Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: f27c42fb by Salvatore Bonaccorso at 2020-11-26T08:23:20+01:00 Track drupal7 as well under CVE-2020-2894{8,9} The drupal project seems to reuse the CVes as well for the respective affecting issues in the drupal code base. Follow that for now. - - - - - 4a6a446f by Salvatore Bonaccorso at 2020-11-26T08:24:32+01:00 DLA-2644: Reference CVE-2020-28948 and CVE-2020-28949 - - - - - 2 changed files: - data/CVE/list - data/DLA/list Changes: ===================================== data/CVE/list ===================================== @@ -270,14 +270,18 @@ CVE-2020-28950 RESERVED CVE-2020-28949 (Archive_Tar through 1.4.10 has :// filename sanitization only to addre ...) {DLA-2465-1} + - drupal7 <removed> - php-pear <unfixed> NOTE: https://github.com/pear/Archive_Tar/issues/33 NOTE: https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da + NOTE: https://www.drupal.org/sa-core-2020-013 CVE-2020-28948 (Archive_Tar through 1.4.10 allows an unserialization attack because ph ...) {DLA-2465-1} + - drupal7 <removed> - php-pear <unfixed> NOTE: https://github.com/pear/Archive_Tar/issues/33 NOTE: https://github.com/pear/Archive_Tar/commit/0670a05fdab997036a3fc3ef113b8f5922e574da + NOTE: https://www.drupal.org/sa-core-2020-013 CVE-2020-28947 (In MISP 2.4.134, XSS exists in the template element index view because ...) NOT-FOR-US: MISP CVE-2020-28946 ===================================== data/DLA/list ===================================== @@ -1,4 +1,5 @@ [26 Nov 2020] DLA-2466-1 drupal7 - security update + {CVE-2020-28948 CVE-2020-28949} [stretch] - drupal7 7.52-2+deb9u13 [23 Nov 2020] DLA-2465-1 php-pear - security update {CVE-2020-28948 CVE-2020-28949} View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/2160a66d1e01901eccdf917e0acb0dc81d9c9671...4a6a446f0c1f609b787acde256a5852988ac2f91 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/2160a66d1e01901eccdf917e0acb0dc81d9c9671...4a6a446f0c1f609b787acde256a5852988ac2f91 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits