg <unfixed>
+ - ffmpeg <unfixed> (low)
+ [stretch] - ffmpeg <postponed> (Wait until fixed in 3.2.x release)
NOTE:
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/1f00c97bc3475c477f3c468cf2d924d5761d0982
CVE-2019-9717
RESERVED
@@ -1185,6 +1193,7 @@ CVE-2019-9688 (sftnow through 2018-12-29 allows
index.php?g=Admin&m=User&
NOT-FOR-US: sftnow
CVE-2019-9687 (PoDoFo 0.9.6 has a heap-based buffer overflow in
PdfString::ConvertUTF ...)
- libpodofo <unfixed> (bug #924430)
+ [stretch] - libpodofo <no-dsa> (Minor issue)
NOTE: https://sourceforge.net/p/podofo/code/1969
CVE-2019-9686 (pacman before 5.1.3 allows directory traversal when installing
a remot ...)
NOT-FOR-US: pacman package manager for arch, different from src:pacman
@@ -1255,8 +1264,9 @@ CVE-2019-9658 (Checkstyle before 8.18 loads external DTDs
by default. ...)
CVE-2019-9657
RESERVED
CVE-2019-9656 (An issue was discovered in LibOFX 0.9.14. There is a NULL
pointer dere ...)
- - libofx <unfixed> (bug #924350)
+ - libofx <unfixed> (unimportant; bug #924350)
NOTE: https://github.com/libofx/libofx/issues/22
+ NOTE: Negligible security impact
CVE-2019-9655
RESERVED
CVE-2019-9654
@@ -1365,6 +1375,7 @@ CVE-2019-9638 (An issue was discovered in the EXIF
component in PHP before 7.1.2
CVE-2019-9633 (gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a
parent ...)
[experimental] - glib2.0 2.59.2-1
- glib2.0 <unfixed> (bug #924344)
+ [stretch] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/glib/issues/1649
NOTE:
https://gitlab.gnome.org/GNOME/glib/commit/d553d92d6e9f53cbe5a34166fcb919ba652c6a8e
(2.59.2)
CVE-2019-9632 (ESAFENET CDG V3 and V5 has an arbitrary file download
vulnerability vi ...)
@@ -1488,7 +1499,8 @@ CVE-2019-9580 (In st2web in StackStorm Web UI before
2.9.3 and 2.10.x before 2.1
CVE-2019-9579
RESERVED
CVE-2019-9578 (In devs.c in Yubico libu2f-host before 1.1.8, the response to
init is ...)
- - libu2f-host 1.1.9-1 (bug #923874)
+ - libu2f-host 1.1.9-1 (low; bug #923874)
+ [stretch] - libu2f-host <no-dsa> (Minor issue)
NOTE:
https://github.com/Yubico/libu2f-host/commit/e4bb58cc8b6202a421e65f8230217d8ae6e16eb5
CVE-2019-9577
RESERVED
@@ -2484,6 +2496,7 @@ CVE-2018-20796 (In the GNU C Library (aka glibc or libc6)
through 2.29, check_ds
CVE-2009-5155 (In the GNU C Library (aka glibc or libc6) before 2.28,
parse_reg_exp i ...)
[experimental] - gnulib 20180621~6979c25-1
- gnulib 20140202+stable-3.2 (bug #924613)
+ [stretch] - gnulib <no-dsa> (Minor issue)
- glibc 2.28-1
[stretch] - glibc <no-dsa> (Minor issue)
[jessie] - glibc <no-dsa> (Minor issue)
@@ -2807,69 +2820,82 @@ CVE-2019-9040 (S-CMS PHP v3.0 has a CSRF vulnerability
to add a new admin user v
CVE-2019-9039
RESERVED
CVE-2019-9038 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9037 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9036 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
NOTE: Not completely fixed with the initial two commits, cf.
NOTE: https://github.com/tbeu/matio/issues/103#issuecomment-472020538 ff
CVE-2019-9035 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9034 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9033 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9032 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9031 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9030 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9029 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9028 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9027 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
CVE-2019-9026 (An issue was discovered in libmatio.a in matio (aka MAT File
I/O Libra ...)
- - libmatio <unfixed> (bug #924185)
+ - libmatio <unfixed> (low; bug #924185)
+ [stretch] - libmatio <no-dsa> (Minor issue)
NOTE: https://github.com/tbeu/matio/issues/103
NOTE:
https://github.com/tbeu/matio/commit/a0539135c9b1ab7613aa7953279da9224da88775
NOTE:
https://github.com/tbeu/matio/commit/2c20d2178017b3eb13ab160cef239648f9915bdb
@@ -5642,10 +5668,12 @@ CVE-2019-7735
CVE-2019-7734
RESERVED
CVE-2019-7733 (In Live555 0.95, there is a buffer overflow via a large integer
in a C ...)
- - liblivemedia <unfixed>
+ - liblivemedia <unfixed> (low)
+ [stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE: https://github.com/rgaufman/live555/issues/21
CVE-2019-7732 (In Live555 0.95, a setup packet can cause a memory leak leading
to DoS ...)
- - liblivemedia <unfixed>
+ - liblivemedia <unfixed> (low)
+ [stretch] - liblivemedia <no-dsa> (Minor issue)
NOTE: https://github.com/rgaufman/live555/issues/20
CVE-2019-7731 (MyWebSQL 3.7 has a remote code execution (RCE) vulnerability
after an ...)
NOT-FOR-US: MyWebSQL
@@ -5875,7 +5903,8 @@ CVE-2019-7650
RESERVED
CVE-2019-7653 (The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2
has CL ...)
{DLA-1717-1}
- - rdflib 4.2.2-2 (bug #921751)
+ - rdflib 4.2.2-2 (low; bug #921751)
+ [stretch] - rdflib <no-dsa> (Minor issue)
NOTE: Debian specific issue as respective scripts are overwritten in
Debian
NOTE: packaging as wrappers invoking python -m.
CVE-2019-7649 (global.encryptPassword in bootstrap/global.js in CMSWing 1.3.7
relies ...)
@@ -21942,7 +21971,7 @@ CVE-2018-19873 (An issue was discovered in Qt before
5.11.3. QBmpHandler has a b
NOTE:
https://github.com/qt/qtbase/commit/621ab8ab59901cc3f9bd98be709929c9eac997a8
CVE-2018-19872 (An issue was discovered in Qt 5.11. A malformed PPM image
causes a div ...)
- qtbase-opensource-src 5.11.2+dfsg-3 (low)
- [stretch] - qtimageformats-opensource-src <no-dsa> (Minor issue)
+ [stretch] - qtbase-opensource-src <no-dsa> (Minor issue)
NOTE: https://bugreports.qt.io/browse/QTBUG-69449
TODO: check if affects qt4-x11 as well
CVE-2018-19871 (An issue was discovered in Qt before 5.11.3. There is QTgaFile
Uncontr ...)
@@ -26916,6 +26945,7 @@ CVE-2018-19121 (An issue has been found in libIEC61850
v1.3. It is a SEGV in Eth
CVE-2018-19141 (Open Ticket Request System (OTRS) 4.0.x before 4.0.33 and
5.0.x before ...)
{DLA-1592-1}
- otrs2 6.0.1-1
+ [stretch] - otrs2 <no-dsa> (Non-free not supported)
NOTE:
https://community.otrs.com/security-advisory-2018-09-security-update-for-otrs-framework/
NOTE: Only the 4.x and 5.x series are affected (and possibly earlier
versions).
NOTE: Add workaround and mark first 6.x version as fixing version
@@ -26927,6 +26957,7 @@ CVE-2018-19142 (Open Ticket Request System (OTRS) 6.0.x
before 6.0.13 allows an
CVE-2018-19143 (Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x
before 5. ...)
{DLA-1592-1}
- otrs2 6.0.13-1
+ [stretch] - otrs2 <no-dsa> (Non-free not supported)
NOTE:
https://community.otrs.com/security-advisory-2018-07-security-update-for-otrs-framework/
CVE-2018-19120 (The HTML thumbnailer plugin in KDE Applications before 18.12.0
allows ...)
- kio-extras 4:18.08.3-1 (bug #913595)
=====================================
data/dsa-needed.txt
=====================================
@@ -17,6 +17,8 @@ If needed, specify the release by adding a slash after the
name of the source pa
--
drupal7
--
+evolution
+--
faad2
not yet fixed upstream
--
@@ -37,6 +39,8 @@ libidn
libpng1.6
wait for final patch
--
+libssh2
+--
linux
Wait until more issues have piled up
--
@@ -52,6 +56,8 @@ openjdk-8 (jmm)
--
passenger (carnil)
--
+pdns
+--
simplesamlphp
--
smarty3
@@ -66,3 +72,5 @@ wireshark
--
wordpress
--
+xen
+--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/448cc3d08c01e2cec750d3c37946c3b7445b81fa
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/448cc3d08c01e2cec750d3c37946c3b7445b81fa
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
