Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
cb013a22 by security tracker role at 2022-07-28T20:10:21+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,27 @@
+CVE-2022-37013
+ RESERVED
+CVE-2022-37012
+ RESERVED
+CVE-2022-37011
+ RESERVED
+CVE-2022-37010 (In JetBrains IntelliJ IDEA before 2022.2 email address
validation in t ...)
+ TODO: check
+CVE-2022-37009 (In JetBrains IntelliJ IDEA before 2022.2 local code execution
via a Va ...)
+ TODO: check
+CVE-2022-2569
+ RESERVED
+CVE-2022-2568
+ RESERVED
+CVE-2022-2567
+ RESERVED
+CVE-2022-2566
+ RESERVED
+CVE-2022-2565
+ RESERVED
+CVE-2022-2564 (Prototype Pollution in GitHub repository automattic/mongoose
prior to ...)
+ TODO: check
+CVE-2022-2563
+ RESERVED
CVE-2022-37008
RESERVED
CVE-2022-37007
@@ -211,8 +235,8 @@ CVE-2022-2555
RESERVED
CVE-2022-2554
RESERVED
-CVE-2022-2553
- RESERVED
+CVE-2022-2553 (The authfile directive in the booth config file is ignored,
preventing ...)
+ TODO: check
CVE-2022-2552
RESERVED
- booth <unfixed>
@@ -1385,8 +1409,8 @@ CVE-2022-36284
RESERVED
CVE-2022-36282
RESERVED
-CVE-2022-35882
- RESERVED
+CVE-2022-35882 (Authenticated (author or higher user role) Stored Cross-Site
Scripting ...)
+ TODO: check
CVE-2022-34868
RESERVED
CVE-2022-34867
@@ -1429,8 +1453,7 @@ CVE-2022-36372
RESERVED
CVE-2022-36367
RESERVED
-CVE-2022-36364
- RESERVED
+CVE-2022-36364 (Apache Calcite Avatica JDBC driver creates HTTP client
instances based ...)
NOT-FOR-US: Apache Calcite
CVE-2022-36298
RESERVED
@@ -2691,6 +2714,7 @@ CVE-2022-2417
CVE-2022-2416
RESERVED
CVE-2022-2415 (Heap buffer overflow in WebGL in Google Chrome prior to
103.0.5060.53 ...)
+ {DSA-5168-1}
- chromium 103.0.5060.53-1
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2022-35873 (This vulnerability allows remote attackers to execute
arbitrary code o ...)
@@ -12935,8 +12959,7 @@ CVE-2022-31815
RESERVED
CVE-2022-31814
RESERVED
-CVE-2022-1948
- RESERVED
+CVE-2022-1948 (An issue has been discovered in GitLab affecting all versions
starting ...)
- gitlab <not-affected> (Vulnerable code introduced later)
NOTE:
https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/
CVE-2022-1947 (Use of Incorrect Operator in GitHub repository polonel/trudesk
prior t ...)
@@ -14738,8 +14761,8 @@ CVE-2022-31241
RESERVED
CVE-2022-31240
RESERVED
-CVE-2022-1805
- RESERVED
+CVE-2022-1805 (When connecting to Amazon Workspaces, the SHA256 presented by
AWS conn ...)
+ TODO: check
CVE-2022-1804
RESERVED
CVE-2022-1803 (Improper Restriction of Rendered UI Layers or Frames in GitHub
reposit ...)
@@ -17495,22 +17518,22 @@ CVE-2022-1616 (Use after free in append_command in
GitHub repository vim/vim pri
[buster] - vim <no-dsa> (Minor issue)
NOTE: https://huntr.dev/bounties/40f1d75f-fb2f-4281-b585-a41017f217e2
NOTE:
https://github.com/vim/vim/commit/d88934406c5375d88f8f1b65331c9f0cab68cc6c
(v8.2.4895)
-CVE-2022-30320
- RESERVED
-CVE-2022-30319
- RESERVED
+CVE-2022-30320 (Saia Burgess Controls (SBC) PCD through 2022-05-06 uses a
Broken or Ri ...)
+ TODO: check
+CVE-2022-30319 (Saia Burgess Controls (SBC) PCD through 2022-05-06 allows
Authenticati ...)
+ TODO: check
CVE-2022-30318
RESERVED
CVE-2022-30317
RESERVED
-CVE-2022-30316
- RESERVED
-CVE-2022-30315
- RESERVED
-CVE-2022-30314
- RESERVED
-CVE-2022-30313
- RESERVED
+CVE-2022-30316 (Honeywell Experion PKS Safety Manager 5.02 has Insufficient
Verificati ...)
+ TODO: check
+CVE-2022-30315 (Honeywell Experion PKS Safety Manager (SM and FSC) through
2022-05-06 ...)
+ TODO: check
+CVE-2022-30314 (Honeywell Experion PKS Safety Manager 5.02 uses Hard-coded
Credentials ...)
+ TODO: check
+CVE-2022-30313 (Honeywell Experion PKS Safety Manager through 2022-05-06 has
Missing A ...)
+ TODO: check
CVE-2022-30312
RESERVED
CVE-2022-30311 (In Festo Controller CECC-X-M1 product family in multiple
versions, the ...)
@@ -25512,14 +25535,14 @@ CVE-2022-27616
RESERVED
CVE-2022-27615 (Improper limitation of a pathname to a restricted directory
('Path Tra ...)
NOT-FOR-US: Synology
-CVE-2022-27614
- RESERVED
-CVE-2022-27613
- RESERVED
-CVE-2022-27612
- RESERVED
-CVE-2022-27611
- RESERVED
+CVE-2022-27614 (Exposure of sensitive information to an unauthorized actor
vulnerabili ...)
+ TODO: check
+CVE-2022-27613 (Improper neutralization of special elements used in an SQL
command ('S ...)
+ TODO: check
+CVE-2022-27612 (Buffer copy without checking size of input ('Classic Buffer
Overflow') ...)
+ TODO: check
+CVE-2022-27611 (Improper limitation of a pathname to a restricted directory
('Path Tra ...)
+ TODO: check
CVE-2022-27610 (Improper limitation of a pathname to a restricted directory
('Path Tra ...)
NOT-FOR-US: Synology
CVE-2022-27609 (Forcepoint One Endpoint prior to version 22.01 installed on
Microsoft ...)
@@ -25725,8 +25748,8 @@ CVE-2022-27511 (Corruption of the system by a remote,
unauthenticated user. The
NOT-FOR-US: Citrix
CVE-2022-27510
RESERVED
-CVE-2022-27509
- RESERVED
+CVE-2022-27509 (Unauthenticated redirection to a malicious website ...)
+ TODO: check
CVE-2022-27508
RESERVED
CVE-2022-27507
@@ -41494,12 +41517,12 @@ CVE-2022-22687 (Buffer copy without checking size of
input ('Classic Buffer Over
NOT-FOR-US: Synology DiskStation Manager
CVE-2022-22686 (Cross-Site Request Forgery (CSRF) vulnerability in webapi
component in ...)
NOT-FOR-US: Synology
-CVE-2022-22685
- RESERVED
-CVE-2022-22684
- RESERVED
-CVE-2022-22683
- RESERVED
+CVE-2022-22685 (Improper limitation of a pathname to a restricted directory
('Path Tra ...)
+ TODO: check
+CVE-2022-22684 (Improper neutralization of special elements used in an OS
command ('OS ...)
+ TODO: check
+CVE-2022-22683 (Buffer copy without checking size of input ('Classic Buffer
Overflow') ...)
+ TODO: check
CVE-2022-22682 (Improper neutralization of input during web page generation
('Cross-si ...)
NOT-FOR-US: Synology
CVE-2022-22681 (Session fixation vulnerability in access control management in
Synolog ...)
@@ -107521,28 +107544,28 @@ CVE-2021-22652 (Access to the Advantech iView
versions prior to v5.7.03.6112 con
NOT-FOR-US: Advantech iView
CVE-2021-22651 (When loading a specially crafted file, Luxion KeyShot versions
prior t ...)
NOT-FOR-US: Luxion
-CVE-2021-22650
- RESERVED
+CVE-2021-22650 (An attacker may use TWinSoft and a malicious source project
file (TPG) ...)
+ TODO: check
CVE-2021-22649 (Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer
versions ...)
NOT-FOR-US: Luxion KeyShot
-CVE-2021-22648
- RESERVED
+CVE-2021-22648 (Ovarro TBox proprietary Modbus file access functions allow
attackers t ...)
+ TODO: check
CVE-2021-22647 (Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer
versions ...)
NOT-FOR-US: Luxion KeyShot
-CVE-2021-22646
- RESERVED
+CVE-2021-22646 (The “ipk” package containing the configuration
created by ...)
+ TODO: check
CVE-2021-22645 (Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer
versions ...)
NOT-FOR-US: Luxion KeyShot
-CVE-2021-22644
- RESERVED
+CVE-2021-22644 (Ovarro TBox TWinSoft uses the custom hardcoded user
“TWinSoft ...)
+ TODO: check
CVE-2021-22643 (Luxion KeyShot versions prior to 10.1, Luxion KeyShot Viewer
versions ...)
NOT-FOR-US: Luxion KeyShot
-CVE-2021-22642
- RESERVED
+CVE-2021-22642 (An attacker could use specially crafted invalid Modbus frames
to crash ...)
+ TODO: check
CVE-2021-22641 (A heap-based buffer overflow issue has been identified in the
way the ...)
NOT-FOR-US: Fuji Electric
-CVE-2021-22640
- RESERVED
+CVE-2021-22640 (An attacker can decrypt the Ovarro TBox login password by
communicatio ...)
+ TODO: check
CVE-2021-22639 (An uninitialized pointer issue has been identified in the way
the appl ...)
NOT-FOR-US: Fuji Electric
CVE-2021-22638 (Fatek FvDesigner Version 1.5.76 and prior is vulnerable to an
out-of-b ...)
@@ -367104,7 +367127,7 @@ CVE-2016-7050 (SerializableProvider in RESTEasy in
Red Hat Enterprise Linux Desk
NOTE: The SerializableProvider has been disabled by default in 3.0.17
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1378613
CVE-2016-7049
- RESERVED
+ REJECTED
CVE-2016-7048 (The interactive installer in PostgreSQL before 9.3.15, 9.4.x
before 9. ...)
NOT-FOR-US: interactive installer used in EnterpriseDB-supplied
PostgreSQL packages
CVE-2016-7047 (A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1
and 5.8 ...)
@@ -367178,7 +367201,7 @@ CVE-2016-7030 (FreeIPA uses a default password policy
that locks an account afte
NOTE: Upstream patch:
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=6f1d92746
NOTE: Additional dependency:
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=73f33569c
CVE-2016-7029
- RESERVED
+ REJECTED
CVE-2016-7027
REJECTED
CVE-2016-7026
@@ -369346,14 +369369,14 @@ CVE-2016-6327
(drivers/infiniband/ulp/srpt/ib_srpt.c in the Linux kernel before
NOTE: Fixed by:
https://git.kernel.org/linus/51093254bf879bc9ce96590400a87897c7498463 (4.6-rc1)
NOTE: Introduced by:
https://git.kernel.org/linus/3e4f574857eebce60bb56d7524f3f9eaa2a126d0 (v3.8-rc1)
CVE-2016-6326
- RESERVED
+ REJECTED
CVE-2016-6325 (The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through
7, JBo ...)
- tomcat8 <not-affected> (Red Hat and derivatives packaging specific)
- tomcat7 <not-affected> (Red Hat and derivatives packaging specific)
- tomcat6 <not-affected> (Red Hat and derivatives packaging specific)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1367447
CVE-2016-6324
- RESERVED
+ REJECTED
CVE-2016-6323 (The makecontext function in the GNU C Library (aka glibc or
libc6) bef ...)
- glibc 2.24-1 (bug #834752)
[jessie] - glibc 2.19-18+deb8u6
@@ -369390,9 +369413,9 @@ CVE-2016-6316 (Cross-site scripting (XSS)
vulnerability in Action View in Ruby o
- ruby-actionpack-3.2 <removed>
NOTE:
https://github.com/rails/rails/commit/4bcccf5ecd81a6272479537911b7d9760c5be164
CVE-2016-6315
- RESERVED
+ REJECTED
CVE-2016-6314
- RESERVED
+ REJECTED
CVE-2016-6313 (The mixing functions in the random number generator in
Libgcrypt befor ...)
{DSA-3650-1 DSA-3649-1 DLA-602-1 DLA-600-1}
- gnupg2 <not-affected> (Uses system libgcrypt)
@@ -372359,7 +372382,7 @@ CVE-2016-5430 (The RSA 1.5 algorithm implementation
in the JOSE_JWE class in JWE
CVE-2016-5429 (jose-php before 2.2.1 does not use constant-time operations for
HMAC c ...)
NOT-FOR-US: jose-php
CVE-2016-5428
- RESERVED
+ REJECTED
CVE-2016-5427 (PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not
proper ...)
{DSA-3664-1 DLA-627-1}
- pdns 4.0.0~alpha1-1
@@ -372446,13 +372469,13 @@ CVE-2016-5416 (389 Directory Server in Red Hat
Enterprise Linux Desktop 6 throug
NOTE: https://github.com/389ds/389-ds-base/issues/1912
NOTE: Potentially related: https://fedorahosted.org/389/ticket/48354
CVE-2016-5415
- RESERVED
+ REJECTED
CVE-2016-5414 (FreeIPA 4.4.0 allows remote attackers to request an arbitrary
SAN name ...)
- freeipa <not-affected> (Vulnerable code introduced in the 4.4.0
release)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1360757
NOTE:
https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=25ed36fda14b30d6a50746a536939e3b428993cb
CVE-2016-5413
- RESERVED
+ REJECTED
CVE-2016-5412 (arch/powerpc/kvm/book3s_hv_rmhandlers.S in the Linux kernel
through 4. ...)
- linux 4.7.2-1
[jessie] - linux 3.16.39-1
@@ -374456,8 +374479,8 @@ CVE-2016-4992 (389 Directory Server in Red Hat
Enterprise Linux Desktop 6 throug
- 389-ds-base 1.3.5.13-1
[jessie] - 389-ds-base <no-dsa> (Minor issue)
NOTE:
http://directory.fedoraproject.org/docs/389ds/releases/release-1-3-5-13.html
-CVE-2016-4991
- RESERVED
+CVE-2016-4991 (Input passed to the Pdf() function is shell escaped and passed
to chil ...)
+ TODO: check
CVE-2016-4990
REJECTED
CVE-2016-4989 (setroubleshoot allows local users to bypass an intended
container prot ...)
@@ -376161,7 +376184,7 @@ CVE-2016-4460 (Apache Pony Mail 0.6c through 0.8b
allows remote attackers to byp
CVE-2016-4459 (Stack-based buffer overflow in native/mod_manager/node.c in
mod_cluste ...)
- libapache2-mod-cluster <itp> (bug #731410)
CVE-2016-4458
- RESERVED
+ REJECTED
CVE-2016-4457 (CloudForms Management Engine before 5.8 includes a default
SSL/TLS cer ...)
NOT-FOR-US: Red Hat CloudForms
CVE-2016-4455 (The Subscription Manager package (aka subscription-manager)
before 1.1 ...)
