Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 57e21f6b by security tracker role at 2019-11-01T08:10:12Z automatic update - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,5 @@ +CVE-2019-18658 + RESERVED CVE-2019-18657 (ClickHouse before 19.13.5.44 allows HTTP header injection via the url ...) NOT-FOR-US: ClickHouse CVE-2019-18656 (Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBu ...) @@ -771,7 +773,7 @@ CVE-2019-18410 CVE-2019-18409 (The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local pr ...) NOT-FOR-US: ruby_parser-legacy packaging issue CVE-2019-18408 (archive_read_format_rar_read_data in archive_read_support_format_rar.c ...) - {DLA-1971-1} + {DSA-4557-1 DLA-1971-1} - libarchive 3.4.0-1 NOTE: https://github.com/libarchive/libarchive/commit/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60 NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14689 @@ -797,8 +799,8 @@ CVE-2019-18398 RESERVED CVE-2019-18397 RESERVED -CVE-2019-18396 - RESERVED +CVE-2019-18396 (An issue was discovered in certain Oi third-party firmware that may be ...) + TODO: check CVE-2019-18395 RESERVED CVE-2019-18394 (A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.j ...) @@ -1036,6 +1038,7 @@ CVE-2019-18283 CVE-2019-18282 RESERVED CVE-2019-18281 (An out-of-bounds memory access in the generateDirectionalRuns() functi ...) + {DSA-4556-1} - qtbase-opensource-src-gles 5.12.5+dfsg-1 - qtbase-opensource-src 5.12.5+dfsg-2 [buster] - qtbase-opensource-src <no-dsa> (Minor issue) @@ -1148,16 +1151,16 @@ CVE-2019-18232 RESERVED CVE-2019-18231 RESERVED -CVE-2019-18230 - RESERVED -CVE-2019-18229 - RESERVED -CVE-2019-18228 - RESERVED -CVE-2019-18227 - RESERVED -CVE-2019-18226 - RESERVED +CVE-2019-18230 (Honeywell equIP and Performance series IP cameras, multiple versions, ...) + TODO: check +CVE-2019-18229 (Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitizati ...) + TODO: check +CVE-2019-18228 (Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vul ...) + TODO: check +CVE-2019-18227 (Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilitie ...) + TODO: check +CVE-2019-18226 (Honeywell equIP series and Performance series IP cameras and recorders ...) + TODO: check CVE-2019-18225 (An issue was discovered in Citrix Application Delivery Controller (ADC ...) NOT-FOR-US: Citrix CVE-2019-18224 (idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a hea ...) @@ -5240,10 +5243,10 @@ CVE-2019-16909 RESERVED CVE-2019-16908 RESERVED -CVE-2019-16907 - RESERVED -CVE-2019-16906 - RESERVED +CVE-2019-16907 (An issue was discovered in the Infosysta "In-App & Desktop Notific ...) + TODO: check +CVE-2019-16906 (An issue was discovered in the Infosysta "In-App & Desktop Notific ...) + TODO: check CVE-2019-16905 (OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an expe ...) - openssh 1:8.1p1-1 (unimportant) [stretch] - openssh <not-affected> (Vulnerable code introduced later) @@ -5881,8 +5884,8 @@ CVE-2019-16676 (Plataformatec Simple Form has Incorrect Access Control in file_m NOTE: http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676/ NOTE: https://github.com/plataformatec/simple_form/commit/8c91bd76a5052ddf3e3ab9fd8333f9aa7b2e2dd6 NOTE: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx -CVE-2019-16675 - RESERVED +CVE-2019-16675 (An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Wo ...) + TODO: check CVE-2019-16674 RESERVED CVE-2019-16673 @@ -6843,8 +6846,8 @@ CVE-2019-16297 RESERVED CVE-2019-16296 RESERVED -CVE-2019-16295 - RESERVED +CVE-2019-16295 (Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS ...) + TODO: check CVE-2019-16294 (SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote ...) NOT-FOR-US: Notepad++ CVE-2019-16293 (The Create Discoveries feature of Open-AudIT before 3.2.0 allows an au ...) @@ -8601,8 +8604,8 @@ CVE-2019-15712 RESERVED CVE-2019-15711 RESERVED -CVE-2019-15710 - RESERVED +CVE-2019-15710 (An OS command injection vulnerability in FortiExtender 4.1.1 and below ...) + TODO: check CVE-2019-15709 