[Git][security-tracker-team/security-tracker][master] Add CVE-2023-46673/elasticsearch
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c299aef8 by Salvatore Bonaccorso at 2023-11-23T07:38:43+01:00 Add CVE-2023-46673/elasticsearch - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -158,7 +158,7 @@ CVE-2023-47250 (In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Ser CVE-2023-47014 (A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester St ...) NOT-FOR-US: Sourcecodester Sticky Notes App CVE-2023-46673 (It was identified that malformed scripts used in the script processor ...) - TODO: check + - elasticsearch CVE-2023-46357 (In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 f ...) NOT-FOR-US: PrestaShop module CVE-2023-45377 (In the module "Chronopost Official" (chronopost) for PrestaShop, a gue ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c299aef8cef324e0ee3fcee51be7a95abf5c680f -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c299aef8cef324e0ee3fcee51be7a95abf5c680f You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2023-48706/vim
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8e1f01a8 by Salvatore Bonaccorso at 2023-11-23T06:42:14+01:00 Add CVE-2023-48706/vim - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,3 +1,8 @@ +CVE-2023-48706 [heap-use-after-free in ex_substitute] + - vim (unimportant) + NOTE: https://github.com/vim/vim/security/advisories/GHSA-c8qm-x72m-q53q + NOTE: Fixed by: https://github.com/vim/vim/commit/26c11c56888d01e298cd8044caf8 (v9.0.2121) + NOTE: Crash in CLI tool, no security impact CVE-2023-6265 (Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to directory tr ...) NOT-FOR-US: Draytek Vigor2960 CVE-2023-6264 (Information leak in Content-Security-Policy header in Devolutions Serv ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8e1f01a85dbb404e35db58fee400af523326c852 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8e1f01a85dbb404e35db58fee400af523326c852 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Added notes for httpie CVE-2023-48052.
Ola Lundqvist pushed to branch master at Debian Security Tracker / security-tracker Commits: 916163b2 by Ola Lundqvist at 2023-11-22T23:27:47+00:00 Added notes for httpie CVE-2023-48052. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -845,7 +845,12 @@ CVE-2023-48053 (Archery v1.10.0 uses a non-random or static IV for Cipher Block NOT-FOR-US: Archery CVE-2023-48052 (Missing SSL certificate validation in HTTPie v3.2.2 allows attackers t ...) - httpie - TODO: check details + TODO: check details further + NOTE: https://gxx777.github.io/HTTPie_3.2.2_Cryptographic_API_Misuse_Vulnerability.md + NOTE: update_warnings.py is about package update and can be considered minor + NOTE: The client.py note tells that this line effectively disables host verification + NOTE: but when the tool is tested using a valid and self-signed cert it showed + NOTE: the page for the valid cert and gave an error on the self-signed cert. CVE-2023-47514 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in lawrence ...) NOT-FOR-US: WordPress plugin CVE-2023-47512 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Gravity ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/916163b25acb075b019922e8b347c60023698936 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/916163b25acb075b019922e8b347c60023698936 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] 8 commits: Added firefox-esr to dla-needed. Already fixed in bullseye.
extractTree function in unADF allow ...) @@ -481632,6 +481640,7 @@ CVE-2016-1243 (Stack-based buffer overflow in the extractTree function in unADF - unadf 0.7.11a-6 (bug #838248) [bookworm] - unadf (Minor issue) [bullseye] - unadf (Minor issue) + [buster] - unadf (Minor issue) NOTE: Fixed by: https://github.com/lclevy/ADFlib/commit/8e973d7b894552c3a3de0ccd2d1e9cb0b8e618dd NOTE: The changes between 0.7.11a-3 and 0.7.11a-4 did not include the upstream fix. CVE-2016-1242 (file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3 ...) = data/dla-needed.txt = @@ -61,6 +61,9 @@ dogecoin NOTE: 20230619: also I just referenced 3 older bitcoin-related CVEs to fix; NOTE: 20230619: dogecoin not present in bullseye/bookworm, so we lead the initiatives. (Beuc/front-desk) -- +firefox-esr + NOTE: 20231122: Added by Front-Desk (ola) +-- flatpak NOTE: 20231006: Added by Front-Desk (Beuc) NOTE: 20231006: Follow fixes from bullseye 11.7 (2 CVEs) (Beuc/front-desk) @@ -258,6 +261,9 @@ suricata (Adrian Bunk) symfony (Markus Koschany) NOTE: 20231118: Added by Front-Desk (apo) -- +thunderbird + NOTE: 20231122: Added by Front-Desk (ola) +-- tor NOTE: 20231119: Added by Front-Desk (apo) -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/808fdee5c7178773c8a540938d25564f4ab52c2f...76b566a4413208a8624d2c91cadb33dfaeef057b -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/808fdee5c7178773c8a540938d25564f4ab52c2f...76b566a4413208a8624d2c91cadb33dfaeef057b You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] unadf fixed in sid
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
808fdee5 by Moritz Mühlenhoff at 2023-11-22T23:24:42+01:00
unadf fixed in sid
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -481622,14 +481622,14 @@ CVE-2016-1245 (It was discovered that the zebra
daemon in Quagga before 1.0.2016
NOTE:
https://lists.quagga.net/pipermail/quagga-users/2016-October/014478.html
CVE-2016-1244 (The extractTree function in unADF allows remote attackers to
execute a ...)
{DSA-3676-1 DLA-631-1}
- - unadf (bug #838248)
+ - unadf 0.7.11a-6 (bug #838248)
[bookworm] - unadf (Minor issue)
[bullseye] - unadf (Minor issue)
NOTE: Fixed by:
https://github.com/lclevy/ADFlib/commit/8e973d7b894552c3a3de0ccd2d1e9cb0b8e618dd
NOTE: The changes between 0.7.11a-3 and 0.7.11a-4 did not include the
upstream fix.
CVE-2016-1243 (Stack-based buffer overflow in the extractTree function in
unADF allow ...)
{DSA-3676-1 DLA-631-1}
- - unadf (bug #838248)
+ - unadf 0.7.11a-6 (bug #838248)
[bookworm] - unadf (Minor issue)
[bullseye] - unadf (Minor issue)
NOTE: Fixed by:
https://github.com/lclevy/ADFlib/commit/8e973d7b894552c3a3de0ccd2d1e9cb0b8e618dd
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/808fdee5c7178773c8a540938d25564f4ab52c2f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/808fdee5c7178773c8a540938d25564f4ab52c2f
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add myself for report bug
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 5b888548 by Bastien Roucariès at 2023-11-22T22:15:25+00:00 Add myself for report bug - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -212,7 +212,7 @@ rails NOTE: 20230131: Utkarsh to start a thread with sec+ruby team with the possible path forward. (utkarsh) NOTE: 20230828: want to rollout ruby-rack first. (utkarsh) -- -reportbug +reportbug (rouca) NOTE: 20231108: Added by Front-Desk (santiago) NOTE: 20231108: Need to handle incompatibilities with versions in debian packages, brought up by PEP 440. See https://salsa.debian.org/lts-team/lts-updates-tasks/-/issues/70 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5b8885487b883f55d4071a1113b4510bf9681d51 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5b8885487b883f55d4071a1113b4510bf9681d51 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
3df4595c by Salvatore Bonaccorso at 2023-11-22T21:42:52+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -11,7 +11,7 @@ CVE-2023-6252 (Path traversal vulnerability in Chalemelon
Power framework, affec
CVE-2023-6189 (Missing access permissions checks inthe M-Files serverbefore
23.11.1 ...)
NOT-FOR-US: M-Files
CVE-2023-6164 (The MainWP Dashboard \u2013 WordPress Manager for Multiple
Websites M ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-6160 (The LifterLMS \u2013 WordPress LMS Plugin for eLearning plugin
for Wor ...)
NOT-FOR-US: WordPress plugin
CVE-2023-6157 (Improper neutralization of livestatus command delimiters in
ajax_searc ...)
@@ -97,9 +97,9 @@ CVE-2023-5048 (The WDContactFormBuilder plugin for WordPress
is vulnerable to St
CVE-2023-5047 (Improper Neutralization of Special Elements used in an SQL
Command ('S ...)
NOT-FOR-US: DRD Fleet Leasing DRDrive
CVE-2023-4726 (The Ultimate Dashboard plugin for WordPress is vulnerable to
Stored Cr ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-4686 (The WP Customer Reviews plugin for WordPress is vulnerable to
Sensitiv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-48705 (Nautobot is a Network Source of Truth and Network Automation
Platform ...)
NOT-FOR-US: Nautobot
CVE-2023-48646 (Zoho ManageEngine RecoveryManager Plus before 6070 allows
admin users ...)
@@ -107,83 +107,83 @@ CVE-2023-48646 (Zoho ManageEngine RecoveryManager Plus
before 6070 allows admin
CVE-2023-48106 (Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2
allows an ...)
- zlib-ng (bug #1002056)
CVE-2023-47825 (Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP
EXtra pl ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47824 (Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal
Pages \ ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47819 (Cross-Site Request Forgery (CSRF) vulnerability in Dang Ngoc
Binh Easy ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47792 (Cross-Site Request Forgery (CSRF) vulnerability in Infinite
Uploads Bi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47791 (Cross-Site Request Forgery (CSRF) vulnerability in Leadster
plugin <=1 ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47785 (Cross-Site Request Forgery (CSRF) vulnerability in LayerSlider
plugin ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47781 (Cross-Site Request Forgery (CSRF) vulnerability in Thrive
Themes Thriv ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47775 (Cross-Site Request Forgery (CSRF) vulnerability in gVectors
Team Comme ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47765 (Cross-Site Request Forgery (CSRF) vulnerability in CodeBard
CodeBard's ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47759 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47758 (Cross-Site Request Forgery (CSRF) vulnerability in Mondula
GmbH Multi ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47755 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-47467 (Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows
a remot ...)
- TODO: check
+ NOT-FOR-US: jeecgboot jeecg-boot
CVE-2023-47380 (Admidio v4.2.12 and below is vulnerable to Cross Site
Scripting (XSS).)
- TODO: check
+ NOT-FOR-US: Admidio
CVE-2023-47350 (SwiftyEdit Content Management System prior to v1.2.0 is
vulnerable to ...)
- TODO: check
+ NOT-FOR-US: SwiftyEdit Content Management System
CVE-2023-47316 (Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect
Access Contro ...)
- TODO: check
+ NOT-FOR-US: Headwind MDM Web panel
CVE-2023-47315 (Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect
Access Contro ...)
- TODO: check
+ NOT-FOR-US: Headwind MDM Web panel
CVE-2023-47314 (Headwind MDM Web panel 5.22.1 is vulnerable to Cross Site
Scripting (X ...)
- TODO: check
+ NOT-FOR-US: Headwind MDM Web panel
CVE-2023-47313 (Headwind MDM Web panel 5.22.1 is vulnerable to Directory
Traversal.)
- TODO: check
+ NOT-FOR-US: Headwind MDM Web panel
CVE-2023-47312 (Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect
Access Contro ...)
- TODO: check
+ NOT-FOR-US: Headwind MDM Web panel
CVE-2023-47251 (In mprivacy-to
[Git][security-tracker-team/security-tracker][master] Add CVE-2023-48106/zlib-ng
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 191cdffb by Salvatore Bonaccorso at 2023-11-22T21:35:32+01:00 Add CVE-2023-48106/zlib-ng - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -105,7 +105,7 @@ CVE-2023-48705 (Nautobot is a Network Source of Truth and Network Automation Pla CVE-2023-48646 (Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users ...) NOT-FOR-US: Zoho ManageEngine CVE-2023-48106 (Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an ...) - TODO: check + - zlib-ng (bug #1002056) CVE-2023-47825 (Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra pl ...) TODO: check CVE-2023-47824 (Cross-Site Request Forgery (CSRF) vulnerability in wpWax Legal Pages \ ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/191cdffb1eb701aecad7da59e9ddfdfd02cdcfa5 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/191cdffb1eb701aecad7da59e9ddfdfd02cdcfa5 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e8431998 by Salvatore Bonaccorso at 2023-11-22T21:32:42+01:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -1,109 +1,109 @@
CVE-2023-6265 (Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to
directory tr ...)
- TODO: check
+ NOT-FOR-US: Draytek Vigor2960
CVE-2023-6264 (Information leak in Content-Security-Policy header in
Devolutions Serv ...)
- TODO: check
+ NOT-FOR-US: Devolutions Server
CVE-2023-6263 (An issue was discovered in Network Optix NxCloud before
23.1.0.40440.I ...)
- TODO: check
+ NOT-FOR-US: Network Optix NxCloud
CVE-2023-6253 (A saved encryption key in the Uninstaller in Digital Guardian's
Agent ...)
- TODO: check
+ NOT-FOR-US: Digital Guardian's Agent
CVE-2023-6252 (Path traversal vulnerability in Chalemelon Power framework,
affecting ...)
- TODO: check
+ NOT-FOR-US: Chalemelon Power framework
CVE-2023-6189 (Missing access permissions checks inthe M-Files serverbefore
23.11.1 ...)
- TODO: check
+ NOT-FOR-US: M-Files
CVE-2023-6164 (The MainWP Dashboard \u2013 WordPress Manager for Multiple
Websites M ...)
TODO: check
CVE-2023-6160 (The LifterLMS \u2013 WordPress LMS Plugin for eLearning plugin
for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-6157 (Improper neutralization of livestatus command delimiters in
ajax_searc ...)
- check-mk
CVE-2023-6156 (Improper neutralization of livestatus command delimiters in the
availa ...)
- check-mk
CVE-2023-6117 (A possibility of unwanted server memory consumption was
detected throu ...)
- TODO: check
+ NOT-FOR-US: M-Files
CVE-2023-6011 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
- TODO: check
+ NOT-FOR-US: DECE Software Geodi
CVE-2023-6009 (The UserPro plugin for WordPress is vulnerable to privilege
escalation ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-6008 (The UserPro plugin for WordPress is vulnerable to Cross-Site
Request F ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-6007 (The UserPro plugin for WordPress is vulnerable to unauthorized
access ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5983 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
- TODO: check
+ NOT-FOR-US: Botanik Software Pharmacy Automation
CVE-2023-5921 (Improper Enforcement of Behavioral Workflow vulnerability in
DECE Soft ...)
- TODO: check
+ NOT-FOR-US: DECE Software Geodi
CVE-2023-5822 (The Drag and Drop Multiple File Upload - Contact Form 7 plugin
for Wor ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5815 (The News & Blog Designer Pack \u2013 WordPress Blog Plugin
\u2014 (Blo ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5742 (The EasyRotator for WordPress plugin for WordPress is
vulnerable to St ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5715 (The Website Optimization \u2013 Plerdy plugin for WordPress is
vulnera ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5708 (The WP Post Columns plugin for WordPress is vulnerable to
Stored Cross ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5706 (The VK Blocks plugin for WordPress is vulnerable to Stored
Cross-Site ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5704 (The CPO Shortcodes plugin for WordPress is vulnerable to Stored
Cross- ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5667 (The Tab Ultimate plugin for WordPress is vulnerable to Stored
Cross-Si ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5664 (The Garden Gnome Package plugin for WordPress is vulnerable to
Stored ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5662 (The Sponsors plugin for WordPress is vulnerable to Stored
Cross-Site S ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5537 (The Delete Usermeta plugin for WordPress is vulnerable to
Cross-Site R ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5469 (The Drop Shadow Boxes plugin for WordPress is vulnerable to
Stored Cro ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5466 (The Wp anything slider plugin for WordPress is vulnerable to
SQL Injec ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5465 (The Popup with fancybox plugin for WordPress is vulnerable to
SQL Inje ...)
- TODO: check
+ NOT-FOR-US: WordPress plugin
CVE-2023-5419 (The Funnelforms Free plugin for WordPress is vulnerable t
[Git][security-tracker-team/security-tracker][master] Process two check-mk issues
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
8021a731 by Salvatore Bonaccorso at 2023-11-22T21:31:09+01:00
Process two check-mk issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -15,9 +15,9 @@ CVE-2023-6164 (The MainWP Dashboard \u2013 WordPress Manager
for Multiple Websi
CVE-2023-6160 (The LifterLMS \u2013 WordPress LMS Plugin for eLearning plugin
for Wor ...)
TODO: check
CVE-2023-6157 (Improper neutralization of livestatus command delimiters in
ajax_searc ...)
- TODO: check
+ - check-mk
CVE-2023-6156 (Improper neutralization of livestatus command delimiters in the
availa ...)
- TODO: check
+ - check-mk
CVE-2023-6117 (A possibility of unwanted server memory consumption was
detected throu ...)
TODO: check
CVE-2023-6011 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8021a73140f80a5d5e1d727d636ba42211ad1e2c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8021a73140f80a5d5e1d727d636ba42211ad1e2c
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
80ada004 by security tracker role at 2023-11-22T20:12:07+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -1,4 +1,190 @@
-CVE-2023-37924
+CVE-2023-6265 (Draytek Vigor2960 v1.5.1.4 and v1.5.1.5 are vulnerable to
directory tr ...)
+ TODO: check
+CVE-2023-6264 (Information leak in Content-Security-Policy header in
Devolutions Serv ...)
+ TODO: check
+CVE-2023-6263 (An issue was discovered in Network Optix NxCloud before
23.1.0.40440.I ...)
+ TODO: check
+CVE-2023-6253 (A saved encryption key in the Uninstaller in Digital Guardian's
Agent ...)
+ TODO: check
+CVE-2023-6252 (Path traversal vulnerability in Chalemelon Power framework,
affecting ...)
+ TODO: check
+CVE-2023-6189 (Missing access permissions checks inthe M-Files serverbefore
23.11.1 ...)
+ TODO: check
+CVE-2023-6164 (The MainWP Dashboard \u2013 WordPress Manager for Multiple
Websites M ...)
+ TODO: check
+CVE-2023-6160 (The LifterLMS \u2013 WordPress LMS Plugin for eLearning plugin
for Wor ...)
+ TODO: check
+CVE-2023-6157 (Improper neutralization of livestatus command delimiters in
ajax_searc ...)
+ TODO: check
+CVE-2023-6156 (Improper neutralization of livestatus command delimiters in the
availa ...)
+ TODO: check
+CVE-2023-6117 (A possibility of unwanted server memory consumption was
detected throu ...)
+ TODO: check
+CVE-2023-6011 (Improper Neutralization of Input During Web Page Generation
('Cross-si ...)
+ TODO: check
+CVE-2023-6009 (The UserPro plugin for WordPress is vulnerable to privilege
escalation ...)
+ TODO: check
+CVE-2023-6008 (The UserPro plugin for WordPress is vulnerable to Cross-Site
Request F ...)
+ TODO: check
+CVE-2023-6007 (The UserPro plugin for WordPress is vulnerable to unauthorized
access ...)
+ TODO: check
+CVE-2023-5983 (Exposure of Sensitive Information to an Unauthorized Actor
vulnerabili ...)
+ TODO: check
+CVE-2023-5921 (Improper Enforcement of Behavioral Workflow vulnerability in
DECE Soft ...)
+ TODO: check
+CVE-2023-5822 (The Drag and Drop Multiple File Upload - Contact Form 7 plugin
for Wor ...)
+ TODO: check
+CVE-2023-5815 (The News & Blog Designer Pack \u2013 WordPress Blog Plugin
\u2014 (Blo ...)
+ TODO: check
+CVE-2023-5742 (The EasyRotator for WordPress plugin for WordPress is
vulnerable to St ...)
+ TODO: check
+CVE-2023-5715 (The Website Optimization \u2013 Plerdy plugin for WordPress is
vulnera ...)
+ TODO: check
+CVE-2023-5708 (The WP Post Columns plugin for WordPress is vulnerable to
Stored Cross ...)
+ TODO: check
+CVE-2023-5706 (The VK Blocks plugin for WordPress is vulnerable to Stored
Cross-Site ...)
+ TODO: check
+CVE-2023-5704 (The CPO Shortcodes plugin for WordPress is vulnerable to Stored
Cross- ...)
+ TODO: check
+CVE-2023-5667 (The Tab Ultimate plugin for WordPress is vulnerable to Stored
Cross-Si ...)
+ TODO: check
+CVE-2023-5664 (The Garden Gnome Package plugin for WordPress is vulnerable to
Stored ...)
+ TODO: check
+CVE-2023-5662 (The Sponsors plugin for WordPress is vulnerable to Stored
Cross-Site S ...)
+ TODO: check
+CVE-2023-5537 (The Delete Usermeta plugin for WordPress is vulnerable to
Cross-Site R ...)
+ TODO: check
+CVE-2023-5469 (The Drop Shadow Boxes plugin for WordPress is vulnerable to
Stored Cro ...)
+ TODO: check
+CVE-2023-5466 (The Wp anything slider plugin for WordPress is vulnerable to
SQL Injec ...)
+ TODO: check
+CVE-2023-5465 (The Popup with fancybox plugin for WordPress is vulnerable to
SQL Inje ...)
+ TODO: check
+CVE-2023-5419 (The Funnelforms Free plugin for WordPress is vulnerable to
unauthorize ...)
+ TODO: check
+CVE-2023-5417 (The Funnelforms Free plugin for WordPress is vulnerable to
unauthorize ...)
+ TODO: check
+CVE-2023-5416 (The Funnelforms Free plugin for WordPress is vulnerable to
unauthorize ...)
+ TODO: check
+CVE-2023-5415 (The Funnelforms Free plugin for WordPress is vulnerable to
unauthorize ...)
+ TODO: check
+CVE-2023-5411 (The Funnelforms Free plugin for WordPress is vulnerable to
unauthorize ...)
+ TODO: check
+CVE-2023-5387 (The Funnelforms Free plugin for WordPress is vulnerable to
unauthorize ...)
+ TODO: check
+CVE-2023-5386 (The Funnelforms Free plugin for WordPress is vulnerable to
unauthorize ...)
+ TODO: check
+CVE-2023-5385 (The Funnelforms Free plugin for WordPress is vulnerable to
unauthorize ...)
+ TODO: check
+CVE-2023-5383 (The Funnelforms Free plugin for WordPress is vulnerable to
Cross-Site ...)
+ TODO: check
+CVE-2023-5382 (The Funnelforms Free plugin for WordPress is vulnerable to
Cross-Site ...)
+ TODO: check
[Git][security-tracker-team/security-tracker][master] Drop notes from CVE-2023-45960
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c5c0a8f7 by Salvatore Bonaccorso at 2023-11-22T21:24:27+01:00 Drop notes from CVE-2023-45960 It got rejected. Withdrawn by its CNA as it was not a security issue. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -4927,10 +4927,6 @@ CVE-2023-46010 (An issue in SeaCMS v.12.9 allows an attacker to execute arbitrar NOT-FOR-US: SeaCMS CVE-2023-45960 REJECTED - - dom4j (unimportant) - NOTE: https://github.com/dom4j/dom4j/issues/171 - NOTE: Not considered as a vulnerability by upstream: - NOTE: https://github.com/dom4j/dom4j/issues/171#issuecomment-1781547256 CVE-2023-45837 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in XYDAC Ul ...) NOT-FOR-US: WordPress plugin CVE-2023-45835 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Libsyn L ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5c0a8f7db8bcf30dcfce2a18278d9c724e84bb2 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5c0a8f7db8bcf30dcfce2a18278d9c724e84bb2 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Drop now postponed entries for intel-microcode
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 1ed0e31a by Salvatore Bonaccorso at 2023-11-22T20:59:15+01:00 Drop now postponed entries for intel-microcode Package has been for a couple of days in unstable, migrated to testing. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1469,8 +1469,6 @@ CVE-2023-5528 (A security issue was discovered in Kubernetes where a user that c - kubernetes (Windows-specific) CVE-2023-23583 (Sequence of processor instructions leads to unexpected behavior for so ...) - intel-microcode 3.20231114.1 (bug #1055962) - [bookworm] - intel-microcode (Wait for exposure in unstable) - [bullseye] - intel-microcode (Wait for exposure in unstable) [buster] - intel-microcode (Wait for exposure in unstable) NOTE: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00950.html NOTE: https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20231114 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1ed0e31ab70cf488d2515bcc6e730d45f09fad8e -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1ed0e31ab70cf488d2515bcc6e730d45f09fad8e You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Track fixed version for nodejs issues fixed with unstable upload
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: b814656b by Salvatore Bonaccorso at 2023-11-22T20:52:52+01:00 Track fixed version for nodejs issues fixed with unstable upload - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -5083,7 +5083,7 @@ CVE-2023-5625 (A regression was introduced in the Red Hat build of python-eventl - python-eventlet (Red Hat-specific regression) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2244717 CVE-2023-39333 - - nodejs (bug #1054892) + - nodejs 18.13.0+dfsg1-1.1 (bug #1054892) [bullseye] - nodejs (Only affects 18.x and later) [buster] - nodejs (Only affects 18.x and later) NOTE: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases#code-injection-via-webassembly-export-names-low---cve-2023-39333 @@ -5896,7 +5896,7 @@ CVE-2023-39277 (SonicOS post-authentication stack-based buffer overflow vulnerab CVE-2023-39276 (SonicOS post-authentication stack-based buffer overflow vulnerability ...) NOT-FOR-US: SonicOS CVE-2023-38552 (When the Node.js policy feature checks the integrity of a resource aga ...) - - nodejs (bug #1054892) + - nodejs 18.13.0+dfsg1-1.1 (bug #1054892) [bullseye] - nodejs (Only affects 18.x and later) [buster] - nodejs (Only affects 18.x and later) NOTE: https://nodejs.org/en/blog/vulnerability/october-2023-security-releases#integrity-checks-according-to-policies-can-be-circumvented-medium---cve-2023-38552 @@ -16127,7 +16127,7 @@ CVE-2023-33242 (Crypto wallets implementing the Lindell17 TSS protocol might all CVE-2023-33241 (Crypto wallets implementing the GG18 or GG20 TSS protocol might allow ...) NOT-FOR-US: Crypto wallets implementing the GG18 or GG20 TSS protocol CVE-2023-32559 (A privilege escalation vulnerability exists in the experimental policy ...) - - nodejs (bug #1050739) + - nodejs 18.13.0+dfsg1-1.1 (bug #1050739) [buster] - nodejs (v10.x doesn't support policy manifests) NOTE: https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-processbinding-mediumcve-2023-32559 NOTE: https://github.com/nodejs/node/commit/d4570fae358693b8f7fec05294b9bb92a966226d (v18.x) @@ -16136,7 +16136,7 @@ CVE-2023-32558 (The use of the deprecated API `process.binding()` can bypass the - nodejs (Only affects 20.x and later) NOTE: https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#processbinding-can-bypass-the-permission-model-through-path-traversal-highcve-2023-32558 CVE-2023-32006 (The use of `module.constructor.createRequire()` can bypass the policy ...) - - nodejs (bug #1050739) + - nodejs 18.13.0+dfsg1-1.1 (bug #1050739) [buster] - nodejs (v10.x doesn't support policy manifests) NOTE: https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-impersonate-other-modules-in-using-moduleconstructorcreaterequire-mediumcve-2023-32006 NOTE: https://github.com/nodejs/node/commit/15bced0bde93f24115b779a309d517845c87e17a (v18.x) @@ -16151,7 +16151,7 @@ CVE-2023-32003 (`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the - nodejs (Only affects 20.x and later) NOTE: https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#fsmkdtemp-and-fsmkdtempsync-are-missing-getvalidatedpath-checks-lowcve-2023-32003 CVE-2023-32002 (The use of `Module._load()` can bypass the policy mechanism and requir ...) - - nodejs (bug #1050739) + - nodejs 18.13.0+dfsg1-1.1 (bug #1050739) [buster] - nodejs (v10.x doesn't support policy manifests) NOTE: https://nodejs.org/en/blog/vulnerability/august-2023-security-releases#permissions-policies-can-be-bypassed-via-module_load-highcve-2023-32002 NOTE: https://github.com/nodejs/node/commit/15bced0bde93f24115b779a309d517845c87e17a (v18.x) @@ -29777,12 +29777,12 @@ CVE-2023-30591 (Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated at NOT-FOR-US: NodeBB CVE-2023-30590 RESERVED - - nodejs (bug #1039990) + - nodejs 18.13.0+dfsg1-1.1 (bug #1039990) [buster] - nodejs (minor issue - Inconsistency Between Implementation and Documented Design) NOTE: https://nodejs.org/en/blog/vulnerability/june-2023-security-releases#diffiehellman-do-not-generate-keys-after-setting-a-private-key-medium-cve-2023-30590 NOTE: Fixed by: https://github.com/nodejs/node/commit/1a5c9284ebce5cd71cf7a3c29759a748c373ac85 (v16.x) CVE-2023-30589 (The llhttp parser in the http module in Node v20.2.0 does not strictly ...) - - nodejs (bug #1039990) + - nodejs 18.13.0+dfsg1-1.1 (bug #1039990) [buster] - nodejs (l
[Git][security-tracker-team/security-tracker][master] tor updates
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 8d263949 by Moritz Mühlenhoff at 2023-11-22T20:21:31+01:00 tor updates - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1659,6 +1659,8 @@ CVE-2023- [tor TROVE-2023-006] NOTE: https://gitlab.torproject.org/tpo/core/tor/-/issues/40883 (non public ATM) CVE-2023- [tor TROVE-2023-004] - tor 0.4.8.8-1 + [bookworm] - tor 0.4.7.16-1 + [bullseye] - tor (see DSA 5562) NOTE: https://gitlab.torproject.org/tpo/core/tor/-/raw/tor-0.4.8.9/ChangeLog NOTE: https://gitlab.torproject.org/tpo/core/tor/-/commit/7aa496a2e057bb7c3cc284a04a1a4d2941c304f1 (tor-0.4.8.8) NOTE: https://gitlab.torproject.org/tpo/core/tor/-/issues/40874 (non public ATM) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8d2639490e0be1c68d17c28d4511f307d8ab8a7b -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8d2639490e0be1c68d17c28d4511f307d8ab8a7b You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] 2 commits: Claim curl and symfony in dla-needed.txt
Markus Koschany pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f36c0119 by Markus Koschany at 2023-11-22T20:07:05+01:00
Claim curl and symfony in dla-needed.txt
- - - - -
fc9c0a74 by Markus Koschany at 2023-11-22T20:08:15+01:00
Reserve DLA-3660-1 for gnutls28
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[22 Nov 2023] DLA-3660-1 gnutls28 - security update
+ {CVE-2023-5981}
+ [buster] - gnutls28 3.6.7-4+deb10u11
[21 Nov 2023] DLA-3659-1 gimp - security update
{CVE-2022-30067 CVE-2023-2 CVE-2023-4}
[buster] - gimp 2.10.8-2+deb10u1
=
data/dla-needed.txt
=
@@ -43,7 +43,7 @@ cinder
cryptojs (guilhem)
NOTE: 20231119: Added by Front-Desk (apo)
--
-curl
+curl (Markus Koschany)
NOTE: 20231103: Added by Front-Desk (lamby)
NOTE: 20231103: Sync with stable. (lamby)
--
@@ -75,9 +75,6 @@ freeimage (gladk)
frr
NOTE: 20231119: Added by Front-Desk (apo)
--
-gnutls28 (Markus Koschany)
- NOTE: 20231117: Added by Front-Desk (apo)
---
gst-plugins-bad1.0 (Thorsten Alteholz)
NOTE: 20231118: Added by Front-Desk (apo)
--
@@ -258,7 +255,7 @@ suricata (Adrian Bunk)
NOTE: 20231016: Still reviewing+testing CVEs. (bunk)
NOTE: 20231120: DLA coming soon. (bunk)
--
-symfony
+symfony (Markus Koschany)
NOTE: 20231118: Added by Front-Desk (apo)
--
tor
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/815355e66df3a41c63115d214d90577269c430ae...fc9c0a74db24c7f32f782c3e3fdc674b0ec6daf9
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/815355e66df3a41c63115d214d90577269c430ae...fc9c0a74db24c7f32f782c3e3fdc674b0ec6daf9
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] firefox, tor DSA
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
815355e6 by Moritz Mühlenhoff at 2023-11-22T19:46:15+01:00
firefox, tor DSA
- - - - -
2 changed files:
- data/DSA/list
- data/dsa-needed.txt
Changes:
=
data/DSA/list
=
@@ -1,3 +1,9 @@
+[22 Nov 2023] DSA-5562-1 tor - security update
+ [bookworm] - tor 0.4.7.16-1
+[22 Nov 2023] DSA-5561-1 firefox-esr - security update
+ {CVE-2023-6204 CVE-2023-6205 CVE-2023-6206 CVE-2023-6207 CVE-2023-6208
CVE-2023-6209 CVE-2023-6212}
+ [bullseye] - firefox-esr 115.5.0esr-1~deb11u1
+ [bookworm] - firefox-esr 115.5.0esr-1~deb12u1
[20 Nov 2023] DSA-5560-1 strongswan - security update
{CVE-2023-41913}
[bullseye] - strongswan 5.9.1-1+deb11u4
=
data/dsa-needed.txt
=
@@ -19,8 +19,6 @@ dnsdist (jmm)
fastdds
Awaiting feedback from maintainer on bullseye status
--
-firefox-esr (jmm)
---
frr
--
gimp (carnil)
@@ -94,8 +92,6 @@ thunderbird (jmm)
--
tiff (aron)
--
-tor (jmm)
---
xen (jmm)
--
zbar
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/815355e66df3a41c63115d214d90577269c430ae
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/815355e66df3a41c63115d214d90577269c430ae
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Update status for CVE-2023-31022/vidia-graphics-drivers-tesla-450
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 77f53c3f by Salvatore Bonaccorso at 2023-11-22T17:12:07+01:00 Update status for CVE-2023-31022/vidia-graphics-drivers-tesla-450 - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -28436,7 +28436,8 @@ CVE-2023-31022 (NVIDIA GPU Display Driver for Windows and Linux contains a vulne - nvidia-graphics-drivers-tesla-460 460.106.00-3 (bug #1055141) [bullseye] - nvidia-graphics-drivers-tesla-460 (Non-free not supported) NOTE: 460.106.00-3 turned the package into a metapackage to aid switching to nvidia-graphics-drivers-tesla-470 - - nvidia-graphics-drivers-tesla-450 (bug #1055140) + - nvidia-graphics-drivers-tesla-450 450.248.02-4 (bug #1055140) + NOTE: 450.248.02-4 turned the package into a metapackage to aid switching to nvidia-graphics-drivers-tesla-470 [bullseye] - nvidia-graphics-drivers-tesla-450 (Non-free not supported) - nvidia-graphics-drivers-tesla-418 (bug #1055139) [bullseye] - nvidia-graphics-drivers-tesla-418 (Non-free not supported) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/77f53c3f574acf33f2e0646ca53542655bab7f36 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/77f53c3f574acf33f2e0646ca53542655bab7f36 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] bullseye/bookworm triage
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6718b1f7 by Moritz Muehlenhoff at 2023-11-22T17:02:18+01:00
bullseye/bookworm triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -1149,6 +1149,8 @@ CVE-2023-1 [GIMP DDS File Parsing Heap-based Buffer
Overflow Remote Code Exe
- gimp 2.10.36-1 (bug #1055984)
[buster] - gimp (DDS plugin added in 2.10.10)
- gimp-dds
+ [bookworm] - gimp-dds (Obsoleted by src:gimp, should get
dropped via Breaks)
+ [bullseye] - gimp-dds (Obsoleted by src:gimp, should get
dropped via Breaks)
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1592/
NOTE:
https://www.gimp.org/news/2023/11/07/gimp-2-10-36-released/#fixed-vulnerabilities
NOTE:
https://gitlab.gnome.org/GNOME/gimp/-/commit/7db71cd0b6e36c454aa0d2d3efeec7e636db4dbc
(GIMP_2_10_36)
@@ -6569,6 +6571,8 @@ CVE-2023-5563 (The SJA1000 CAN controller driver backend
automatically attempt t
NOT-FOR-US: Zephyr RTOS (unrelated to src:zephyr)
CVE-2023-5557 (A flaw was found in the tracker-miners package. A weakness in
the sand ...)
- tracker-miners 3.4.5-1 (bug #1053881)
+ [bookworm] - tracker-miners (Minor issue)
+ [bullseye] - tracker-miners (Minor issue)
NOTE:
https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/#tracker-miners-seccomp-sandbox-escape
NOTE: https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/277
NOTE: https://gitlab.gnome.org/GNOME/tracker-miners/-/merge_requests/480
@@ -43353,6 +43357,8 @@ CVE-2023-26142 (All versions of the package crow are
vulnerable to HTTP Response
NOT-FOR-US: Crow
CVE-2023-26141 (Versions of the package sidekiq before 7.1.3 are vulnerable to
Denial ...)
- ruby-sidekiq
+ [bookworm] - ruby-sidekiq (Minor issue)
+ [bullseye] - ruby-sidekiq (Minor issue)
[buster] - ruby-sidekiq (Minor issue, DoS still possible)
NOTE: https://security.snyk.io/vuln/SNYK-RUBY-SIDEKIQ-5885107
NOTE:
https://github.com/sidekiq/sidekiq/commit/62c90d7c5a7d8a378d79909859d87c2e0702bf89
(v7.1.3)
@@ -229819,15 +229825,23 @@ CVE-2020-24296
RESERVED
CVE-2020-24295 (Buffer Overflow vulnerability in
PSDParser.cpp::ReadImageLine() in Fre ...)
- freeimage
+ [bookworm] - freeimage (Revisit when patches are available)
+ [bullseye] - freeimage (Revisit when patches are available)
NOTE:
https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
CVE-2020-24294 (Buffer Overflow vulnerability in psdParser::UnpackRLE function
in PSDP ...)
- freeimage
+ [bookworm] - freeimage (Revisit when patches are available)
+ [bullseye] - freeimage (Revisit when patches are available)
NOTE:
https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
CVE-2020-24293 (Buffer Overflow vulnerability in psdThumbnail::Read in
PSDParser.cpp i ...)
- freeimage
+ [bookworm] - freeimage (Revisit when patches are available)
+ [bullseye] - freeimage (Revisit when patches are available)
NOTE:
https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
CVE-2020-24292 (Buffer Overflow vulnerability in load function in
PluginICO.cpp in Fre ...)
- freeimage
+ [bookworm] - freeimage (Revisit when patches are available)
+ [bullseye] - freeimage (Revisit when patches are available)
NOTE:
https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/
CVE-2020-24291
RESERVED
@@ -481417,11 +481431,15 @@ CVE-2016-1245 (It was discovered that the zebra
daemon in Quagga before 1.0.2016
CVE-2016-1244 (The extractTree function in unADF allows remote attackers to
execute a ...)
{DSA-3676-1 DLA-631-1}
- unadf (bug #838248)
+ [bookworm] - unadf (Minor issue)
+ [bullseye] - unadf (Minor issue)
NOTE: Fixed by:
https://github.com/lclevy/ADFlib/commit/8e973d7b894552c3a3de0ccd2d1e9cb0b8e618dd
NOTE: The changes between 0.7.11a-3 and 0.7.11a-4 did not include the
upstream fix.
CVE-2016-1243 (Stack-based buffer overflow in the extractTree function in
unADF allow ...)
{DSA-3676-1 DLA-631-1}
- unadf (bug #838248)
+ [bookworm] - unadf (Minor issue)
+ [bullseye] - unadf (Minor issue)
NOTE: Fixed by:
https://github.com/lclevy/ADFlib/commit/8e973d7b894552c3a3de0ccd2d1e9cb0b8e618dd
NOTE: The changes between 0.7.11a-3 and 0.7.11a-4 did not include the
upstream fix.
CVE-2016-1242 (file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x
before 3 ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6718b1f7011e963f7d1ed317be9f222859974ee4
--
View it on GitL
[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 0b90da7a by Moritz Muehlenhoff at 2023-11-22T14:44:07+01:00 NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -267,7 +267,7 @@ CVE-2023-48241 (XWiki Platform is a generic wiki platform. Starting in version 6 CVE-2023-48240 (XWiki Platform is a generic wiki platform. The rendered diff in XWiki ...) NOT-FOR-US: XWiki CVE-2023-48223 (fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to v ...) - TODO: check + NOT-FOR-US: fast-jwt CVE-2023-48221 (wire-avs provides Audio, Visual, and Signaling (AVS) functionality sur ...) NOT-FOR-US: wire-avs CVE-2023-48218 (The Strapi Protected Populate Plugin protects `get` endpoints from rev ...) @@ -393,7 +393,7 @@ CVE-2023-48295 (LibreNMS is an auto-discovering PHP/MySQL/SNMP based network mon CVE-2023-48294 (LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitorin ...) NOT-FOR-US: LibreNMS CVE-2023-48238 (joaquimserafim/json-web-token is a javascript library use to interact ...) - TODO: check + NOT-FOR-US: Node json-web-token CVE-2023-48028 (kodbox 1.46.01 has a security flaw that enables user enumeration. This ...) NOT-FOR-US: kodbox CVE-2023-48017 (Dreamer_cms 4.1.3 is vulnerable to Cross Site Request Forgery (CSRF) v ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0b90da7ae48ae7063dac81cef421fb9b3d19332b -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0b90da7ae48ae7063dac81cef421fb9b3d19332b You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] vlc n/a
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: dffd9d23 by Moritz Muehlenhoff at 2023-11-22T14:30:15+01:00 vlc n/a - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -58,7 +58,8 @@ CVE-2023-47016 (radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_item NOTE: https://github.com/radareorg/radare2/issues/22349 NOTE: https://github.com/radareorg/radare2/commit/40c9f50e127be80b9d816bce2ab2ee790831aefd CVE-2023-46814 (A binary hijacking vulnerability exists within the VideoLAN VLC media ...) - TODO: check + - vlc (Windows-specific) + NOTE: https://www.videolan.org/security/sb-vlc3019.html CVE-2023-41146 (Autodesk Customer Support Portal allows cases created by users under a ...) NOT-FOR-US: Autodesk Customer Support Portal CVE-2023-41145 (Autodesk users who no longer have an active license for an account can ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dffd9d23389703621494c75083e0f944619db1e8 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dffd9d23389703621494c75083e0f944619db1e8 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new giflib issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: c0ba91ef by Moritz Muehlenhoff at 2023-11-22T14:25:31+01:00 new giflib issue - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -45,7 +45,10 @@ CVE-2023-48230 (Cap'n Proto is a data interchange format and capability-based RP CVE-2023-48228 (authentik is an open-source identity provider. When initialising a oau ...) NOT-FOR-US: authentik CVE-2023-48161 (Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows ...) - TODO: check + - giflib + [bookworm] - giflib (Minor issue) + [bullseye] - giflib (Minor issue) + NOTE: https://sourceforge.net/p/giflib/bugs/167/ CVE-2023-47393 (An access control issue in Mercedes me IOS APP v1.34.0 and below allow ...) NOT-FOR-US: Mercedes me IOS APP CVE-2023-47392 (An access control issue in Mercedes me IOS APP v1.34.0 and below allow ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c0ba91ef066c46e2ffa304a044c5728eeb6a49e5 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c0ba91ef066c46e2ffa304a044c5728eeb6a49e5 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 141f by Moritz Muehlenhoff at 2023-11-22T14:06:58+01:00 NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -31,7 +31,7 @@ CVE-2023-48302 (Nextcloud Server provides data storage for Nextcloud, an open so CVE-2023-48301 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - nextcloud-server (bug #941708) CVE-2023-48299 (TorchServe is a tool for serving and scaling PyTorch models in product ...) - TODO: check + NOT-FOR-US: TorchServe CVE-2023-48239 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - nextcloud-server (bug #941708) CVE-2023-48230 (Cap'n Proto is a data interchange format and capability-based RPC syst ...) @@ -147,11 +147,11 @@ CVE-2023-5598 (Stored Cross-site Scripting (XSS) vulnerabilities\xc2affecting 3D CVE-2023-5055 (Possible variant of CVE-2021-3434 in function le_ecred_reconf_req.) NOT-FOR-US: zephyr-rtos CVE-2023-49061 (An attacker could have performed HTML template injection via Reader Mo ...) - TODO: check + - firefox (Only affects Firefox for iOS) CVE-2023-49060 (An attacker could have accessed internal pages or data by ex-filtratin ...) - TODO: check + - firefox (Only affects Firefox for iOS) CVE-2023-48226 (OpenReplay is a self-hosted session replay suite. In version 1.14.0, d ...) - TODO: check + NOT-FOR-US: OpenReplay CVE-2023-48124 (Cross Site Scripting in SUP Online Shopping v.1.0 allows a remote atta ...) NOT-FOR-US: SUP Online Shopping CVE-2023-47643 (SuiteCRM is a Customer Relationship Management (CRM) software applicat ...) @@ -265,7 +265,7 @@ CVE-2023-48240 (XWiki Platform is a generic wiki platform. The rendered diff in CVE-2023-48223 (fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to v ...) TODO: check CVE-2023-48221 (wire-avs provides Audio, Visual, and Signaling (AVS) functionality sur ...) - TODO: check + NOT-FOR-US: wire-avs CVE-2023-48218 (The Strapi Protected Populate Plugin protects `get` endpoints from rev ...) NOT-FOR-US: Strapi Protected Populate Plugin CVE-2023-48111 (Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via t ...) @@ -161776,7 +161776,7 @@ CVE-2021-38407 (Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerab CVE-2021-38406 (Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper va ...) NOT-FOR-US: Delta Electronic CVE-2021-38405 (The Datalogics APDFL library used in affected products is vulnerable t ...) - TODO: check + NOT-FOR-US: Siemens CVE-2021-38404 (Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper va ...) NOT-FOR-US: Delta Electronic CVE-2021-38403 (Delta Electronics DIALink versions 1.2.4.0 and prior is vulnerable to ...) @@ -163205,7 +163205,7 @@ CVE-2021-37944 CVE-2021-37943 RESERVED CVE-2021-37942 (A local privilege escalation issue was found with the APM Java agent, ...) - TODO: check + NOT-FOR-US: Elastic APM Java agent CVE-2021-37941 (A local privilege escalation issue was found with the APM Java agent, ...) NOT-FOR-US: Elastic APM Java agent CVE-2021-37940 (An information disclosure via GET request server-side request forgery ...) @@ -163215,7 +163215,7 @@ CVE-2021-37939 (It was discovered that Kibana\u2019s JIRA connector & IBM Resili CVE-2021-37938 (It was discovered that on Windows operating systems specifically, Kiba ...) - kibana (bug #700337) CVE-2021-37937 (An issue was found with how API keys are created with the Fleet-Server ...) - TODO: check + - elasticsearch CVE-2021-37936 (It was discovered that Kibana was not sanitizing document fields conta ...) - kibana (bug #700337) CVE-2021-37935 (An information disclosure vulnerability in the login page of Huntflow ...) @@ -202921,9 +202921,9 @@ CVE-2021-22153 (A Remote Code Execution vulnerability in the Management Console CVE-2021-22152 (A Denial of Service due to Improper Input Validation vulnerability in ...) NOT-FOR-US: BlackBerry UEM CVE-2021-22151 (It was discovered that Kibana was not validating a user supplied path, ...) - TODO: check + - kibana (bug #700337) CVE-2021-22150 (It was discovered that a user with Fleet admin permissions could uploa ...) - TODO: check + - kibana (bug #700337) CVE-2021-22149 (Elastic Enterprise Search App Search versions before 7.14.0 are vulner ...) NOT-FOR-US: Elastic Enterprise Search CVE-2021-22148 (Elastic Enterprise Search App Search versions before 7.14.0 was vulner ...) @@ -202937,7 +202937,7 @@ CVE-2021-22145 (A memory disclosure vulnerability was identified in Elasticsearc CVE-2021-22144 (In
[Git][security-tracker-team/security-tracker][master] bullseye/bookworm triage
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 1a0109c5 by Moritz Muehlenhoff at 2023-11-22T10:59:25+01:00 bullseye/bookworm triage - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -76,9 +76,10 @@ CVE-2023-6238 (A buffer overflow vulnerability was found in the NVM Express (NVM CVE-2023-6235 (An uncontrolled search path element vulnerability has been found in th ...) NOT-FOR-US: Duet Display for Windows CVE-2023-6228 [heap-based buffer overflow in cpStripToTile() in tools/tiffcp.c] - - tiff + - tiff (unimportant) NOTE: https://gitlab.com/libtiff/libtiff/-/issues/606 NOTE: Fixed by: https://gitlab.com/libtiff/libtiff/-/commit/1e7d217a323eac701b134afc4ae39b6bdfdbc96a + NOTE: Crash in CLI tool, no security impact CVE-2023-6213 (Memory safety bugs present in Firefox 119. Some of these bugs showed e ...) - firefox 120.0-1 NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2023-49/#CVE-2023-6213 @@ -1536,9 +1537,13 @@ CVE-2023-47117 (Label Studio is an open source data labeling tool. In all curren NOT-FOR-US: Label Studio CVE-2023-46446 (An issue in AsyncSSH v2.14.0 and earlier allows attackers to control t ...) - python-asyncssh (bug #1055999) + [bookworm] - python-asyncssh (Minor issue) + [bullseye] - python-asyncssh (Minor issue) NOTE: https://github.com/ronf/asyncssh/security/advisories/GHSA-c35q-ffpf-5qpm CVE-2023-46445 (An issue in AsyncSSH v2.14.0 and earlier allows attackers to control t ...) - python-asyncssh (bug #1056000) + [bookworm] - python-asyncssh (Minor issue) + [bullseye] - python-asyncssh (Minor issue) NOTE: https://github.com/ronf/asyncssh/security/advisories/GHSA-cfc2-wr2v-gxm5 CVE-2023-46021 (SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank ...) NOT-FOR-US: Code-Projects Blood Bank @@ -4573,6 +4578,8 @@ CVE-2023-46119 (Parse Server is an open source backend that can be deployed to a NOT-FOR-US: Parse Server CVE-2023-46118 (RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API ...) - rabbitmq-server + [bookworm] - rabbitmq-server (Minor issue) + [bullseye] - rabbitmq-server (Minor issue) NOTE: https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg NOTE: https://github.com/rabbitmq/rabbitmq-server/pull/9708 CVE-2023-4 (File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker t ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1a0109c5a3b29c102ddc93d794e6c0ba32b7e007 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1a0109c5a3b29c102ddc93d794e6c0ba32b7e007 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] NFUs
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 09378dcd by Moritz Muehlenhoff at 2023-11-22T10:07:28+01:00 NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,3 +1,5 @@ +CVE-2023-37924 + NOT-FOR-US: Apache Submarine CVE-2023-6248 (The Syrus4 IoT gateway utilizes an unsecured MQTT server to download a ...) NOT-FOR-US: Syrus4 IoT gateway CVE-2023-5299 (A user with a standard account in Fuji Electric Tellus Lite may overwr ...) @@ -5,15 +7,15 @@ CVE-2023-5299 (A user with a standard account in Fuji Electric Tellus Lite may o CVE-2023-49105 (An issue was discovered in ownCloud owncloud/core before 10.13.1. An a ...) - owncloud CVE-2023-49104 (An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when ...) - TODO: check + NOT-FOR-US: Owncloud addon CVE-2023-49103 (An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2 ...) - TODO: check + NOT-FOR-US: Owncloud addon CVE-2023-48701 (Statamic CMS is a Laravel and Git powered content management system (C ...) NOT-FOR-US: Statamic CMS CVE-2023-48700 (The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libr ...) NOT-FOR-US: Nautobot Device Onboarding plugin CVE-2023-48699 (fastbots is a library for fast bot and scraper development using selen ...) - TODO: check + NOT-FOR-US: fastbots CVE-2023-48307 (Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivi ...) NOT-FOR-US: Nextcloud Mail app CVE-2023-48306 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/09378dcd13dfb874fe297e8b26c4dbab05ab1be5 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/09378dcd13dfb874fe297e8b26c4dbab05ab1be5 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] data/dla-needed.txt: Claim strongswan.
Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker Commits: e99cd54d by Chris Lamb at 2023-11-22T08:55:38+00:00 data/dla-needed.txt: Claim strongswan. - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -245,7 +245,7 @@ samba squid NOTE: 20231102: Added by Front-Desk (lamby) -- -strongswan +strongswan (Chris Lamb) NOTE: 20231121: Added by Front-Desk (ola) -- suricata (Adrian Bunk) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e99cd54dbffccd962048b75b31152d01b9830b47 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e99cd54dbffccd962048b75b31152d01b9830b47 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2023-47016/radare2
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: a65c8108 by Salvatore Bonaccorso at 2023-11-22T09:37:51+01:00 Add CVE-2023-47016/radare2 - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -49,7 +49,9 @@ CVE-2023-47393 (An access control issue in Mercedes me IOS APP v1.34.0 and below CVE-2023-47392 (An access control issue in Mercedes me IOS APP v1.34.0 and below allow ...) NOT-FOR-US: Mercedes me IOS APP CVE-2023-47016 (radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in l ...) - TODO: check + - radare2 + NOTE: https://github.com/radareorg/radare2/issues/22349 + NOTE: https://github.com/radareorg/radare2/commit/40c9f50e127be80b9d816bce2ab2ee790831aefd CVE-2023-46814 (A binary hijacking vulnerability exists within the VideoLAN VLC media ...) TODO: check CVE-2023-41146 (Autodesk Customer Support Portal allows cases created by users under a ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a65c81083eead36aee9fcc9ccabf8cec9f9b6c6c -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a65c81083eead36aee9fcc9ccabf8cec9f9b6c6c You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: af3cfad9 by Salvatore Bonaccorso at 2023-11-22T09:37:04+01:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -45,25 +45,25 @@ CVE-2023-48228 (authentik is an open-source identity provider. When initialising CVE-2023-48161 (Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows ...) TODO: check CVE-2023-47393 (An access control issue in Mercedes me IOS APP v1.34.0 and below allow ...) - TODO: check + NOT-FOR-US: Mercedes me IOS APP CVE-2023-47392 (An access control issue in Mercedes me IOS APP v1.34.0 and below allow ...) - TODO: check + NOT-FOR-US: Mercedes me IOS APP CVE-2023-47016 (radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in l ...) TODO: check CVE-2023-46814 (A binary hijacking vulnerability exists within the VideoLAN VLC media ...) TODO: check CVE-2023-41146 (Autodesk Customer Support Portal allows cases created by users under a ...) - TODO: check + NOT-FOR-US: Autodesk Customer Support Portal CVE-2023-41145 (Autodesk users who no longer have an active license for an account can ...) - TODO: check + NOT-FOR-US: Autodesk CVE-2023-40152 (When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted ...) - TODO: check + NOT-FOR-US: Fuji Electric Tellus Lite V-Simulator CVE-2023-35127 (Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V ...) - TODO: check + NOT-FOR-US: Fuji Electric Tellus Lite V-Simulator CVE-2023-2447 (The UserPro plugin for WordPress is vulnerable to Cross-Site Request F ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2023-2446 (The UserPro plugin for WordPress is vulnerable to sensitive informatio ...) - TODO: check + NOT-FOR-US: WordPress plugin CVE-2023-6238 (A buffer overflow vulnerability was found in the NVM Express (NVMe) dr ...) - linux [bookworm] - linux (Vulnerable code not present) @@ -34240,7 +34240,7 @@ CVE-2023-29071 CVE-2023-29070 RESERVED CVE-2023-29069 (A maliciously crafted DLL file can be forced to install onto a non-def ...) - TODO: check + NOT-FOR-US: Autodesk CVE-2023-29068 (A maliciously crafted file consumed through pskernel.dll file could le ...) NOT-FOR-US: Autodesk CVE-2023-29067 (A maliciously crafted X_B file when parsed through Autodesk\xae AutoCA ...) @@ -95356,7 +95356,7 @@ CVE-2022-35640 CVE-2022-35639 (IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do no ...) NOT-FOR-US: IBM CVE-2022-35638 (IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 a ...) - TODO: check + NOT-FOR-US: IBM CVE-2022-35637 (IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is ...) NOT-FOR-US: IBM CVE-2022-35636 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/af3cfad915e0f3cb97830aeed7d11270d4e464b3 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/af3cfad915e0f3cb97830aeed7d11270d4e464b3 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2023-49105/owncloud
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 48914d05 by Salvatore Bonaccorso at 2023-11-22T09:31:45+01:00 Add CVE-2023-49105/owncloud - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -3,7 +3,7 @@ CVE-2023-6248 (The Syrus4 IoT gateway utilizes an unsecured MQTT server to downl CVE-2023-5299 (A user with a standard account in Fuji Electric Tellus Lite may overwr ...) NOT-FOR-US: Fuji Electric Tellus Lite CVE-2023-49105 (An issue was discovered in ownCloud owncloud/core before 10.13.1. An a ...) - TODO: check + - owncloud CVE-2023-49104 (An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when ...) TODO: check CVE-2023-49103 (An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2 ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/48914d05c669f144b7a9d588c9b67198138f5bfe -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/48914d05c669f144b7a9d588c9b67198138f5bfe You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2023-48230/capnproto
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: e1cac527 by Salvatore Bonaccorso at 2023-11-22T09:31:02+01:00 Add CVE-2023-48230/capnproto - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -33,7 +33,13 @@ CVE-2023-48299 (TorchServe is a tool for serving and scaling PyTorch models in p CVE-2023-48239 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - nextcloud-server (bug #941708) CVE-2023-48230 (Cap'n Proto is a data interchange format and capability-based RPC syst ...) - TODO: check + - capnproto + [bookworm] - capnproto (Vulnerable code not present) + [bullseye] - capnproto (Vulnerable code not present) + [buster] - capnproto (Vulnerable code not present) + NOTE: https://github.com/capnproto/capnproto/security/advisories/GHSA-r89h-f468-62w3 + NOTE: https://github.com/capnproto/capnproto/commit/75c5c1499aa6e7690b741204ff9af91cce526c59 (v2-branch) + NOTE: https://github.com/capnproto/capnproto/commit/5d5d734b0350c6f2e36c3155753e6a19fbfeda9a (v1.0.1.1) CVE-2023-48228 (authentik is an open-source identity provider. When initialising a oau ...) NOT-FOR-US: authentik CVE-2023-48161 (Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e1cac527aac7c958ea7030af1aa7fa0e8de9e4a2 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e1cac527aac7c958ea7030af1aa7fa0e8de9e4a2 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add set of new issues for nextcloud-server
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 66913580 by Salvatore Bonaccorso at 2023-11-22T09:28:58+01:00 Add set of new issues for nextcloud-server - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -17,21 +17,21 @@ CVE-2023-48699 (fastbots is a library for fast bot and scraper development using CVE-2023-48307 (Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivi ...) NOT-FOR-US: Nextcloud Mail app CVE-2023-48306 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2023-48305 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2023-48304 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2023-48303 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2023-48302 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2023-48301 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2023-48299 (TorchServe is a tool for serving and scaling PyTorch models in product ...) TODO: check CVE-2023-48239 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) - TODO: check + - nextcloud-server (bug #941708) CVE-2023-48230 (Cap'n Proto is a data interchange format and capability-based RPC syst ...) TODO: check CVE-2023-48228 (authentik is an open-source identity provider. When initialising a oau ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/66913580721bcc7ff8734f319ca3e649430809d8 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/66913580721bcc7ff8734f319ca3e649430809d8 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: d6c0633c by Salvatore Bonaccorso at 2023-11-22T09:27:46+01:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,7 +1,7 @@ CVE-2023-6248 (The Syrus4 IoT gateway utilizes an unsecured MQTT server to download a ...) - TODO: check + NOT-FOR-US: Syrus4 IoT gateway CVE-2023-5299 (A user with a standard account in Fuji Electric Tellus Lite may overwr ...) - TODO: check + NOT-FOR-US: Fuji Electric Tellus Lite CVE-2023-49105 (An issue was discovered in ownCloud owncloud/core before 10.13.1. An a ...) TODO: check CVE-2023-49104 (An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when ...) @@ -9,13 +9,13 @@ CVE-2023-49104 (An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1 CVE-2023-49103 (An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2 ...) TODO: check CVE-2023-48701 (Statamic CMS is a Laravel and Git powered content management system (C ...) - TODO: check + NOT-FOR-US: Statamic CMS CVE-2023-48700 (The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libr ...) - TODO: check + NOT-FOR-US: Nautobot Device Onboarding plugin CVE-2023-48699 (fastbots is a library for fast bot and scraper development using selen ...) TODO: check CVE-2023-48307 (Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivi ...) - TODO: check + NOT-FOR-US: Nextcloud Mail app CVE-2023-48306 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) TODO: check CVE-2023-48305 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) @@ -35,7 +35,7 @@ CVE-2023-48239 (Nextcloud Server provides data storage for Nextcloud, an open so CVE-2023-48230 (Cap'n Proto is a data interchange format and capability-based RPC syst ...) TODO: check CVE-2023-48228 (authentik is an open-source identity provider. When initialising a oau ...) - TODO: check + NOT-FOR-US: authentik CVE-2023-48161 (Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows ...) TODO: check CVE-2023-47393 (An access control issue in Mercedes me IOS APP v1.34.0 and below allow ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d6c0633c384aaf1626fe9550bd7d6528e4b936e5 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d6c0633c384aaf1626fe9550bd7d6528e4b936e5 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8b93407b by security tracker role at 2023-11-22T08:12:07+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,4 +1,64 @@ -CVE-2023-6238 [nvme: memory corruption via unprivileged user passthrough] +CVE-2023-6248 (The Syrus4 IoT gateway utilizes an unsecured MQTT server to download a ...) + TODO: check +CVE-2023-5299 (A user with a standard account in Fuji Electric Tellus Lite may overwr ...) + TODO: check +CVE-2023-49105 (An issue was discovered in ownCloud owncloud/core before 10.13.1. An a ...) + TODO: check +CVE-2023-49104 (An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when ...) + TODO: check +CVE-2023-49103 (An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2 ...) + TODO: check +CVE-2023-48701 (Statamic CMS is a Laravel and Git powered content management system (C ...) + TODO: check +CVE-2023-48700 (The Nautobot Device Onboarding plugin uses the netmiko and NAPALM libr ...) + TODO: check +CVE-2023-48699 (fastbots is a library for fast bot and scraper development using selen ...) + TODO: check +CVE-2023-48307 (Nextcloud Mail is the mail app for Nextcloud, a self-hosted productivi ...) + TODO: check +CVE-2023-48306 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) + TODO: check +CVE-2023-48305 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) + TODO: check +CVE-2023-48304 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) + TODO: check +CVE-2023-48303 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) + TODO: check +CVE-2023-48302 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) + TODO: check +CVE-2023-48301 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) + TODO: check +CVE-2023-48299 (TorchServe is a tool for serving and scaling PyTorch models in product ...) + TODO: check +CVE-2023-48239 (Nextcloud Server provides data storage for Nextcloud, an open source c ...) + TODO: check +CVE-2023-48230 (Cap'n Proto is a data interchange format and capability-based RPC syst ...) + TODO: check +CVE-2023-48228 (authentik is an open-source identity provider. When initialising a oau ...) + TODO: check +CVE-2023-48161 (Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows ...) + TODO: check +CVE-2023-47393 (An access control issue in Mercedes me IOS APP v1.34.0 and below allow ...) + TODO: check +CVE-2023-47392 (An access control issue in Mercedes me IOS APP v1.34.0 and below allow ...) + TODO: check +CVE-2023-47016 (radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in l ...) + TODO: check +CVE-2023-46814 (A binary hijacking vulnerability exists within the VideoLAN VLC media ...) + TODO: check +CVE-2023-41146 (Autodesk Customer Support Portal allows cases created by users under a ...) + TODO: check +CVE-2023-41145 (Autodesk users who no longer have an active license for an account can ...) + TODO: check +CVE-2023-40152 (When Fuji Electric Tellus Lite V-Simulator parses a specially-crafted ...) + TODO: check +CVE-2023-35127 (Stack-based buffer overflow may occur when Fuji Electric Tellus Lite V ...) + TODO: check +CVE-2023-2447 (The UserPro plugin for WordPress is vulnerable to Cross-Site Request F ...) + TODO: check +CVE-2023-2446 (The UserPro plugin for WordPress is vulnerable to sensitive informatio ...) + TODO: check +CVE-2023-6238 (A buffer overflow vulnerability was found in the NVM Express (NVMe) dr ...) - linux [bookworm] - linux (Vulnerable code not present) [bullseye] - linux (Vulnerable code not present) @@ -34173,8 +34233,8 @@ CVE-2023-29071 RESERVED CVE-2023-29070 RESERVED -CVE-2023-29069 - RESERVED +CVE-2023-29069 (A maliciously crafted DLL file can be forced to install onto a non-def ...) + TODO: check CVE-2023-29068 (A maliciously crafted file consumed through pskernel.dll file could le ...) NOT-FOR-US: Autodesk CVE-2023-29067 (A maliciously crafted X_B file when parsed through Autodesk\xae AutoCA ...) @@ -95289,8 +95349,8 @@ CVE-2022-35640 RESERVED CVE-2022-35639 (IBM Sterling Partner Engagement Manager 6.1, 6.2, and Cloud 22.2 do no ...) NOT-FOR-US: IBM -CVE-2022-35638 - RESERVED +CVE-2022-35638 (IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.8 a ...) + TODO: check CVE-2022-35637 (IBM Db2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, 11.1, and 11.5 is ...) NOT-FOR-US: IBM CVE-2022-35636 @@ -163127,8 +163187,8 @