@@ -376183,7 +376206,7 @@ CVE-2016-4453 (The vmsvga_fifo_run function in
hw/display/vmware_vga.c in QEMU a
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg05270.html
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1336650
CVE-2016-4452
- RESERVED
+ REJECTED
CVE-2016-4451 (The (1) Organization and (2) Locations APIs in Foreman before
1.11.3 a ...)
- foreman <itp> (bug #663101)
CVE-2016-4450 (os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before
1.11.1 al ...)
@@ -376276,10 +376299,10 @@ CVE-2016-4428 (Cross-site scripting (XSS)
vulnerability in OpenStack Dashboard (
{DSA-3617-1 DLA-520-1}
- horizon 3:9.0.1-2 (bug #828967)
NOTE: https://bugs.launchpad.net/bugs/1567673
-CVE-2016-4427
- RESERVED
-CVE-2016-4426
- RESERVED
+CVE-2016-4427 (In zulip before 1.3.12, deactivated users could access messages
if SSO ...)
+ TODO: check
+CVE-2016-4426 (In zulip before 1.3.12, bot API keys were accessible to other
users in ...)
+ TODO: check
CVE-2016-4424
RESERVED
CVE-2016-4423 (The attemptAuthentication function in
Component/Security/Http/Firewall ...)
@@ -378208,7 +378231,7 @@ CVE-2016-3731 (Moodle 3.0 through 3.0.3, 2.9 through
2.9.5, and 2.8 through 2.8.
- moodle <not-affected> (Does only affect 2.8 and newer)
NOTE:
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53696
CVE-2016-3730
- RESERVED
+ REJECTED
CVE-2016-3729 (The user editing form in Moodle 3.0 through 3.0.3, 2.9 through
2.9.5, ...)
- moodle 2.7.14+dfsg-1
NOTE:
http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-53954
@@ -378298,8 +378321,8 @@ CVE-2016-3710 (The VGA module in QEMU improperly
performs bounds checking on ban
NOTE: Xen switched to qemu-system in 4.4.0-1
NOTE: http://xenbits.xen.org/xsa/advisory-179.html
NOTE: mitigation: run HVM in stubdomains, PV, default video card not
vulnerable, i386-only
-CVE-2016-3709
- RESERVED
+CVE-2016-3709 (Possible cross-site scripting vulnerability in libxml after
commit 960 ...)
+ TODO: check
CVE-2016-3708 (Red Hat OpenShift Enterprise 3.2, when multi-tenant SDN is
enabled and ...)
NOT-FOR-US: OpenShiftEnterprise / Red Hat
CVE-2016-3707 (The icmp_check_sysrq function in net/ipv4/icmp.c in the
kernel.org pro ...)
@@ -378326,9 +378349,9 @@ CVE-2016-3703 (Red Hat OpenShift Enterprise 3.2 and
3.1 do not properly validate
CVE-2016-3702 (Padding oracle flaw in CloudForms Management Engine (aka CFME)
5 allow ...)
NOT-FOR-US: Red Hat CloudForms Management Engine
CVE-2016-3701
- RESERVED
+ REJECTED
CVE-2016-3700
- RESERVED
+ REJECTED
CVE-2016-3699 (The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and
Red Hat ...)
- linux <not-affected> (Fixed before we first included the securelevel
patchset)
NOTE:
https://github.com/mjg59/linux/commit/a4a5ed2835e8ea042868b7401dced3f517cafa76
@@ -378355,7 +378378,7 @@ CVE-2016-3694 (Multiple SQL injection vulnerabilities
in modified eCommerce Shop
CVE-2016-3693 (The Safemode gem before 1.2.4 for Ruby, when initialized with a
delega ...)
- foreman <itp> (bug #663101)
CVE-2016-3692
- RESERVED
+ REJECTED
CVE-2016-3691 (Routes in Kallithea before 0.3.2 allows remote attackers to
bypass the ...)
- kallithea <itp> (bug #689573)
CVE-2016-3690 (The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote
attack ...)
@@ -383220,10 +383243,10 @@ CVE-2016-2140 (The libvirt driver in OpenStack
Compute (Nova) before 2015.1.4 (k
[jessie] - nova <no-dsa> (Minor issue)
[wheezy] - nova <no-dsa> (Minor issue)
NOTE: Affects: <=2015.1.3, >=12.0.0 <=12.0.2
-CVE-2016-2139
- RESERVED
-CVE-2016-2138
- RESERVED
+CVE-2016-2139 (In kippo-graph before version 1.5.1, there is a cross-site
scripting v ...)
+ TODO: check
+CVE-2016-2138 (In kippo-graph before version 1.5.1, there is a cross-site
scripting v ...)
+ TODO: check
CVE-2016-2137
REJECTED
CVE-2016-2136
@@ -383268,7 +383291,7 @@ CVE-2016-2123 (A flaw was found in samba versions
4.0.0 to 4.5.2. The Samba rout
[wheezy] - samba <not-affected> (Affects only Samba 4.0.0 to 4.5.2)
NOTE: https://www.samba.org/samba/security/CVE-2016-2123.html
CVE-2016-2122
- RESERVED
+ REJECTED
CVE-2016-2121 (A permissions flaw was found in redis, which sets weak
permissions on ...)
- redis 3:3.2.5-2 (bug #842987)
[jessie] - redis <no-dsa> (Minor issue)
@@ -383356,7 +383379,7 @@ CVE-2016-2103 (Multiple cross-site scripting (XSS)
vulnerabilities in Red Hat Sa
CVE-2016-2102 (HAProxy statistics in openstack-tripleo-image-elements are
non-authent ...)
- tripleo-image-elements <not-affected> (Configuration not found in
Debian's version)
CVE-2016-2101
- RESERVED
+ REJECTED
CVE-2016-2100 (Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote
authen ...)
- foreman <itp> (bug #663101)
CVE-2016-2099 (Use-after-free vulnerability in validators/DTD/DTDScanner.cpp
in Apach ...)
@@ -388139,8 +388162,8 @@ CVE-2016-0797 (Multiple integer overflows in OpenSSL
1.0.1 before 1.0.1s and 1.0
- openssl 1.0.2g-1
NOTE: https://www.openssl.org/news/secadv/20160301.txt
NOTE: Fixed in master in
https://git.openssl.org/?p=openssl.git;a=commit;h=99ba9fd02fd481eb971023a3a0a251a37eb87e4c
-CVE-2016-0796
- RESERVED
+CVE-2016-0796 (WordPress Plugin mb.miniAudioPlayer-an HTML5 audio player for
your mp3 ...)
+ TODO: check
CVE-2016-0795 (LibreOffice before 5.0.5 allows remote attackers to cause a
denial of ...)
{DSA-3482-1}
- libreoffice 1:5.0.5~rc1-1
@@ -388172,7 +388195,7 @@ CVE-2016-0787 (The diffie_hellman_sha256 function in
kex.c in libssh2 before 1.7
NOTE: Upstream fix:
https://github.com/libssh2/libssh2/commit/ca5222ea819cc5ed797860070b4c6c1aeeb28420
NOTE: Upstream patch only fixes DH SHA-256 key exchange type, not DH
SHA-1
CVE-2016-0786
- RESERVED
+ REJECTED
CVE-2016-0785 (Apache Struts 2.x before 2.3.28 allows remote attackers to
execute arb ...)
- libstruts1.2-java <not-affected> (Only 2.0.0 to 2.3.28.1)
NOTE: http://struts.apache.org/docs/s2-029.html
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cb013a2280065e426c8d09b2528229e72cae99ef
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cb013a2280065e426c8d09b2528229e72cae99ef
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