RESERVED CVE-2019-15708 @@ -16304,16 +16307,16 @@ CVE-2019-13553 (Rittal Chiller SK 3232-Series web interface as built upon Carel NOT-FOR-US: Rittal Chiller SK 3232-Series CVE-2019-13552 (In WebAccess versions 8.4.1 and prior, multiple command injection vuln ...) NOT-FOR-US: WebAccess -CVE-2019-13551 - RESERVED +CVE-2019-13551 (Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vul ...) + TODO: check CVE-2019-13550 (In WebAccess, versions 8.4.1 and prior, an improper authorization vuln ...) NOT-FOR-US: WebAccess CVE-2019-13549 (Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb ...) NOT-FOR-US: Rittal Chiller SK 3232-Series CVE-2019-13548 (CODESYS V3 web server, all versions prior to 3.5.14.10, allows an atta ...) NOT-FOR-US: CODESYS -CVE-2019-13547 - RESERVED +CVE-2019-13547 (Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecu ...) + TODO: check CVE-2019-13546 (In IntelliSpace Perinatal, Versions K and prior, a vulnerability withi ...) NOT-FOR-US: IntelliSpace Perinatal CVE-2019-13545 (In Horner Automation Cscape 9.90 and prior, improper validation of dat ...) @@ -16391,8 +16394,8 @@ CVE-2019-13510 (Rockwell Automation Arena Simulation Software versions 16.00.00 CVE-2019-13509 (In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06. ...) {DSA-4521-1} - docker.io 18.09.1+dfsg1-8 (bug #932673) -CVE-2019-13508 - RESERVED +CVE-2019-13508 (FreeTDS through 1.1.11 has a Buffer Overflow. ...) + TODO: check CVE-2019-13507 (hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection. ...) NOT-FOR-US: hidea.com AZ Admin CVE-2019-13506 (@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandle ...) @@ -39616,10 +39619,10 @@ CVE-2019-5153 RESERVED CVE-2019-5152 RESERVED -CVE-2019-5151 - RESERVED -CVE-2019-5150 - RESERVED +CVE-2019-5151 (An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A ...) + TODO: check +CVE-2019-5150 (An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. Wh ...) + TODO: check CVE-2019-5149 RESERVED CVE-2019-5148 @@ -39728,8 +39731,8 @@ CVE-2019-5097 RESERVED CVE-2019-5096 RESERVED -CVE-2019-5095 - RESERVED +CVE-2019-5095 (An issue summary information disclosure vulnerability exists in Atlass ...) + TODO: check CVE-2019-5094 (An exploitable code execution vulnerability exists in the quota file f ...) {DSA-4535-1 DLA-1935-1} - e2fsprogs 1.45.4-1 (bug #941139) @@ -39876,8 +39879,8 @@ CVE-2019-5051 (An exploitable heap-based buffer overflow vulnerability exists wh NOTE: https://hg.libsdl.org/SDL_image/rev/e7e9786a1a34 CVE-2019-5050 (A specifically crafted PDF file can lead to a heap corruption when ope ...) NOT-FOR-US: NitroPDF -CVE-2019-5049 - RESERVED +CVE-2019-5049 (An exploitable memory corruption vulnerability exists in AMD ATIDXX64. ...) + TODO: check CVE-2019-5048 (A specifically crafted PDF file can lead to a heap corruption when ope ...) NOT-FOR-US: NitroPDF CVE-2019-5047 (An exploitable Use After Free vulnerability exists in the CharProcs pa ...) @@ -39888,8 +39891,8 @@ CVE-2019-5045 (A specifically crafted jpeg2000 file embedded in a PDF file can l NOT-FOR-US: NitroPDF CVE-2019-5044 REJECTED -CVE-2019-5043 - RESERVED +CVE-2019-5043 (An exploitable denial-of-service vulnerability exists in the Weave dae ...) + TODO: check CVE-2019-5042 (An exploitable Use-After-Free vulnerability exists in the way Function ...) NOT-FOR-US: Aspose CVE-2019-5041 (An exploitable Stack Based Buffer Overflow vulnerability exists in the ...) @@ -39914,8 +39917,8 @@ CVE-2019-5032 (An exploitable out-of-bounds read vulnerability exists in the Lab NOT-FOR-US: Aspose CVE-2019-5031 (An exploitable memory corruption vulnerability exists in the JavaScrip ...) NOT-FOR-US: Foxit PDF Reader -CVE-2019-5030 - RESERVED +CVE-2019-5030 (A buffer overflow vulnerability exists in the PowerPoint document conv ...) + TODO: check CVE-2019-5029 RESERVED CVE-2019-5028 @@ -39928,8 +39931,8 @@ CVE-2019-5025 REJECTED CVE-2019-5024 (A restricted environment escape vulnerability exists in the "kiosk mod ...) NOT-FOR-US: Capsule Technologies SmartLinx Neuron -CVE-2019-5023 - RESERVED +CVE-2019-5023 (An exploitable vulnerability exists in the grsecurity PaX patch for th ...) + TODO: check CVE-2019-5022 REJECTED CVE-2019-5021 (Versions of the Official Alpine Linux Docker images (since v3.3) conta ...) @@ -39963,8 +39966,7 @@ CVE-2019-5012 (An exploitable privilege escalation vulnerability exists in the W NOT-FOR-US: Wacom MacOS driver CVE-2019-5011 (An exploitable privilege escalation vulnerability exists in the helper ...) NOT-FOR-US: CleanMyMac -CVE-2019-5010 [NULL pointer dereference using a specially crafted X509 certificate] - RESERVED +CVE-2019-5010 (An exploitable denial-of-service vulnerability exists in the X509 cert ...) {DLA-1834-1 DLA-1663-1} - python3.7 3.7.2-2 (bug #921064) - python3.6 <removed> (bug #921063) @@ -96327,8 +96329,8 @@ CVE-2018-4066 (An exploitable cross-site request forgery vulnerability exists in NOT-FOR-US: Sierra Wireless AirLink ES450 firmware CVE-2018-4065 (An exploitable cross-site scripting vulnerability exists in the ACEMan ...) NOT-FOR-US: Sierra Wireless AirLink ES450 firmware -CVE-2018-4064 - RESERVED +CVE-2018-4064 (An exploitable unverified password change vulnerability exists in the ...) + TODO: check CVE-2018-4063 (An exploitable remote code execution vulnerability exists in the uploa ...) NOT-FOR-US: Sierra Wireless AirLink ES450 firmware CVE-2018-4062 (A hard-coded credentials vulnerability exists in the snmpd function of ...) @@ -96396,8 +96398,8 @@ CVE-2018-4033 (The CleanMyMac X software contains an exploitable privilege escal NOT-FOR-US: Clean My Mac X CVE-2018-4032 (An exploitable privilege escalation vulnerability exists in the way th ...) NOT-FOR-US: Clean My Mac X -CVE-2018-4031 - RESERVED +CVE-2018-4031 (An exploitable vulnerability exists in the safe browsing function of t ...) + TODO: check CVE-2018-4030 (An exploitable vulnerability exists the safe browsing function of the ...) NOT-FOR-US: CUJO Smart Firewall CVE-2018-4029 (An exploitable code execution vulnerability exists in the HTTP request ...) @@ -96461,8 +96463,8 @@ CVE-2018-4004 (An exploitable privilege escalation vulnerability exists in the S NOT-FOR-US: Shimo VPN CVE-2018-4003 (An exploitable heap overflow vulnerability exists in the mdnscap binar ...) NOT-FOR-US: CUJO Smart Firewall -CVE-2018-4002 - RESERVED +CVE-2018-4002 (An exploitable denial-of-service vulnerability exists in the mdnscap b ...) + TODO: check CVE-2018-4001 (An exploitable uninitialized pointer vulnerability exists in the Offic ...) NOT-FOR-US: Atlantis Word Processor CVE-2018-4000 (An exploitable double-free vulnerability exists in the Office Open XML ...) @@ -96499,8 +96501,8 @@ CVE-2018-3985 (An exploitable double free vulnerability exists in the mdnscap bi NOT-FOR-US: CUJO Smart Firewall CVE-2018-3984 (An exploitable uninitialized length vulnerability exists within the Wo ...) NOT-FOR-US: Atlantis Word Processor -CVE-2018-3983 - RESERVED +CVE-2018-3983 (An exploitable uninitialized pointer vulnerability exists in the Word ...) + TODO: check CVE-2018-3982 (An exploitable arbitrary write vulnerability exists in the Word docume ...) NOT-FOR-US: Atlantis Word Processor CVE-2018-3981 (An exploitable out-of-bounds write exists in the TIFF-parsing function ...) @@ -254842,8 +254844,7 @@ CVE-2013-2076 (Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, on - xen 4.2.2-1 [squeeze] - xen <end-of-life> (Unsupported in squeeze-lts) NOTE: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00002.html -CVE-2013-2075 - RESERVED +CVE-2013-2075 (Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-r ...) - chicken <not-affected> (Incomplete fix was never applied) CVE-2013-2074 (kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows att ...) {DLA-952-1} @@ -255009,8 +255010,7 @@ CVE-2013-2026 REJECTED CVE-2013-2025 (Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x th ...) NOT-FOR-US: Ushahidi -CVE-2013-2024 [OS command injection vulnerability in Chicken Scheme] - RESERVED +CVE-2013-2024 (OS command