Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 3fb3389b by security tracker role at 2024-07-02T20:12:14+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,183 @@ +CVE-2024-6452 (A vulnerability classified as critical was found in linlinjava litemal ...) + TODO: check +CVE-2024-6441 (A vulnerability was found in ORIPA up to 1.72. It has been declared as ...) + TODO: check +CVE-2024-6440 (A vulnerability was found in SourceCodester Home Owners Collection Man ...) + TODO: check +CVE-2024-6439 (A vulnerability was found in SourceCodester Home Owners Collection Man ...) + TODO: check +CVE-2024-6438 (A vulnerability has been found in Hitout Carsale 1.0 and classified as ...) + TODO: check +CVE-2024-6382 (Incorrect handling of certain string inputs may result in MongoDB Rust ...) + TODO: check +CVE-2024-6381 (The bson_strfreev function in the MongoDB C driver library may be susc ...) + TODO: check +CVE-2024-6341 + REJECTED +CVE-2024-6264 (The Post Meta Data Manager plugin for WordPress is vulnerable to Store ...) + TODO: check +CVE-2024-6099 (The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vul ...) + TODO: check +CVE-2024-6088 (The LearnPress \u2013 WordPress LMS Plugin plugin for WordPress is vul ...) + TODO: check +CVE-2024-6012 (The Cost Calculator Builder plugin for WordPress is vulnerable to unau ...) + TODO: check +CVE-2024-6011 (The Cost Calculator Builder plugin for WordPress is vulnerable to Stor ...) + TODO: check +CVE-2024-5866 (Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The ...) + TODO: check +CVE-2024-5865 (Vulnerability in Delinea Centrify PAS v. 21.3 and possibly others. The ...) + TODO: check +CVE-2024-5260 (The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data T ...) + TODO: check +CVE-2024-4897 (parisneo/lollms-webui, in its latest version, is vulnerable to remote ...) + TODO: check +CVE-2024-4836 (Web services managed by Edito CMS (Content Management System) in versi ...) + TODO: check +CVE-2024-4467 (A flaw was found in the QEMU disk image utility (qemu-img) 'info' comm ...) + TODO: check +CVE-2024-4268 (The Ultimate Blocks \u2013 WordPress Blocks Plugin plugin for WordPres ...) + TODO: check +CVE-2024-3826 (In versions of Akana in versions prior to and including 2022.1.3 valid ...) + TODO: check +CVE-2024-39894 (OpenSSH 9.5 through 9.7 before 9.8 sometimes allows timing attacks aga ...) + TODO: check +CVE-2024-39891 (In the Twilio Authy API, accessed by Authy Android before 25.1.0 and A ...) + TODO: check +CVE-2024-39323 (aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Sta ...) + TODO: check +CVE-2024-39316 (Rack is a modular Ruby web server interface. Starting in version 3.1.0 ...) + TODO: check +CVE-2024-39315 (Pomerium is an identity and context-aware access proxy. Prior to versi ...) + TODO: check +CVE-2024-39206 (An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 all ...) + TODO: check +CVE-2024-39143 (A stored cross-site scripting (XSS) vulnerability exists in ResidenceC ...) + TODO: check +CVE-2024-39119 (idccms v1.35 was discovered to contain a Cross-Site Request Forgery (C ...) + TODO: check +CVE-2024-38857 (Improper neutralization of input in Checkmk before versions 2.3.0p8, 2 ...) + TODO: check +CVE-2024-38537 (Fides is an open-source privacy engineering platform. `fides.js`, a cl ...) + TODO: check +CVE-2024-38519 (`yt-dlp` is a command-line audio/video downloader. Prior to version 20 ...) + TODO: check +CVE-2024-37185 (in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbit ...) + TODO: check +CVE-2024-37077 (in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbit ...) + TODO: check +CVE-2024-37030 (in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbit ...) + TODO: check +CVE-2024-36404 (GeoTools is an open source Java library that provides tools for geospa ...) + TODO: check +CVE-2024-36278 (in OpenHarmony v4.0.0 and prior versions allow a local attacker cause ...) + TODO: check +CVE-2024-36260 (in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbit ...) + TODO: check +CVE-2024-36243 (in OpenHarmony v4.0.0 and prior versions allow a remote attacker arbit ...) + TODO: check +CVE-2024-34601 (Improper verification of intent by broadcast receiver vulnerability in ...) + TODO: check +CVE-2024-34600 (Improper verification of intent by broadcast receiver vulnerability in ...) + TODO: check +CVE-2024-34599 (Improper input validation in Tips prior to version 6.2.9.4 in Android ...) + TODO: check +CVE-2024-34597 (Improper input validation in Samsung Health prior to version 6.27.0.11 ...) + TODO: check +CVE-2024-34596 (Improper authentication in SmartThings prior to version 1.8.17 allows ...) + TODO: check +CVE-2024-34595 (Improper access control in clickAdapterItem of SystemUI prior to SMR J ...) + TODO: check +CVE-2024-34594 (Exposure of sensitive information in proc file system prior to SMR Jul ...) + TODO: check +CVE-2024-34593 (Improper input validation in parsing and distributing RTCP packet in l ...) + TODO: check +CVE-2024-34592 (Improper input validation in parsing RTCP SDES packet in librtp.so pri ...) + TODO: check +CVE-2024-34591 (Improper input validation in parsing an item data from RTCP SDES packe ...) + TODO: check +CVE-2024-34590 (Improper input validation\ud63bin parsing an item type from RTCP SDES ...) + TODO: check +CVE-2024-34589 (Improper input validation in parsing RTCP RR packet in librtp.so prior ...) + TODO: check +CVE-2024-34588 (Improper input validation\ud63bin parsing RTCP SR packet in librtp.so ...) + TODO: check +CVE-2024-34587 (Improper input validation in parsing application information from RTCP ...) + TODO: check +CVE-2024-34586 (Improper access control in KnoxCustomManagerService prior to SMR Jul-2 ...) + TODO: check +CVE-2024-34585 (Improper access control in launchApp of SystemUI prior to SMR Jul-2024 ...) + TODO: check +CVE-2024-34584 (Improper privilege management in SumeNNService prior to SMR Jul-2024 R ...) + TODO: check +CVE-2024-34583 (Improper access control in system property prior to SMR Jul-2024 Relea ...) + TODO: check +CVE-2024-34122 (Acrobat for Edge versions 126.0.2592.68 and earlier are affected by an ...) + TODO: check +CVE-2024-32932 (Under certain circumstances the web interface users credentials may be ...) + TODO: check +CVE-2024-32757 (Under certain circumstances unnecessary user details are provided with ...) + TODO: check +CVE-2024-32756 (Under certain circumstances the Linux users credentials may be recover ...) + TODO: check +CVE-2024-32755 (Under certain circumstances the web interface will accept characters u ...) + TODO: check +CVE-2024-31071 (in OpenHarmony v4.0.0 and prior versions allow a local attacker cause ...) + TODO: check +CVE-2024-26314 (Improper privilege management in Jungo WinDriver 6.0.0 through 16.1.0 ...) + TODO: check +CVE-2024-25088 (Improper privilege management in Jungo WinDriver before 12.5.1 allows ...) + TODO: check +CVE-2024-25087 (Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.7.0 ...) + TODO: check +CVE-2024-25086 (Improper privilege management in Jungo WinDriver before 12.2.0 allows ...) + TODO: check +CVE-2024-22106 (Improper privilege management in Jungo WinDriver before 12.5.1 allows ...) + TODO: check +CVE-2024-22105 (Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.5.1 ...) + TODO: check +CVE-2024-22104 (Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.5.1 all ...) + TODO: check +CVE-2024-22103 (Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.6.0 all ...) + TODO: check +CVE-2024-22102 (Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.6.0 ...) + TODO: check +CVE-2024-20901 (Improper input validation in copying data to buffer cache in libsaped ...) + TODO: check +CVE-2024-20900 (Improper authentication in MTP application prior to SMR Jul-2024 Relea ...) + TODO: check +CVE-2024-20899 (Use of implicit intent for sensitive communication in RCS function in ...) + TODO: check +CVE-2024-20898 (Use of implicit intent for sensitive communication in SoftphoneClient ...) + TODO: check +CVE-2024-20897 (Use of implicit intent for sensitive communication in FCM function in ...) + TODO: check +CVE-2024-20896 (Use of implicit intent for sensitive communication in Configuration me ...) + TODO: check +CVE-2024-20895 (Improper access control in Dar service prior to SMR Jul-2024 Release 1 ...) + TODO: check +CVE-2024-20894 (Improper handling of exceptional conditions in Secure Folder prior to ...) + TODO: check +CVE-2024-20893 (Improper input validation in libmediaextractorservice.so prior to SMR ...) + TODO: check +CVE-2024-20892 (Improper verification of signature in FilterProvider prior to SMR Jul- ...) + TODO: check +CVE-2024-20891 (Improper access control in launchFullscreenIntent of SystemUI prior to ...) + TODO: check +CVE-2024-20890 (Improper input validation in BLE prior to SMR Jul-2024 Release 1 allow ...) + TODO: check +CVE-2024-20889 (Improper authentication in BLE prior to SMR Jul-2024 Release 1 allows ...) + TODO: check +CVE-2024-20888 (Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 a ...) + TODO: check +CVE-2023-51778 (Out-of-Bounds Write vulnerability in Jungo WinDriver before 12.1.0 all ...) + TODO: check +CVE-2023-51777 (Denial of Service (DoS) vulnerability in Jungo WinDriver before 12.1.0 ...) + TODO: check +CVE-2023-51776 (Improper privilege management in Jungo WinDriver before 12.1.0 allows ...) + TODO: check +CVE-2023-39324 + REJECTED CVE-2024-32498 [OSSA-2024-001: Arbitrary file access through custom QCOW2 external data] - cinder <unfixed> (bug #1074763) - glance 2:28.0.1-3+deb12u1 (bug #1074761) @@ -1267,7 +1447,8 @@ CVE-2024-39371 (In the Linux kernel, the following vulnerability has been resolv [bullseye] - linux <not-affected> (Vulnerable code not present) [buster] - linux <not-affected> (Vulnerable code not present) NOTE: https://git.kernel.org/linus/5fc16fa5f13b3c06fdb959ef262050bd810416a2 (6.10-rc3) -CVE-2024-39362 (In the Linux kernel, the following vulnerability has been resolved: i ...) +CVE-2024-39362 + REJECTED - linux 6.9.7-1 NOTE: https://git.kernel.org/linus/3f858bbf04dbac934ac279aaee05d49eb9910051 (6.10-rc1) CVE-2024-39301 (In the Linux kernel, the following vulnerability has been resolved: n ...) @@ -1963,7 +2144,8 @@ CVE-2024-38621 (In the Linux kernel, the following vulnerability has been resolv - linux 6.9.7-1 [bookworm] - linux 6.1.94-1 NOTE: https://git.kernel.org/linus/faa4364bef2ec0060de381ff028d1d836600a381 (6.10-rc1) -CVE-2024-38391 (In the Linux kernel, the following vulnerability has been resolved: c ...) +CVE-2024-38391 + REJECTED - linux 6.9.7-1 [bookworm] - linux <not-affected> (Vulnerable code not present) [bullseye] - linux <not-affected> (Vulnerable code not present) @@ -12333,7 +12515,8 @@ CVE-2021-47284 (In the Linux kernel, the following vulnerability has been resolv - linux 5.10.46-1 [buster] - linux 4.19.208-1 NOTE: https://git.kernel.org/linus/9f6f852550d0e1b7735651228116ae9d300f69b3 (5.13-rc4) -CVE-2021-47285 (In the Linux kernel, the following vulnerability has been resolved: n ...) +CVE-2021-47285 + REJECTED - linux 5.10.46-1 [buster] - linux 4.19.208-1 NOTE: https://git.kernel.org/linus/8ab78863e9eff11910e1ac8bcf478060c29b379e (5.13-rc4) @@ -108989,8 +109172,8 @@ CVE-2023-24532 (The ScalarMult and ScalarBaseMult methods of the P256 Curve may NOTE: https://go-review.googlesource.com/c/go/+/471256 NOTE: https://github.com/golang/go/commit/602eeaab387f24a4b28c5eccbb50fa934f3bc3c4 (go1.20.2) NOTE: https://github.com/golang/go/commit/639b67ed114151c0d786aa26e7faeab942400703 (go1.19.7) -CVE-2023-24531 - RESERVED +CVE-2023-24531 (Command go env is documented as outputting a shell script containing t ...) + TODO: check CVE-2023-24473 (An information disclosure vulnerability exists in the TGAInput::read_t ...) [experimental] - openimageio 2.4.9.0+dfsg-1 - openimageio 2.4.13.0+dfsg-1 (bug #1034150) @@ -137424,7 +137607,7 @@ CVE-2022-38091 CVE-2022-3429 (A denial-of-service vulnerability was found in the firmware used in Le ...) NOT-FOR-US: Lenovo CVE-2022-3428 - RESERVED + REJECTED CVE-2022-3427 (The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request ...) NOT-FOR-US: Corner Ad plugin for WordPress CVE-2022-3426 (The Advanced WP Columns WordPress plugin through 2.0.6 does not saniti ...) @@ -139508,17 +139691,17 @@ CVE-2022-41732 (IBM Maximo Mobile 8.7 and 8.8 stores user credentials in plain c CVE-2022-41731 (IBM Watson Knowledge Catalog on Cloud Pak for Data 4.5.0 is vulnerable ...) NOT-FOR-US: IBM CVE-2022-41730 - RESERVED + REJECTED CVE-2022-41729 - RESERVED + REJECTED CVE-2022-41728 - RESERVED + REJECTED CVE-2022-41727 (An attacker can craft a malformed TIFF image which will consume a sign ...) - golang-golang-x-image 0.5.0-1 [bullseye] - golang-golang-x-image <no-dsa> (Minor issue) [buster] - golang-golang-x-image <postponed> (Limited support, minor issue, DoS) CVE-2022-41726 - RESERVED + REJECTED CVE-2022-41725 (A denial of service is possible from excessive resource consumption in ...) - golang-1.20 1.20.1-1 [experimental] - golang-1.19 1.19.6-1 @@ -139581,7 +139764,7 @@ CVE-2022-41720 (On Windows, restricted files can be accessed via os.DirFS and ht CVE-2022-41719 (Unmarshal can panic on some inputs, possibly allowing for denial of se ...) NOT-FOR-US: shamaton/msgpack CVE-2022-41718 - RESERVED + REJECTED CVE-2022-41717 (An attacker can cause excessive memory growth in a Go server accepting ...) - golang-1.19 1.19.4-1 - golang-1.18 1.18.9-1 @@ -165527,7 +165710,7 @@ CVE-2022-32193 (Couchbase Server 6.6.x through 7.x before 7.0.4 exposes Sensitiv CVE-2022-32192 (Couchbase Server 5.x through 7.x before 7.0.4 exposes Sensitive Inform ...) NOT-FOR-US: Couchbase Server CVE-2022-32191 - RESERVED + REJECTED CVE-2022-32190 (JoinPath and URL.JoinPath do not remove ../ path elements appended to ...) - golang-1.19 1.19.1-1 - golang-1.18 <not-affected> (Vulnerable code introduced in 1.19) @@ -165655,7 +165838,7 @@ CVE-2022-32148 (Improper exposure of client IP addresses in net/http before Go 1 NOTE: https://github.com/golang/go/commit/ebea1e3353fa766025aa5190b9c7cc05cf069187 (go1.18.4) NOTE: https://github.com/golang/go/commit/ed2f33e1a7e0d18f61bd56f7ee067331d612c27e (go1.17.12) CVE-2022-32147 - RESERVED + REJECTED CVE-2022-32146 RESERVED CVE-2022-32145 (A vulnerability has been identified in Teamcenter Active Workspace V5. ...) @@ -170061,8 +170244,8 @@ CVE-2022-30638 (Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and NOT-FOR-US: Adobe CVE-2022-30637 (Adobe Illustrator versions 26.0.2 (and earlier) and 25.4.5 (and earlie ...) NOT-FOR-US: Adobe -CVE-2022-30636 - RESERVED +CVE-2022-30636 (httpTokenCacheKey uses path.Base to extract the expected HTTP-01 token ...) + TODO: check CVE-2022-30635 (Uncontrolled recursion in Decoder.Decode in encoding/gob before Go 1.1 ...) - golang-1.19 1.19~rc2-1 - golang-1.18 1.18.4-1 @@ -185323,14 +185506,14 @@ CVE-2022-25482 RESERVED CVE-2022-25481 (ThinkPHP Framework v5.0.24 was discovered to be configured without the ...) NOT-FOR-US: ThinkPHP Framework -CVE-2022-25480 - RESERVED -CVE-2022-25479 - RESERVED -CVE-2022-25478 - RESERVED -CVE-2022-25477 - RESERVED +CVE-2022-25480 (Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sy ...) + TODO: check +CVE-2022-25479 (Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sy ...) + TODO: check +CVE-2022-25478 (Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sy ...) + TODO: check +CVE-2022-25477 (Vulnerability in Realtek RtsPer driver for PCIe Card Reader (RtsPer.sy ...) + TODO: check CVE-2022-25476 RESERVED CVE-2022-25475 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3fb3389b1a083792594e44970dab5f2da94e51b2 -- This project does not include diff previews in email notifications. View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3fb3389b1a083792594e44970dab5f2da94e51b2 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits