[Git][security-tracker-team/security-tracker][master] Add CVE-2020-706{1,2,3}/php issues
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1bfe14b6 by Salvatore Bonaccorso at 2020-02-28T06:50:42+01:00
Add CVE-2020-706{1,2,3}/php issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -5343,10 +5343,28 @@ CVE-2020-7064
RESERVED
CVE-2020-7063
RESERVED
+ - php7.4 7.4.3-1
+ - php7.3 7.3.15-1
+ - php7.0
+ - php5
+ NOTE: Fixed in PHP 7.4.3, 7.3.15, 7.2.28
+ NOTE: PHP Bug: http://bugs.php.net/79082
CVE-2020-7062
RESERVED
+ - php7.4 7.4.3-1
+ - php7.3 7.3.15-1
+ - php7.0
+ - php5
+ NOTE: Fixed in PHP 7.4.3, 7.3.15, 7.2.28
+ NOTE: PHP Bug: http://bugs.php.net/79221
CVE-2020-7061
RESERVED
+ - php7.4 7.4.3-1
+ - php7.3 7.3.15-1
+ - php7.0
+ - php5
+ NOTE: Fixed in PHP 7.4.3, 7.3.15
+ NOTE: PHP Bug: http://bugs.php.net/79171
CVE-2020-7060 (When using certain mbstring functions to convert multibyte
encodings, ...)
{DSA-4628-1 DSA-4626-1}
- php7.4 7.4.2-7
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1bfe14b6e83bd6c66ae048aab54f63bf86dd408a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1bfe14b6e83bd6c66ae048aab54f63bf86dd408a
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add assigned CVEs for wireshark
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 5c5dd026 by Salvatore Bonaccorso at 2020-02-28T06:42:13+01:00 Add assigned CVEs for wireshark - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -2,24 +2,35 @@ CVE-2020-9420 RESERVED CVE-2020-9419 RESERVED -CVE-2020- [LTE RRC dissector memory leak] +CVE-2020-9431 [LTE RRC dissector memory leak] - wireshark 3.2.2-1 [jessie] - wireshark (Minor issue, can be fixed along in next DLA) NOTE: https://www.wireshark.org/security/wnpa-sec-2020-03.html -CVE-2020- [WiMax DLMAP dissector crash] + NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16341 + NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=086003c9d616906e08bbeeab9c17b3aa4c6ff850 +CVE-2020-9430 [WiMax DLMAP dissector crash] - wireshark 3.2.2-1 [jessie] - wireshark (Minor issue, can be fixed along in next DLA) NOTE: https://www.wireshark.org/security/wnpa-sec-2020-04.html -CVE-2020- [EAP dissector crash] + NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16368 + NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16383 + NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=6b98dc63701b1da1cc7681cb383dabb0b7007d73 + NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=93d6b03a67953b82880cdbdcf0d30e2a3246d790 +CVE-2020-9428 [EAP dissector crash] - wireshark 3.2.2-1 [jessie] - wireshark (Minor issue, can be fixed along in next DLA) NOTE: https://www.wireshark.org/security/wnpa-sec-2020-05.html -CVE-2020- [WireGuard dissector crash] + NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16397 + NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=9fe2de783dbcbe74144678d60a4e3923367044b2 +CVE-2020-9429 [WireGuard dissector crash] - wireshark 3.2.2-1 [buster] - wireshark (Vulnerable code not present) [stretch] - wireshark (Vulnerable code not present) [jessie] - wireshark (Vulnerable code not present) NOTE: https://www.wireshark.org/security/wnpa-sec-2020-06.html + NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16394 + NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=73c5fff899f253c44a72657048aec7db6edee571 + NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=a2530f740d67d41908e84434bb5ec99480c2ac2e CVE-2020-9418 RESERVED CVE-2020-9417 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c5dd0269d1ed35b7ecf0a808a90be1dde9dbe54 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c5dd0269d1ed35b7ecf0a808a90be1dde9dbe54 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reserve DLA-2123-1 for pure-ftpd
Roberto C. Sánchez pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
27445bec by Roberto C. Sánchez at 2020-02-27T18:54:56-05:00
Reserve DLA-2123-1 for pure-ftpd
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[27 Feb 2020] DLA-2123-1 pure-ftpd - security update
+ {CVE-2020-9274}
+ [jessie] - pure-ftpd 1.0.36-3.2+deb8u1
[27 Feb 2020] DLA-2122-1 libusbmuxd - security update
{CVE-2016-5104}
[jessie] - libusbmuxd 1.0.9-1+deb8u1
=
data/dla-needed.txt
=
@@ -64,8 +64,6 @@ php5 (Thorsten Alteholz)
phppgadmin
NOTE: 20200218: no fix yet; wide usage
--
-pure-ftpd (Roberto C. Sánchez)
---
qemu (Utkarsh Gupta)
NOTE: 20200223: WIP.
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/27445bec3b7b76e69bde809742538bdb0a34855a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/27445bec3b7b76e69bde809742538bdb0a34855a
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] update notes on CVE-2020-9274/pure-ftpd
Roberto C. Sánchez pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ef8e3564 by Roberto C. Sánchez at 2020-02-27T18:31:49-05:00
update notes on CVE-2020-9274/pure-ftpd
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -362,8 +362,10 @@ CVE-2020-9275
CVE-2020-9274 (An issue was discovered in Pure-FTPd 1.0.49. An uninitialized
pointer ...)
- pure-ftpd 1.0.49-4 (bug #952666)
NOTE:
https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
- NOTE: though the CVE description does not specifically say, the issue
seems to be a heap out-of-bounds read
- NOTE: probably not the end of the world, but it is made worse by use of
the rather unsafe strcmp() instead of strncmp() in the vulnerable functions
+ NOTE: though the CVE description does not specifically say, the issue
seems to be an
+ NOTE: out-of-bounds memory read which may result in information
disclosure;
+ NOTE: probably not the end of the world, but it is made worse by use of
the rather
+ NOTE: unsafe strcmp() instead of strncmp() in the vulnerable functions
CVE-2020-9273 (In ProFTPD 1.3.7, it is possible to corrupt the memory pool by
interru ...)
{DSA-4635-1 DLA-2115-1}
- proftpd-dfsg 1.3.6c-1 (bug #951800)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ef8e356471d8d32e15f7a590d76b91ccfd0af502
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ef8e356471d8d32e15f7a590d76b91ccfd0af502
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] update notes on CVE-2020-9274/pure-ftpd
Roberto C. Sánchez pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d691cbad by Roberto C. Sánchez at 2020-02-27T17:14:35-05:00
update notes on CVE-2020-9274/pure-ftpd
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -362,6 +362,8 @@ CVE-2020-9275
CVE-2020-9274 (An issue was discovered in Pure-FTPd 1.0.49. An uninitialized
pointer ...)
- pure-ftpd 1.0.49-4 (bug #952666)
NOTE:
https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
+ NOTE: though the CVE description does not specifically say, the issue
seems to be a heap out-of-bounds read
+ NOTE: probably not the end of the world, but it is made worse by use of
the rather unsafe strcmp() instead of strncmp() in the vulnerable functions
CVE-2020-9273 (In ProFTPD 1.3.7, it is possible to corrupt the memory pool by
interru ...)
{DSA-4635-1 DLA-2115-1}
- proftpd-dfsg 1.3.6c-1 (bug #951800)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d691cbade58a84e3f21ac01363145eac315275b1
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d691cbade58a84e3f21ac01363145eac315275b1
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] 3 commits: Remove doubled note
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: f87193fe by Salvatore Bonaccorso at 2020-02-27T23:06:05+01:00 Remove doubled note - - - - - 7b9943e8 by Salvatore Bonaccorso at 2020-02-27T23:06:53+01:00 Remove no-dsa tagged entry which got an update - - - - - d911927a by Salvatore Bonaccorso at 2020-02-27T23:12:06+01:00 Process several NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -217,8 +217,7 @@ CVE-2020-9336 (fauzantrif eLection 2.0 has XSS via the Admin Dashboard - Set CVE-2020-6802 [mutation XSS vulnerability] RESERVED - python-bleach 3.1.1-1 (bug #951907) - [jessie] - python-bleach (Fix too invasive in jessie) - NOTE: Jessie version uses an external html5 parser making a fix invasive. + [jessie] - python-bleach (Fix too invasive in jessie; uses external html5 parser) NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=1615315 (not public) NOTE: https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r NOTE: https://github.com/mozilla/bleach/commit/f77e0f6392177a06e46a49abd61a4d9f035e57fd @@ -63919,13 +63918,13 @@ CVE-2019-5328 CVE-2019-5327 RESERVED CVE-2019-5326 (An administrative application user of or application user with write a ...) - TODO: check + NOT-FOR-US: Aruba Airwave VisualRF CVE-2019-5325 RESERVED CVE-2019-5324 RESERVED CVE-2019-5323 (There are command injection vulnerabilities present in the AirWave app ...) - TODO: check + NOT-FOR-US: Aruba Airwave CVE-2019-5322 (A remotely exploitable information disclosure vulnerability is present ...) NOT-FOR-US: Edge Switch models CVE-2019-5321 @@ -133871,7 +133870,7 @@ CVE-2017-16902 (On the Vonage VDV-23 115 3.2.11-0.9.40 home router, sending a lo CVE-2017-16901 RESERVED CVE-2017-16900 (Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200 allows the ...) - TODO: check + NOT-FOR-US: Hunesion i-oneNet CVE-2017-16899 (An array index error in the fig2dev program in Xfig 3.2.6a allows remo ...) - fig2dev 1:3.2.6a-5 (bug #881143) [stretch] - fig2dev 1:3.2.6a-2+deb9u1 @@ -199601,7 +199600,6 @@ CVE-2016-5104 (The socket_create function in common/socket.c in libimobiledevice [wheezy] - libimobiledevice (Vulnerable code not present) NOTE: https://github.com/libimobiledevice/libimobiledevice/commit/df1f5c4d70d0c19ad40072f5246ca457e7f9849e - libusbmuxd 1.0.10-3 (bug #825554) - [jessie] - libusbmuxd (Minor issue) NOTE: https://github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991d0aed61ce6482614196 CVE-2016-4552 (Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1 ...) - roundcube 1.2.0+dfsg.1-1 @@ -258440,7 +258438,7 @@ CVE-2014-2729 (Cross-site scripting (XSS) vulnerability in content.aspx in Ektro CVE-2014-2728 RESERVED CVE-2014-2727 (The STARTTLS implementation in MailMarshal before 7.2 allows plaintext ...) - TODO: check + NOT-FOR-US: MailMarshal CVE-2012-6641 (Cross-site scripting (XSS) vulnerability in redirect.php in the Socoli ...) NOT-FOR-US: PrestaShop CVE-2012-6640 (Cross-site scripting (XSS) vulnerability in Horde Internet Mail Progra ...) @@ -259803,7 +259801,7 @@ CVE-2014-2230 (Open redirect vulnerability in the header function in adclick.php CVE-2014-2229 RESERVED CVE-2014-2228 (The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote a ...) - TODO: check + NOT-FOR-US: HP Fortify SCA CVE-2014-2227 (The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Ne ...) NOT-FOR-US: Ubiquiti Networks CVE-2014-2226 (Ubiquiti UniFi Controller before 3.2.1 logs the administrative passwor ...) @@ -275594,7 +275592,7 @@ CVE-2013-3495 (The Intel VT-d Interrupt Remapping engine in Xen 3.3.x through 4. - xen 4.4.1-3 (unimportant) NOTE: Hardware design flaw, no software solution CVE-2013-3494 (A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll ...) - TODO: check + NOT-FOR-US: UMPlayer CVE-2013-3493 (XnView 2.03 has an integer overflow vulnerability ...) NOT-FOR-US: XnView CVE-2013-3492 (XnView 2.03 has a stack-based buffer overflow vulnerability ...) @@ -293809,7 +293807,7 @@ CVE-2012-3553 (chan_skinny.c in the Skinny (aka SCCP) channel driver in Asterisk CVE-2012-3352 RESERVED CVE-2012-3351 (Multiple cross-site scripting (XSS) vulnerabilities in LongTail Video ...) - TODO: check + NOT-FOR-US: LongTail Video JW Player CVE-2012-3350 (SQL injection vulnerability in index.php in Webmatic 3.1.1 allows remo ...) NOT-FOR-US: WebMatic NOTE: http://seclists.org/bugtraq/2012/Jul/25 @@ -295557,7 +29,7 @@ CVE-2012-2631
[Git][security-tracker-team/security-tracker][master] Reserve DLA-2122-1 for libusbmuxd
Dylan Aïssi pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
ffd4520e by Dylan Aïssi at 2020-02-27T23:04:38+01:00
Reserve DLA-2122-1 for libusbmuxd
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[27 Feb 2020] DLA-2122-1 libusbmuxd - security update
+ {CVE-2016-5104}
+ [jessie] - libusbmuxd 1.0.9-1+deb8u1
[27 Feb 2020] DLA-2121-1 libimobiledevice - security update
{CVE-2016-5104}
[jessie] - libimobiledevice 1.1.6+dfsg-3.1+deb8u1
=
data/dla-needed.txt
=
@@ -38,8 +38,6 @@ libmatio (Adrian Bunk)
--
libmtp (Dylan Aïssi)
--
-libusbmuxd (Dylan Aïssi)
---
linux (Ben Hutchings)
--
linux-4.9 (Ben Hutchings)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ffd4520e4a576c03cd7636846aba4f64aa3a1829
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ffd4520e4a576c03cd7636846aba4f64aa3a1829
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Changed python-bleach CVE from not-affected to ignored. Salvatore pointed out...
Ola Lundqvist pushed to branch master at Debian Security Tracker / security-tracker Commits: 4176e72c by Ola Lundqvist at 2020-02-27T22:57:55+01:00 Changed python-bleach CVE from not-affected to ignored. Salvatore pointed out that it was a wrong conclusion but the fix is too invasive in jessie. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -217,7 +217,8 @@ CVE-2020-9336 (fauzantrif eLection 2.0 has XSS via the Admin Dashboard - Set CVE-2020-6802 [mutation XSS vulnerability] RESERVED - python-bleach 3.1.1-1 (bug #951907) - [jessie] - python-bleach (Vulnerable functionality does not exist in this version) + [jessie] - python-bleach (Fix too invasive in jessie) + NOTE: Jessie version uses an external html5 parser making a fix invasive. NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=1615315 (not public) NOTE: https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r NOTE: https://github.com/mozilla/bleach/commit/f77e0f6392177a06e46a49abd61a4d9f035e57fd View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4176e72ce831b572f2dca8f56dbd1fd90b8dd655 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4176e72ce831b572f2dca8f56dbd1fd90b8dd655 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] dla-needed: add and claim libusbmuxd
Dylan Aïssi pushed to branch master at Debian Security Tracker / security-tracker Commits: 98b3affb by Dylan Aïssi at 2020-02-27T22:37:12+01:00 dla-needed: add and claim libusbmuxd - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -38,6 +38,8 @@ libmatio (Adrian Bunk) -- libmtp (Dylan Aïssi) -- +libusbmuxd (Dylan Aïssi) +-- linux (Ben Hutchings) -- linux-4.9 (Ben Hutchings) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/98b3affb7ee669bbc3be5ed069455808fd869e8f -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/98b3affb7ee669bbc3be5ed069455808fd869e8f You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Remove no-dsa tagged entry which got an update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 265b5c86 by Salvatore Bonaccorso at 2020-02-27T22:29:02+01:00 Remove no-dsa tagged entry which got an update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -199597,7 +199597,6 @@ CVE-2016-5105 (The megasas_dcmd_cfg_read function in hw/scsi/megasas.c in QEMU, NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1339583 CVE-2016-5104 (The socket_create function in common/socket.c in libimobiledevice and ...) - libimobiledevice 1.2.0+dfsg-3 (bug #825553) - [jessie] - libimobiledevice (Minor issue) [wheezy] - libimobiledevice (Vulnerable code not present) NOTE: https://github.com/libimobiledevice/libimobiledevice/commit/df1f5c4d70d0c19ad40072f5246ca457e7f9849e - libusbmuxd 1.0.10-3 (bug #825554) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/265b5c8653e31a93cbb9a6c71f3f485fd33bffc5 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/265b5c8653e31a93cbb9a6c71f3f485fd33bffc5 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] LTS: claim pure-ftpd in dla-needed.txt
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / security-tracker Commits: a9e1cbcf by Roberto C. Sánchez at 2020-02-27T16:12:59-05:00 LTS: claim pure-ftpd in dla-needed.txt - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -64,7 +64,7 @@ php5 (Thorsten Alteholz) phppgadmin NOTE: 20200218: no fix yet; wide usage -- -pure-ftpd +pure-ftpd (Roberto C. Sánchez) -- qemu (Utkarsh Gupta) NOTE: 20200223: WIP. View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a9e1cbcf786aa6d71d00db37f7786f8ff14a1919 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a9e1cbcf786aa6d71d00db37f7786f8ff14a1919 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add upstream commit references for CVE-2020-704{1,2,3}/openfortivpn
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
7ddcca7c by Salvatore Bonaccorso at 2020-02-27T21:40:08+01:00
Add upstream commit references for CVE-2020-704{1,2,3}/openfortivpn
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -5400,12 +5400,15 @@ CVE-2020-7044 (In Wireshark 3.2.x before 3.2.1, the
WASSP dissector could crash.
CVE-2020-7043 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
- openfortivpn 1.12.0-1
NOTE: https://github.com/adrienverge/openfortivpn/issues/536
+ NOTE:
https://github.com/adrienverge/openfortivpn/commit/6328a070ddaab16faaf008cb9a8a62439c30f2a8
CVE-2020-7042 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
- openfortivpn 1.12.0-1
NOTE: https://github.com/adrienverge/openfortivpn/issues/536
+ NOTE:
https://github.com/adrienverge/openfortivpn/commit/9eee997d599a89492281fc7ffdd79d88cd61afc3
CVE-2020-7041 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
- openfortivpn 1.12.0-1
NOTE: https://github.com/adrienverge/openfortivpn/issues/536
+ NOTE:
https://github.com/adrienverge/openfortivpn/commit/60660e00b80bad0fadcf39aee86f6f8756c94f91
CVE-2020-7040 (storeBackup.pl in storeBackup through 3.5 relies on the
/tmp/storeBack ...)
{DLA-2095-1}
- storebackup (bug #949393)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ddcca7c81e900b79514ead54ff9b224ae867903
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ddcca7c81e900b79514ead54ff9b224ae867903
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2020-704{1,2,3}/openfortivpn
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
758085e0 by Salvatore Bonaccorso at 2020-02-27T21:37:28+01:00
Add CVE-2020-704{1,2,3}/openfortivpn
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -5398,11 +5398,14 @@ CVE-2020-7044 (In Wireshark 3.2.x before 3.2.1, the
WASSP dissector could crash.
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f90a3720b73ca140403315126e2a478c4f70ca03
NOTE: https://www.wireshark.org/security/wnpa-sec-2020-01.html
CVE-2020-7043 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
- TODO: check
+ - openfortivpn 1.12.0-1
+ NOTE: https://github.com/adrienverge/openfortivpn/issues/536
CVE-2020-7042 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
- TODO: check
+ - openfortivpn 1.12.0-1
+ NOTE: https://github.com/adrienverge/openfortivpn/issues/536
CVE-2020-7041 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
- TODO: check
+ - openfortivpn 1.12.0-1
+ NOTE: https://github.com/adrienverge/openfortivpn/issues/536
CVE-2020-7040 (storeBackup.pl in storeBackup through 3.5 relies on the
/tmp/storeBack ...)
{DLA-2095-1}
- storebackup (bug #949393)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/758085e0266cfc1243dc212ad9b779fbed9591cd
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/758085e0266cfc1243dc212ad9b779fbed9591cd
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: ac04cbb3 by Salvatore Bonaccorso at 2020-02-27T21:33:23+01:00 Process NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -5775,9 +5775,9 @@ CVE-2020-6866 CVE-2020-6865 RESERVED CVE-2020-6864 (ZTE E8820V3 router product is impacted by an information leak vulnerab ...) - TODO: check + NOT-FOR-US: ZTE CVE-2020-6863 (ZTE E8820V3 router product is impacted by a permission and access cont ...) - TODO: check + NOT-FOR-US: ZTE CVE-2020-6862 (V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Informati ...) NOT-FOR-US: ZTE F6x2W CVE-2020-6861 @@ -65372,7 +65372,7 @@ CVE-2019-4671 CVE-2019-4670 (IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a ...) NOT-FOR-US: IBM CVE-2019-4669 (IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06, 8.6.0.0 ...) - TODO: check + NOT-FOR-US: IBM CVE-2019-4668 RESERVED CVE-2019-4667 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ac04cbb35ba2bd5bd56b6b80778beebe0752d03c -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ac04cbb35ba2bd5bd56b6b80778beebe0752d03c You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
69bc2d44 by security tracker role at 2020-02-27T20:10:23+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -1,3 +1,7 @@
+CVE-2020-9420
+ RESERVED
+CVE-2020-9419
+ RESERVED
CVE-2020- [LTE RRC dissector memory leak]
- wireshark 3.2.2-1
[jessie] - wireshark (Minor issue, can be fixed along in
next DLA)
@@ -5393,12 +5397,12 @@ CVE-2020-7044 (In Wireshark 3.2.x before 3.2.1, the
WASSP dissector could crash.
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16324
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f90a3720b73ca140403315126e2a478c4f70ca03
NOTE: https://www.wireshark.org/security/wnpa-sec-2020-01.html
-CVE-2020-7043
- RESERVED
-CVE-2020-7042
- RESERVED
-CVE-2020-7041
- RESERVED
+CVE-2020-7043 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
+ TODO: check
+CVE-2020-7042 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
+ TODO: check
+CVE-2020-7041 (An issue was discovered in openfortivpn 1.11.0 when used with
OpenSSL ...)
+ TODO: check
CVE-2020-7040 (storeBackup.pl in storeBackup through 3.5 relies on the
/tmp/storeBack ...)
{DLA-2095-1}
- storebackup (bug #949393)
@@ -5770,10 +5774,10 @@ CVE-2020-6866
RESERVED
CVE-2020-6865
RESERVED
-CVE-2020-6864
- RESERVED
-CVE-2020-6863
- RESERVED
+CVE-2020-6864 (ZTE E8820V3 router product is impacted by an information leak
vulnerab ...)
+ TODO: check
+CVE-2020-6863 (ZTE E8820V3 router product is impacted by a permission and
access cont ...)
+ TODO: check
CVE-2020-6862 (V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by
Informati ...)
NOT-FOR-US: ZTE F6x2W
CVE-2020-6861
@@ -63907,14 +63911,14 @@ CVE-2019-5328
RESERVED
CVE-2019-5327
RESERVED
-CVE-2019-5326
- RESERVED
+CVE-2019-5326 (An administrative application user of or application user with
write a ...)
+ TODO: check
CVE-2019-5325
RESERVED
CVE-2019-5324
RESERVED
-CVE-2019-5323
- RESERVED
+CVE-2019-5323 (There are command injection vulnerabilities present in the
AirWave app ...)
+ TODO: check
CVE-2019-5322 (A remotely exploitable information disclosure vulnerability is
present ...)
NOT-FOR-US: Edge Switch models
CVE-2019-5321
@@ -65367,8 +65371,8 @@ CVE-2019-4671
RESERVED
CVE-2019-4670 (IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could
allow a ...)
NOT-FOR-US: IBM
-CVE-2019-4669
- RESERVED
+CVE-2019-4669 (IBM Business Process Manager 8.5.7.0 through 8.5.7.0 2017.06,
8.6.0.0 ...)
+ TODO: check
CVE-2019-4668
RESERVED
CVE-2019-4667
@@ -68313,7 +68317,7 @@ CVE-2019-3422 (The Sec Consult Security Lab reported an
information disclosure v
NOT-FOR-US: ZTE
CVE-2019-3421 (The 7520V3V1.0.0B09P27 version, and all earlier versions of ZTE
produc ...)
NOT-FOR-US: ZTE
-CVE-2019-3420 (The version V2.5.0_EG1T5_TED of ZTE ZXHN H108N product are
impacted by ...)
+CVE-2019-3420 (All versions up to V2.5.0_EG1T5_TED of ZTE ZXHN H108N product
are impa ...)
NOT-FOR-US: ZTE
CVE-2019-3419 (A security vulnerability exists in a management port in the
version of ...)
NOT-FOR-US: ZTE
@@ -133859,8 +133863,8 @@ CVE-2017-16902 (On the Vonage VDV-23 115
3.2.11-0.9.40 home router, sending a lo
NOT-FOR-US: Vonage VDV-23 115 3.2.11-0.9.40 home router
CVE-2017-16901
RESERVED
-CVE-2017-16900
- RESERVED
+CVE-2017-16900 (Incorrect Access Control in Hunesion i-oneNet 3.0.6042.1200
allows the ...)
+ TODO: check
CVE-2017-16899 (An array index error in the fig2dev program in Xfig 3.2.6a
allows remo ...)
- fig2dev 1:3.2.6a-5 (bug #881143)
[stretch] - fig2dev 1:3.2.6a-2+deb9u1
@@ -231270,8 +231274,7 @@ CVE-2015-2994 (Unrestricted file upload vulnerability
in ChangePhoto.jsp in SysA
NOT-FOR-US: SysAid Help Desk
CVE-2015-2993 (SysAid Help Desk before 15.2 does not properly restrict access
to cert ...)
NOT-FOR-US: SysAid Help Desk
-CVE-2015-2992
- RESERVED
+CVE-2015-2992 (Apache Struts before 2.3.20 has a cross-site scripting (XSS)
vulnerabi ...)
- libstruts1.2-java (Affects 2.0.0 - 2.3.16.3)
CVE-2015-2991 (Buffer overflow in NScripter before 3.00 allows remote
attackers to ex ...)
NOT-FOR-US: NScripter
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/69bc2d44928a37601f944b21882cffa4a1c86291
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/69bc2d44928a37601f944b21882cffa4a1c86291
You're receiving this email because of
[Git][security-tracker-team/security-tracker][master] Marked three vulnerabilities for wireshark as postponed.
Ola Lundqvist pushed to branch master at Debian Security Tracker / security-tracker Commits: 5ba438cf by Ola Lundqvist at 2020-02-27T20:43:47+01:00 Marked three vulnerabilities for wireshark as postponed. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,11 +1,14 @@ CVE-2020- [LTE RRC dissector memory leak] - wireshark 3.2.2-1 + [jessie] - wireshark (Minor issue, can be fixed along in next DLA) NOTE: https://www.wireshark.org/security/wnpa-sec-2020-03.html CVE-2020- [WiMax DLMAP dissector crash] - wireshark 3.2.2-1 + [jessie] - wireshark (Minor issue, can be fixed along in next DLA) NOTE: https://www.wireshark.org/security/wnpa-sec-2020-04.html CVE-2020- [EAP dissector crash] - wireshark 3.2.2-1 + [jessie] - wireshark (Minor issue, can be fixed along in next DLA) NOTE: https://www.wireshark.org/security/wnpa-sec-2020-05.html CVE-2020- [WireGuard dissector crash] - wireshark 3.2.2-1 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5ba438cf1697473e013eb1cdf3a732c5571d4633 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5ba438cf1697473e013eb1cdf3a732c5571d4633 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] CVE-2017-6363 marked as ignored for jessie following Debian Secutiry team.
Ola Lundqvist pushed to branch master at Debian Security Tracker / security-tracker Commits: 55b8e704 by Ola Lundqvist at 2020-02-27T20:30:55+01:00 CVE-2017-6363 marked as ignored for jessie following Debian Secutiry team. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -166686,6 +166686,7 @@ CVE-2017-6363 (** DISPUTED ** In the GD Graphics Library (aka LibGD) through 2.2 - libgd2 [buster] - libgd2 (Minor issue) [stretch] - libgd2 (Minor issue) + [jessie] - libgd2 (Minor issue) NOTE: https://github.com/libgd/libgd/commit/0be86e1926939a98afbd2f3a23c673dfc4df2a7c NOTE: https://github.com/libgd/libgd/commit/2dbd8f6e66b73ed43d9b81a45350922b80f75397 NOTE: https://github.com/libgd/libgd/issues/383 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55b8e704773325295be9d06bb8b4254bd7e2070a -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/55b8e704773325295be9d06bb8b4254bd7e2070a You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Marked CVE-2020-6802 as not affected for jessie. The vulnerable functionality...
Ola Lundqvist pushed to branch master at Debian Security Tracker / security-tracker Commits: bcdf3a8a by Ola Lundqvist at 2020-02-27T20:08:51+01:00 Marked CVE-2020-6802 as not affected for jessie. The vulnerable functionality does not exist in this version. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -210,6 +210,7 @@ CVE-2020-9336 (fauzantrif eLection 2.0 has XSS via the Admin Dashboard - Set CVE-2020-6802 [mutation XSS vulnerability] RESERVED - python-bleach 3.1.1-1 (bug #951907) + [jessie] - python-bleach (Vulnerable functionality does not exist in this version) NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=1615315 (not public) NOTE: https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r NOTE: https://github.com/mozilla/bleach/commit/f77e0f6392177a06e46a49abd61a4d9f035e57fd View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bcdf3a8aed65cbcb839d5ebc961eb8bc466d0491 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bcdf3a8aed65cbcb839d5ebc961eb8bc466d0491 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add reference to upstream issue for CVE-2020-1734/ansible
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 4577d5d9 by Salvatore Bonaccorso at 2020-02-27T18:26:31+01:00 Add reference to upstream issue for CVE-2020-1734/ansible - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -19168,6 +19168,7 @@ CVE-2020-1734 [shell enabled by default in a pipe lookup plugin subprocess] - ansible NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1801804 NOTE: https://github.com/ansible/ansible/issues/6550 + NOTE: https://github.com/ansible/ansible/issues/67792 CVE-2020-1733 [insecure temporary directory when running become_user from become directive] RESERVED - ansible View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4577d5d99826d6195270a2324a4500a221099866 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4577d5d99826d6195270a2324a4500a221099866 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add reference to upstream issue for CVE-2020-1735/ansible
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 86c25213 by Salvatore Bonaccorso at 2020-02-27T18:24:36+01:00 Add reference to upstream issue for CVE-2020-1735/ansible - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -19162,6 +19162,7 @@ CVE-2020-1735 [path injection on dest parameter in fetch module] RESERVED - ansible NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1802085 + NOTE: https://github.com/ansible/ansible/issues/67793 CVE-2020-1734 [shell enabled by default in a pipe lookup plugin subprocess] RESERVED - ansible View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/86c252133226def1e7febf60d0d07303d454adcc -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/86c252133226def1e7febf60d0d07303d454adcc You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add reference to upstream issue for CVE-2020-1736/ansible
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 4e9ca677 by Salvatore Bonaccorso at 2020-02-27T18:23:39+01:00 Add reference to upstream issue for CVE-2020-1736/ansible - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -19157,6 +19157,7 @@ CVE-2020-1736 [atomic_move primitive sets permissive permissions] RESERVED - ansible NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1802124 + NOTE: https://github.com/ansible/ansible/issues/67794 CVE-2020-1735 [path injection on dest parameter in fetch module] RESERVED - ansible View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e9ca67743a371033771ef3246352f94cb0c2bb5 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4e9ca67743a371033771ef3246352f94cb0c2bb5 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add reference to upstream issue for CVE-2020-1737/ansible
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 397268a0 by Salvatore Bonaccorso at 2020-02-27T18:22:40+01:00 Add reference to upstream issue for CVE-2020-1737/ansible - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -19152,6 +19152,7 @@ CVE-2020-1737 [Extract-Zip function in win_unzip module does not check extracted RESERVED - ansible NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1802154 + NOTE: https://github.com/ansible/ansible/issues/67795 CVE-2020-1736 [atomic_move primitive sets permissive permissions] RESERVED - ansible View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/397268a00a1a3c5c392570ec0675a02e8de1d5b3 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/397268a00a1a3c5c392570ec0675a02e8de1d5b3 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add upstream issue for CVE-2020-1738/ansible
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 970369f9 by Salvatore Bonaccorso at 2020-02-27T18:21:28+01:00 Add upstream issue for CVE-2020-1738/ansible - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -19147,6 +19147,7 @@ CVE-2020-1738 [module package can be selected by the ansible facts] RESERVED - ansible NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1802164 + NOTE: https://github.com/ansible/ansible/issues/67796 CVE-2020-1737 [Extract-Zip function in win_unzip module does not check extracted path] RESERVED - ansible View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/970369f9c7228334e34ce4d2f40f703ebcb8e912 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/970369f9c7228334e34ce4d2f40f703ebcb8e912 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add upstream issue for CVE-2020-1739/ansible
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8292c91a by Salvatore Bonaccorso at 2020-02-27T18:20:34+01:00 Add upstream issue for CVE-2020-1739/ansible - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -19142,6 +19142,7 @@ CVE-2020-1739 [svn module leaks password when specified as a parameter] RESERVED - ansible NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1802178 + NOTE: https://github.com/ansible/ansible/issues/67797 CVE-2020-1738 [module package can be selected by the ansible facts] RESERVED - ansible View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8292c91a90d6d78b10dd18827ddbfff5d3de9904 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8292c91a90d6d78b10dd18827ddbfff5d3de9904 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reference upstream issue for CVE-2020-1740/ansible
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 7c7ae754 by Salvatore Bonaccorso at 2020-02-27T18:19:23+01:00 Reference upstream issue for CVE-2020-1740/ansible - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -19137,6 +19137,7 @@ CVE-2020-1740 [secrets readable after ansible-vault edit] RESERVED - ansible NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1802193 + NOTE: https://github.com/ansible/ansible/issues/67798 CVE-2020-1739 [svn module leaks password when specified as a parameter] RESERVED - ansible View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7c7ae754d7599171c40aa22f74a4d504d251df57 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7c7ae754d7599171c40aa22f74a4d504d251df57 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2019-10064/wpa
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: f135e512 by Salvatore Bonaccorso at 2020-02-27T17:53:24+01:00 Add CVE-2019-10064/wpa - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -50432,6 +50432,8 @@ CVE-2019-10065 RESERVED CVE-2019-10064 RESERVED + - wpa + NOTE: https://www.openwall.com/lists/oss-security/2020/02/27/1 CVE-2019-10063 (Flatpak before 1.0.8, 1.1.x and 1.2.x before 1.2.4, and 1.3.x before 1 ...) - flatpak 1.2.3-2 (bug #925541) [stretch] - flatpak 0.8.9-0+deb9u3 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f135e512c3e7411a97b1b56e7e4fa7b6c6246365 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f135e512c3e7411a97b1b56e7e4fa7b6c6246365 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] qtbase-opensource-src fixed
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 510fadc8 by Moritz Muehlenhoff at 2020-02-27T16:48:33+01:00 qtbase-opensource-src fixed - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -3324,7 +3324,7 @@ CVE-2020-7963 CVE-2019-20420 RESERVED CVE-2015-9541 (Qt through 5.14 allows an exponential XML entity expansion attack via ...) - - qtbase-opensource-src (low; bug #951066) + - qtbase-opensource-src 5.12.5+dfsg-9 (low; bug #951066) [buster] - qtbase-opensource-src (Minor issue) [stretch] - qtbase-opensource-src (Minor issue) NOTE: https://bugreports.qt.io/browse/QTBUG-47417 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/510fadc897d42652196aba163c4a8ad4c2055426 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/510fadc897d42652196aba163c4a8ad4c2055426 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2017-6363/libgd2
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0382a055 by Salvatore Bonaccorso at 2020-02-27T15:55:49+01:00
Add CVE-2017-6363/libgd2
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -166673,7 +166673,12 @@ CVE-2017-6365
CVE-2017-6364
RESERVED
CVE-2017-6363 (** DISPUTED ** In the GD Graphics Library (aka LibGD) through
2.2.5, t ...)
- TODO: check
+ - libgd2
+ [buster] - libgd2 (Minor issue)
+ [stretch] - libgd2 (Minor issue)
+ NOTE:
https://github.com/libgd/libgd/commit/0be86e1926939a98afbd2f3a23c673dfc4df2a7c
+ NOTE:
https://github.com/libgd/libgd/commit/2dbd8f6e66b73ed43d9b81a45350922b80f75397
+ NOTE: https://github.com/libgd/libgd/issues/383
CVE-2017-6362 (Double free vulnerability in the gdImagePngPtr function in
libgd2 befo ...)
{DSA-3961-1 DLA-1106-1}
- libgd2 2.2.5-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0382a055a05411890c22f1d4f1f69aad2036ac8c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0382a055a05411890c22f1d4f1f69aad2036ac8c
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for CVE-2017-18640/snakeyaml
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c53a8c43 by Salvatore Bonaccorso at 2020-02-27T15:34:50+01:00 Add Debian bug reference for CVE-2017-18640/snakeyaml - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -15310,7 +15310,7 @@ CVE-2019-19727 (SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak sl NOTE: The example file is installed as well in Debian as 0644 and slurmdbd.conf NOTE: not directly installed by the slurmdbd binary package. CVE-2017-18640 (The Alias feature in SnakeYAML 1.18 allows entity expansion during a l ...) - - snakeyaml + - snakeyaml (bug #952683) [buster] - snakeyaml (Minor issue) [stretch] - snakeyaml (Minor issue) [jessie] - snakeyaml (unclear security impact) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c53a8c431c4c503961a4c69630d301ddbb385c5c -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c53a8c431c4c503961a4c69630d301ddbb385c5c You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Mark CVE-2017-18640/snakeyaml as no-dsa
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: bb916022 by Salvatore Bonaccorso at 2020-02-27T15:17:57+01:00 Mark CVE-2017-18640/snakeyaml as no-dsa - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -15311,6 +15311,8 @@ CVE-2019-19727 (SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak sl NOTE: not directly installed by the slurmdbd binary package. CVE-2017-18640 (The Alias feature in SnakeYAML 1.18 allows entity expansion during a l ...) - snakeyaml + [buster] - snakeyaml (Minor issue) + [stretch] - snakeyaml (Minor issue) [jessie] - snakeyaml (unclear security impact) NOTE: https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion NOTE: Patch to introduce a configuration option to restrict aliases for View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bb91602215a476077e9b2f467912d8d34534323b -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bb91602215a476077e9b2f467912d8d34534323b You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reference mitigation commit for CVE-2017-18640/snakeyaml
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: a2be2c0e by Salvatore Bonaccorso at 2020-02-27T15:03:07+01:00 Reference mitigation commit for CVE-2017-18640/snakeyaml - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -15313,6 +15313,9 @@ CVE-2017-18640 (The Alias feature in SnakeYAML 1.18 allows entity expansion duri - snakeyaml [jessie] - snakeyaml (unclear security impact) NOTE: https://bitbucket.org/asomov/snakeyaml/issues/377/allow-configuration-for-preventing-billion + NOTE: Patch to introduce a configuration option to restrict aliases for + NOTE: collections: + NOTE: https://bitbucket.org/asomov/snakeyaml/commits/b680ce64971d943083012c04690c0ffa9fea6da4 CVE-2019-19726 (OpenBSD through 6.6 allows local users to escalate to root because a c ...) NOT-FOR-US: OpenBSD CVE-2019-19725 (sysstat through 12.2.0 has a double free in check_file_actlst in sa_co ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a2be2c0e130a0f472980a98e284b86536300450b -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a2be2c0e130a0f472980a98e284b86536300450b You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] mark CVE-2020-9308 as not affected for Jessie, Stretch and Buster
Thorsten Alteholz pushed to branch master at Debian Security Tracker / security-tracker Commits: f2941bfa by Thorsten Alteholz at 2020-02-27T14:33:23+01:00 mark CVE-2020-9308 as not affected for Jessie, Stretch and Buster - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -275,8 +275,9 @@ CVE-2020-9309 RESERVED CVE-2020-9308 (archive_read_support_format_rar5.c in libarchive before 3.4.2 attempts ...) - libarchive (bug #951759) - [buster] - libarchive (Minor issue) - [stretch] - libarchive (Minor issue) + [buster] - libarchive (rar5 support added in 3.4.0) + [stretch] - libarchive (rar5 support added in 3.4.0) + [jessie] - libarchive (rar5 support added in 3.4.0) NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20459 NOTE: https://github.com/libarchive/libarchive/pull/1326 NOTE: https://github.com/libarchive/libarchive/commit/94821008d6eea81e315c5881cdf739202961040a View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f2941bfa04fd42370565dd1102fcdb4adca44f90 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f2941bfa04fd42370565dd1102fcdb4adca44f90 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Revert "Update python-bleach TEMP-0951907-7D0FFB (#951907) to indicate jessie/stretch not affected"
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: d5a1546f by Salvatore Bonaccorso at 2020-02-27T13:43:49+01:00 Revert Update python-bleach TEMP-0951907-7D0FFB (#951907) to indicate jessie/stretch not affected The code was several times quite refactored, but the issue is present as well in older versions. See https://bugs.debian.org/951907#42 and following. In particular upstream did back in b07814e0753c (Extract all html5lib things into a shim module) in v3.0.0 did split some code from bleach.sanitizer to bleach.html5lib_shim, and before in 67afdf8ae7d3 (Prevent HTMLTokenizer from unescaping entities) in v2.1 was quite refactored. But the issue which arises when cleaning when noscript and one of the mentioned raw text tags are whitelisted is present in earlier versions even. Tested in explicitly in 2.0-1 and 1.4-1. This reverts commit b2007687dcd7a17c62cfb47af81b08e99add8f08. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -210,8 +210,6 @@ CVE-2020-9336 (fauzantrif eLection 2.0 has XSS via the Admin Dashboard - Set CVE-2020-6802 [mutation XSS vulnerability] RESERVED - python-bleach 3.1.1-1 (bug #951907) - [stretch] - python-bleach (Vulnerable code introduced later) - [jessie] - python-bleach (Vulnerable code introduced later) NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=1615315 (not public) NOTE: https://github.com/mozilla/bleach/security/advisories/GHSA-q65m-pv3f-wr5r NOTE: https://github.com/mozilla/bleach/commit/f77e0f6392177a06e46a49abd61a4d9f035e57fd View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d5a1546fb68258e1720f77086e8c19281f2c6aed -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d5a1546fb68258e1720f77086e8c19281f2c6aed You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new wireshark issues
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 020189d2 by Moritz Muehlenhoff at 2020-02-27T13:05:58+01:00 new wireshark issues - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,3 +1,18 @@ +CVE-2020- [LTE RRC dissector memory leak] + - wireshark 3.2.2-1 + NOTE: https://www.wireshark.org/security/wnpa-sec-2020-03.html +CVE-2020- [WiMax DLMAP dissector crash] + - wireshark 3.2.2-1 + NOTE: https://www.wireshark.org/security/wnpa-sec-2020-04.html +CVE-2020- [EAP dissector crash] + - wireshark 3.2.2-1 + NOTE: https://www.wireshark.org/security/wnpa-sec-2020-05.html +CVE-2020- [WireGuard dissector crash] + - wireshark 3.2.2-1 + [buster] - wireshark (Vulnerable code not present) + [stretch] - wireshark (Vulnerable code not present) + [jessie] - wireshark (Vulnerable code not present) + NOTE: https://www.wireshark.org/security/wnpa-sec-2020-06.html CVE-2020-9418 RESERVED CVE-2020-9417 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/020189d2c752f4ad39fc309fcc0f753738d1f788 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/020189d2c752f4ad39fc309fcc0f753738d1f788 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add fixed version for CVE-2020-9274/pure-ftpd
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4964f4fa by Salvatore Bonaccorso at 2020-02-27T12:02:42+01:00
Add fixed version for CVE-2020-9274/pure-ftpd
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -338,7 +338,7 @@ CVE-2020-9276
CVE-2020-9275
RESERVED
CVE-2020-9274 (An issue was discovered in Pure-FTPd 1.0.49. An uninitialized
pointer ...)
- - pure-ftpd (bug #952666)
+ - pure-ftpd 1.0.49-4 (bug #952666)
NOTE:
https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
CVE-2020-9273 (In ProFTPD 1.3.7, it is possible to corrupt the memory pool by
interru ...)
{DSA-4635-1 DLA-2115-1}
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4964f4fa63f0e0f0aa12e8d4f814bb4489451c1d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4964f4fa63f0e0f0aa12e8d4f814bb4489451c1d
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add upstream commit for CVE-2015-9541/qtbase-opensource-src
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 84a74971 by Salvatore Bonaccorso at 2020-02-27T11:58:27+01:00 Add upstream commit for CVE-2015-9541/qtbase-opensource-src - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -3314,6 +3314,7 @@ CVE-2015-9541 (Qt through 5.14 allows an exponential XML entity expansion attack [buster] - qtbase-opensource-src (Minor issue) [stretch] - qtbase-opensource-src (Minor issue) NOTE: https://bugreports.qt.io/browse/QTBUG-47417 + NOTE: https://code.qt.io/cgit/qt/qtbase.git/commit/?id=fd4be84d23a0db4186cb42e736a9de3af722c7f7 CVE-2020-7962 RESERVED CVE-2020-7961 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/84a74971e903ae577b1d8977813ce501af574f36 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/84a74971e903ae577b1d8977813ce501af574f36 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new unimportant puppet issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: ec29d3b3 by Moritz Muehlenhoff at 2020-02-27T11:22:51+01:00 new unimportant puppet issue - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -3359,7 +3359,10 @@ CVE-2020-7944 CVE-2020-7943 RESERVED CVE-2020-7942 (Previously, Puppet operated on a model that a node with a valid certif ...) - TODO: check + - puppet (unimportant) + NOTE: This CVE assignment is for switching the default setting of strict_hostname_checking, + NOTE: the option is available in older Puppet releases (such as 4.8 from Stretch) + NOTE: https://puppet.com/security/cve/CVE-2020-7942/ CVE-2020-7941 (A privilege escalation issue in plone.app.contenttypes in Plone 4.3 th ...) NOT-FOR-US: Plone CVE-2020-7940 (Missing password strength checks on some forms in Plone 4.3 through 5. ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ec29d3b3d57699723fe39e8d5ce97f5dbc5ef007 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ec29d3b3d57699723fe39e8d5ce97f5dbc5ef007 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Mark CVE-2020-8130/rake as no-dsa
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d61bfa32 by Salvatore Bonaccorso at 2020-02-27T11:02:21+01:00
Mark CVE-2020-8130/rake as no-dsa
While there is a OS command injection issue here present, the attack
surface is limited and difficult to inject malicious input to
Rake::FileList. The issue can be fixed via a point release.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -2877,6 +2877,8 @@ CVE-2020-8131 (Arbitrary filesystem write vulnerability
in Yarn 1.21.1 and earli
CVE-2020-8130 (There is an OS command injection vulnerability in Ruby Rake
12.3. ...)
{DLA-2120-1}
- rake 12.3.3-1
+ [buster] - rake (Minor issue)
+ [stretch] - rake (Minor issue)
NOTE: https://hackerone.com/reports/651518
NOTE: Fixed by:
https://github.com/ruby/rake/commit/5b8f8fc41a5d7d7d6a5d767e48464c60884d3aee
(v12.3.3)
CVE-2020-8129 (An unintended require vulnerability in script-manager npm
package vers ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d61bfa32738369632a87bdd5a436f7ccc719fcfe
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d61bfa32738369632a87bdd5a436f7ccc719fcfe
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] mojarra n/a
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: fefc6f76 by Moritz Muehlenhoff at 2020-02-27T10:15:35+01:00 mojarra n/a - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -5574,6 +5574,8 @@ CVE-2020-6951 RESERVED CVE-2020-6950 RESERVED + - mojarra (Vulnerable code introduced later) + NOTE: https://github.com/eclipse-ee4j/mojarra/commit/cefbb9447e7be560e59da2da6bd7cb93776f7741 CVE-2020-6949 (A privilege escalation issue was discovered in the postUser function i ...) NOT-FOR-US: HashBrown CMS CVE-2020-6948 (A remote code execution issue was discovered in HashBrown CMS through ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fefc6f765a6e23307f0ab69faded29bd3403ce07 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/fefc6f765a6e23307f0ab69faded29bd3403ce07 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for CVE-2020-9274/pure-ftpd
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2f33fff4 by Salvatore Bonaccorso at 2020-02-27T09:39:02+01:00
Add Debian bug reference for CVE-2020-9274/pure-ftpd
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -338,7 +338,7 @@ CVE-2020-9276
CVE-2020-9275
RESERVED
CVE-2020-9274 (An issue was discovered in Pure-FTPd 1.0.49. An uninitialized
pointer ...)
- - pure-ftpd
+ - pure-ftpd (bug #952666)
NOTE:
https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
CVE-2020-9273 (In ProFTPD 1.3.7, it is possible to corrupt the memory pool by
interru ...)
{DSA-4635-1 DLA-2115-1}
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2f33fff40a75e070ba0044232214252c6f8244b2
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2f33fff40a75e070ba0044232214252c6f8244b2
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2020-9274/pure-ftpd
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0f43a261 by Salvatore Bonaccorso at 2020-02-27T09:21:23+01:00
Add CVE-2020-9274/pure-ftpd
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -336,7 +336,8 @@ CVE-2020-9276
CVE-2020-9275
RESERVED
CVE-2020-9274 (An issue was discovered in Pure-FTPd 1.0.49. An uninitialized
pointer ...)
- TODO: check
+ - pure-ftpd
+ NOTE:
https://github.com/jedisct1/pure-ftpd/commit/8d0d42542e2cb7a56d645fbe4d0ef436e38bcefa
CVE-2020-9273 (In ProFTPD 1.3.7, it is possible to corrupt the memory pool by
interru ...)
{DSA-4635-1 DLA-2115-1}
- proftpd-dfsg 1.3.6c-1 (bug #951800)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0f43a261368a07792a78d99db6eedbe9d4834715
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0f43a261368a07792a78d99db6eedbe9d4834715
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] 2 commits: Process NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 426dfc1b by Salvatore Bonaccorso at 2020-02-27T09:12:13+01:00 Process NFUs - - - - - a3043933 by Salvatore Bonaccorso at 2020-02-27T09:19:46+01:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -187,7 +187,7 @@ CVE-2020-9339 (SOPlanning 1.45 allows XSS via the Name or Comment to status.php. CVE-2020-9338 (SOPlanning 1.45 allows XSS via the "Your SoPlanning url" field. ...) NOT-FOR-US: SOPlanning CVE-2020-9337 (In GolfBuddy Course Manager 1.1, passwords are sent (with base64 encod ...) - TODO: check + NOT-FOR-US: GolfBuddy Course Manager CVE-2020-9336 (fauzantrif eLection 2.0 has XSS via the Admin Dashboard - Settings ...) NOT-FOR-US: fauzantrif eLection CVE-2020-6802 [mutation XSS vulnerability] @@ -1074,9 +1074,9 @@ CVE-2020-8954 CVE-2020-8953 (OpenVPN Access Server 2.8.x before 2.8.1 allows LDAP authentication by ...) NOT-FOR-US: OpenVPN Access Server CVE-2020-8952 (Fiserv Accurate Reconciliation 2.19.0 allows XSS via the logout.jsp ti ...) - TODO: check + NOT-FOR-US: Fiserv Accurate Reconciliation CVE-2020-8951 (Fiserv Accurate Reconciliation 2.19.0 allows XSS via the Source or Des ...) - TODO: check + NOT-FOR-US: Fiserv Accurate Reconciliation CVE-2020-8950 (The AUEPLauncher service in Radeon AMD User Experience Program Launche ...) NOT-FOR-US: Radeon AMD User Experience Program Launcher CVE-2020-8949 (Gocloud S2A_WL 4.2.7.16471, S2A 4.2.7.17278, S2A 4.3.0.15815, S2A 4.3. ...) @@ -12823,23 +12823,23 @@ CVE-2019-19996 (An issue was discovered on Intelbras IWR 3000N 1.8.7 devices. A CVE-2019-19995 (A CSRF issue was discovered on Intelbras IWR 3000N 1.8.7 devices, lead ...) NOT-FOR-US: Intelbras IWR 3000N devices CVE-2019-19994 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19993 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19992 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19991 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19990 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19989 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19988 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19987 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19986 (An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 ...) - TODO: check + NOT-FOR-US: Selesta Visual Access Manager (VAM) CVE-2019-19985 (The WordPress plugin, Email Subscribers Newsletters, before 4.2. ...) NOT-FOR-US: WordPress plugin CVE-2019-19984 (The WordPress plugin, Email Subscribers Newsletters, before 4.2. ...) @@ -13102,9 +13102,9 @@ CVE-2020-3926 (An arbitrary-file-access vulnerability exists in ServiSign securi CVE-2020-3925 (A Remote Code Execution(RCE) vulnerability exists in some designated a ...) NOT-FOR-US: ServiSign security plugin CVE-2020-3924 (DVR firmware in TAT-76 and TAT-77 series of products, provided by TONN ...) - TODO: check + NOT-FOR-US: DVR firmware in TAT-76 and TAT-77 series CVE-2020-3923 (DVR firmware in TAT-76 and TAT-77 series of products, provided by TONN ...) - TODO: check + NOT-FOR-US: DVR firmware in TAT-76 and TAT-77 series CVE-2020-3922 RESERVED CVE-2020-3921 @@ -15042,27 +15042,27 @@ CVE-2020-3177 CVE-2020-3176 RESERVED CVE-2020-3175 (A vulnerability in the resource handling system of Cisco NX-OS Softwar ...) - TODO: check + NOT-FOR-US: Cisco CVE-2020-3174 (A vulnerability in the anycast gateway feature of Cisco NX-OS Software ...) - TODO: check + NOT-FOR-US: Cisco CVE-2020-3173 (A vulnerability in the local management (local-mgmt) CLI of Cisco UCS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2020-3172 (A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2020-3171 (A
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9c6503ba by security tracker role at 2020-02-27T08:10:13+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -338,7 +338,7 @@ CVE-2020-9275
CVE-2020-9274 (An issue was discovered in Pure-FTPd 1.0.49. An uninitialized
pointer ...)
TODO: check
CVE-2020-9273 (In ProFTPD 1.3.7, it is possible to corrupt the memory pool by
interru ...)
- {DLA-2115-1}
+ {DSA-4635-1 DLA-2115-1}
- proftpd-dfsg 1.3.6c-1 (bug #951800)
NOTE: https://github.com/proftpd/proftpd/issues/903
NOTE:
https://github.com/proftpd/proftpd/commit/d388f7904d4c9a6d0ea54237b8b54a57c19d8d49
(master)
@@ -1431,6 +1431,7 @@ CVE-2020-8795 (In GitLab Enterprise Edition (EE) 12.5.0
through 12.7.5, sharing
- gitlab (Only affects EE version)
NOTE:
https://about.gitlab.com/releases/2020/02/13/critical-security-release-gitlab-12-dot-7-dot-6-released/
CVE-2020-8794 (OpenSMTPD before 6.6.4 allows remote code execution because of
an out- ...)
+ {DSA-4634-1}
- opensmtpd 6.6.4p1-1 (bug #952453)
NOTE: https://www.openwall.com/lists/oss-security/2020/02/24/5
NOTE: https://poolp.org/posts/2020-01-30/opensmtpd-advisory-dissected/
@@ -2871,6 +2872,7 @@ CVE-2020-8131 (Arbitrary filesystem write vulnerability
in Yarn 1.21.1 and earli
- node-yarnpkg
NOTE: https://hackerone.com/reports/730239
CVE-2020-8130 (There is an OS command injection vulnerability in Ruby Rake
12.3. ...)
+ {DLA-2120-1}
- rake 12.3.3-1
NOTE: https://hackerone.com/reports/651518
NOTE: Fixed by:
https://github.com/ruby/rake/commit/5b8f8fc41a5d7d7d6a5d767e48464c60884d3aee
(v12.3.3)
@@ -13099,10 +13101,10 @@ CVE-2020-3926 (An arbitrary-file-access vulnerability
exists in ServiSign securi
NOT-FOR-US: ServiSign security plugin
CVE-2020-3925 (A Remote Code Execution(RCE) vulnerability exists in some
designated a ...)
NOT-FOR-US: ServiSign security plugin
-CVE-2020-3924
- RESERVED
-CVE-2020-3923
- RESERVED
+CVE-2020-3924 (DVR firmware in TAT-76 and TAT-77 series of products, provided
by TONN ...)
+ TODO: check
+CVE-2020-3923 (DVR firmware in TAT-76 and TAT-77 series of products, provided
by TONN ...)
+ TODO: check
CVE-2020-3922
RESERVED
CVE-2020-3921
@@ -24587,8 +24589,8 @@ CVE-2019-18240 (In Fuji Electric V-Server 4.0.6 and
prior, several heap-based bu
NOT-FOR-US: Fuji
CVE-2019-18239
RESERVED
-CVE-2019-18238
- RESERVED
+CVE-2019-18238 (Moxa ioLogik 2542-HSPA Series Controllers and IOs, and
IOxpress Config ...)
+ TODO: check
CVE-2019-18237
RESERVED
CVE-2019-18236 (Multiple buffer overflow vulnerabilities exist when the PLC
Editor Ver ...)
@@ -42498,7 +42500,7 @@ CVE-2019-12884
CVE-2019-12883
RESERVED
CVE-2019-12882
- RESERVED
+ REJECTED
CVE-2019-12881 (i915_gem_userptr_get_pages in
drivers/gpu/drm/i915/i915_gem_userptr.c ...)
- linux
NOTE: https://gist.github.com/oxagast/472866fb2c3d439e10499d7141d0a520
@@ -75319,7 +75321,7 @@ CVE-2018-19670
CVE-2018-19669
RESERVED
CVE-2018-19668
- RESERVED
+ REJECTED
CVE-2018-19667
RESERVED
CVE-2018-19666 (The agent in OSSEC through 3.1.0 on Windows allows local users
to gain ...)
@@ -166618,8 +166620,8 @@ CVE-2017-6373
RESERVED
CVE-2017-6372
RESERVED
-CVE-2017-6371
- RESERVED
+CVE-2017-6371 (Synchronet BBS 3.16c for Windows allows remote attackers to
cause a de ...)
+ TODO: check
CVE-2017-6370 (TYPO3 7.6.15 sends an http request to an
index.php?loginProvider URI i ...)
NOT-FOR-US: TYPO3
CVE-2017-6369 (Insufficient checks in the UDF subsystem in Firebird 2.5.x
before 2.5. ...)
@@ -166640,8 +166642,8 @@ CVE-2017-6365
RESERVED
CVE-2017-6364
RESERVED
-CVE-2017-6363
- RESERVED
+CVE-2017-6363 (** DISPUTED ** In the GD Graphics Library (aka LibGD) through
2.2.5, t ...)
+ TODO: check
CVE-2017-6362 (Double free vulnerability in the gdImagePngPtr function in
libgd2 befo ...)
{DSA-3961-1 DLA-1106-1}
- libgd2 2.2.5-1
@@ -168211,7 +168213,7 @@ CVE-2017-5863 (Open-Xchange GmbH OX App Suite 7.8.3
and earlier is affected by:
CVE-2017-5862
RESERVED
CVE-2017-5861
- RESERVED
+ REJECTED
CVE-2017-5860
RESERVED
CVE-2017-5859 (On Cambium Networks cnPilot R200/201 devices before 4.3, there
is a vu ...)
@@ -223376,8 +223378,8 @@ CVE-2015-5688 (Directory traversal vulnerability in
lib/app/index.js in Geddy be
NOTE: https://nodesecurity.io/advisories/10
CVE-2015-5687 (system/session/drivers/cookie.php in Anchor CMS 0.9.x allows
remote at ...)
NOT-FOR-US: Anchor CMS
-CVE-2015-5686
- RESERVED
+CVE-2015-5686
[Git][security-tracker-team/security-tracker][master] Track fixed versions for golang-go.crypto via unstable
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
62f2fda3 by Salvatore Bonaccorso at 2020-02-27T09:05:19+01:00
Track fixed versions for golang-go.crypto via unstable
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -314,7 +314,7 @@ CVE-2020-9285
CVE-2020-9284
RESERVED
CVE-2020-9283 (golang.org/x/crypto before v0.0.0-20200220183623-bac4c82f6975
for Go a ...)
- - golang-go.crypto (bug #952462)
+ - golang-go.crypto 1:0.0~git20200221.2aa609c-1 (bug #952462)
[buster] - golang-go.crypto (Minor issue)
[stretch] - golang-go.crypto (Minor issue)
[jessie] - golang-go.crypto (Minor issue)
@@ -45199,14 +45199,14 @@ CVE-2019-11843
RESERVED
CVE-2019-11841 (A message-forgery issue was discovered in
crypto/openpgp/clearsign/cle ...)
{DLA-1920-1}
- - golang-go.crypto
+ - golang-go.crypto 1:0.0~git20200221.2aa609c-1
NOTE:
https://go.googlesource.com/crypto/+/c05e17bb3b2dca130fc919668a96b4bec9eb9442
NOTE: Patch fixes the second part of the CVE ("prepend arbitrary text")
NOTE: but not the first ("ignores the value of [the Hash] header"), as
hinted at reporter's 2019-05-09 note:
NOTE:
https://packetstormsecurity.com/files/152840/Go-Cryptography-Libraries-Cleartext-Message-Spoofing.html
CVE-2019-11840 (An issue was discovered in supplementary Go cryptography
libraries, ak ...)
{DLA-1840-1}
- - golang-go.crypto
+ - golang-go.crypto 1:0.0~git20200221.2aa609c-1
NOTE: https://github.com/golang/go/issues/30965
NOTE:
https://go.googlesource.com/crypto/+/b7391e95e576cacdcdd422573063bc057239113d
NOTE:
https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/62f2fda30310c135aabf9c81cce0d1cb77f311e6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/62f2fda30310c135aabf9c81cce0d1cb77f311e6
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