injection vulnerability in the "qs" procedure from the "uti ...) - chicken 4.8.0.3-1 (bug #706525) [wheezy] - chicken <no-dsa> (Minor issue) [squeeze] - chicken <no-dsa> (Minor issue) @@ -255069,8 +255069,7 @@ CVE-2013-2013 (The user-password-update command in python-keystoneclient before [wheezy] - python-keystoneclient 2012.1-3+deb7u1 NOTE: https://bugs.launchpad.net/python-keystoneclient/+bug/938315 NOTE: https://review.openstack.org/28702 -CVE-2013-2012 [autojump profile will load random stuff from a directory called custom_install] - RESERVED +CVE-2013-2012 (autojump before 21.5.8 allows local users to gain privileges via a Tro ...) - autojump <not-affected> (vulnerable code not present for unstable) NOTE: experimental affected as per 21.5.1-1, see #706252 NOTE: experimental fixed as 21.5.1-2 @@ -255267,8 +255266,7 @@ CVE-2013-1953 (Integer underflow in the input_bmp_reader function in input-bmp.c CVE-2013-1952 (Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, ...) {DSA-2666-1} - xen 4.1.4-4 -CVE-2013-1951 - RESERVED +CVE-2013-1951 (A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 ...) - mediawiki 1:1.19.5-1 [squeeze] - mediawiki <end-of-life> CVE-2013-1950 (The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remot ...) @@ -255284,8 +255282,7 @@ CVE-2013-1947 (kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attac NOT-FOR-US: Ruby Gem kelredd-pruview CVE-2013-1946 (The RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.3 and 7. ...) NOT-FOR-US: RESTful Web Services (RESTWS) Drupal cotributed module -CVE-2013-1945 - RESERVED +CVE-2013-1945 (ruby193 uses an insecure LD_LIBRARY_PATH setting. ...) NOT-FOR-US: Red Hat specific packaging flaw of Ruby in Red Hat OpenShift Enterprise CVE-2013-1944 (The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 d ...) {DSA-2660-1} @@ -261529,23 +261526,19 @@ CVE-2012-6127 REJECTED CVE-2012-6126 REJECTED -CVE-2012-6125 - RESERVED +CVE-2012-6125 (Chicken before 4.8.0 is susceptible to algorithmic complexity attacks ...) - chicken 4.8.0-1 (low; bug #702410) [wheezy] - chicken <no-dsa> (Minor issue) [squeeze] - chicken <no-dsa> (Minor issue) -CVE-2012-6124 - RESERVED +CVE-2012-6124 (A casting error in Chicken before 4.8.0 on 64-bit platform caused the ...) - chicken 4.8.0-1 (low; bug #702410) [wheezy] - chicken <no-dsa> (Minor issue) [squeeze] - chicken <no-dsa> (Minor issue) -CVE-2012-6123 - RESERVED +CVE-2012-6123 (Chicken before 4.8.0 does not properly handle NUL bytes in certain str ...) - chicken 4.8.0-1 (low; bug #702410) [wheezy] - chicken <no-dsa> (Minor issue) [squeeze] - chicken <no-dsa> (Minor issue) -CVE-2012-6122 - RESERVED +CVE-2012-6122 (Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allo ...) - chicken 4.8.0.3-1 (low; bug #702410) [wheezy] - chicken <no-dsa> (Minor issue) [squeeze] - chicken <no-dsa> (Minor issue) @@ -298105,8 +298098,7 @@ CVE-2010-2784 (The subpage MMIO initialization functionality in the subpage_regi - qemu-kvm 0.12.5+dfsg-3 (bug #594478) - kvm <removed> [lenny] - kvm 72+dfsg-5~lenny6 -CVE-2010-2783 - RESERVED +CVE-2010-2783 (IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary ...) - openjdk-6 6b18-1.8.1-1 CVE-2009-4957 (Directory traversal vulnerability in loadpanel.php in Interspire Activ ...) NOT-FOR-US: Interspire ActiveKB @@ -298835,8 +298827,7 @@ CVE-2010-2550 (The SMB Server in Microsoft Windows XP SP2 and SP3, Windows Serve NOT-FOR-US: Microsoft CVE-2010-2549 (Use-after-free vulnerability in the kernel-mode drivers in Microsoft W ...) NOT-FOR-US: Microsoft -CVE-2010-2548 - RESERVED +CVE-2010-2548 (IcedTea6 before 1.7.4 does not properly check property access, which a ...) - openjdk-6 6b18-1.8.1-1 CVE-2010-2547 (Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2. ...) {DSA-2076-1} View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/57e21f6b626d8371a9ce2e966dde854218274943 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/57e21f6b626d8371a9ce2e966dde854218274943 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits