[Git][security-tracker-team/security-tracker][master] Update status for three older libpod CVES
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5982c43d by Salvatore Bonaccorso at 2020-05-16T06:44:35+02:00
Update status for three older libpod CVES
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -34946,7 +34946,7 @@ CVE-2019-18468
CVE-2019-18467
REJECTED
CVE-2019-18466 (An issue was discovered in Podman in libpod before 1.6.0. It
resolves ...)
- - libpod
+ - libpod (Fixed before initial upload)
CVE-2019-18601 (OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to
denial of ser ...)
{DLA-1982-1}
- openafs 1.8.5-1 (low; bug #943587)
@@ -61163,7 +61163,7 @@ CVE-2019-10153 (A flaw was discovered in fence-agents,
prior to version 4.3.4, w
NOTE: https://github.com/ClusterLabs/fence-agents/pull/255
NOTE: https://github.com/ClusterLabs/fence-agents/pull/272
CVE-2019-10152 (A path traversal vulnerability has been discovered in podman
before ve ...)
- - libpod
+ - libpod (Fixed before initial upload)
CVE-2019-10151
RESERVED
CVE-2019-10150 (It was found that OpenShift Container Platform versions 3.6.x
- 4.6.0 ...)
@@ -113314,7 +113314,7 @@ CVE-2018-10857 (git-annex is vulnerable to a private
data exposure and exfiltrat
NOTE: http://www.openwall.com/lists/oss-security/2018/06/26/4
NOTE:
https://git-annex.branchable.com/security/CVE-2018-10857_and_CVE-2018-10859/
CVE-2018-10856 (It has been discovered that podman before version 0.6.1 does
not drop ...)
- - libpod
+ - libpod (Fixed before initial upload)
CVE-2018-10855 (Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not
honor the n ...)
{DSA-4396-1}
- ansible 2.5.5+dfsg-1 (low)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5982c43d89941b472d437b71cc3b7a0da10b7671
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5982c43d89941b472d437b71cc3b7a0da10b7671
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add information for CVE-2020-1726/libpod
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: ef661241 by Salvatore Bonaccorso at 2020-05-16T06:41:17+02:00 Add information for CVE-2020-1726/libpod - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -30051,6 +30051,9 @@ CVE-2020-1727 RESERVED CVE-2020-1726 (A flaw was discovered in Podman where it incorrectly allows containers ...) - libpod + NOTE: Introduced in: https://github.com/containers/libpod/commit/997c4b56ed2121726e966afe9a102ed16ba78f93 (v1.6.0-rc1) + NOTE: https://github.com/containers/libpod/pull/5168 + NOTE: Fixed by: https://github.com/containers/libpod/commit/c140ecdc9b416ab4efd4d21d14acd63b6adbdd42 (v1.8.1-rc1) CVE-2020-1725 RESERVED CVE-2020-1724 (A flaw was found in Keycloak in versions before 9.0.2. This flaw allow ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ef66124191282486a6617b2ac811c0cfb9d25471 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ef66124191282486a6617b2ac811c0cfb9d25471 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Correct source package name: podman -> libpod
László Böszörményi pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e6d0e97c by Laszlo Boszormenyi (GCS) at 2020-05-16T04:13:57+00:00
Correct source package name: podman - libpod
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -30050,7 +30050,7 @@ CVE-2020-1728 (A vulnerability was found in all
versions of Keycloak where, the
CVE-2020-1727
RESERVED
CVE-2020-1726 (A flaw was discovered in Podman where it incorrectly allows
containers ...)
- - podman
+ - libpod
CVE-2020-1725
RESERVED
CVE-2020-1724 (A flaw was found in Keycloak in versions before 9.0.2. This
flaw allow ...)
@@ -34943,7 +34943,7 @@ CVE-2019-18468
CVE-2019-18467
REJECTED
CVE-2019-18466 (An issue was discovered in Podman in libpod before 1.6.0. It
resolves ...)
- - podman
+ - libpod
CVE-2019-18601 (OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to
denial of ser ...)
{DLA-1982-1}
- openafs 1.8.5-1 (low; bug #943587)
@@ -61160,7 +61160,7 @@ CVE-2019-10153 (A flaw was discovered in fence-agents,
prior to version 4.3.4, w
NOTE: https://github.com/ClusterLabs/fence-agents/pull/255
NOTE: https://github.com/ClusterLabs/fence-agents/pull/272
CVE-2019-10152 (A path traversal vulnerability has been discovered in podman
before ve ...)
- - podman
+ - libpod
CVE-2019-10151
RESERVED
CVE-2019-10150 (It was found that OpenShift Container Platform versions 3.6.x
- 4.6.0 ...)
@@ -113311,7 +113311,7 @@ CVE-2018-10857 (git-annex is vulnerable to a private
data exposure and exfiltrat
NOTE: http://www.openwall.com/lists/oss-security/2018/06/26/4
NOTE:
https://git-annex.branchable.com/security/CVE-2018-10857_and_CVE-2018-10859/
CVE-2018-10856 (It has been discovered that podman before version 0.6.1 does
not drop ...)
- - podman
+ - libpod
CVE-2018-10855 (Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not
honor the n ...)
{DSA-4396-1}
- ansible 2.5.5+dfsg-1 (low)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e6d0e97c47e2e5f34f8953b43f7aa74d9f252692
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e6d0e97c47e2e5f34f8953b43f7aa74d9f252692
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] podman entered the archive, move from itp status to unfixed for further checks
László Böszörményi pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b7685fa8 by Laszlo Boszormenyi (GCS) at 2020-05-16T04:03:39+00:00
podman entered the archive, move from itp status to unfixed for further checks
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -30050,7 +30050,7 @@ CVE-2020-1728 (A vulnerability was found in all
versions of Keycloak where, the
CVE-2020-1727
RESERVED
CVE-2020-1726 (A flaw was discovered in Podman where it incorrectly allows
containers ...)
- - podman (bug #930440)
+ - podman
CVE-2020-1725
RESERVED
CVE-2020-1724 (A flaw was found in Keycloak in versions before 9.0.2. This
flaw allow ...)
@@ -34943,7 +34943,7 @@ CVE-2019-18468
CVE-2019-18467
REJECTED
CVE-2019-18466 (An issue was discovered in Podman in libpod before 1.6.0. It
resolves ...)
- - podman (bug #930440)
+ - podman
CVE-2019-18601 (OpenAFS before 1.6.24 and 1.8.x before 1.8.5 is prone to
denial of ser ...)
{DLA-1982-1}
- openafs 1.8.5-1 (low; bug #943587)
@@ -61160,7 +61160,7 @@ CVE-2019-10153 (A flaw was discovered in fence-agents,
prior to version 4.3.4, w
NOTE: https://github.com/ClusterLabs/fence-agents/pull/255
NOTE: https://github.com/ClusterLabs/fence-agents/pull/272
CVE-2019-10152 (A path traversal vulnerability has been discovered in podman
before ve ...)
- - podman (bug #930440)
+ - podman
CVE-2019-10151
RESERVED
CVE-2019-10150 (It was found that OpenShift Container Platform versions 3.6.x
- 4.6.0 ...)
@@ -113311,7 +113311,7 @@ CVE-2018-10857 (git-annex is vulnerable to a private
data exposure and exfiltrat
NOTE: http://www.openwall.com/lists/oss-security/2018/06/26/4
NOTE:
https://git-annex.branchable.com/security/CVE-2018-10857_and_CVE-2018-10859/
CVE-2018-10856 (It has been discovered that podman before version 0.6.1 does
not drop ...)
- - podman (bug #930440)
+ - podman
CVE-2018-10855 (Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not
honor the n ...)
{DSA-4396-1}
- ansible 2.5.5+dfsg-1 (low)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b7685fa80a5d55961d7effce28c79616ab003f27
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b7685fa80a5d55961d7effce28c79616ab003f27
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
Processing 9a29b8b0666d29c2c23598c7d3ca4cf02ab86dae failed
The error message was: data/CVE/list:30052: ITPed package podman is in the archive data/CVE/list:34945: ITPed package podman is in the archive data/CVE/list:61162: ITPed package podman is in the archive data/CVE/list:113313: ITPed package podman is in the archive make: *** [Makefile:34: all] Error 1 ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reserve DSA number for apache-log4j1.2 update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
9a29b8b0 by Salvatore Bonaccorso at 2020-05-16T00:10:42+02:00
Reserve DSA number for apache-log4j1.2 update
- - - - -
2 changed files:
- data/DSA/list
- data/dsa-needed.txt
Changes:
=
data/DSA/list
=
@@ -1,3 +1,7 @@
+[16 May 2020] DSA-4686-1 apache-log4j1.2 - security update
+ {CVE-2019-17571}
+ [stretch] - apache-log4j1.2 1.2.17-7+deb9u1
+ [buster] - apache-log4j1.2 1.2.17-8+deb10u1
[14 May 2020] DSA-4685-1 apt - security update
{CVE-2020-3810}
[stretch] - apt 1.4.10
=
data/dsa-needed.txt
=
@@ -11,9 +11,6 @@ To pick an issue, simply add your uid behind it.
If needed, specify the release by adding a slash after the name of the source
package.
---
-apache-log4j1.2
- Maintaner proposed to address this via a DSA, sent debdiffs for review
--
chromium
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9a29b8b0666d29c2c23598c7d3ca4cf02ab86dae
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9a29b8b0666d29c2c23598c7d3ca4cf02ab86dae
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add new FreeRDP issues
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8337b9ef by Salvatore Bonaccorso at 2020-05-15T23:13:17+02:00 Add new FreeRDP issues - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -4846,15 +4846,30 @@ CVE-2020-11526 (libfreerdp/core/update.c in FreeRDP versions 1.1 through 2. NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/192856cb59974ee4d7d3e72cbeafa676aa7565cf NOTE: https://github.com/FreeRDP/FreeRDP/issues/6012 CVE-2020-11525 (libfreerdp/cache/bitmap.c in FreeRDP versions 1.0 through 2.0.0-r ...) - TODO: check + - freerdp2 + - freerdp + NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9755-fphh-gmjg + NOTE: https://github.com/FreeRDP/FreeRDP/commit/0b6b92a25a77d533b8a92d6acc840a81e103684e CVE-2020-11524 (libfreerdp/codec/interleaved.c in FreeRDP versions 1.0 through 2. ...) - TODO: check + - freerdp2 + - freerdp + NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgw8-3mp2-p5qw + NOTE: https://github.com/FreeRDP/FreeRDP/commit/7b1d4b49391b4512402840431757703a96946820 CVE-2020-11523 (libfreerdp/gdi/region.c in FreeRDP versions 1.0 through 2.0.0-rc4 ...) - TODO: check + - freerdp2 + - freerdp + NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qrh-8cp8-4x42 + NOTE: https://github.com/FreeRDP/FreeRDP/commit/ce21b9d7ecd967e0bc98ed31a6b3757848aa6c9e CVE-2020-11522 (libfreerdp/gdi/gdi.c in FreeRDP 1.0 through 2.0.0-rc4 has an Out- ...) - TODO: check + - freerdp2 + - freerdp + NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-48wx-7vgj-fffh + NOTE: https://github.com/FreeRDP/FreeRDP/commit/907640a924fa7a9a99c80a48ac225e9d8e41548b CVE-2020-11521 (libfreerdp/codec/planar.c in FreeRDP version 1.0 through 2.0.0-rc ...) - TODO: check + - freerdp2 + - freerdp + NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5cwc-6wc9-255w + NOTE: https://github.com/FreeRDP/FreeRDP/commit/17f547ae11835bb11baa3d045245dc1694866845 CVE-2020-11520 RESERVED CVE-2020-11519 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8337b9ef469f633a5f7d4bd9cd3f991c03cd54ff -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8337b9ef469f633a5f7d4bd9cd3f991c03cd54ff You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Update notes for CVE-2020-12762/json-c
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c6fe75e8 by Salvatore Bonaccorso at 2020-05-15T22:51:32+02:00
Update notes for CVE-2020-12762/json-c
Include two additional commits to address the regression (for the master
branch) and reference the pull request including backports for 0.13.x,
0.12.x, 0.11 and 0.10.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -703,12 +703,15 @@ CVE-2020-12763 (TRENDnet ProView Wireless camera
TV-IP512WN 1.0R 1.0.4 is vulner
CVE-2020-12762 (json-c through 0.14 has an integer overflow and out-of-bounds
write vi ...)
- json-c (bug #960326)
NOTE: https://github.com/json-c/json-c/pull/592
- NOTE:
https://github.com/json-c/json-c/commit/77d935b7ae7871a1940cd827e850e6063044ec45
NOTE:
https://github.com/json-c/json-c/commit/099016b7e8d70a6d5dd814e788bba08d33d48426
+ NOTE:
https://github.com/json-c/json-c/commit/77d935b7ae7871a1940cd827e850e6063044ec45
NOTE:
https://github.com/json-c/json-c/commit/d07b91014986900a3a75f306d302e13e005e9d67
+ NOTE:
https://github.com/json-c/json-c/commit/519dfe1591d85432986f9762d41d1a883198c157
+ NOTE:
https://github.com/json-c/json-c/commit/a59d5acfab4485d5133114df61785b1fc633e0c6
NOTE: d07b91014986 ("Fix integer overflows.") introduces a regression
tracked as:
NOTE: https://github.com/json-c/json-c/issues/599
NOTE: https://github.com/json-c/json-c/pull/610
+ NOTE: Working backports for older branches:
https://github.com/json-c/json-c/pull/608
CVE-2020-12761 (modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer
overflow ( ...)
- imlib2 1.6.1-2 (bug #960192)
[buster] - imlib2 (Vulnerable code introduced later)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c6fe75e8ee2ce0cd9af1849179f01b12a45fc943
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c6fe75e8ee2ce0cd9af1849179f01b12a45fc943
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 06d38b00 by Salvatore Bonaccorso at 2020-05-15T22:25:40+02:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,7 +1,7 @@ CVE-2020-13094 RESERVED CVE-2020-13093 (iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal. ...) - TODO: check + NOT-FOR-US: iSpyConnect.com Agent DVR CVE-2020-13092 (scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute ...) TODO: check CVE-2020-13091 (pandas through 1.0.3 can unserialize and execute commands from an untr ...) @@ -409,7 +409,7 @@ CVE-2020-12891 CVE-2020-12890 RESERVED CVE-2020-12889 (MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across us ...) - TODO: check + NOT-FOR-US: MISP CVE-2020-12888 (The VFIO PCI driver in the Linux kernel through 5.6.13 mishandles atte ...) - linux NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1836244 @@ -520,7 +520,7 @@ CVE-2020-12836 CVE-2020-12835 RESERVED CVE-2020-12834 (eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 thr ...) - TODO: check + NOT-FOR-US: eQ-3 Homematic Central Control Unit CVE-2020-12833 RESERVED CVE-2020-12832 (The simple-file-list plugin before 4.2.8 for WordPress mishandles a .. ...) @@ -606,7 +606,7 @@ CVE-2020-12800 CVE-2020-12799 RESERVED CVE-2020-12798 (Cellebrite UFED 5.0 to 7.5.0.845 implements local operating system pol ...) - TODO: check + NOT-FOR-US: Cellebrite UFED CVE-2020-12797 RESERVED CVE-2020-12796 @@ -867,7 +867,7 @@ CVE-2020-12687 (An issue was discovered in Serpico before 1.3.3. The /admin/atta CVE-2020-12686 RESERVED CVE-2020-12685 (XSS in the admin help system admin/help.html and admin/quicklinks.html ...) - TODO: check + NOT-FOR-US: Interchange CVE-2020-12684 RESERVED CVE-2020-12683 (Katyshop2 before 2.12 has multiple stored XSS issues. ...) @@ -10819,7 +10819,7 @@ CVE-2020-9075 CVE-2020-9074 RESERVED CVE-2020-9073 (Huawei P20 smartphones with versions earlier than 10.0.0.156(C00E156R1 ...) - TODO: check + NOT-FOR-US: Huawei CVE-2020-9072 (Huawei OSD product with versions earlier than OSD_uwp_9.0.32.0 have a ...) NOT-FOR-US: Huawei CVE-2020-9071 @@ -13064,7 +13064,7 @@ CVE-2020-8102 CVE-2020-8101 RESERVED CVE-2020-8100 (Improper Input Validation vulnerability in the cevakrnl.rv0 module as ...) - TODO: check + NOT-FOR-US: Bitdefender CVE-2020-8099 (A vulnerability in the improper handling of junctions in Bitdefender A ...) NOT-FOR-US: Bitdefender Antivirus Free CVE-2020-8098 @@ -14545,7 +14545,7 @@ CVE-2020-7472 CVE-2019-20390 (A Cross-Site Request Forgery (CSRF) vulnerability was discovered in Su ...) TODO: check CVE-2019-20389 (An XSS issue was identified on the Subrion CMS 4.2.1 /panel/configurat ...) - TODO: check + NOT-FOR-US: Subrion CMS CVE-2019-20388 (xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaV ...) - libxml2 2.9.10+dfsg-2.1 (bug #949583) [buster] - libxml2 (Minor issue) @@ -29491,7 +29491,7 @@ CVE-2020-1810 (There is a weak algorithm vulnerability in some Huawei products. CVE-2020-1809 RESERVED CVE-2020-1808 (Huawei smartphones Honor View 20;Honor 20;Honor 20 PRO;Honor Magic2 wi ...) - TODO: check + NOT-FOR-US: Huawei CVE-2020-1807 (HUAWEI Mate 20 smartphones with versions earlier than 10.0.0.188(C00E7 ...) NOT-FOR-US: Huawei CVE-2020-1806 (Huawei Honor V10 smartphones with versions earlier than 10.0.0.156(C00 ...) @@ -34237,7 +34237,7 @@ CVE-2019-18668 (An issue was discovered in the Currency Switcher addon before 2. CVE-2019-18667 (/usr/local/www/freeradius_view_config.php in the freeradius3 package b ...) NOT-FOR-US: FreeBSD specific freeradius_view_config.php in the freeradius3 package CVE-2019-18666 (An issue was discovered on D-Link DAP-1360 revision F devices. Remote ...) - TODO: check + NOT-FOR-US: D-Link CVE-2019-18665 (The Log module in SECUDOS DOMOS before 5.6 allows local file inclusion ...) NOT-FOR-US: SECUDOS DOMOS CVE-2019-18664 (The Log module in SECUDOS DOMOS before 5.6 allows XSS. ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/06d38b00f8bfe43e853582d286d2dfc65776d913 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/06d38b00f8bfe43e853582d286d2dfc65776d913 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net
[Git][security-tracker-team/security-tracker][master] Update notes for CVE-2020-12762/json-c
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
045d8c1a by Salvatore Bonaccorso at 2020-05-15T22:21:00+02:00
Update notes for CVE-2020-12762/json-c
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -706,6 +706,9 @@ CVE-2020-12762 (json-c through 0.14 has an integer overflow
and out-of-bounds wr
NOTE:
https://github.com/json-c/json-c/commit/77d935b7ae7871a1940cd827e850e6063044ec45
NOTE:
https://github.com/json-c/json-c/commit/099016b7e8d70a6d5dd814e788bba08d33d48426
NOTE:
https://github.com/json-c/json-c/commit/d07b91014986900a3a75f306d302e13e005e9d67
+ NOTE: d07b91014986 ("Fix integer overflows.") introduces a regression
tracked as:
+ NOTE: https://github.com/json-c/json-c/issues/599
+ NOTE: https://github.com/json-c/json-c/pull/610
CVE-2020-12761 (modules/loaders/loader_ico.c in imlib2 1.6.0 has an integer
overflow ( ...)
- imlib2 1.6.1-2 (bug #960192)
[buster] - imlib2 (Vulnerable code introduced later)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/045d8c1a2c2f16fa99a66bad94cfa20579168084
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/045d8c1a2c2f16fa99a66bad94cfa20579168084
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: aea444b0 by security tracker role at 2020-05-15T20:10:21+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,4 +1,416 @@ -CVE-2020-12888 [vfio: access to disabled MMIO space of some devices may lead to DoS scenario] +CVE-2020-13094 + RESERVED +CVE-2020-13093 (iSpyConnect.com Agent DVR before 2.7.1.0 allows directory traversal. ...) + TODO: check +CVE-2020-13092 (scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute ...) + TODO: check +CVE-2020-13091 (pandas through 1.0.3 can unserialize and execute commands from an untr ...) + TODO: check +CVE-2020-13090 + RESERVED +CVE-2020-13089 + RESERVED +CVE-2020-13088 + RESERVED +CVE-2020-13087 + RESERVED +CVE-2020-13086 + RESERVED +CVE-2020-13085 + RESERVED +CVE-2020-13084 + RESERVED +CVE-2020-13083 + RESERVED +CVE-2020-13082 + RESERVED +CVE-2020-13081 + RESERVED +CVE-2020-13080 + RESERVED +CVE-2020-13079 + RESERVED +CVE-2020-13078 + RESERVED +CVE-2020-13077 + RESERVED +CVE-2020-13076 + RESERVED +CVE-2020-13075 + RESERVED +CVE-2020-13074 + RESERVED +CVE-2020-13073 + RESERVED +CVE-2020-13072 + RESERVED +CVE-2020-13071 + RESERVED +CVE-2020-13070 + RESERVED +CVE-2020-13069 + RESERVED +CVE-2020-13068 + RESERVED +CVE-2020-13067 + RESERVED +CVE-2020-13066 + RESERVED +CVE-2020-13065 + RESERVED +CVE-2020-13064 + RESERVED +CVE-2020-13063 + RESERVED +CVE-2020-13062 + RESERVED +CVE-2020-13061 + RESERVED +CVE-2020-13060 + RESERVED +CVE-2020-13059 + RESERVED +CVE-2020-13058 + RESERVED +CVE-2020-13057 + RESERVED +CVE-2020-13056 + RESERVED +CVE-2020-13055 + RESERVED +CVE-2020-13054 + RESERVED +CVE-2020-13053 + RESERVED +CVE-2020-13052 + RESERVED +CVE-2020-13051 + RESERVED +CVE-2020-13050 + RESERVED +CVE-2020-13049 + RESERVED +CVE-2020-13048 + RESERVED +CVE-2020-13047 + RESERVED +CVE-2020-13046 + RESERVED +CVE-2020-13045 + RESERVED +CVE-2020-13044 + RESERVED +CVE-2020-13043 + RESERVED +CVE-2020-13042 + RESERVED +CVE-2020-13041 + RESERVED +CVE-2020-13040 + RESERVED +CVE-2020-13039 + RESERVED +CVE-2020-13038 + RESERVED +CVE-2020-13037 + RESERVED +CVE-2020-13036 + RESERVED +CVE-2020-13035 + RESERVED +CVE-2020-13034 + RESERVED +CVE-2020-13033 + RESERVED +CVE-2020-13032 + RESERVED +CVE-2020-13031 + RESERVED +CVE-2020-13030 + RESERVED +CVE-2020-13029 + RESERVED +CVE-2020-13028 + RESERVED +CVE-2020-13027 + RESERVED +CVE-2020-13026 + RESERVED +CVE-2020-13025 + RESERVED +CVE-2020-13024 + RESERVED +CVE-2020-13023 + RESERVED +CVE-2020-13022 + RESERVED +CVE-2020-13021 + RESERVED +CVE-2020-13020 + RESERVED +CVE-2020-13019 + RESERVED +CVE-2020-13018 + RESERVED +CVE-2020-13017 + RESERVED +CVE-2020-13016 + RESERVED +CVE-2020-13015 + RESERVED +CVE-2020-13014 + RESERVED +CVE-2020-13013 + RESERVED +CVE-2020-13012 + RESERVED +CVE-2020-13011 + RESERVED +CVE-2020-13010 + RESERVED +CVE-2020-13009 + RESERVED +CVE-2020-13008 + RESERVED +CVE-2020-13007 + RESERVED +CVE-2020-13006 + RESERVED +CVE-2020-13005 + RESERVED +CVE-2020-13004 + RESERVED +CVE-2020-13003 + RESERVED +CVE-2020-13002 + RESERVED +CVE-2020-13001 + RESERVED +CVE-2020-13000 + RESERVED +CVE-2020-12999 + RESERVED +CVE-2020-12998 + RESERVED +CVE-2020-12997 + RESERVED +CVE-2020-12996 + RESERVED +CVE-2020-12995 + RESERVED +CVE-2020-12994 + RESERVED +CVE-2020-12993 + RESERVED +CVE-2020-12992 + RESERVED +CVE-2020-12991 + RESERVED +CVE-2020-12990 + RESERVED +CVE-2020-12989 + RESERVED +CVE-2020-12988 + RESERVED +CVE-2020-12987 + RESERVED +CVE-2020-12986 + RESERVED +CVE-2020-12985 + RESERVED +CVE-2020-12984 + RESERVED +CVE-2020-12983 + RESERVED +CVE-2020-12982 + RESERVED +CVE-2020-12981 + RESERVED +CVE-2020-12980 + RESERVED +CVE-2020-12979 + RESERVED +CVE-2020-12978 + RESERVED +CVE-2020-12977 + RESERVED +CVE-2020-12976 + RESERVED +CVE-2020-12975 + RESERVED +CVE-2020-12974 + RESERVED +CVE-2020-12973 + RESERVED +CVE-2020-12972 + RESERVED +CVE-2020-12971 + RESERVED +CVE-2020-12970 + RESERVED +CVE-2020-12969 + RESERVED +CVE-2020-12968 + RESERVED +CVE-2020-12967 + RESERVED +CVE-2020-12966 + RESERVED +CVE-2020-12965 + RESERVED +CVE-2020-12964 +
[Git][security-tracker-team/security-tracker][master] Add CVE-2020-12888/linux
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 5d93d603 by Salvatore Bonaccorso at 2020-05-15T21:32:16+02:00 Add CVE-2020-12888/linux - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,3 +1,6 @@ +CVE-2020-12888 [vfio: access to disabled MMIO space of some devices may lead to DoS scenario] + - linux + NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1836244 CVE-2020-12887 RESERVED CVE-2020-12886 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5d93d603da96dd61881fbe345a48d568e545b63f -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5d93d603da96dd61881fbe345a48d568e545b63f You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add fixed version for CVE-2020-12823/openconnect via unstable
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 747ead2c by Salvatore Bonaccorso at 2020-05-15T20:50:02+02:00 Add fixed version for CVE-2020-12823/openconnect via unstable - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -140,7 +140,7 @@ CVE-2020-12825 (libcroco through 0.6.13 has excessive recursion in cr_parser_par CVE-2020-12824 RESERVED CVE-2020-12823 (OpenConnect 8.09 has a buffer overflow, causing a denial of service (a ...) - - openconnect (bug #960620) + - openconnect 8.10-1 (bug #960620) NOTE: https://gitlab.com/openconnect/openconnect/-/merge_requests/108 CVE-2020-12822 RESERVED View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/747ead2c4cdb29722ae022f14a50c9a40e6610e8 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/747ead2c4cdb29722ae022f14a50c9a40e6610e8 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 72a5f7f9 by Salvatore Bonaccorso at 2020-05-15T14:11:21+02:00 Process NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -9,7 +9,7 @@ CVE-2020-12884 CVE-2020-12883 RESERVED CVE-2020-12882 (Submitty through 20.04.01 allows XSS via upload of an SVG document, as ...) - TODO: check + NOT-FOR-US: Submitty CVE-2020-12881 RESERVED CVE-2020-12880 @@ -1914,7 +1914,7 @@ CVE-2020-12070 (The Advanced Woo Search plugin version through 1.99 for Wordpres CVE-2020-12069 RESERVED CVE-2020-12068 (An issue was discovered in CODESYS Development System before 3.5.16.0. ...) - TODO: check + NOT-FOR-US: CODESYS CVE-2020-12067 RESERVED CVE-2020-12066 (CServer::SendMsg in engine/server/server.cpp in Teeworlds 0.7.x before ...) @@ -1977,7 +1977,7 @@ CVE-2020-12048 CVE-2020-12047 RESERVED CVE-2020-12046 (Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACs firmwar ...) - TODO: check + NOT-FOR-US: Opto 22 SoftPAC Project CVE-2020-12045 RESERVED CVE-2020-12044 @@ -1985,7 +1985,7 @@ CVE-2020-12044 CVE-2020-12043 RESERVED CVE-2020-12042 (Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified within ...) - TODO: check + NOT-FOR-US: Opto 22 SoftPAC Project CVE-2020-12041 RESERVED CVE-2020-12040 @@ -6921,7 +6921,7 @@ CVE-2020-10622 (LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product CVE-2020-10621 (Multiple issues exist that allow files to be uploaded and executed on ...) NOT-FOR-US: WebAccess/NMS CVE-2020-10620 (Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC communication d ...) - TODO: check + NOT-FOR-US: Opto 22 SoftPAC Project CVE-2020-10619 (An attacker could use a specially crafted URL to delete files outside ...) NOT-FOR-US: WebAccess/NMS CVE-2020-10618 (LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product is vu ...) @@ -6929,7 +6929,7 @@ CVE-2020-10618 (LCDS LAquis SCADA Versions 4.3.1 and prior. The affected product CVE-2020-10617 (There are multiple ways an unauthenticated attacker could perform SQL ...) NOT-FOR-US: WebAccess/NMS CVE-2020-10616 (Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specif ...) - TODO: check + NOT-FOR-US: Opto 22 SoftPAC Project CVE-2020-10615 (Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41 ...) NOT-FOR-US: Triangle MicroWorks SCADA Data Gateway CVE-2020-10614 @@ -6937,7 +6937,7 @@ CVE-2020-10614 CVE-2020-10613 (Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41 ...) NOT-FOR-US: Triangle MicroWorks SCADA Data Gateway CVE-2020-10612 (Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent communicat ...) - TODO: check + NOT-FOR-US: Opto 22 SoftPAC Project CVE-2020-10611 (Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122, 2.41 ...) NOT-FOR-US: Triangle MicroWorks SCADA Data Gateway CVE-2020-10610 @@ -44902,7 +44902,7 @@ CVE-2019-15085 (An issue was discovered in PRiSE adAS 1.7.0. The current databas CVE-2019-15084 (Realtek Waves MaxxAudio driver 1.6.2.0, as used on Dell laptops, insta ...) NOT-FOR-US: Realtek CVE-2019-15083 (Default installations of Zoho ManageEngine ServiceDesk Plus 10.0 befor ...) - TODO: check + NOT-FOR-US: Zoho ManageEngine CVE-2018-20974 (The js-jobs plugin before 1.0.7 for WordPress has CSRF. ...) NOT-FOR-US: js-jobs plugin for WordPress CVE-2018-20973 (The companion-auto-update plugin before 3.2.1 for WordPress has local ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72a5f7f9de54ced2f36d73b64568a8a07b2bbc38 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/72a5f7f9de54ced2f36d73b64568a8a07b2bbc38 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Correct version number for DLA-2211-1 prior to upload.
Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker
Commits:
68ab5cfc by Chris Lamb at 2020-05-15T13:03:27+01:00
Correct version number for DLA-2211-1 prior to upload.
- - - - -
1 changed file:
- data/DLA/list
Changes:
=
data/DLA/list
=
@@ -1,6 +1,6 @@
[15 May 2020] DLA-2211-1 log4net - security update
{CVE-2018-1285}
- [jessie] - log4net 1.2.10+dfsg-6
+ [jessie] - log4net 1.2.10+dfsg-6+deb8u1
[15 May 2020] DLA-2210-1 apt - security update
{CVE-2020-3810}
[jessie] - apt 1.0.9.8.6
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68ab5cfcfdff90d823c5d6a8a16343b2c0c82d12
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/68ab5cfcfdff90d823c5d6a8a16343b2c0c82d12
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reserve DLA-2211-1 for log4net
Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker
Commits:
4bce696a by Chris Lamb at 2020-05-15T12:57:59+01:00
Reserve DLA-2211-1 for log4net
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[15 May 2020] DLA-2211-1 log4net - security update
+ {CVE-2018-1285}
+ [jessie] - log4net 1.2.10+dfsg-6
[15 May 2020] DLA-2210-1 apt - security update
{CVE-2020-3810}
[jessie] - apt 1.0.9.8.6
=
data/dla-needed.txt
=
@@ -79,8 +79,6 @@ linux (Ben Hutchings)
--
linux-4.9 (Ben Hutchings)
--
-log4net (Chris Lamb)
---
mumble (Abhijith PA)
NOTE: 20200325: Regression in last upload, forgot to follow up.
NOTE: 20200325: https://github.com/mumble-voip/mumble/issues/3605 (abhijith)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4bce696a2ca39d79aec229c64741cf323bbe520a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4bce696a2ca39d79aec229c64741cf323bbe520a
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for CVE-2020-8159/ruby-actionpack-page-caching
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 5c7233ca by Salvatore Bonaccorso at 2020-05-15T13:39:08+02:00 Add Debian bug reference for CVE-2020-8159/ruby-actionpack-page-caching - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -12506,7 +12506,7 @@ CVE-2020-8161 CVE-2020-8160 RESERVED CVE-2020-8159 (There is a vulnerability in actionpack_page-caching gem v1.2.1 th ...) - - ruby-actionpack-page-caching + - ruby-actionpack-page-caching (bug #960680) NOTE: https://groups.google.com/forum/#!topic/rubyonrails-security/CFRVkEytdP8 CVE-2020-8158 RESERVED View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c7233caefd6b454ea8816ca294896116197e736 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5c7233caefd6b454ea8816ca294896116197e736 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add notes for CVE-2020-10744
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: afe8ef52 by Salvatore Bonaccorso at 2020-05-15T13:13:19+02:00 Add notes for CVE-2020-10744 - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -6484,10 +6484,13 @@ CVE-2020-10746 RESERVED CVE-2020-10745 RESERVED -CVE-2020-10744 +CVE-2020-10744 [incomplete fix for CVE-2020-1733] RESERVED - ansible + [buster] - ansible (Incomplete fix not applied) + [stretch] - ansible (Incomplete fix not applied) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1835566 + NOTE: CVE is for an incomplete fix of CVE-2020-1733 CVE-2020-10743 RESERVED - kibana (bug #700337) @@ -29592,6 +29595,8 @@ CVE-2020-1733 (A race condition flaw was found in Ansible Engine 2.7.17 and prio NOTE: https://github.com/ansible/ansible/issues/67791 NOTE: https://github.com/ansible/ansible/pull/68921 NOTE: https://github.com/ansible/ansible/commit/8077d8e40148fe77e2393caa5f2b2ea855149d63 + NOTE: When applying the fix for CVE-2020-1733 make sure to apply complete fix to + NOTE: not open up CVE-2020-10744. CVE-2020-1732 (A flaw was found in Soteria before 1.0.1, in a way that multiple reque ...) - wildfly (bug #752018) CVE-2020-1731 (A flaw was found in all versions of the Keycloak operator, before vers ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/afe8ef5207e276b289ae1b4dbed030c6e89376e3 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/afe8ef5207e276b289ae1b4dbed030c6e89376e3 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] CVE-2019-20637/varnish: jessie not-affected
Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker Commits: 58040b35 by Sylvain Beucler at 2020-05-15T11:34:03+02:00 CVE-2019-20637/varnish: jessie not-affected - - - - - 2 changed files: - data/CVE/list - data/dla-needed.txt Changes: = data/CVE/list = @@ -3855,9 +3855,11 @@ CVE-2020-11647 (In Wireshark 3.2.0 to 3.2.2, 3.0.0 to 3.0.9, and 2.6.0 to 2.6.15 NOTE: https://www.wireshark.org/security/wnpa-sec-2020-07.html CVE-2019-20637 (An issue was discovered in Varnish Cache before 6.0.5 LTS, 6.1.x and 6 ...) - varnish 6.4.0-1 (bug #956305) + [jessie] - varnish (Vulnerability introduced later, PoC not leaking) NOTE: http://varnish-cache.org/security/VSV4.html#vsv4 NOTE: https://github.com/varnishcache/varnish-cache/commit/bd7b3d6d47ccbb5e1747126f8e2a297f38e56b8c (6.x fix) NOTE: https://github.com/varnishcache/varnish-cache/commit/0c9c38513bdb7730ac886eba7563f2d87894d734 (test case / reproducer) + NOTE: Introduced in https://github.com/varnishcache/varnish-cache/commit/62932b422f311ed1224f14a216169bcdc1b77a2d (5.0) NOTE: Case #3 implies labels introduced in https://github.com/varnishcache/varnish-cache/commit/34350d5e183ef4e04285729d1f63b784d1bc6454 (5.0) CVE-2020-11646 RESERVED = data/dla-needed.txt = @@ -115,15 +115,6 @@ tomcat8 tzdata NOTE: 20200514: LTS update must wait on oldstable update first to prevent newer version in LTS (roberto) -- -varnish (Sylvain Beucler) - NOTE: 20200410: There was a reworking of the functions in cache_req_fsm.c - NOTE: 20200410: compared to HEAD, but a glance suggests that the underlying - NOTE: 20200410: reset of err_code and err_reason still might need doing, but - NOTE: 20200410: I don't quite understand the restart/synthetic requests. (lamby) - NOTE: 20200424: Getting diagnostic info from upstream, cf. #956305 (Beuc) - NOTE: 20200506: Not enough info so far, ping'd varnish-misc ML (Beuc) - NOTE: 20200512: Not enough info so far, ping'd security contacts (Beuc) --- xcftools (Anton Gladky) NOTE: 20200111: wrote a patch + reproducer for CVE-2019-5086, waiting for upstream review (hle) NOTE: 20200414: Flurry of activity on/around 20200401 essentially rejecting original patch View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/58040b35d3db55baa077ffe425a0b7d8d989980b -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/58040b35d3db55baa077ffe425a0b7d8d989980b You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
04b6343e by security tracker role at 2020-05-15T08:10:20+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -1,3 +1,23 @@
+CVE-2020-12887
+ RESERVED
+CVE-2020-12886
+ RESERVED
+CVE-2020-12885
+ RESERVED
+CVE-2020-12884
+ RESERVED
+CVE-2020-12883
+ RESERVED
+CVE-2020-12882 (Submitty through 20.04.01 allows XSS via upload of an SVG
document, as ...)
+ TODO: check
+CVE-2020-12881
+ RESERVED
+CVE-2020-12880
+ RESERVED
+CVE-2020-12879
+ RESERVED
+CVE-2020-12878
+ RESERVED
CVE-2020-12877 (Veritas APTARE versions prior to 10.4 allowed sensitive
information to ...)
NOT-FOR-US: Veritas
CVE-2020-12876 (Veritas APTARE versions prior to 10.4 allowed remote users to
access s ...)
@@ -992,8 +1012,8 @@ CVE-2020-12442 (Ivanti Avalanche 6.3 allows a SQL
injection that is vaguely asso
NOT-FOR-US: Ivanti
CVE-2020-12441
RESERVED
-CVE-2020-12440
- RESERVED
+CVE-2020-12440 (NGINX through 1.18.0 allows an HTTP request smuggling attack
that can ...)
+ TODO: check
CVE-2020-12439 (Grin before 3.1.0 allows attackers to adversely affect
availability of ...)
NOT-FOR-US: Grin
CVE-2020-12438 (An XSS vulnerability exists in the banners.php page of
PHP-Fusion 9.03 ...)
@@ -1893,8 +1913,8 @@ CVE-2020-12070 (The Advanced Woo Search plugin version
through 1.99 for Wordpres
NOT-FOR-US: Advanced Woo Search plugin for WordPress
CVE-2020-12069
RESERVED
-CVE-2020-12068
- RESERVED
+CVE-2020-12068 (An issue was discovered in CODESYS Development System before
3.5.16.0. ...)
+ TODO: check
CVE-2020-12067
RESERVED
CVE-2020-12066 (CServer::SendMsg in engine/server/server.cpp in Teeworlds
0.7.x before ...)
@@ -1956,16 +1976,16 @@ CVE-2020-12048
RESERVED
CVE-2020-12047
RESERVED
-CVE-2020-12046
- RESERVED
+CVE-2020-12046 (Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACs
firmwar ...)
+ TODO: check
CVE-2020-12045
RESERVED
CVE-2020-12044
RESERVED
CVE-2020-12043
RESERVED
-CVE-2020-12042
- RESERVED
+CVE-2020-12042 (Opto 22 SoftPAC Project Version 9.6 and prior. Paths specified
within ...)
+ TODO: check
CVE-2020-12041
RESERVED
CVE-2020-12040
@@ -2208,8 +2228,7 @@ CVE-2020-11933
RESERVED
CVE-2020-11932 (It was discovered that the Subiquity installer for Ubuntu
Server logge ...)
NOT-FOR-US: Subiquity installer for Ubuntu
-CVE-2020-11931
- RESERVED
+CVE-2020-11931 (An Ubuntu-specific modification to Pulseaudio to provide
security medi ...)
NOT-FOR-US: Ubuntu snap packaging of Pulseaudio
CVE-2018-21231 (Certain NETGEAR devices are affected by incorrect
configuration of sec ...)
NOT-FOR-US: Netgear
@@ -6896,24 +6915,24 @@ CVE-2020-10622 (LCDS LAquis SCADA Versions 4.3.1 and
prior. The affected product
NOT-FOR-US: LCDS LAquis SCADA
CVE-2020-10621 (Multiple issues exist that allow files to be uploaded and
executed on ...)
NOT-FOR-US: WebAccess/NMS
-CVE-2020-10620
- RESERVED
+CVE-2020-10620 (Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC
communication d ...)
+ TODO: check
CVE-2020-10619 (An attacker could use a specially crafted URL to delete files
outside ...)
NOT-FOR-US: WebAccess/NMS
CVE-2020-10618 (LCDS LAquis SCADA Versions 4.3.1 and prior. The affected
product is vu ...)
NOT-FOR-US: LCDS LAquis SCADA
CVE-2020-10617 (There are multiple ways an unauthenticated attacker could
perform SQL ...)
NOT-FOR-US: WebAccess/NMS
-CVE-2020-10616
- RESERVED
+CVE-2020-10616 (Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does
not specif ...)
+ TODO: check
CVE-2020-10615 (Triangle MicroWorks SCADA Data Gateway 3.02.0697 through
4.0.122, 2.41 ...)
NOT-FOR-US: Triangle MicroWorks SCADA Data Gateway
CVE-2020-10614
RESERVED
CVE-2020-10613 (Triangle MicroWorks SCADA Data Gateway 3.02.0697 through
4.0.122, 2.41 ...)
NOT-FOR-US: Triangle MicroWorks SCADA Data Gateway
-CVE-2020-10612
- RESERVED
+CVE-2020-10612 (Opto 22 SoftPAC Project Version 9.6 and prior. SoftPACAgent
communicat ...)
+ TODO: check
CVE-2020-10611 (Triangle MicroWorks SCADA Data Gateway 3.02.0697 through
4.0.122, 2.41 ...)
NOT-FOR-US: Triangle MicroWorks SCADA Data Gateway
CVE-2020-10610
@@ -23621,7 +23640,7 @@ CVE-2020-3811
RESERVED
CVE-2020-3810 [apt out-of-bounds read in .ar/.tar implemations]
RESERVED
- {DSA-4685-1}
+ {DSA-4685-1 DLA-2210-1}
- apt 2.1.2
NOTE: https://github.com/Debian/apt/issues/111
NOTE: https://bugs.launchpad.net/bugs/1878177
@@ -35751,10 +35770,10 @@ CVE-2020-0223
RESERVED
[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: e2d4fef9 by Moritz Muehlenhoff at 2020-05-15T09:54:45+02:00 NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -5364,11 +5364,11 @@ CVE-2020-11075 CVE-2020-11074 RESERVED CVE-2020-11073 (In Autoswitch Python Virtualenv before version 0.16.0, a user who ente ...) - TODO: check + NOT-FOR-US: zsh-autoswitch-virtualenv CVE-2020-11072 (In SLP Validate (npm package slp-validate) before version 1.2.1, users ...) - TODO: check + NOT-FOR-US: Node slp-validate CVE-2020-11071 (SLPJS (npm package slpjs) before version 0.27.2, has a vulnerability w ...) - TODO: check + NOT-FOR-US: Node slpjs CVE-2020-11070 (The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulne ...) NOT-FOR-US: TYPO3 CVE-2020-11069 (In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has be ...) @@ -10798,7 +10798,7 @@ CVE-2020-8901 CVE-2020-8900 RESERVED CVE-2020-8899 (There is a buffer overwrite vulnerability in the Quram qmg library of ...) - TODO: check + NOT-FOR-US: Samsung CVE-2020-8898 RESERVED CVE-2020-8897 @@ -12489,13 +12489,13 @@ CVE-2020-8158 CVE-2020-8157 (UniFi Cloud Key firmware = v1.1.10 for Cloud Key gen2 and Cloud Ke ...) NOT-FOR-US: UniFi Cloud Key CVE-2020-8156 (A missing verification of the TLS host in Nextcloud Mail 1.1.3 allowed ...) - TODO: check + NOT-FOR-US: Nextcloud Mail CVE-2020-8155 (An outdated 3rd party library in the Files PDF viewer for Nextcloud Se ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2020-8154 (An Insecure direct object reference vulnerability in Nextcloud Server ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2020-8153 (Improper access control in Groupfolders app 4.0.3 allowed to delete hi ...) - TODO: check + NOT-FOR-US: Nextcloud Groupfolders app CVE-2020-8152 RESERVED CVE-2020-8151 (There is a possible information disclosure issue in Active Resource ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e2d4fef9678aa4bad7a23f27510a150c96456897 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e2d4fef9678aa4bad7a23f27510a150c96456897 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new QT issue (n/a)
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 757848bd by Moritz Muehlenhoff at 2020-05-15T09:46:08+02:00 new QT issue (n/a) - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1464,7 +1464,10 @@ CVE-2020-12268 (jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20332 NOTE: https://github.com/ArtifexSoftware/jbig2dec/commit/0726320a4b55078e9d8deb590e477d598b3da66e CVE-2020-12267 (setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextM ...) - TODO: check + - qtbase-opensource-src (Vulnerable code not present) + NOTE: https://github.com/qt/qtbase/commit/7447e2b337f12b4d04935d0f30fc673e4327d5a0 + NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20450 + NOTE: The 5.14 in experimental contains the code, but is already fixed CVE-2019-20790 (OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, ...) - opendmarc NOTE: https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/757848bd7796bbb9bdcce02d8dc98534cc103a46 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/757848bd7796bbb9bdcce02d8dc98534cc103a46 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new ruby-actionpack-page-caching issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: de7acad2 by Moritz Muehlenhoff at 2020-05-15T09:37:45+02:00 new ruby-actionpack-page-caching issue new qemu issue (unfixed upstream) NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,11 +1,11 @@ CVE-2020-12877 (Veritas APTARE versions prior to 10.4 allowed sensitive information to ...) - TODO: check + NOT-FOR-US: Veritas CVE-2020-12876 (Veritas APTARE versions prior to 10.4 allowed remote users to access s ...) - TODO: check + NOT-FOR-US: Veritas CVE-2020-12875 (Veritas APTARE versions prior to 10.4 did not perform adequate authori ...) - TODO: check + NOT-FOR-US: Veritas CVE-2020-12874 (Veritas APTARE versions prior to 10.4 included code that bypassed the ...) - TODO: check + NOT-FOR-US: Veritas CVE-2020-12873 RESERVED CVE-2020-12872 @@ -98,6 +98,9 @@ CVE-2020-12830 RESERVED CVE-2020-12829 RESERVED + - qemu + NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1808510 + NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1786026 CVE-2020-12828 RESERVED CVE-2020-12827 @@ -223,7 +226,7 @@ CVE-2020-12783 (Exim through 4.93 has an out-of-bounds read in the SPA authentic NOTE: https://git.exim.org/exim.git/commitdiff/57aa14b216432be381b6295c312065b2fd034f86 NOTE: https://git.exim.org/exim.git/commitdiff/a04174dc2a84ae1008c23b6a7109e7fa3fb7b8b0 CVE-2020-12772 (An issue was discovered in Ignite Realtime Spark 2.8.3 (and the ROAR p ...) - TODO: check + NOT-FOR-US: Ignite Realtime Spark CVE-2020-12767 (exif_entry_get_value in exif-entry.c in libexif 0.6.21 has a divide-by ...) - libexif (bug #960199) [buster] - libexif (Minor issue) @@ -261,7 +264,7 @@ CVE-2020-12765 (Solis Miolo 2.0 allows index.php?module=installaction=view& CVE-2020-12764 (Gnuteca 3.8 allows file.php?folder=/file= Directory Traversal. ...) NOT-FOR-US: Gnuteca CVE-2020-12763 (TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable t ...) - TODO: check + NOT-FOR-US: TRENDnet ProView CVE-2020-12762 (json-c through 0.14 has an integer overflow and out-of-bounds write vi ...) - json-c (bug #960326) NOTE: https://github.com/json-c/json-c/pull/592 @@ -370,7 +373,7 @@ CVE-2020-12719 (XXE during an EventPublisher update can occur in Management Cons CVE-2020-12718 (In administration/comments.php in PHP-Fusion 9.03.50, an authenticated ...) NOT-FOR-US: PHP-Fusion CVE-2020-12717 (The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote atta ...) - TODO: check + NOT-FOR-US: COVIDSafe (Australia) app CVE-2020-12716 RESERVED CVE-2020-12715 @@ -442,7 +445,7 @@ CVE-2020-12679 (A reflected cross-site scripting (XSS) vulnerability in the Mite CVE-2020-12678 REJECTED CVE-2020-12677 (An issue was discovered in Progress MOVEit Automation Web Admin. A Web ...) - TODO: check + NOT-FOR-US: Progress MOVEit Automation Web Admin CVE-2020-12676 RESERVED CVE-2020-12675 @@ -6879,7 +6882,7 @@ CVE-2020-10628 CVE-2020-10627 RESERVED CVE-2020-10626 (In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled sear ...) - TODO: check + NOT-FOR-US: Fazecast jSerialComm CVE-2020-10625 (WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remo ...) NOT-FOR-US: WebAccess/NMS CVE-2020-10624 @@ -12476,7 +12479,8 @@ CVE-2020-8161 CVE-2020-8160 RESERVED CVE-2020-8159 (There is a vulnerability in actionpack_page-caching gem v1.2.1 th ...) - TODO: check + - ruby-actionpack-page-caching + NOTE: https://groups.google.com/forum/#!topic/rubyonrails-security/CFRVkEytdP8 CVE-2020-8158 RESERVED CVE-2020-8157 (UniFi Cloud Key firmware = v1.1.10 for Cloud Key gen2 and Cloud Ke ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/de7acad2b8cf9357e310e5d729f895ba6f5c6e0d -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/de7acad2b8cf9357e310e5d729f895ba6f5c6e0d You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new ansible issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 651df17f by Moritz Muehlenhoff at 2020-05-15T09:22:36+02:00 new ansible issue new pip non issue new issue in ITPd kibana NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -6459,8 +6459,11 @@ CVE-2020-10745 RESERVED CVE-2020-10744 RESERVED + - ansible + NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1835566 CVE-2020-10743 RESERVED + - kibana (bug #700337) CVE-2020-10742 RESERVED - linux @@ -32410,6 +32413,7 @@ CVE-2020-1162 RESERVED CVE-2020-1161 RESERVED + NOT-FOR-US: Microsoft .NET CVE-2020-1160 RESERVED CVE-2020-1159 @@ -32516,6 +32520,7 @@ CVE-2020-1109 RESERVED CVE-2020-1108 RESERVED + NOT-FOR-US: Microsoft .NET CVE-2020-1107 RESERVED CVE-2020-1106 @@ -80309,7 +80314,9 @@ CVE-2018-20227 (RDF4J 2.4.2 allows Directory Traversal via ../ in an entry in a CVE-2018-20226 (An organization administrator can add a super administrator in THEHIVE ...) NOT-FOR-US: THEHIVE CVE-2018-20225 (An issue was discovered in pip (all versions) because it installs the ...) - TODO: check + - python-pip (unimportant) + NOTE: https://cowlicks.website/posts/arbitrary-code-execution-from-pips-extra-index-url.html + NOTE: pip is inherently affected by malicious packages, use packages from Debian instead :-) CVE-2018-20224 RESERVED CVE-2018-20223 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/651df17fbe481dd8249c09fc89081120f70ab2c7 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/651df17fbe481dd8249c09fc89081120f70ab2c7 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
