Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits: 195e5fce by Moritz Muehlenhoff at 2024-08-16T14:05:18+02:00 bookworm triage - - - - - 2 changed files: - data/CVE/list - data/dsa-needed.txt Changes: ===================================== data/CVE/list ===================================== @@ -731,6 +731,7 @@ CVE-2024-20082 (In Modem, there is a possible memory corruption due to a missing NOT-FOR-US: Mediatek CVE-2024-7730 - qemu <unfixed> + [bookworm] - qemu <no-dsa> (Minor issue) NOTE: https://lore.kernel.org/qemu-devel/virtio-snd-fuzz-2427-fix-v1-manos.pitsidiana...@linaro.org/ NOTE: https://gitlab.com/qemu-project/qemu/-/issues/2427 NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/98e77e3dd8dd6e7aa9a7dffa60f49c8c8a49d4e3 (v9.1.0-rc0) @@ -2168,6 +2169,7 @@ CVE-2024-7317 (The Folders \u2013 Unlimited Folders to Organize Media Library Fo NOT-FOR-US: WordPress plugin CVE-2024-7246 (It's possible for a gRPC client communicating with a HTTP/2 proxy to p ...) - grpc <unfixed> + [bookworm] - grpc <no-dsa> (Minor issue) NOTE: https://github.com/grpc/grpc/issues/36245 NOTE: Fixed in 1.58.3, 1.59.5, 1.60.2, 1.61.3, 1.62.3, 1.63.2, 1.64.3, 1.65.4. CVE-2024-6720 (The Light Poll WordPress plugin through 1.0.0 does not have CSRF check ...) @@ -12030,7 +12032,7 @@ CVE-2024-34142 (Adobe Experience Manager versions 6.5.20 and earlier are affecte CVE-2024-34141 (Adobe Experience Manager versions 6.5.20 and earlier are affected by a ...) NOT-FOR-US: Adobe CVE-2024-32111 (Improper Limitation of a Pathname to a Restricted Directory ('Path Tra ...) - - wordpress 6.5.5+dfsg1-1 (bug #1074486) + - wordpress <not-affected> (Only affects Windows systems) NOTE: https://wordpress.org/news/2024/06/wordpress-6-5-5/ CVE-2024-31111 (Improper Neutralization of Input During Web Page Generation (XSS or 'C ...) - wordpress 6.5.5+dfsg1-1 (bug #1074486) @@ -67518,6 +67520,7 @@ CVE-2023-43364 (main.py in Searchor before 2.4.2 uses eval on CLI input, which m NOT-FOR-US: Searchor CVE-2023-41337 (h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In ...) - h2o <unfixed> (bug #1059413) + [bookworm] - h2o <no-dsa> (Minor issue) NOTE: https://github.com/h2o/h2o/security/advisories/GHSA-5v5r-rghf-rm6q NOTE: Fixed by: https://github.com/h2o/h2o/commit/35760540337a47e5150da0f4a66a609fad2ef0ab CVE-2023-38694 (Umbraco is an ASP.NET content management system (CMS). Starting in ver ...) @@ -78693,6 +78696,7 @@ CVE-2023-44487 (The HTTP/2 protocol allows a denial of service (server resource [bullseye] - grpc <no-dsa> (Minor issue) [buster] - grpc <no-dsa> (Minor issue) - h2o 2.2.5+dfsg2-8 (bug #1054232) + [bookworm] - h2o <no-dsa> (Minor issue) - haproxy 1.8.13-1 - nginx 1.24.0-2 (unimportant; bug #1053770) - nghttp2 1.57.0-1 (bug #1053769) ===================================== data/dsa-needed.txt ===================================== @@ -11,6 +11,8 @@ To pick an issue, simply add your uid behind it. If needed, specify the release by adding a slash after the name of the source package. +-- +aom (jmm) -- cacti Bastien Roucariès is proposing to work on a update and agreed on it with maintainer @@ -25,8 +27,7 @@ dnsmasq Lee Garrett showed interest to prepare an update for review -- frr - Tobias Frost (tobi) proposed to work on preparing an update, but discussion - with Debian maintainer for status on bullseye + updates + coordination with the maintainer ongoing -- ghostscript (carnil) -- @@ -37,10 +38,8 @@ git glance Maintainer prepared updates for review -- -h2o (jmm) --- libreswan - Waiting on feedback from maintainer, proposal to EOL Bullseye + Waiting on feedback from maintainer -- linux (carnil) Wait until more issues have piled up, though try to regulary rebase for point View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/195e5fce977fdbd73a6e3bf716abf90f21144645 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/195e5fce977fdbd73a6e3bf716abf90f21144645 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits