subject:"\[Git\]\[security\-tracker\-team\/security\-tracker\]\[master\] bullseye triage"

[Git][security-tracker-team/security-tracker][master] bullseye triage

2024-05-01 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
eab15f76 by Moritz Muehlenhoff at 2024-05-01T13:42:52+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -22378,7 +22378,7 @@ CVE-2023-50387 (Certain DNSSEC aspects of the DNS 
protocol (in RFC 4033, 4034, 4
[bullseye] - knot-resolver  (Too intrusive to backport, if 
DNSSEC is used Bookworm can be used)
[buster] - knot-resolver  (Too intrusive to backport)
- pdns-recursor 4.9.3-1 (bug #1063852)
-   [bullseye] - pdns-recursor  (Too intrusive to backport, if 
DNSSEC is used Bookworm can be used)
+   [bullseye] - pdns-recursor  (No longer supported with 
security updates in Bullseye)
- unbound 1.19.1-1 (bug #1063845)
- systemd 255.4-1
[bookworm] - systemd  (DNSSEC is disabled by default in 
systemd-resolved; can be fixed via point release)
@@ -22420,7 +22420,7 @@ CVE-2023-50868 (The Closest Encloser Proof aspect of 
the DNS protocol (in RFC 51
[bullseye] - knot-resolver  (Too intrusive to backport, if 
DNSSEC is used Bookworm can be used)
[buster] - knot-resolver  (Too intrusive to backport, if 
DNSSEC is used Bookworm can be used)
- pdns-recursor 4.9.3-1 (bug #1063852)
-   [bullseye] - pdns-recursor  (Too intrusive to backport, if 
DNSSEC is used Bookworm can be used)
+   [bullseye] - pdns-recursor  (No longer supported with 
security updates in Bullseye)
- unbound 1.19.1-1 (bug #1063845)
- systemd 255.4-1
[bookworm] - systemd  (DNSSEC is disabled by default in 
systemd-resolved; can be fixed via point release)
@@ -41844,6 +41844,7 @@ CVE-2015-20110 (JHipster generator-jhipster before 
2.23.0 allows a timing attack
NOT-FOR-US: JHipster generator-jhipster
 CVE-2023-34049 [allows an attacker to force Salt-SSH to run their script]
- salt  (bug #1055179)
+   [bullseye] - salt  (Scheduled for removal)
[buster] - salt  (EOL in buster LTS)
NOTE: 
https://saltproject.io/security-announcements/2023-10-27-advisory/index.html
 CVE-2023-5844 (Unverified Password Change in GitHub repository 
pimcore/admin-ui-class ...)
@@ -64221,6 +64222,7 @@ CVE-2023-28370 (Open redirect vulnerability in Tornado 
versions 6.3.1 and earlie
[bullseye] - python-tornado  (Minor issue)
[buster] - python-tornado  (Minor issue)
- salt  (bug #1059297)
+   [bullseye] - salt  (Scheduled for removal)
[buster] - salt  (EOL in buster LTS)
NOTE: 
https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f
 (v6.3.2)
 CVE-2023-27529 (Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) 
contains an ...)
@@ -81150,7 +81152,7 @@ CVE-2023-26438 (External service lookups for a number 
of protocols were vulnerab
NOT-FOR-US: OX App Suite
 CVE-2023-26437 (Denial of service vulnerability in PowerDNS Recursor allows 
authoritat ...)
- pdns-recursor 4.8.4-1 (bug #1033941)
-   [bullseye] - pdns-recursor  (Minor issue)
+   [bullseye] - pdns-recursor  (No longer supported with 
security updates in Bullseye)
[buster] - pdns-recursor  (Minor issue)
NOTE: 
https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2023-02.html
NOTE: 
https://github.com/PowerDNS/pdns/commit/94fccab63457f8327add3a8e1e2b7876234e4989
 (rec-4.6.6)
@@ -107817,10 +107819,12 @@ CVE-2023-20899 (VMware SD-WAN (Edge) contains a 
bypass authentication vulnerabil
NOT-FOR-US: VMware
 CVE-2023-20898 (Git Providers can read from the wrong environment because they 
get the ...)
- salt  (bug #1051504)
+   [bullseye] - salt  (Scheduled for removal)
[buster] - salt  (EOL in buster LTS)
NOTE: https://saltproject.io/security-announcements/2023-08-10-advisory/
 CVE-2023-20897 (Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion 
return. ...)
- salt  (bug #1051504)
+   [bullseye] - salt  (Scheduled for removal)
[buster] - salt  (EOL in buster LTS)
NOTE: https://saltproject.io/security-announcements/2023-08-10-advisory/
NOTE: https://github.com/saltstack/salt/issues/64061
@@ -129284,7 +129288,7 @@ CVE-2022-37429 (Silverstripe silverstripe/framework 
through 4.11 allows XSS (iss
NOT-FOR-US: SilverStripe CMS
 CVE-2022-37428 (PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, 
when pro ...)
- pdns-recursor 4.7.2-1
-   [bullseye] - pdns-recursor  (Minor issue)
+   [bullseye] - pdns-recursor  (No longer supported with 
security updates in Bullseye)
[buster] - pdns-recursor  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/08/23/1
NOTE: https://downloads.powerdns.com/patches/2022-02/
@@ -158499,7 +158503,7 @@ CVE-2022-27228 (In the

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-24 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
0ba18c60 by Moritz Mühlenhoff at 2023-05-24T18:17:19+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -52131,6 +52131,7 @@ CVE-2022-41608 (Cross-Site Request Forgery (CSRF) 
vulnerability in Thomas Belser
NOT-FOR-US: WordPress plugin
 CVE-2022-41606 (HashiCorp Nomad and Nomad Enterprise 1.0.2 up to 1.2.12, and 
1.3.5 job ...)
- nomad  (bug #1021670)
+   [bullseye] - nomad  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-22-nomad-panics-on-job-submission-with-bad-artifact-stanza-source-url/45420
 CVE-2022-41605
RESERVED
@@ -100015,18 +100016,22 @@ CVE-2022-24687 (HashiCorp Consul and Consul 
Enterprise 1.9.0 through 1.9.14, 1.1
NOTE: 
https://github.com/hashicorp/consul/commit/d35c6a97cbdff252f5238d6b52f49786f896566a
 (v1.9.15)
 CVE-2022-24686 (HashiCorp Nomad and Nomad Enterprise 0.3.0 through 1.0.17, 
1.1.11, and ...)
- nomad  (bug #1021273)
+   [bullseye] - nomad  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-01-nomad-artifact-download-race-condition/35559
 CVE-2022-24685 (HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 
allow i ...)
- nomad  (bug #1021273)
+   [bullseye] - nomad  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-03-nomad-malformed-job-parsing-results-in-excessive-cpu-usage/35561
NOTE: https://github.com/hashicorp/nomad/issues/12038
 CVE-2022-24684 (HashiCorp Nomad and Nomad Enterprise 0.9.0 through 1.0.16, 
1.1.11, and ...)
- nomad  (bug #1021273)
+   [bullseye] - nomad  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-04-nomad-spread-job-stanza-may-trigger-panic-in-servers/35562
NOTE: https://github.com/hashicorp/nomad/issues/12039
NOTE: 
https://github.com/hashicorp/nomad/commit/c49359ad58f0af18a5697a0b7b9b6cca9656d267
 (v1.2.6)
 CVE-2022-24683 (HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 
1.1.11, and ...)
- nomad  (bug #1021273)
+   [bullseye] - nomad  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-02-nomad-alloc-filesystem-and-container-escape/35560
 CVE-2022-24682 (An issue was discovered in the Calendar feature in Zimbra 
Collaboratio ...)
NOT-FOR-US: Zimbra
@@ -119241,6 +119246,7 @@ CVE-2021-43416
RESERVED
 CVE-2021-43415 (HashiCorp Nomad and Nomad Enterprise up to 1.0.13, 1.1.7, and 
1.2.0, w ...)
- nomad  (bug #1021273)
+   [bullseye] - nomad  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2021-31-nomad-qemu-task-driver-allowed-paths-bypass-with-job-args/32288
NOTE: https://github.com/hashicorp/nomad/issues/11542
NOTE: https://github.com/hashicorp/nomad/pull/11554


=
data/dsa-needed.txt
=
@@ -18,6 +18,8 @@ c-ares
 --
 cinder
 --
+docker-registry (jmm)
+--
 gpac (aron)
 --
 jupyter-core



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0ba18c601e344b81267580d8ba8d25c51345e74b

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0ba18c601e344b81267580d8ba8d25c51345e74b
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-19 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
19efa95a by Moritz Muehlenhoff at 2023-05-19T17:40:51+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -82,8 +82,9 @@ CVE-2023-31903 (GuppY CMS 6.00.10 is vulnerable to 
Unrestricted File Upload whic
 CVE-2023-31902 (RPA Technology Mobile Mouse 3.6.0.4 is vulnerable to Remote 
Code Execu ...)
NOT-FOR-US: RPA Technology Mobile Mouse
 CVE-2023-31725 (yasm 1.3.0.55.g101bc was discovered to contain a 
heap-use-after-free v ...)
-   - yasm 
+   - yasm  (unimportant)
NOTE: https://github.com/yasm/yasm/issues/221
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-31724 (yasm 1.3.0.55.g101bc was discovered to contain a segmentation 
violatio ...)
- yasm  (unimportant)
NOTE: https://github.com/yasm/yasm/issues/222
@@ -446,6 +447,7 @@ CVE-2023-31408 (Cleartext Storage of Sensitive Information 
in SICK FTMg AIR FLOW
NOT-FOR-US: SICK
 CVE-2023-32784 (In KeePass 2.x before 2.54, it is possible to recover the 
cleartext ma ...)
- keepass2 
+   [bullseye] - keepass2  (Minor issue)
NOTE: https://github.com/vdohney/keepass-password-dumper
NOTE: 
https://sourceforge.net/p/keepass/discussion/329220/thread/f3438e6283/
 CVE-2023-32758 (giturlparse (aka git-url-parse) through 1.2.2, as used in 
Semgrep thro ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/19efa95abc996d1ec55635099eaa51129cbdd7b8

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/19efa95abc996d1ec55635099eaa51129cbdd7b8
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-19 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
234c492e by Moritz Muehlenhoff at 2023-05-19T16:32:05+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -5734,6 +5734,7 @@ CVE-2023-29660
RESERVED
 CVE-2023-29659 (A Segmentation fault caused by a floating point exception 
exists in li ...)
- libheif  (bug #1035607)
+   [bullseye] - libheif  (Minor issue)
NOTE: https://github.com/strukturag/libheif/issues/794
NOTE: 
https://github.com/strukturag/libheif/commit/e05e15b57a38ec411cb9acb38512a1c36ff62991
 (v1.15.2)
 CVE-2023-29658
@@ -8535,6 +8536,7 @@ CVE-2023-1625 [information leak in API]
RESERVED
[experimental] - heat 1:20.0.0~rc1-1
- heat 1:19.0.0-2 (bug #1034186)
+   [bullseye] - heat  (Minor issue)
[buster] - heat  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2181621
NOTE: https://review.opendev.org/c/openstack/heat/+/868166
@@ -21424,6 +21426,7 @@ CVE-2023-24531
 CVE-2023-24473 (An information disclosure vulnerability exists in the 
TGAInput::read_t ...)
[experimental] - openimageio 2.4.9.0+dfsg-1
- openimageio  (bug #1034150)
+   [bullseye] - openimageio  (Minor issue)
NOTE: https://github.com/OpenImageIO/oiio/pull/3768
NOTE: 
https://github.com/OpenImageIO/oiio/commit/759fcd392d130c12ae476857e1ed2a91bcf2686b
 (master)
NOTE: 
https://github.com/OpenImageIO/oiio/commit/209bb4c327b2a8be08f41c1a213dfe9001f0b5d0
 (v2.4.8.1)
@@ -21431,12 +21434,14 @@ CVE-2023-24473 (An information disclosure 
vulnerability exists in the TGAInput::
 CVE-2023-24472 (A denial of service vulnerability exists in the 
FitsOutput::close() fu ...)
[experimental] - openimageio 2.4.9.0+dfsg-1
- openimageio  (bug #1034151)
+   [bullseye] - openimageio  (Minor issue)
NOTE: 
https://github.com/OpenImageIO/oiio/commit/f8db9f38d18a66889f444031051e0f0acaa611b6
 (master)
NOTE: 
https://github.com/OpenImageIO/oiio/commit/a39692256b060b543f53646c6a807c81b79c5750
 (v2.4.8.1)
NOTE: 
https://talosintelligence.com/vulnerability_reports/TALOS-2023-1709
 CVE-2023-22845 (An out-of-bounds read vulnerability exists in the 
TGAInput::decode_pix ...)
[experimental] - openimageio 2.4.9.0+dfsg-1
- openimageio  (bug #1034150)
+   [bullseye] - openimageio  (Minor issue)
NOTE: https://github.com/OpenImageIO/oiio/pull/3768
NOTE: 
https://github.com/OpenImageIO/oiio/commit/759fcd392d130c12ae476857e1ed2a91bcf2686b
 (master)
NOTE: 
https://github.com/OpenImageIO/oiio/commit/209bb4c327b2a8be08f41c1a213dfe9001f0b5d0
 (v2.4.8.1)
@@ -67724,6 +67729,7 @@ CVE-2022-31471 (untangle is a python library to convert 
XML data to python objec
NOTE: https://github.com/stchris/untangle/pull/94
 CVE-2022-2393 (A flaw was found in pki-core, which could allow a user to get a 
certif ...)
- dogtag-pki  (bug #1034802)
+   [bullseye] - dogtag-pki  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2101046
 CVE-2022-2392 (The Lana Downloads Manager WordPress plugin before 1.8.0 is 
affected b ...)
NOT-FOR-US: WordPress plugin
@@ -193942,9 +193948,10 @@ CVE-2020-27509 (Persistent XSS in Galaxkey Secure 
Mail Client in Galaxkey up to
 CVE-2020-27508 (In two-factor authentication, the system also sending 2fa 
secret key i ...)
NOT-FOR-US: Frappe Framework
 CVE-2020-27507 (The Kamailio SIP before 5.5.0 server mishandles INVITE 
requests with d ...)
-   - kamailio 5.5.3-1
-   NOTE: 
https://github.com/kamailio/kamailio/commit/ada3701d22b1fd579f06b4f54fa695fa988e685f
 (5.5.0)
+   - kamailio 5.4.2-1
NOTE: https://github.com/kamailio/kamailio/issues/2503
+   NOTE: 
https://github.com/kamailio/kamailio/commit/f57c900b438f3233fa1e9a9d3ca8cd383a30baa6
 (5.4.2) (5.4 branch)
+   NOTE: 
https://github.com/kamailio/kamailio/commit/ada3701d22b1fd579f06b4f54fa695fa988e685f
 (5.5.0) (master branch)
 CVE-2020-27506
RESERVED
 CVE-2020-27505


=
data/dsa-needed.txt
=
@@ -14,6 +14,8 @@ If needed, specify the release by adding a slash after the 
name of the source pa
 --
 asterisk
 --
+cinder
+--
 cups-filters
 --
 gpac (aron)
@@ -37,6 +39,8 @@ netatalk
   open regression with MacOS, tentative patch not yet merged upstream
   See discussion on team mailing list.
 --
+nova
+--
 openjdk-11 (jmm)
 --
 openjdk-17 (jmm)
@@ -51,6 +55,10 @@ php-horde-turba
 --
 py7zr
 --
+python-glance-store
+--
+python-os-brick
+--
 python-werkzeug
 --
 ring



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/234c492e44d69ad58d708c5a6f68a18c28eb3dab

-- 
View it on GitLab:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-19 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
b8c47a99 by Moritz Muehlenhoff at 2023-05-19T13:36:01+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -691,6 +691,7 @@ CVE-2023-2641 (A vulnerability was found in SourceCodester 
Online Internship Man
NOT-FOR-US: SourceCodester Online Internship Management System
 CVE-2023-32076 (in-toto is a framework to protect supply chain integrity. The 
in-toto  ...)
- in-toto  (bug #1035934)
+   [bullseye] - in-toto  (Minor issue)
NOTE: 
https://github.com/in-toto/in-toto/security/advisories/GHSA-wc64-c5rv-32pf
NOTE: 
https://github.com/in-toto/in-toto/commit/f88138c90861953c77a1384ea2fcc58126e6fe59
 (v2.0.0)
NOTE: 
https://github.com/in-toto/in-toto/commit/9835aae17bc60b600713962b2bb66e6b7abe9325
 (v2.0.0)
@@ -8397,6 +8398,7 @@ CVE-2023-28859 (redis-py before 4.4.4 and 4.5.x before 
4.5.4 leaves a connection
NOTE: https://github.com/redis/redis-py/pull/2641
 CVE-2023-28858 (redis-py before 4.5.3 leaves a connection open after canceling 
an asyn ...)
- python-redis  (bug #1033754)
+   [bullseye] - python-redis  (Vulnerable code not present)
[buster] - python-redis  (Vulnerable code introduced 
later)
NOTE: https://github.com/redis/redis-py/issues/2624
NOTE: https://github.com/redis/redis-py/pull/2641
@@ -11067,6 +11069,7 @@ CVE-2023-28116 (Contiki-NG is an open-source, 
cross-platform operating system fo
NOT-FOR-US: Contiki-NG
 CVE-2023-28115 (Snappy is a PHP library allowing thumbnail, snapshot or PDF 
generation ...)
- civicrm  (bug #1036284)
+   [bullseye] - civicrm  (Minor issue)
NOTE: 
https://github.com/KnpLabs/snappy/security/advisories/GHSA-gq6w-q6wh-jggc
NOTE: https://github.com/KnpLabs/snappy/pull/469
NOTE: 
https://github.com/KnpLabs/snappy/commit/1ee6360cbdbea5d09705909a150df7963a88efd6
 (v1.4.2)


=
data/dsa-needed.txt
=
@@ -14,6 +14,8 @@ If needed, specify the release by adding a slash after the 
name of the source pa
 --
 asterisk
 --
+cups-filters
+--
 gpac (aron)
 --
 jupyter-core



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b8c47a9986b10c61e647714f34ee02c1f869f5dd

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b8c47a9986b10c61e647714f34ee02c1f869f5dd
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-19 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f474a2a5 by Moritz Muehlenhoff at 2023-05-19T12:25:53+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -453,6 +453,7 @@ CVE-2023-32758 (giturlparse (aka git-url-parse) through 
1.2.2, as used in Semgre
 CVE-2023-2700 (A vulnerability was found in libvirt. This security flaw 
ouccers due t ...)
[experimental] - libvirt 9.3.0-1
- libvirt  (bug #1036297)
+   [bullseye] - libvirt  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2203653
NOTE: Fixed by: 
https://gitlab.com/libvirt/libvirt/-/commit/6425a311b8ad19d6f9c0b315bf1d722551ea3585
 (v9.3.0)
 CVE-2023-2699 (A vulnerability, which was classified as critical, has been 
found in S ...)
@@ -8463,16 +8464,19 @@ CVE-2023-28843 (PrestaShop/paypal is an open source 
module for the PrestaShop we
NOT-FOR-US: PrestaShop
 CVE-2023-28842 (Moby) is an open source container framework developed by 
Docker Inc. t ...)
- docker.io 20.10.24+dfsg1-1
+   [bullseye] - docker.io  (Minor issue)
NOTE: 
https://github.com/moby/moby/security/advisories/GHSA-6wrf-mxfj-pf5p
NOTE: 
https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333
 CVE-2023-28841 (Moby is an open source container framework developed by Docker 
Inc. th ...)
- docker.io 20.10.24+dfsg1-1
+   [bullseye] - docker.io  (Minor issue)
NOTE: 
https://github.com/moby/moby/security/advisories/GHSA-33pg-m6jh-5237
NOTE: 
https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333
NOTE: https://github.com/moby/moby/issues/43382
NOTE: https://github.com/moby/moby/pull/45118
 CVE-2023-28840 (Moby is an open source container framework developed by Docker 
Inc. th ...)
- docker.io 20.10.24+dfsg1-1
+   [bullseye] - docker.io  (Minor issue)
NOTE: 
https://github.com/moby/moby/security/advisories/GHSA-232p-vwff-86mp
NOTE: 
https://github.com/moby/libnetwork/security/advisories/GHSA-gvm4-2qqg-m333
NOTE: https://github.com/moby/moby/issues/43382


=
data/dsa-needed.txt
=
@@ -23,6 +23,12 @@ linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more recent v5.10.y versions
 --
+libraw
+--
+libssh
+--
+libwebp (jmm)
+--
 nbconvert
 --
 netatalk



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f474a2a5c477a7e077c8c23a40e1dafec15699d6

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f474a2a5c477a7e077c8c23a40e1dafec15699d6
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-18 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
dc5f382e by Moritz Muehlenhoff at 2023-05-18T17:51:15+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -337,43 +337,67 @@ CVE-2023-31620 (An issue in the dv_compare component of 
openlink virtuoso-openso
NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/a4997ed2499c4de8c95e2de9e2a07b60384fbbec
 CVE-2023-31619 (An issue in the sch_name_to_object component of openlink 
virtuoso-open ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1133
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/2ed10333e6e973c2b3e1e60ba854ef0dd12afe07
 CVE-2023-31618 (An issue in the sqlc_union_dt_wrap component of openlink 
virtuoso-open ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1136
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/030e47a29976709a50603e3f34e82278e5f462df
 CVE-2023-31617 (An issue in the dk_set_delete component of openlink 
virtuoso-opensourc ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1127
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/2b64ad928ef5f75fc93091677a78abfbd17ea07f
 CVE-2023-31616 (An issue in the bif_mod component of openlink 
virtuoso-opensource v7.2 ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1122
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/25fff0eaa85898004bb14909e9f29d16b2918792
 CVE-2023-31615 (An issue in the chash_array component of openlink 
virtuoso-opensource  ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1124
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/d02925b18e3ad0244ae7c52acf92bfa686738eb2
 CVE-2023-31614 (An issue in the mp_box_deserialize_string function in openlink 
virtuos ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1117
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/7c488ae70803b208a94bf12fee792195caddbf7d
 CVE-2023-31613 (An issue in the __nss_database_lookup component of openlink 
virtuoso-o ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1121
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/171718c844530864cb375213c8b9cbc8ba079efc
 CVE-2023-31612 (An issue in the dfe_qexp_list component of openlink 
virtuoso-opensourc ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1125
 CVE-2023-31611 (An issue in the __libc_longjmp component of openlink 
virtuoso-opensour ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1119
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/db0b768dfbb66e306504d0f7951c4ae4932edd74
 CVE-2023-31610 (An issue in the _IO_default_xsputn component of openlink 
virtuoso-open ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1118
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/2ed10333e6e973c2b3e1e60ba854ef0dd12afe07
 CVE-2023-31609 (An issue in the dfe_unit_col_loci component of openlink 
virtuoso-opens ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1126
 CVE-2023-31608 (An issue in the artm_div_int component of openlink 
virtuoso-opensource ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1123
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/9c5bdeb73b00b5ae88db0be036d429d779126094
 CVE-2023-31607 (An issue in the __libc_malloc component of openlink 
virtuoso-opensourc ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1120
+   NOTE:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-17 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ae967725 by Moritz Muehlenhoff at 2023-05-17T16:26:56+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -173,40 +173,64 @@ CVE-2023-31842 (Sourcecodester Faculty Evaluation System 
v1.0 is vulnerable to S
NOT-FOR-US: Sourcecodester Faculty Evaluation System
 CVE-2023-31631 (An issue in the sqlo_preds_contradiction component of openlink 
virtuos ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1137
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/c77cd981a82a7f6385b174eb818057b2f19d8c09
 CVE-2023-31630 (An issue in the sqlo_query_spec component of openlink 
virtuoso-opensou ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1138
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/f9244141ce68dc4a3314fd4a0cd5bb3bdd6ab830
 CVE-2023-31629 (An issue in the sqlo_union_scope component of openlink 
virtuoso-openso ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1139
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/9553f94992f0a33f7eb7e87e74f0f78998ba5bec
 CVE-2023-31628 (An issue in the stricmp component of openlink 
virtuoso-opensource v7.2 ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1141
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/2ed10333e6e973c2b3e1e60ba854ef0dd12afe07
 CVE-2023-31627 (An issue in the strhash component of openlink 
virtuoso-opensource v7.2 ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1140
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/ce61d6f568568b771d7e857408e3246d31135494
 CVE-2023-31626 (An issue in the gpf_notice component of openlink 
virtuoso-opensource v ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1129
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/2ed10333e6e973c2b3e1e60ba854ef0dd12afe07
 CVE-2023-31625 (An issue in the psiginfo component of openlink 
virtuoso-opensource v7. ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1132
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/2ed10333e6e973c2b3e1e60ba854ef0dd12afe07
 CVE-2023-31624 (An issue in the sinv_check_exp component of openlink 
virtuoso-opensour ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1134
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/311097fb1f23d0a1dd7dcdd2afecf6fe14665526
 CVE-2023-31623 (An issue in the mp_box_copy component of openlink 
virtuoso-opensource  ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1131
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/2ed10333e6e973c2b3e1e60ba854ef0dd12afe07
 CVE-2023-31622 (An issue in the sqlc_make_policy_trig component of openlink 
virtuoso-o ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1135
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/db91dc5602a8cfde2e4e1d00387d5ba4b77389dc
 CVE-2023-31621 (An issue in the kc_var_col component of openlink 
virtuoso-opensource v ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1130
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/ec54f1c7b50df944ae4a8d3e29cd7eaf1cc97b21
 CVE-2023-31620 (An issue in the dv_compare component of openlink 
virtuoso-opensource v ...)
- virtuoso-opensource 
+   [bullseye] - virtuoso-opensource  (Minor issue)
NOTE: https://github.com/openlink/virtuoso-opensource/issues/1128
+   NOTE: 
https://github.com/openlink/virtuoso-opensource/commit/a4997ed2499c4de8c95e2de9e2a07b60384fbbec
 CVE-2023-31619 (An issue in the sch_name_to_object component of openlink 
virtuoso-open

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-17 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
0fe51f8c by Moritz Muehlenhoff at 2023-05-17T15:33:43+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -46,6 +46,7 @@ CVE-2023-2738 (A vulnerability classified as critical has 
been found in Tongda O
TODO: check
 CVE-2023-2731 [null pointer deference in LZWDecode() in libtiff/tif_lzw.c]
- tiff 
+   [bullseye] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/548
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/9be22b639ea69e102d3847dca4c53ef025e9527b
 CVE-2023-2730 (Cross-site Scripting (XSS) - Stored in GitHub repository 
pimcore/pimco ...)
@@ -581,6 +582,7 @@ CVE-2023-2614 (Cross-site Scripting (XSS) - DOM in GitHub 
repository pimcore/pim
NOT-FOR-US: pimcore
 CVE-2023-2610 (Integer Overflow or Wraparound in GitHub repository vim/vim 
prior to 9 ...)
- vim  (bug #1035955)
+   [bullseye] - vim  (Minor issue)
NOTE: https://huntr.dev/bounties/31e67340-935b-4f6c-a923-f7246bc29c7d
NOTE: 
https://github.com/vim/vim/commit/ab9a2d884b3a4abe319606ea95a5a6d6b01cd73a 
(v9.0.1532)
 CVE-2023-32216
@@ -3776,6 +3778,7 @@ CVE-2023-1981 [avahi-daemon can be crashed via DBus]
RESERVED
{DLA-3414-1}
- avahi 0.8-10 (bug #1034594)
+   [bullseye] - avahi  (Minor issue)
NOTE: https://github.com/lathiat/avahi/issues/375
NOTE: https://github.com/lathiat/avahi/pull/407
NOTE: 
https://github.com/lathiat/avahi/commit/a2696da2f2c50ac43b6c4903f72290d5c3fa9f6f


=
data/dsa-needed.txt
=
@@ -11,6 +11,8 @@ To pick an issue, simply add your uid behind it.
 
 If needed, specify the release by adding a slash after the name of the source 
package.
 
+--
+asterisk
 --
 chromium
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0fe51f8cfdbd10a7fe4092deaeec7741280c5494

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0fe51f8cfdbd10a7fe4092deaeec7741280c5494
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-08 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
47fd1137 by Moritz Muehlenhoff at 2023-05-08T17:27:21+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -2334,6 +2334,7 @@ CVE-2023-30609 (matrix-react-sdk is a react-based SDK for 
inserting a Matrix cha
NOTE: 
https://github.com/matrix-org/matrix-react-sdk/security/advisories/GHSA-xv83-x443-7rmw
 CVE-2023-30608 (sqlparse is a non-validating SQL parser module for Python. In 
affected ...)
- sqlparse  (bug #1034615)
+   [bullseye] - sqlparse  (Minor issue)
NOTE: 
https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
NOTE: Introduced by: 
https://github.com/andialbrecht/sqlparse/commit/e75e35869473832a1eb67772b1adfee2db11b85a
 (0.1.15)
NOTE: Fixed by: 
https://github.com/andialbrecht/sqlparse/commit/c457abd5f097dd13fb21543381e7cfafe7d31cfb
 (0.4.4)
@@ -2753,6 +2754,7 @@ CVE-2023-2005
RESERVED
 CVE-2023-2004 (An integer overflow vulnerability was discovered in Freetype in 
tt_hva ...)
- freetype 2.12.1+dfsg-5 (bug #1034612)
+   [bullseye] - freetype  (Minor issue)
[buster] - freetype  (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50462
NOTE: 
https://github.com/freetype/freetype/commit/e6fda039ad638866b7a6a5d046f03278ba1b7611
 (VER-2-13-0)
@@ -2860,18 +2862,21 @@ CVE-2023-1994 (GQUIC dissector crash in Wireshark 4.0.0 
to 4.0.4 and 3.6.0 to 3.
{DLA-3402-1}
[experimental] - wireshark 4.0.5-1~exp1
- wireshark  (bug #1034721)
+   [bullseye] - wireshark  (Minor issue)
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18947
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-11.html
 CVE-2023-1993 (LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 
to 3.6 ...)
{DLA-3402-1}
[experimental] - wireshark 4.0.5-1~exp1
- wireshark  (bug #1034721)
+   [bullseye] - wireshark  (Minor issue)
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18900
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-10.html
 CVE-2023-1992 (RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 
to 3.6. ...)
{DLA-3402-1}
[experimental] - wireshark 4.0.5-1~exp1
- wireshark  (bug #1034721)
+   [bullseye] - wireshark  (Minor issue)
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18852
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-09.html
 CVE-2023-1991
@@ -4873,6 +4878,7 @@ CVE-2023-29580 (yasm 1.3.0.55.g101bc was discovered to 
contain a segmentation vi
NOTE: Crash in CLI tool, no security impact
 CVE-2023-29579 (yasm 1.3.0.55.g101bc was discovered to contain a stack 
overflow via th ...)
- yasm 
+   [bullseye] - yasm  (Minor issue)
NOTE: https://github.com/yasm/yasm/issues/214
 CVE-2023-29578 (mp4v2 v2.0.0 was discovered to contain a heap buffer overflow 
via the  ...)
NOT-FOR-US: MP4v2
@@ -5195,6 +5201,7 @@ CVE-2023-29492 (Novi Survey before 8.9.43676 allows 
remote attackers to execute
NOT-FOR-US: Novi Survey
 CVE-2023-29491 (ncurses before 6.4 20230408, when used by a setuid 
application, allows ...)
- ncurses  (bug #1034372)
+   [bullseye] - ncurses  (Minor issue)
NOTE: https://invisible-island.net/ncurses/NEWS.html#index-t20230408
NOTE: 
http://ncurses.scripts.mit.edu/?p=ncurses.git;a=commitdiff;h=eb51b1ea1f75a0ec17c9c5937cb28df1e8eeec56
NOTE: 
https://github.com/ThomasDickey/ncurses-snapshots/commit/a6d3f92bb5bba1a71c7c3df39497abbe5fe999ff
@@ -5439,6 +5446,7 @@ CVE-2023-1907
RESERVED
 CVE-2023-1906 (A heap-based buffer overflow issue was discovered in 
ImageMagick's Imp ...)
- imagemagick  (bug #1034373)
+   [bullseye] - imagemagick  (Minor issue)
[buster] - imagemagick  (Minor issue)
NOTE: 
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247
NOTE: 
https://github.com/ImageMagick/ImageMagick6/commit/e30c693b37c3b41723f1469d1226a2c814ca443d
 (ImageMagick 6.9.12-84)
@@ -9061,6 +9069,7 @@ CVE-2023-28372
RESERVED
 CVE-2023-28371 (In Stellarium through 1.2, attackers can write to files that 
are typic ...)
- stellarium  (bug #1034183)
+   [bullseye] - stellarium  (Minor issue)
NOTE: 
https://github.com/Stellarium/stellarium/commit/1261f74dc4aa6bbd01ab514343424097f8cf46b7
NOTE: 
https://github.com/Stellarium/stellarium/commit/787a894897b7872ae96e6f5804a182210edd5c78
NOTE: 
https://github.com/Stellarium/stellarium/commit/eba61df3b38605befcb43687a4c0a159dbc0c5cb
@@ -17588,18 +17597,23 @@ CVE-2023-25515
RESERVED
 CVE-2023-25514 (NVIDIA CUDA toolkit for Linux and Windows contains

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-05-02 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
8c06fed2 by Moritz Muehlenhoff at 2023-05-02T15:08:27+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -24,6 +24,7 @@ CVE-2023-2428 (Cross-site Scripting (XSS) - Stored in GitHub 
repository thorsten
NOT-FOR-US: phpmyfaq
 CVE-2023-2426 (Use of Out-of-range Pointer Offset in GitHub repository vim/vim 
prior  ...)
- vim  (bug #1035323)
+   [bullseye] - vim  (Minor issue)
NOTE: https://huntr.dev/bounties/3451be4c-91c8-4d08-926b-cbff7396f425
NOTE: 
https://github.com/vim/vim/commit/caf642c25de526229264cab9425e7c9979f3509b 
(v9.0.1499)
 CVE-2023-31485 (GitLab::API::v4 through 0.26 does not verify TLS certificates 
when con ...)
@@ -17161,6 +17162,7 @@ CVE-2023-25568
RESERVED
 CVE-2023-25567 (GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that 
implements  ...)
- gss-ntlmssp 1.2.0-1 (bug #1031369)
+   [bullseye] - gss-ntlmssp  (Minor issue)
NOTE: 
https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/025fbb756d44ffee8f847db4222ed6aa4bd1fbe4
 (v1.2.0)
 CVE-2023-25566 (GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that 
implement ...)
@@ -17171,6 +17173,7 @@ CVE-2023-25566 (GSS-NTLMSSP is a mechglue plugin for 
the GSSAPI library that imp
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/8660fb16474054e692a596e9c79670cd4d3954f4
 (v1.2.0)
 CVE-2023-25565 (GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that 
implement ...)
- gss-ntlmssp 1.2.0-1 (bug #1031369)
+   [bullseye] - gss-ntlmssp  (Minor issue)
NOTE: 
https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64
 (v1.2.0)
 CVE-2023-25564 (GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that 
implement ...)
@@ -17181,6 +17184,7 @@ CVE-2023-25564 (GSS-NTLMSSP is a mechglue plugin for 
the GSSAPI library that imp
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/c753000eb31835c0664e528fbc99378ae0cbe950
 (v1.2.0)
 CVE-2023-25563 (GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that 
implement ...)
- gss-ntlmssp 1.2.0-1 (bug #1031369)
+   [bullseye] - gss-ntlmssp  (Minor issue)
NOTE: 
https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-jjjx-5qf7-9mgf
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/97c62c6167299028d80765080e74d91dfc99efbd
 (v1.2.0)
 CVE-2023-25562 (DataHub is an open-source metadata platform. In versions of 
DataHub pr ...)
@@ -109485,6 +109489,7 @@ CVE-2021-45424
RESERVED
 CVE-2021-45423 (A Buffer Overflow vulnerabilityexists in Pev 0.81 via the 
pe_exports f ...)
- pev 0.81-9 (bug #1034725)
+   [bullseye] - pev  (Minor issue, will be fixed in next point 
release)
NOTE: https://github.com/merces/libpe/issues/35
NOTE: 
https://github.com/merces/libpe/commit/9b5fedc37ccbcd23695a0e97c0fe46c999e26100
NOTE: 
https://github.com/merces/libpe/commit/8960f7d710c4d1a43badd2bbf273721248b864f8



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8c06fed2b2418e78d802836a1be87d85438b0b61

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8c06fed2b2418e78d802836a1be87d85438b0b61
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-04-19 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
a131af39 by Moritz Muehlenhoff at 2023-04-19T09:08:52+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -304,12 +304,14 @@ CVE-2023-2110
RESERVED
 CVE-2023-30775
RESERVED
-   - tiff 4.5.0-2
+   - tiff 4.5.0-2 (unimportant)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/464
NOTE: 
https://gitlab.com/libtiff/libtiff/-/afd7086090dafd3949afd172822cbcec4ed17d56 
(v4.5.0rc1)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-30774
RESERVED
- tiff 4.5.0-2
+   [bullseye] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/463
NOTE: 
https://gitlab.com/libtiff/libtiff/-/f00484b9519df933723deb38fff943dc291a793d 
(v4.5.0rc1)
 CVE-2023-2109 (Cross-site Scripting (XSS) - DOM in GitHub repository 
chatwoot/chatwoo ...)
@@ -48382,6 +48384,7 @@ CVE-2022-41728
RESERVED
 CVE-2022-41727 (An attacker can craft a malformed TIFF image which will 
consume a sign ...)
- golang-golang-x-image 0.5.0-1
+   [bullseye] - golang-golang-x-image  (Minor issue)
[buster] - golang-golang-x-image  (Limited support, minor 
issue, DoS)
 CVE-2022-41726
RESERVED



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a131af3944b34f0918abf86cfe6e9bdfdf62cabc

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a131af3944b34f0918abf86cfe6e9bdfdf62cabc
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-04-13 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ae04ed3a by Moritz Muehlenhoff at 2023-04-13T21:00:53+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -13503,6 +13503,7 @@ CVE-2023-0843
RESERVED
 CVE-2023-0842 (xml2js version 0.4.23 allows an external attacker to edit or 
add new p ...)
- node-xml2js  (bug #1034148)
+   [bullseye] - node-xml2js  (Minor issue)
NOTE: https://fluidattacks.com/advisories/myers/
NOTE: https://github.com/Leonidas-from-XIV/node-xml2js/issues/663
NOTE: https://github.com/Leonidas-from-XIV/node-xml2js/pull/603
@@ -114742,33 +114743,40 @@ CVE-2021-43319 (Zoho ManageEngine Network 
Configuration Manager before 125488 is
 CVE-2021-43318
RESERVED
 CVE-2021-43317 (A heap-based buffer overflows was discovered in upx, during 
the generi ...)
-   - upx-ucl 
+   - upx-ucl  (unimportant)
NOTE: https://github.com/upx/upx/issues/380
NOTE: 
https://github.com/upx/upx/commit/b327645e648d46c8730be80730a171cf74cfe338
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-43316 (A heap-based buffer overflow was discovered in upx, during the 
generic ...)
-   - upx-ucl 
+   - upx-ucl  (unimportant)
NOTE: https://github.com/upx/upx/issues/381
NOTE: 
https://github.com/upx/upx/commit/962c35aa08ef3dcee13d3f7ef6e2d845da912f25
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-43315 (A heap-based buffer overflows was discovered in upx, during 
the generi ...)
-   - upx-ucl 
+   - upx-ucl  (unimportant)
NOTE: https://github.com/upx/upx/issues/380
NOTE: 
https://github.com/upx/upx/commit/b327645e648d46c8730be80730a171cf74cfe338
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-43314 (A heap-based buffer overflows was discovered in upx, during 
the generi ...)
-   - upx-ucl 
+   - upx-ucl  (unimportant)
NOTE: https://github.com/upx/upx/issues/380
NOTE: 
https://github.com/upx/upx/commit/b327645e648d46c8730be80730a171cf74cfe338
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-43313 (A heap-based buffer overflow was discovered in upx, during the 
variabl ...)
-   - upx-ucl 
+   - upx-ucl  (unimportant)
NOTE: https://github.com/upx/upx/issues/378
NOTE: 
https://github.com/upx/upx/commit/828a6cf07b69bc7314e888d7b76f0eafe125a3f6
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-43312 (A heap-based buffer overflow was discovered in upx, during the 
variabl ...)
-   - upx-ucl 
+   - upx-ucl  (unimportant)
NOTE: https://github.com/upx/upx/issues/379
NOTE: 
https://github.com/upx/upx/commit/828a6cf07b69bc7314e888d7b76f0eafe125a3f6
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-43311 (A heap-based buffer overflow was discovered in upx, during the 
generic ...)
-   - upx-ucl 
+   - upx-ucl  (unimportant)
NOTE: https://github.com/upx/upx/issues/380
NOTE: 
https://github.com/upx/upx/commit/b327645e648d46c8730be80730a171cf74cfe338
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-43310 (A vulnerability in Keylime before 6.3.0 allows an attacker to 
craft a  ...)
NOT-FOR-US: Keylime
 CVE-2021-43309 (An exponential ReDoS (Regular Expression Denial of Service) 
can be tri ...)
@@ -248734,6 +248742,7 @@ CVE-2019-19922 (kernel/sched/fair.c in the Linux 
kernel before 5.3.9, when cpu.c
 CVE-2023-27561 (runc through 1.1.4 has Incorrect Access Control leading to 
Escalation  ...)
{DLA-3369-1}
- runc 1.1.5+ds1-1 (bug #1033520)
+   [bullseye] - runc  (Minor issue)
NOTE: https://github.com/opencontainers/runc/issues/3751
NOTE: 
https://github.com/opencontainers/runc/issues/2197#issuecomment-1437617334
NOTE: 
https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9


=
data/dsa-needed.txt
=
@@ -36,6 +36,8 @@ php-horde-turba
 --
 py7zr
 --
+python-werkzeug
+--
 ring
   might make sense to rebase to current version
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae04ed3abf8cee70d58176f91eff1b15dc35589c

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae04ed3abf8cee70d58176f91eff1b15dc35589c
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-04-13 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
765695dc by Moritz Muehlenhoff at 2023-04-13T16:09:55+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -2098,11 +2098,13 @@ CVE-2023-29583
 CVE-2023-29582
RESERVED
 CVE-2023-29581 (yasm 1.3.0.55.g101bc was discovered to contain a segmentation 
violatio ...)
-   - yasm 
+   - yasm  (unimportant)
NOTE: https://github.com/yasm/yasm/issues/216
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-29580 (yasm 1.3.0.55.g101bc was discovered to contain a segmentation 
violatio ...)
-   - yasm 
+   - yasm  (unimportant)
NOTE: https://github.com/yasm/yasm/issues/215
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-29579
RESERVED
 CVE-2023-29578
@@ -4143,6 +4145,7 @@ CVE-2023-1691
RESERVED
 CVE-2022-48434 (libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in 
VLC and  ...)
- ffmpeg 7:5.1.2-1
+   [bullseye] - ffmpeg  (Wait until it lands in 4.3.x)
NOTE: 
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/cc867f2c09d2b69cee8a0eccd62aff002cbbfe11
 (n6.1-dev)
NOTE: 
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/35aa7e70e7ec350319e7634a30d8d8aa1e6ecdda
 (n5.1.2)
 CVE-2022-48433 (In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could 
leak thro ...)
@@ -5125,6 +5128,7 @@ CVE-2023-1545 (SQL Injection in GitHub repository 
nilsteampassnet/teampass prior
- teampass  (bug #730180)
 CVE-2023-1544 (A flaw was found in the QEMU implementation of VMWare's 
paravirtual RD ...)
- qemu  (bug #1034179)
+   [bullseye] - qemu  (Minor issue)
NOTE: 
https://lists.nongnu.org/archive/html/qemu-devel/2023-03/msg00206.html
 CVE-2023-28686 (Dino before 0.2.3, 0.3.x before 0.3.2, and 0.4.x before 0.4.2 
allows a ...)
{DSA-5379-1}
@@ -10488,10 +10492,12 @@ CVE-2023-26918
RESERVED
 CVE-2023-26917 (libyang from v2.0.164 to v2.1.30 was discovered to contain a 
NULL poin ...)
- libyang2 
+   [bullseye] - libyang2  (Minor issue)
NOTE: https://github.com/CESNET/libyang/issues/1987
NOTE: 
https://github.com/CESNET/libyang/commit/cfa1a965a429e4bfc5ae1539a8e87a9cf71c3090
 (v2.1.55)
 CVE-2023-26916 (libyang from v2.0.164 to v2.1.30 was discovered to contain a 
NULL poin ...)
- libyang2  (bug #1034154)
+   [bullseye] - libyang2  (Minor issue)
NOTE: https://github.com/CESNET/libyang/issues/1979
NOTE: 
https://github.com/CESNET/libyang/commit/dc668d296f9f05aeab6315d44cff3208641e3096
 (v2.1.55)
 CVE-2023-26915
@@ -49422,6 +49428,7 @@ CVE-2022-40900
RESERVED
 CVE-2022-40899 (An issue discovered in Python Charmers Future 0.18.2 and 
earlier allow ...)
- python-future  (bug #1031699)
+   [bullseye] - python-future  (Minor issue)
NOTE: https://github.com/PythonCharmers/python-future/pull/610
NOTE: 
https://github.com/PythonCharmers/python-future/commit/c91d70b34ef0402aef3e9d04364ba98509dca76f
 (v0.18.3)
 CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 
0.37.1  ...)
@@ -53557,11 +53564,14 @@ CVE-2022-39210 (Nextcloud android is the official 
Android client for the Nextclo
NOT-FOR-US: Nextcloud android
 CVE-2022-39209 (cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and 
renderin ...)
- cmark-gfm 0.29.0.gfm.6-2 (bug #1020588)
+   [bullseye] - cmark-gfm  (Minor issue)
[buster] - cmark-gfm  (Minor issue)
- python-cmarkgfm 
+   [bullseye] - python-cmarkgfm  (Minor issue)
[buster] - python-cmarkgfm  (Minor issue)
- ghostwriter 2.1.6+ds-1 (unimportant)
- ruby-commonmarker 
+   [bullseye] - ruby-commonmarker  (Minor issue)
[buster] - ruby-commonmarker  (Minor issue)
- r-cran-commonmark 1.8.1-1
[bullseye] - r-cran-commonmark  (Minor issue)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/765695dc67dfa6bcc2ffadf1fd19d21e973280c7

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/765695dc67dfa6bcc2ffadf1fd19d21e973280c7
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-03-21 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
36906343 by Moritz Muehlenhoff at 2023-03-21T16:51:11+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -1147,6 +1147,7 @@ CVE-2023-28340
RESERVED
 CVE-2023-28339 (OpenDoas through 6.8.2, when TIOCSTI is available, allows 
privilege es ...)
- doas 
+   [bullseye] - doas  (Minor issue)
- opendoas 
NOTE: https://github.com/Duncaen/OpenDoas/issues/106
NOTE: https://www.openwall.com/lists/oss-security/2023/03/14/4
@@ -1717,6 +1718,7 @@ CVE-2023-1371
RESERVED
 CVE-2023-1370 ([Json-smart](https://netplex.github.io/json-smart/) is a 
performance f ...)
- json-smart 
+   [bullseye] - json-smart  (Minor issue)
NOTE: 
https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/
NOTE: 
https://github.com/netplex/json-smart-v2/commit/5b3205d051952d3100aa0db1535f6ba6226bd87a
 (2.4.9)
 CVE-2023-1369 (A vulnerability was found in TG Soft Vir.IT eXplorer 9.4.86.0. 
It has  ...)
@@ -1829,6 +1831,7 @@ CVE-2023-28145
RESERVED
 CVE-2023-28144 (KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default 
configura ...)
- hotspot 
+   [bullseye] - hotspot  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/03/14/8
NOTE: Introduced by: 
https://github.com/KDAB/hotspot/commit/3b4682565f0e53f903f3ad0f3f2c0f236d382efb 
(v1.3.0)
NOTE: Opt-In to allow privilege escalation (and disable by default):
@@ -4894,10 +4897,12 @@ CVE-2023-27104
RESERVED
 CVE-2023-27103 (Libde265 v1.0.11 was discovered to contain a heap buffer 
overflow via  ...)
- libde265  (bug #1033257)
+   [bullseye] - libde265  (Minor issue)
NOTE: https://github.com/strukturag/libde265/issues/394
NOTE: 
https://github.com/strukturag/libde265/commit/d6bf73e765b7a23627bfd7a8645c143fd9097995
 CVE-2023-27102 (Libde265 v1.0.11 was discovered to contain a segmentation 
violation vi ...)
- libde265  (bug #1033257)
+   [bullseye] - libde265  (Minor issue)
NOTE: https://github.com/strukturag/libde265/issues/393
NOTE: 
https://github.com/strukturag/libde265/commit/0b1752abff97cb542941d317a0d18aa50cb199b1
 CVE-2023-27101
@@ -6384,7 +6389,7 @@ CVE-2022-48345 (sanitize-url (aka 
@braintree/sanitize-url) before 6.0.2 allows X
[bullseye] - node-mermaid  (Minor issue)
NOTE: 
https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c
 CVE-2023-26464 (** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or 
SocketAppen ...)
-   - apache-log4j1.2 
+   - apache-log4j1.2  (Only affects legacy Java releases 
which Debian hasn't shipped since 2015)
NOTE: https://lists.apache.org/thread/wkx6grrcjkh86crr49p4blc1v1nflj3t
 CVE-2023-0991
RESERVED
@@ -6963,6 +6968,7 @@ CVE-2023-26250
RESERVED
 CVE-2023-26249 (Knot Resolver before 5.6.0 enables attackers to consume its 
resources, ...)
- knot-resolver 5.6.0-1
+   [bullseye] - knot-resolver  (Minor issue)
NOTE: https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html
 CVE-2023-26248
RESERVED
@@ -83113,12 +83119,15 @@ CVE-2022-26891 (Microsoft Edge (Chromium-based) 
Elevation of Privilege Vulnerabi
NOT-FOR-US: Microsoft
 CVE-2022-26061 (A heap-based buffer overflow vulnerability exists in the 
gif2h5 functi ...)
- hdf5  (bug #1031726)
+   [bullseye] - hdf5  (Minor issue, revisit when fixed upstream)
NOTE: 
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1487
 CVE-2022-25972 (An out-of-bounds write vulnerability exists in the gif2h5 
functionalit ...)
- hdf5  (bug #1031726)
+   [bullseye] - hdf5  (Minor issue, revisit when fixed upstream)
NOTE: 
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1485
 CVE-2022-25942 (An out-of-bounds read vulnerability exists in the gif2h5 
functionality ...)
- hdf5  (bug #1031726)
+   [bullseye] - hdf5  (Minor issue, revisit when fixed upstream)
NOTE: 
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1486
 CVE-2022-0935 (Host Header injection in password Reset in GitHub repository 
livehelpe ...)
NOT-FOR-US: livehelperchat


=
data/dsa-needed.txt
=
@@ -11,6 +11,8 @@ To pick an issue, simply add your uid behind it.
 
 If needed, specify the release by adding a slash after the name of the source 
package.
 
+--
+cairosvg
 --
 gpac (aron)
 --
@@ -56,6 +58,8 @@ samba
 sofia-sip
   Maintainer proposed debdiff for review with additional question and sent a 
followup
 --
+xen
+--
 xrdp
   needs

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-03-20 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
2fd6cae3 by Moritz Muehlenhoff at 2023-03-20T21:22:05+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -2904,29 +2904,36 @@ CVE-2023-27791
 CVE-2023-27790
RESERVED
 CVE-2023-27789 (An issue found in TCPprep v.4.4.3 allows a remote attacker to 
cause a  ...)
-   - tcpreplay 
+   - tcpreplay  (unimportant)
NOTE: https://github.com/appneta/tcpreplay/issues/784
NOTE: https://github.com/appneta/tcpreplay/pull/783
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-27788 (An issue found in TCPrewrite v.4.4.3 allows a remote attacker 
to cause ...)
-   - tcpreplay 
+   - tcpreplay  (unimportant)
NOTE: https://github.com/appneta/tcpreplay/issues/786
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-27787 (An issue found in TCPprep v.4.4.3 allows a remote attacker to 
cause a  ...)
-   - tcpreplay 
+   - tcpreplay  (unimportant)
NOTE: https://github.com/appneta/tcpreplay/issues/788
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-27786 (An issue found in TCPprep v.4.4.3 allows a remote attacker to 
cause a  ...)
-   - tcpreplay 
+   - tcpreplay  (unimportant)
NOTE: https://github.com/appneta/tcpreplay/issues/782
NOTE: https://github.com/appneta/tcpreplay/pull/783
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-27785 (An issue found in TCPreplay TCPprep v.4.4.3 allows a remote 
attacker t ...)
-   - tcpreplay 
+   - tcpreplay  (unimportant)
NOTE: https://github.com/appneta/tcpreplay/issues/785
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-27784 (An issue found in TCPReplay v.4.4.3 allows a remote attacker 
to cause  ...)
-   - tcpreplay 
+   - tcpreplay  (unimportant)
NOTE: https://github.com/appneta/tcpreplay/issues/787
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-27783 (An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote 
attacke ...)
-   - tcpreplay 
+   - tcpreplay  (unimportant)
NOTE: https://github.com/appneta/tcpreplay/issues/780
NOTE: https://github.com/appneta/tcpreplay/pull/781
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-27782
RESERVED
 CVE-2023-27781 (jpegoptim v1.5.2 was discovered to contain a heap overflow in 
the opti ...)
@@ -94538,6 +94545,7 @@ CVE-2021-46323 (Espruino 2v11.251 was discovered to 
contain a SEGV vulnerability
NOT-FOR-US: Espruino
 CVE-2021-46322 (Duktape v2.99.99 was discovered to contain a SEGV 
vulnerability via th ...)
- duktape 2.7.0-1
+   [bullseye] - duktape  (Minor issue)
NOTE: https://github.com/svaarala/duktape/issues/2448
NOTE: https://github.com/svaarala/duktape/pull/2451
NOTE: 
https://github.com/svaarala/duktape/commit/fc75060165a011ff5ec43bfebea0c37a3d1baca1
@@ -128591,6 +128599,7 @@ CVE-2021-36490
RESERVED
 CVE-2021-36489 (Buffer Overflow vulnerability in Allegro through 5.2.6 allows 
attacker ...)
- allegro4.4  (bug #1032670)
+   [bullseye] - allegro4.4  (Minor issue)
[buster] - allegro4.4  (Minor issue)
- allegro5 2:5.2.8.0-1
[bullseye] - allegro5  (Minor issue)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2fd6cae3b697677a6b1a3f4006a465037a8c261b

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2fd6cae3b697677a6b1a3f4006a465037a8c261b
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-03-16 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f6c41193 by Moritz Muehlenhoff at 2023-03-16T14:17:47+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -2,9 +2,11 @@ CVE-2023-28488
RESERVED
 CVE-2023-28487 (Sudo before 1.9.13 does not escape control characters in 
sudoreplay ou ...)
- sudo 1.9.13p1-1
+   [bullseye] - sudo  (Minor issue)
NOTE: 
https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca
 CVE-2023-28486 (Sudo before 1.9.13 does not escape control characters in log 
messages. ...)
- sudo 1.9.13p1-1
+   [bullseye] - sudo  (Minor issue)
NOTE: 
https://github.com/sudo-project/sudo/commit/334daf92b31b79ce68ed75e2ee14fca265f029ca
 CVE-2023-28485
RESERVED
@@ -2933,6 +2935,7 @@ CVE-2023-1162 (A vulnerability, which was classified as 
critical, was found in D
NOT-FOR-US: DrayTek Vigor 2960
 CVE-2023-1161 (ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 
4.0.3 an ...)
- wireshark 
+   [bullseye] - wireshark  (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-08.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18839
 CVE-2023-1160 (Use of Platform-Dependent Third Party Components in GitHub 
repository  ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f6c41193d4b7bda16ec132f26a43e82407c068cc

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f6c41193d4b7bda16ec132f26a43e82407c068cc
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-03-14 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
a1b5eb28 by Moritz Muehlenhoff at 2023-03-14T16:29:52+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -557,6 +557,7 @@ CVE-2023-1351 (A vulnerability classified as critical has 
been found in SourceCo
NOT-FOR-US: SourceCodester Computer Parts Sales and Inventory System
 CVE-2023-1350 (A vulnerability was found in liferea. It has been rated as 
critical. A ...)
- liferea 1.14.1-1 (bug #1032822)
+   [bullseye] - liferea  (Minor issue)
NOTE: Introduced by: 
https://github.com/lwindolf/liferea/commit/b8288389820a3f510ef4b21684b22439c41d95a5
 (v1.12.0)
NOTE: introduced by: 
https://github.com/lwindolf/liferea/commit/b67dbba73443ab7b36fcd3c78aa803e974c0f23e
 (v1.12.0)
NOTE: Fixed by: 
https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59
 (v1.14.1)
@@ -1003,6 +1004,7 @@ CVE-2023-1290 (A vulnerability, which was classified as 
critical, has been found
 CVE-2023-1289
RESERVED
- imagemagick 
+   [bullseye] - imagemagick  (Minor issue)
NOTE: 
https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr
NOTE: 
https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4
 CVE-2023-1288 (An XML External Entity injection (XXE) vulnerability in ENOVIA 
Live Co ...)
@@ -2112,6 +2114,7 @@ CVE-2023-1176
RESERVED
 CVE-2023-1175 (Incorrect Calculation of Buffer Size in GitHub repository 
vim/vim prio ...)
- vim 2:9.0.1378-1
+   [bullseye] - vim  (Minor issue)
NOTE: https://huntr.dev/bounties/7e93fc17-92eb-4ae7-b01a-93bb460b643e
NOTE: 
https://github.com/vim/vim/commit/c99cbf8f289bdda5d4a77d7ec415850a520330ba 
(v9.0.1378)
 CVE-2022-4930 (A vulnerability classified as problematic was found in nuxsmin 
sysPass ...)
@@ -2245,9 +2248,10 @@ CVE-2023-1172
 CVE-2023-1171
RESERVED
 CVE-2023-1170 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.1 ...)
-   - vim 2:9.0.1378-1
+   - vim 2:9.0.1378-1 (unimportant)
NOTE: https://huntr.dev/bounties/286e0090-e654-46d2-ac60-29f81799d0a4
NOTE: 
https://github.com/vim/vim/commit/1c73b65229c25e3c1fd8824ba958f7cc4d604f9c 
(v9.0.1376)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-1169
RESERVED
 CVE-2015-10089 (A vulnerability classified as problematic has been found in 
flame.js.  ...)
@@ -7762,6 +7766,7 @@ CVE-2023-25567 (GSS-NTLMSSP, a mechglue plugin for the 
GSSAPI library that imple
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/025fbb756d44ffee8f847db4222ed6aa4bd1fbe4
 (v1.2.0)
 CVE-2023-25566 (GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that 
implement ...)
- gss-ntlmssp 1.2.0-1 (bug #1031369)
+   [bullseye] - gss-ntlmssp  (Vulnerable code not present)
NOTE: 
https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-mfm4-6g58-jw74
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/8660fb16474054e692a596e9c79670cd4d3954f4
 (v1.2.0)
 CVE-2023-25565 (GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that 
implement ...)
@@ -7770,6 +7775,7 @@ CVE-2023-25565 (GSS-NTLMSSP is a mechglue plugin for the 
GSSAPI library that imp
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64
 (v1.2.0)
 CVE-2023-25564 (GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that 
implement ...)
- gss-ntlmssp 1.2.0-1 (bug #1031369)
+   [bullseye] - gss-ntlmssp  (Vulnerable code not present)
NOTE: 
https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-r85x-q5px-9xfq
NOTE: 
https://github.com/gssapi/gss-ntlmssp/commit/c753000eb31835c0664e528fbc99378ae0cbe950
 (v1.2.0)
 CVE-2023-25563 (GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that 
implement ...)
@@ -48847,6 +48853,7 @@ CVE-2022-38102
RESERVED
 CVE-2022-38090 (Improper isolation of shared resources in some Intel(R) 
Processors whe ...)
- intel-microcode  (bug #1031334)
+   [bullseye] - intel-microcode  (Minor issue)
NOTE: 
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00767.html
NOTE: 
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20230214
 CVE-2022-38084
@@ -54402,6 +54409,7 @@ CVE-2022-34657
RESERVED
 CVE-2022-33196 (Incorrect default permissions in some memory controller 
configurations ...)
- intel-microcode  (bug #1031334)
+   [bullseye] - intel-microcode  (Minor issue)
NOTE: 
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00738.html
NOTE:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-03-08 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
5990d70b by Moritz Muehlenhoff at 2023-03-08T20:02:07+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -1608,6 +1608,7 @@ CVE-2023-1099 (A vulnerability was found in 
SourceCodester Online Student Manage
NOT-FOR-US: SourceCodester Online Student Management System
 CVE-2023-27371 (GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of 
Service)  ...)
- libmicrohttpd 0.9.75-6
+   [bullseye] - libmicrohttpd  (Minor issue)
NOTE: 
https://git.gnunet.org/libmicrohttpd.git/commit/?id=e0754d1638c602382384f1eface30854b1defeec
 (v0.9.76)
NOTE: 
https://lists.gnu.org/archive/html/libmicrohttpd/2023-02/msg0.html
 CVE-2023-27370
@@ -3732,6 +3733,7 @@ CVE-2023-22293
RESERVED
 CVE-2023-0996 (There is a vulnerability in the strided image data parsing code 
in the ...)
- libheif 1.15.1-1 (bug #1032101)
+   [bullseye] - libheif  (Minor issue)
NOTE: https://github.com/strukturag/libheif/pull/759
NOTE: 
https://govtech-csg.github.io/security-advisories/2023/02/24/CVE-2023-0996.html
 CVE-2023-0995 (Cross-site Scripting (XSS) - Stored in GitHub repository 
unilogies/bum ...)


=
data/dsa-needed.txt
=
@@ -12,7 +12,9 @@ To pick an issue, simply add your uid behind it.
 If needed, specify the release by adding a slash after the name of the source 
package.
 
 --
-chromium
+apache2 (jmm)
+--
+chromium (jmm)
 --
 jupyter-core
   Maintainer asked for availability to prepare updates



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5990d70b760077ef4d7a7c7bb7441663576bb741

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5990d70b760077ef4d7a7c7bb7441663576bb741
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-03-03 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
9501e698 by Moritz Muehlenhoff at 2023-03-03T19:43:39+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -2651,6 +2651,7 @@ CVE-2023-0992
RESERVED
 CVE-2022-48345 (sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows 
XSS via ...)
- node-mermaid  (bug #1032313)
+   [bullseye] - node-mermaid  (Minor issue)
NOTE: 
https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c
 CVE-2023-26464
RESERVED
@@ -2687,6 +2688,7 @@ CVE-2022-48342 (In JetBrains TeamCity before 2022.10.2 
jVMTI was enabled by defa
 CVE-2023-26463
RESERVED
- strongswan 5.9.8-4
+   [bullseye] - strongswan  (Vulnerable code not present)
NOTE: 
https://www.strongswan.org/blog/2023/03/02/strongswan-vulnerability-(cve-2023-26463).html
 CVE-2023-26462 (ThingsBoard 3.4.1 could allow a remote attacker to gain 
elevated privi ...)
NOT-FOR-US: ThingsBoard
@@ -45603,8 +45605,9 @@ CVE-2022-2962 (A DMA reentrancy issue was found in the 
Tulip device emulation in
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/1171
NOTE: 
https://gitlab.com/qemu-project/qemu/-/commit/36a894aeb64a2e02871016da1c37d4a4ca109182
 CVE-2022-2961 (A use-after-free flaw was found in the Linux kernels PLP 
Rose f ...)
-   - linux 
+   - linux  (unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2120595
+   NOTE: Mitigated by 
hamradio-disable-auto-loading-as-mitigation-against-local-exploits.patch
 CVE-2022-2960
RESERVED
 CVE-2022-2959 (A race condition was found in the Linux kernel's watch queue 
due to a  ...)
@@ -73897,8 +73900,9 @@ CVE-2022-1250 (The LifterLMS PayPal WordPress plugin 
before 1.4.0 does not sanit
 CVE-2022-1248 (A vulnerability was found in SAP Information System 1.0 which 
has been ...)
NOT-FOR-US: SAP
 CVE-2022-1247 (An issue found in linux-kernel that leads to a race condition 
in rose_ ...)
-   - linux 
+   - linux  (unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2066799
+   NOTE: Mitigated by 
hamradio-disable-auto-loading-as-mitigation-against-local-exploits.patch
 CVE-2022-1246
REJECTED
 CVE-2022-1245 (A privilege escalation flaw was found in the token exchange 
feature of ...)
@@ -81746,6 +81750,7 @@ CVE-2022-25928
RESERVED
 CVE-2022-25927 (Versions of the package ua-parser-js from 0.7.30 and before 
0.7.33, fr ...)
- node-ua-parser-js 
+   [bullseye] - node-ua-parser-js  (Minor issue)
NOTE: 
https://github.com/faisalman/ua-parser-js/commit/a6140a17dd0300a35cfc9cff999545f267889411
NOTE: https://security.snyk.io/vuln/SNYK-JS-UAPARSERJS-3244450
NOTE: 
https://github.com/faisalman/ua-parser-js/security/advisories/GHSA-fhg7-m89q-25r3



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9501e698ef0205aff58f2d2f92aabaa73856ca72

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9501e698ef0205aff58f2d2f92aabaa73856ca72
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-03-03 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
7fdc140f by Moritz Muehlenhoff at 2023-03-03T11:24:22+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -6466,6 +6466,7 @@ CVE-2023-25156 (Kiwi TCMS, an open source test management 
system, does not impos
NOT-FOR-US: Kiwi TCMS
 CVE-2023-25155 (Redis is an in-memory database that persists on disk. 
Authenticated us ...)
- redis  (bug #1032279)
+   [bullseye] - redis  (Minor issue)
NOTE: 
https://github.com/redis/redis/security/advisories/GHSA-x2r7-j9vw-3w83
NOTE: 
https://github.com/redis/redis/commit/2a2a582e7cd99ba3b531336b8bd41df2b566e619 
(7.0.9)
 CVE-2023-25154 (Misskey is an open source, decentralized social media 
platform. In ver ...)
@@ -37296,8 +37297,8 @@ CVE-2022-41860 (In freeradius, when an EAP-SIM 
supplicant sends an unknown SIM o
 CVE-2022-41859 (In freeradius, the EAP-PWD function compute_password_element() 
leaks i ...)
{DLA-3342-1}
- freeradius 3.2.0+dfsg-1
+   [bullseye] - freeradius  (Minor issue)
NOTE: 
https://github.com/FreeRADIUS/freeradius-server/commit/9e5e8f2f912ad2da8ac6e176ac3a606333469937
 (release_3_0_26)
-   TODO: check details on fix
 CVE-2022-41858 (A flaw was found in the Linux kernel. A NULL pointer 
dereference may o ...)
- linux 5.17.6-1
[bullseye] - linux 5.10.113-1
@@ -37310,10 +37311,10 @@ CVE-2022-41856
 CVE-2022-41855
REJECTED
 CVE-2022-41854 (Those using Snakeyaml to parse untrusted YAML files may be 
vulnerable  ...)
-   - snakeyaml 1.33-1
+   - snakeyaml 1.33-1 (unimportant)
[buster] - snakeyaml 1.23-1+deb10u1
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=50355
-   TODO: check details
+   NOTE: No suitable for parsing untrusted YAML, see README.Debian.security
 CVE-2022-41853 (Those using java.sql.Statement or java.sql.PreparedStatement 
in hsqldb ...)
{DSA-5313-1 DLA-3234-1}
- hsqldb 2.7.1-1 (bug #1023573)


=
data/dsa-needed.txt
=
@@ -38,6 +38,8 @@ php-horde-mime-viewer
 --
 php-horde-turba
 --
+py7zr
+--
 rails (aron)
 --
 ring



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7fdc140f1370c83b3d3418e2815f1c65aff48fe1

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7fdc140f1370c83b3d3418e2815f1c65aff48fe1
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-03-01 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
e6c2bacf by Moritz Muehlenhoff at 2023-03-01T12:25:54+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -3276,6 +3276,7 @@ CVE-2023-0912 (A vulnerability classified as critical has 
been found in SourceCo
NOT-FOR-US: SourceCodester Auto Dealer Management System
 CVE-2019-25104 (A vulnerability has been found in rtcwcoop 1.0.2 and 
classified as pro ...)
- iortcw  (bug #1031732)
+   [bullseye] - iortcw  (Minor issue)
NOTE: https://github.com/rtcwcoop/rtcwcoop/pull/45
NOTE: Reported against a version based on iortcw, but seems missing in 
iortcw
 CVE-2016-15026 (A vulnerability was found in 3breadt dd-plist 1.17 and 
classified as p ...)
@@ -6903,6 +6904,7 @@ CVE-2023-24810 (Misskey is an open source, decentralized 
social media platform.
NOT-FOR-US: Misskey
 CVE-2023-24809 (NetHack is a single player dungeon exploration game. Starting 
with ver ...)
- nethack  (bug #1031869)
+   [bullseye] - nethack  (Minor issue)
[buster] - nethack  (Minor issue)
NOTE: 
https://github.com/NetHack/NetHack/security/advisories/GHSA-2cqv-5w4v-mgch
NOTE: https://nethack.org/security/CVE-2023-24809.html
@@ -8318,6 +8320,7 @@ CVE-2023-24330
 CVE-2023-24329 (An issue in the urllib.parse component of Python before v3.11 
allows a ...)
- python3.11 
- python3.9 
+   [bullseye] - python3.9  (Minor issue)
- python3.7 
NOTE: https://pointernull.com/security/python-url-parse-problem.html
NOTE: https://github.com/python/cpython/pull/99421
@@ -11655,11 +11658,13 @@ CVE-2023-23111
 CVE-2023-23110 (An exploitable firmware modification vulnerability was 
discovered in c ...)
NOT-FOR-US: Netgear
 CVE-2023-23109 (In crasm 1.8-3, invalid input validation, specific files 
passed to the ...)
-   - crasm 
+   - crasm  (unimportant)
NOTE: https://github.com/colinbourassa/crasm/pull/7
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-23108 (In crasm 1.8-3, invalid input validation, specific files 
passed to the ...)
-   - crasm 
+   - crasm  (unimportant)
NOTE: https://github.com/colinbourassa/crasm/pull/7
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-23107
RESERVED
 CVE-2023-23106
@@ -81586,6 +81591,7 @@ CVE-2022-21223 (The package cocoapods-downloader before 
1.6.2 are vulnerable to
NOT-FOR-US: cocoapods-downloader
 CVE-2022-21222 (The package css-what before 2.1.3 are vulnerable to Regular 
Expression ...)
- node-css-what 5.0.1
+   [bullseye] - node-css-what  (Minor issue)
NOTE: https://security.snyk.io/vuln/SNYK-JS-CSSWHAT-3035488
NOTE: ReDoS issue fixed with rewrite of module to TypeScript
NOTE: Not fixed in 4.0.0 see 
https://sources.debian.org/src/node-css-what/4.0.0-3/src/parse.ts/#L84


=
data/dsa-needed.txt
=
@@ -17,6 +17,8 @@ apr (carnil)
 jupyter-core
   Maintainer asked for availability to prepare updates
 --
+libreswan
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more recent v5.10.y versions
@@ -26,6 +28,9 @@ netatalk
 --
 nodejs (aron)
 --
+openimageio
+  some issues allow for RCE, the other ones can also be ignored for stable
+--
 php-cas
 --
 php-horde-mime-viewer
@@ -34,6 +39,9 @@ php-horde-turba
 --
 rails (aron)
 --
+ring
+  might make sense to rebase to current version
+--
 ruby-nokogiri
 --
 ruby-rack
@@ -50,6 +58,8 @@ sofia-sip
 spip (seb)
   Maintainer prepared updates
 --
+syslog-ng
+--
 xrdp
   needs some additional clarification, tentatively DSA worthy
   maybe upgrade to 0.9.21 within bullseye?



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e6c2bacfee370b446f649ac41ff3482b0c5f72d5

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e6c2bacfee370b446f649ac41ff3482b0c5f72d5
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-02-23 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
5de29380 by Moritz Muehlenhoff at 2023-02-23T12:26:31+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -521,6 +521,7 @@ CVE-2023-26254
RESERVED
 CVE-2023-26253 (In Gluster GlusterFS 11.0, there is an 
xlators/mount/fuse/src/fuse-bri ...)
- glusterfs  (bug #1031731)
+   [bullseye] - glusterfs  (Minor issue)
NOTE: https://github.com/gluster/glusterfs/issues/3954
 CVE-2023-26252
RESERVED
@@ -628,6 +629,7 @@ CVE-2023-0927 (Use after free in Web Payments API in Google 
Chrome on Android pr
[buster] - chromium  (see DSA 5046)
 CVE-2022-48340 (In Gluster GlusterFS 11.0, there is an 
xlators/cluster/dht/src/dht-com ...)
- glusterfs  (bug #1031796)
+   [bullseye] - glusterfs  (Minor issue)
NOTE: https://github.com/gluster/glusterfs/issues/3732
 CVE-2022-48336
RESERVED
@@ -15629,6 +15631,7 @@ CVE-2022-4511 (A vulnerability has been found in 
RainyGao DocSys and classified
NOT-FOR-US: RainyGao DocSys
 CVE-2022-4510 (A path traversal vulnerability was identified in ReFirm Labs 
binwalk f ...)
- binwalk 2.3.4+dfsg1-1
+   [bullseye] - binwalk  (Minor issue)
NOTE: https://github.com/ReFirmLabs/binwalk/pull/617
NOTE: 
https://github.com/ReFirmLabs/binwalk/commit/696fe34ed680ffd951bfeca737feb4a0b98dde5c
 (v2.3.4)
 CVE-2022-4509 (The Content Control WordPress plugin before 1.1.10 does not 
validate a ...)
@@ -91768,6 +91771,7 @@ CVE-2021-46024 (Projectworlds 
online-shopping-webvsite-in-php 1.0 suffers from a
NOT-FOR-US: Projectworlds online-shopping-webvsite-in-php
 CVE-2021-46023 (An Untrusted Pointer Dereference was discovered in function 
mrb_vm_exe ...)
- mruby 3.1.0-1
+   [bullseye] - mruby  (Minor issue)
NOTE: https://github.com/mruby/mruby/issues/5613
 CVE-2021-46022 (An Use-After-Free vulnerability in rec_mset_elem_destroy() at 
rec-mset ...)
- recutils  (unimportant)
@@ -130834,6 +130838,7 @@ CVE-2021-32851 (Mind-elixir is a free, open source 
mind map core. Prior to versi
TODO: check
 CVE-2021-32850 (jQuery MiniColors is a color picker built on jQuery. Prior to 
version  ...)
- jquery-minicolors  (bug #1031791)
+   [bullseye] - jquery-minicolors  (Minor issue)
NOTE: 
https://securitylab.github.com/advisories/GHSL-2021-1045_jQuery_MiniColors_Plugin/
NOTE: 
https://github.com/claviska/jquery-minicolors/commit/ef134824a7f4110ada53ea6c173111a4fa2f48f3
 (2.3.6)
 CVE-2021-32849 (Gerapy is a distributed crawler management framework. Prior to 
version ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5de29380efc69f27b721942c55c1e2ba8aef0ba8

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5de29380efc69f27b721942c55c1e2ba8aef0ba8
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-02-15 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
a7c31718 by Moritz Muehlenhoff at 2023-02-15T17:48:34+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -235,6 +235,7 @@ CVE-2023-0806
RESERVED
 CVE-2023-25727 (In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an 
authenticated use ...)
- phpmyadmin 4:5.2.1+dfsg-1
+   [bullseye] - phpmyadmin  (Minor issue)
NOTE: https://www.phpmyadmin.net/security/PMASA-2023-1/
 CVE-2023-25726
RESERVED
@@ -10635,6 +10636,7 @@ CVE-2023-22333 (Cross-site scripting vulnerability in 
EasyMail 2.00.130 and earl
NOT-FOR-US: EasyMail
 CVE-2023-22332 (Information disclosure vulnerability exists in Pgpool-II 4.4.0 
to 4.4. ...)
- pgpool2  (bug #1030048)
+   [bullseye] - pgpool2  (Minor issue)
NOTE: https://www.pgpool.net/mediawiki/index.php/Main_Page#News
 CVE-2023-22324 (SQL injection vulnerability in the CONPROSYS HMI System (CHS) 
Ver.3.5. ...)
NOT-FOR-US: CONPROSYS
@@ -72086,6 +72088,7 @@ CVE-2022-27673 (Insufficient access controls in the AMD 
Link Android app may pot
 CVE-2022-27672 (When SMT is enabled, certain AMD processors may speculatively 
execute  ...)
- linux 6.1.12-1
- xen 
+   [bullseye] - xen  (Vulnerable code not present)
NOTE: https://www.openwall.com/lists/oss-security/2023/02/14/4
NOTE: 
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1045
NOTE: https://xenbits.xen.org/xsa/advisory-426.html


=
data/dsa-needed.txt
=
@@ -16,6 +16,8 @@ apr-util (carnil)
 --
 apr (carnil)
 --
+curl
+--
 firefox-esr (jmm)
 --
 frr
@@ -30,6 +32,8 @@ linux (carnil)
 netatalk
   open regression with MacOS, tentative patch not yet merged upstream
 --
+nss
+--
 multipath-tools
   Tobias Frost proposed a potential update to be reviewed, maintainer asked to 
review changes
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a7c31718befd1381e7360aee9f0689aee6957cdb

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a7c31718befd1381e7360aee9f0689aee6957cdb
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-02-10 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
930574e9 by Moritz Muehlenhoff at 2023-02-10T08:59:38+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -5363,6 +5363,7 @@ CVE-2023-23628 (Metabase is an open source data analytics 
platform. Affected ver
NOT-FOR-US: Metabase
 CVE-2023-23627 (Sanitize is an allowlist-based HTML and CSS sanitizer. 
Versions 5.0.0  ...)
- ruby-sanitize  (bug #1030047)
+   [bullseye] - ruby-sanitize  (Minor issue)
NOTE: 
https://github.com/rgrove/sanitize/security/advisories/GHSA-fw3g-2h3j-qmm7
NOTE: 
https://github.com/rgrove/sanitize/commit/ec14265e530dc3fe31ce2ef773594d3a97778d22
 (v6.0.1)
 CVE-2023-23626
@@ -10350,6 +10351,7 @@ CVE-2020-36628 (A vulnerability classified as critical 
has been found in Calsign
NOT-FOR-US: Calsign APDE
 CVE-2020-36627 (A vulnerability was found in Macaron i18n. It has been 
declared as pro ...)
- golang-github-go-macaron-i18n 
+   [bullseye] - golang-github-go-macaron-i18n  (Minor issue)
[buster] - golang-github-go-macaron-i18n  (Limited support, 
minor issue, follow bullseye DSAs/point-releases)
NOTE: 
https://github.com/go-macaron/i18n/commit/329b0c4844cc16a5a253c011b55180598e707735
 (v0.5.0)
 CVE-2020-36626 (A vulnerability classified as critical has been found in 
Modern Tribe  ...)
@@ -30290,9 +30292,10 @@ CVE-2022-3425 (The Analyticator WordPress plugin 
before 6.5.6 unserializes user
NOT-FOR-US: WordPress plugin
 CVE-2022-3424 [misc: sgi-gru: fix use-after-free error in 
gru_set_context_option, gru_fault and gru_handle_user_call_os]
RESERVED
-   - linux 6.1.4-1
+   - linux 6.1.4-1 (unimportant)
NOTE: 
https://lore.kernel.org/all/20221006152643.1694235-1-zyytlz...@163.com/
NOTE: 
https://git.kernel.org/linus/643a16a0eb1d6ac23744bb6e90a00fc21148a9dc
+   NOTE: SGI_GRU not enabled in any Debian kernel
 CVE-2022-3423 (Denial of Service in GitHub repository nocodb/nocodb prior to 
0.92.0. ...)
NOT-FOR-US: nocodb
 CVE-2022-3422 (Account Takeover :: when see the info i can see the hash pass i 
can cr ...)
@@ -34889,6 +34892,7 @@ CVE-2022-3217 (When logging in to a VBASE runtime 
project via Web-Remote, the pr
 CVE-2018-25047 (In Smarty before 3.1.47 and 4.x before 4.2.1, 
libs/plugins/function.ma ...)
{DLA-3262-1}
- smarty3 3.1.47-1 (bug #1019897)
+   [bullseye] - smarty3  (Minor issue)
- smarty4 4.2.1-1 (bug #1019896)
NOTE: https://github.com/smarty-php/smarty/issues/454
NOTE: 
https://github.com/smarty-php/smarty/commit/f1f7ee6e34c14a8a9dfa5c6ef894d39277a93938
 (v3.1.47)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/930574e97e267371947b4c9b04c882b39470f0ad

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/930574e97e267371947b4c9b04c882b39470f0ad
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-02-07 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
5790e7d1 by Moritz Muehlenhoff at 2023-02-07T13:54:27+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -7620,6 +7620,7 @@ CVE-2023-22800
 CVE-2023-22799
RESERVED
- ruby-globalid  (bug #1029851)
+   [bullseye] - ruby-globalid  (Minor issue)
NOTE: 
https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127
NOTE: 
https://github.com/rails/globalid/commit/3bc4349422e60f2235876a59dd415e98b072eb2b
 (v1.1.0)
 CVE-2023-22798
@@ -15551,11 +15552,13 @@ CVE-2022-46491 (A Cross-Site Request Forgery (CSRF) 
vulnerability in the Add Adm
NOT-FOR-US: nbnbk
 CVE-2022-46490 (GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered 
to contai ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
NOTE: https://github.com/gpac/gpac/issues/2327
NOTE: 
https://github.com/gpac/gpac/commit/8968a510250e8c70a611221d63fe0a45b7d3a551 
(v2.2.0)
 CVE-2022-46489 (GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered 
to contai ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
NOTE: https://github.com/gpac/gpac/issues/2328
NOTE: 
https://github.com/gpac/gpac/commit/44e8616ec6d0c37498cdacb81375b09249fa9daa 
(v2.2.0)


=
data/dsa-needed.txt
=
@@ -20,6 +20,8 @@ frr
 --
 haproxy (carnil)
 --
+imagemagick (jmm)
+--
 jupyter-core
   Maintainer asked for availability to prepare updates
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5790e7d1be5c9ef84935d7ef5bb8e86633caa37b

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5790e7d1be5c9ef84935d7ef5bb8e86633caa37b
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-02-06 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
891d9dab by Moritz Muehlenhoff at 2023-02-06T16:53:15+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -526,10 +526,11 @@ CVE-2023-25002
 CVE-2023-25001
RESERVED
 CVE-2023-0634 (An uncontrolled process operation was found in the newgrp 
command prov ...)
-   - shadow 
+   - shadow  (unimportant)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2166544
NOTE: https://github.com/shadow-maint/shadow/pull/642
NOTE: 
https://github.com/shadow-maint/shadow/commit/62172f6fb51519a8cf56e35e4ce2b76cc301a7fc
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-0633
RESERVED
 CVE-2023-0632
@@ -27436,6 +27437,7 @@ CVE-2022-3561 (Cross-site Scripting (XSS) - Generic in 
GitHub repository librenm
NOT-FOR-US: LibreNMS
 CVE-2022-3560 (A flaw was found in pesign. The pesign package provides a 
systemd serv ...)
- pesign  (bug #1030168)
+   [bullseye] - pesign  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/01/31/6
NOTE: https://www.openwall.com/lists/oss-security/2023/02/01/2
NOTE: 
https://github.com/rhboot/pesign/commit/d8a8c259994d0278c59b30b41758a8dd0abff998
 (116)
@@ -78149,10 +78151,12 @@ CVE-2022-24896 (Tuleap is a Free  Open Source 
Suite to manage software deve
NOT-FOR-US: Tuleap
 CVE-2022-24895 (Symfony is a PHP framework for web and console applications 
and a set  ...)
- symfony 5.4.20+dfsg-1
+   [bullseye] - symfony  (Minor issue)
NOTE: 
https://github.com/symfony/symfony/security/advisories/GHSA-3gv2-29qc-v67m
NOTE: 
https://github.com/symfony/symfony/commit/5909d74ecee359ea4982fcf4331aaf2e489a1fd4
 CVE-2022-24894 (Symfony is a PHP framework for web and console applications 
and a set  ...)
- symfony 5.4.20+dfsg-1
+   [bullseye] - symfony  (Minor issue)
NOTE: 
https://github.com/symfony/symfony/security/advisories/GHSA-h7vf-5wrv-9fhv
NOTE: 
https://github.com/symfony/symfony/commit/d2f6322af9444ac5cd1ef3ac6f280dbef7f9d1fb
 CVE-2022-24893 (ESP-IDF is the official development framework for Espressif 
SoCs. In E ...)


=
data/dsa-needed.txt
=
@@ -11,9 +11,15 @@ To pick an issue, simply add your uid behind it.
 
 If needed, specify the release by adding a slash after the name of the source 
package.
 
+--
+apr-util
+--
+apr
 --
 frr
 --
+haproxy
+--
 jupyter-core
   Maintainer asked for availability to prepare updates
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/891d9dab823803c5fa72786a7d4f30558b57b1de

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/891d9dab823803c5fa72786a7d4f30558b57b1de
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-30 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
9e5dd925 by Moritz Muehlenhoff at 2023-01-30T13:14:37+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -2935,6 +2935,7 @@ CVE-2023- [RUSTSEC-2023-0002]
NOTE: https://github.com/rust-lang/git2-rs/pull/909
 CVE-2023- [RUSTSEC-2022-0078]
- rust-bumpalo 
+   [bullseye] - rust-bumpalo  (Minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2022-0078.html
NOTE: https://github.com/fitzgen/bumpalo/blob/main/CHANGELOG.md#3111
 CVE-2023-23698
@@ -12387,6 +12388,7 @@ CVE-2022-4397 (A vulnerability was found in morontt 
zend-blog-number-2. It has b
NOT-FOR-US: morontt zend-blog-number-2
 CVE-2022-4396 (** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in 
RDFlib py ...)
- python-pyrdfa 3.5.2+20220329~ds-1 (bug #1026051)
+   [bullseye] - python-pyrdfa  (Minor issue)
NOTE: 
https://github.com/RDFLib/pyrdfa3/commit/ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e
NOTE: https://github.com/RDFLib/pyrdfa3/pull/40
 CVE-2022-46906 (Insufficient processing of user input in WebSoft HCM 
2021.2.3.327 allo ...)
@@ -31025,6 +31027,7 @@ CVE-2020-36604 (hoek before 8.5.1 and 9.x before 9.0.3 
allows prototype poisonin
NOTE: Fixed by: 
https://github.com/hapijs/hoek/commit/948baf98634a5c206875b67d11368f133034fa90 
(v9.0.3)
 CVE-2022-3276 (Command injection is possible in the puppetlabs-mysql module 
prior to  ...)
- puppet-module-puppetlabs-mysql  (bug #1027154)
+   [bullseye] - puppet-module-puppetlabs-mysql  (Minor issue)
NOTE: https://puppet.com/security/cve/CVE-2022-3276
NOTE: 
https://github.com/puppetlabs/puppetlabs-mysql/commit/f83792b256fa6acc1b1375b3bfed257629a5c02d
 (v13.0.0)
NOTE: 
https://github.com/puppetlabs/puppetlabs-mysql/commit/18813a151f150a374a52141db520ed2a8d38b071
 (v13.0.0)
@@ -45186,6 +45189,7 @@ CVE-2022-35978 (Minetest is a free open-source voxel 
game engine with easy moddi
NOTE: 
https://github.com/minetest/minetest/commit/da71e86633d0b27cd02d7aac9fdac625d141ca13
 (5.6.0)
 CVE-2022-35977 (Redis is an in-memory database that persists on disk. 
Authenticated us ...)
- redis 5:7.0.8-1
+   [bullseye] - redis  (Minor issue)
NOTE: 
https://github.com/redis/redis/commit/6c25c6b7da116e110e89a5db45eeae743879e7ea 
(7.0.8)
 CVE-2022-35976 (The GitOps Tools Extension for VSCode relies on kubeconfigs in 
order t ...)
NOT-FOR-US: GitOps Tools Extension for VSCode
@@ -81059,6 +81063,7 @@ CVE-2022-23838
 CVE-2022-23837 (In api.rb in Sidekiq before 5.2.10 and 6.4.0, there is no 
limit on the ...)
{DLA-2943-1}
- ruby-sidekiq  (bug #1004193)
+   [bullseye] - ruby-sidekiq  (Minor issue)
NOTE: 
https://github.com/mperham/sidekiq/commit/7785ac1399f1b28992adb56055f6acd88fd1d956
 (v6.4.0)
 CVE-2022-23836
RESERVED



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9e5dd925f26f10f7189f3c8f80d0546f2470ac47

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9e5dd925f26f10f7189f3c8f80d0546f2470ac47
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-30 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
11ade977 by Moritz Mühlenhoff at 2023-01-30T11:55:30+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -16622,6 +16622,7 @@ CVE-2022-4056
RESERVED
 CVE-2022-4055 (When xdg-mail is configured to use thunderbird for mailto URLs, 
improp ...)
- xdg-utils  (bug #1027160)
+   [bullseye] - xdg-utils  (Minor issue)
NOTE: 
https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/205#note_1494267
NOTE: https://gitlab.freedesktop.org/xdg/xdg-utils/-/merge_requests/58
 CVE-2022-4054 (An issue has been discovered in GitLab affecting all versions 
starting ...)
@@ -40567,6 +40568,7 @@ CVE-2022-37706 (enlightenment_sys in Enlightenment 
before 0.25.4 allows local us
 CVE-2022-37705
RESERVED
- amanda  (bug #1029829)
+   [bullseye] - amanda  (Minor issue)
NOTE: https://github.com/MaherAzzouzi/CVE-2022-37705
NOTE: https://github.com/zmanda/amanda/issues/192
NOTE: https://marc.info/?l=amanda-hackers=167437716918603=2


=
data/dsa-needed.txt
=
@@ -11,9 +11,13 @@ To pick an issue, simply add your uid behind it.
 
 If needed, specify the release by adding a slash after the name of the source 
package.
 
+--
+cinder (jmm)
 --
 frr
 --
+glance (jmm)
+--
 jupyter-core
   Maintainer asked for availability to prepare updates
 --
@@ -28,6 +32,8 @@ linux (carnil)
 netatalk
   open regression with MacOS, tentative patch not yet merged upstream
 --
+nova (jmm)
+--
 multipath-tools
   Tobias Frost proposed a potential update to be reviewed, maintainer asked to 
review changes
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/11ade977b14218f0b01408703bf04687a6c1a640

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/11ade977b14218f0b01408703bf04687a6c1a640
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-28 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ada99554 by Moritz Muehlenhoff at 2023-01-28T13:15:35+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -2399,7 +2399,9 @@ CVE-2023-0342
 CVE-2023-0341 [potential buffer overflow in ec_glob]
RESERVED
- editorconfig-core 0.12.6-0.1
-   TODO: check details
+   [bullseye] - editorconfig-core  (Minor issue)
+   NOTE: https://github.com/editorconfig/editorconfig-core-c/pull/87
+   NOTE: 
https://github.com/editorconfig/editorconfig-core-c/commit/41281ea82fbf24b060a9f69b9c5369350fb0529e
 CVE-2023-0340
RESERVED
 CVE-2023-0339
@@ -11540,8 +11542,9 @@ CVE-2022-47026
 CVE-2022-47025
RESERVED
 CVE-2022-47024 (A null pointer dereference issue was discovered in function 
gui_x11_cr ...)
-   - vim 2:9.0.0626-1
+   - vim 2:9.0.0626-1 (unimportant)
NOTE: 
https://github.com/vim/vim/commit/a63ad78ed31e36dbdf3a9cd28071dcdbefce7d19 
(v9.0.0339)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-47023
RESERVED
 CVE-2022-47022
@@ -13699,12 +13702,14 @@ CVE-2022-4257 (A vulnerability was found in C-DATA 
Web Management System. It has
 CVE-2022-4256 (The All-in-One Addons for Elementor WordPress plugin before 
2.4.4 does ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-4255 (An info leak issue was identified in all versions of GitLab EE 
from 13 ...)
-   TODO: check
+   - gitlab  (Specific to EE)
 CVE-2022-4254 [libsss_certmap fails to sanitise certificate data used in LDAP 
filters]
RESERVED
- sssd 2.3.1-1
+   [bullseye] - sssd  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2149894
-   TODO: check upstream references (missing), and fixing commit
+   NOTE: https://github.com/SSSD/sssd/issues/5135
+   NOTE: 
https://github.com/SSSD/sssd/commit/a2b9a84460429181f2a4fa7e2bb5ab49fd561274
 CVE-2022-4253 (A vulnerability was found in SourceCodester Canteen Management 
System. ...)
NOT-FOR-US: SourceCodester Canteen Management System
 CVE-2022-4252 (A vulnerability was found in SourceCodester Canteen Management 
System. ...)
@@ -15420,6 +15425,7 @@ CVE-2022-45749
RESERVED
 CVE-2022-45748 (An issue was discovered with assimp 5.1.4, a use after free 
occurred i ...)
- assimp 
+   [bullseye] - assimp  (Minor issue)
NOTE: https://github.com/assimp/assimp/issues/4286
 CVE-2022-45747
RESERVED



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ada99554bb1804d57a86712e01498675d04c7b53

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ada99554bb1804d57a86712e01498675d04c7b53
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-26 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
c8516a5c by Moritz Muehlenhoff at 2023-01-26T13:05:59+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -11301,6 +11301,7 @@ CVE-2022-47017
RESERVED
 CVE-2022-47016 (A null pointer dereference issue was discovered in function 
window_pan ...)
- tmux 
+   [bullseye] - tmux  (Minor issue)
NOTE: https://github.com/tmux/tmux/issues/3312
NOTE: https://github.com/tmux/tmux/issues/3447
NOTE: 
https://github.com/tmux/tmux/commit/e86752820993a00e3d28350cbe46878ba95d9012
@@ -23899,10 +23900,14 @@ CVE-2022-43592 (An information disclosure 
vulnerability exists in the DPXOutput:
- openimageio  (bug #1027143)
NOTE: 
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1651
 CVE-2022-43591 (A buffer overflow vulnerability exists in the QML QtScript 
Reflect API ...)
-   - qt6-declarative 
-   - qtdeclarative-opensource-src 
-   - qtdeclarative-opensource-src-gles 
+   - qt6-declarative 6.4.2+dfsg~rc1-2 (unimportant)
+   - qtdeclarative-opensource-src  (unimportant)
+   - qtdeclarative-opensource-src-gles  (unimportant)
+   NOTE: Not considered a security issue, QML only supported from a 
trusted source
NOTE: 
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1650
+   NOTE: 
https://www.qt.io/blog/regarding-recent-reported-security-vulnerabilities-from-cisco-talos
+   NOTE: https://bugreports.qt.io/browse/QTBUG-107619
+   NOTE: https://codereview.qt-project.org/c/qt/qtdeclarative/+/437789
 CVE-2022-43590 (A null pointer dereference vulnerability exists in the 
handle_ioctl_0x ...)
NOT-FOR-US: Callback technologies CBFS Filter
 CVE-2022-43589 (A null pointer dereference vulnerability exists in the 
handle_ioctl_83 ...)
@@ -30667,10 +30672,14 @@ CVE-2022-41141
 CVE-2022-41140
RESERVED
 CVE-2022-40983 (An integer overflow vulnerability exists in the QML QtScript 
Reflect A ...)
-   - qt6-declarative 
-   - qtdeclarative-opensource-src 
-   - qtdeclarative-opensource-src-gles 
-   NOTE: 
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1617
+   - qt6-declarative 6.4.2+dfsg~rc1-2 (unimportant)
+   - qtdeclarative-opensource-src  (unimportant)
+   - qtdeclarative-opensource-src-gles  (unimportant)
+   NOTE: Not considered a security issue, QML only supported from a 
trusted source
+   NOTE: 
https://www.talosintelligence.com/vulnerability_reports/TALOS-2022-1650
+   NOTE: 
https://www.qt.io/blog/regarding-recent-reported-security-vulnerabilities-from-cisco-talos
+   NOTE: https://bugreports.qt.io/browse/QTBUG-107619
+   NOTE: https://codereview.qt-project.org/c/qt/qtdeclarative/+/437921
 CVE-2022-40693
RESERVED
 CVE-2022-41222 (mm/mremap.c in the Linux kernel before 5.13.3 has a 
use-after-free via ...)
@@ -33045,6 +33054,7 @@ CVE-2022-40153
REJECTED
 CVE-2022-40152 (Those using Woodstox to parse XML data may be vulnerable to 
Denial of  ...)
- libwoodstox-java 
+   [bullseye] - libwoodstox-java  (Minor issue)
NOTE: https://github.com/x-stream/xstream/issues/304
NOTE: https://github.com/advisories/GHSA-3f7h-mf4q-vrm4
 CVE-2022-40151 (Those using Xstream to seralize XML data may be vulnerable to 
Denial o ...)


=
data/dsa-needed.txt
=
@@ -12,10 +12,10 @@ To pick an issue, simply add your uid behind it.
 If needed, specify the release by adding a slash after the name of the source 
package.
 
 --
-bind9
+bind9 (jmm)
   Maintainer uploaded bullseye-security update
 --
-chromium
+chromium (jmm)
 --
 curl (jmm)
   Team asked maintainer to prepare updates
@@ -27,6 +27,8 @@ git (aron)
 jupyter-core
   Maintainer asked for availability to prepare updates
 --
+libde265
+--
 libhtml-stripscripts-perl (carnil)
 --
 linux (carnil)
@@ -43,7 +45,7 @@ openjdk-11 (jmm)
 --
 openjdk-17 (jmm)
 --
-php-cas (jmm)
+php-cas
 --
 php-horde-mime-viewer
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c8516a5c66faf2d9238e807e4879c611e8462fdb

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c8516a5c66faf2d9238e807e4879c611e8462fdb
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-24 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
aac46c0f by Moritz Muehlenhoff at 2023-01-24T14:52:24+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -927,6 +927,7 @@ CVE-2023-24057
RESERVED
 CVE-2023-24056 (In pkgconf through 1.9.3, variable duplication can cause 
unbounded str ...)
- pkgconf 1.8.1-1
+   [bullseye] - pkgconf  (Minor issue)
NOTE: 
https://gitea.treehouse.systems/ariadne/pkgconf/commit/81cc9b3e6dafcdd02579bcccec6ac47d91e5d023
 (pkgconf-1.9.4, pkgconf-1.8.1)
NOTE: https://nullprogram.com/blog/2023/01/18/
 CVE-2023-24055 (** DISPUTED ** KeePass through 2.53 (in a default 
installation) allows ...)
@@ -4865,6 +4866,7 @@ CVE-2023-22743
RESERVED
 CVE-2023-22742 (libgit2 is a cross-platform, linkable library implementation 
of Git. W ...)
- libgit2 1.5.1+ds-1 (bug #1029368)
+   [bullseye] - libgit2  (Minor issue)
NOTE: 
https://github.com/libgit2/libgit2/commit/cd6f679af401eda1f172402006ef8265f8bd58ea
 (v1.4.5)
NOTE: 
https://github.com/libgit2/libgit2/commit/42e5db98b963ae503229c63e44e06e439df50e56
 (v1.5.1)
NOTE: 
https://github.com/libgit2/libgit2/security/advisories/GHSA-8643-3wh5-rmjq


=
data/dsa-needed.txt
=
@@ -22,6 +22,8 @@ git (aron)
 jupyter-core
   Maintainer asked for availability to prepare updates
 --
+libhtml-stripscripts-perl
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more recent v5.10.y versions



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aac46c0f00aa64ff20550209ed3caafa28517b98

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aac46c0f00aa64ff20550209ed3caafa28517b98
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-23 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
4c023ff2 by Moritz Muehlenhoff at 2023-01-23T11:18:33+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -632,32 +632,39 @@ CVE-2022-48280
RESERVED
 CVE-2023- [wnpa-sec-2023-07: TIPC dissector crash]
- wireshark 4.0.3-1
+   [bullseye] - wireshark  (Minor issue, fix along in future 
update)
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-07.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18770
 CVE-2023- [wnpa-sec-2023-06: Multiple dissector excessive loops]
- wireshark 4.0.3-1
+   [bullseye] - wireshark  (Minor issue, fix along in future 
update)
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-06.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18711
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18720
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18737
 CVE-2023- [wnpa-sec-2023-05: iSCSI dissector crash]
- wireshark 4.0.3-1
+   [bullseye] - wireshark  (Minor issue, fix along in future 
update)
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-05.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18796
 CVE-2023- [wnpa-sec-2023-04: GNW dissector crash]
- wireshark 4.0.3-1
+   [bullseye] - wireshark  (Minor issue, fix along in future 
update)
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-04.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18779
 CVE-2023- [wnpa-sec-2023-03: Dissection engine crash]
- wireshark 4.0.3-1
+   [bullseye] - wireshark  (Minor issue, fix along in future 
update)
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-03.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18766
 CVE-2023- [wnpa-sec-2023-02: NFS dissector memory leak]
- wireshark 4.0.3-1
+   [bullseye] - wireshark  (Minor issue, fix along in future 
update)
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-02.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18628
 CVE-2023- [wnpa-sec-2023-01: EAP dissector crash]
- wireshark 4.0.3-1
+   [bullseye] - wireshark  (Minor issue, fix along in future 
update)
NOTE: https://www.wireshark.org/security/wnpa-sec-2023-01.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18622
 CVE-2023-24059 (Grand Theft Auto V for PC allows attackers to achieve partial 
remote c ...)
@@ -677,9 +684,10 @@ CVE-2023-0434 (Improper Input Validation in GitHub 
repository pyload/pyload prio
 CVE-2023-24054
RESERVED
 CVE-2023-0433 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.1 ...)
-   - vim 
+   - vim  (unimportant)
NOTE: https://huntr.dev/bounties/ae933869-a1ec-402a-bbea-d51764c6618e/
NOTE: 
https://github.com/vim/vim/commit/11977f917506d950b7e0cae558bd9189260b253b 
(v9.0.1225)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-24053
RESERVED
 CVE-2023-24052
@@ -4591,6 +4599,7 @@ CVE-2023-22746
RESERVED
 CVE-2023-22745 (tpm2-tss is an open source software implementation of the 
Trusted Comp ...)
- tpm2-tss  (bug #1029369)
+   [bullseye] - tpm2-tss  (Minor issue)
NOTE: Fixed by: 
https://github.com/tpm2-software/tpm2-tss/commit/306490c8d848c367faa2d9df81f5e69dab46ffb5
NOTE: 
https://github.com/tpm2-software/tpm2-tss/security/advisories/GHSA-4j3v-fh23-vx67
 CVE-2023-22744



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c023ff2561f93e8ebcc48651fcda6fa15803434

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c023ff2561f93e8ebcc48651fcda6fa15803434
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-18 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
e9a278be by Moritz Muehlenhoff at 2023-01-18T15:37:34+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -712,10 +712,10 @@ CVE-2023-0290
 CVE-2023-0289 (Cross-site Scripting (XSS) - Stored in GitHub repository 
craigk5n/webc ...)
NOT-FOR-US: craigk5n/webcalendar
 CVE-2023-0288 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.1 ...)
-   - vim 
-   [buster] - vim  (Minor issue)
+   - vim  (unimportant)
NOTE: https://huntr.dev/bounties/550a0852-9be0-4abe-906c-f803b34e41d3
NOTE: 
https://github.com/vim/vim/commit/232bdaaca98c34a99ffadf27bf6ee08be6cc8f6a 
(v9.0.1189)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-0287 (A vulnerability was found in ityouknow favorites-web. It has 
been rate ...)
NOT-FOR-US: ityouknow favorites-web
 CVE-2023-0286
@@ -2487,6 +2487,7 @@ CVE-2023-22900
RESERVED
 CVE-2023-22899 (Zip4j through 2.11.2, as used in Threema and other products, 
does not  ...)
- zip4j 2.11.2-3 (bug #1029038)
+   [bullseye] - zip4j  (Minor issue)
NOTE: https://github.com/srikanth-lingala/zip4j/issues/485
NOTE: 
https://github.com/srikanth-lingala/zip4j/commit/597b31afb473a40e8252de5b5def1876bab198d3
 CVE-2023-22898 (workers/extractor.py in Pandora (aka pandora-analysis/pandora) 
1.3.0 a ...)
@@ -2678,6 +2679,7 @@ CVE-2022-4884 (Path-Traversal in MKP storing in Tribe29 
Checkmk =2.0.0p32 an
 CVE-2022-4883
RESERVED
- libxpm 1:3.5.12-1.1
+   [bullseye] - libxpm  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/01/17/2
NOTE: 
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/515294bb8023a45ff916696d0a14308ff4f3a376
 (libXpm-3.5.15)
NOTE: 
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/8178eb0834d82242e1edbc7d4fb0d1b397569c68
 (libXpm-3.5.15)
@@ -2728,11 +2730,13 @@ CVE-2022-48230
 CVE-2022-46285
RESERVED
- libxpm 1:3.5.12-1.1
+   [bullseye] - libxpm  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/01/17/2
NOTE: 
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/a3a7c6dcc3b629d765014816c566c63165c63ca8
 (libXpm-3.5.15)
 CVE-2022-44617
RESERVED
- libxpm 1:3.5.12-1.1
+   [bullseye] - libxpm  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/01/17/2
NOTE: 
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb287c0030c9913b046643
 (libXpm-3.5.15)
NOTE: 
https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/c5ab17bcc34914c0b0707d2135dbebe9a367c5f0
 (libXpm-3.5.15)
@@ -2810,6 +2814,7 @@ CVE-2021-4307 (A vulnerability was found in Yomguithereal 
Baobab up to 2.6.0. It
NOT-FOR-US: Yomguithereal Baobab
 CVE-2020-36646 (A vulnerability classified as problematic has been found in 
MediaArea  ...)
- libzen 0.4.39-1
+   [bullseye] - libzen  (Minor issue)
NOTE: https://github.com/MediaArea/ZenLib/pull/119
NOTE: 
https://github.com/MediaArea/ZenLib/commit/6475fcccd37c9cf17e0cfe263b5fe0e2e47a8408
 (v0.4.39)
 CVE-2017-20164 (A vulnerability was found in Symbiote Seed up to 6.0.2. It has 
been cl ...)


=
data/dsa-needed.txt
=
@@ -67,6 +67,8 @@ sofia-sip
 sox
   patch needed for CVE-2021-40426, check with upstream
 --
+swift
+--
 tiff (aron)
 --
 varnish (carnil)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e9a278be78d80b41807a9bca05c586c0681c9ea1

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e9a278be78d80b41807a9bca05c586c0681c9ea1
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-18 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
9d5282a2 by Moritz Muehlenhoff at 2023-01-18T14:07:25+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -375,6 +375,7 @@ CVE-2023-0331
 CVE-2023-0330
RESERVED
- qemu 
+   [bullseye] - qemu  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2160151
NOTE: Proposed patch: 
https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html
 CVE-2023-0329
@@ -12013,7 +12014,9 @@ CVE-2022-46177 (Discourse is an option source 
discussion platform. Prior to vers
NOT-FOR-US: Discourse
 CVE-2022-46176 (Cargo is a Rust package manager. The Rust Security Response WG 
was not ...)
- cargo 0.66.0+ds1-1
+   [bullseye] - cargo  (Minor issue)
- rust-cargo 0.66.0-1
+   [bullseye] - rust-cargo  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/01/10/3
NOTE: 
https://github.com/rust-lang/wg-security-response/tree/main/patches/CVE-2022-46176
 CVE-2022-46175 (JSON5 is an extension to the popular JSON file format that 
aims to be  ...)


=
data/dsa-needed.txt
=
@@ -11,6 +11,9 @@ To pick an issue, simply add your uid behind it.
 
 If needed, specify the release by adding a slash after the name of the source 
package.
 
+--
+apache2
+  Update to 2.4.55 should settle in unstable for a week, before considering an 
update
 --
 curl (jmm)
   Team asked maintainer to prepare updates



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9d5282a23d7ffa8ee597ee185ac6cf25c8be8c3e

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9d5282a23d7ffa8ee597ee185ac6cf25c8be8c3e
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-16 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
7ee10f8b by Moritz Muehlenhoff at 2023-01-16T13:09:50+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -22,6 +22,7 @@ CVE-2023-0306 (Cross-site Scripting (XSS) - Stored in GitHub 
repository thorsten
NOT-FOR-US: phpmyfaq
 CVE-2023- [Multiple integer overflow and buffer overflow issues in game 
loading]
- sgt-puzzles  (bug #1028986)
+   [bullseye] - sgt-puzzles  (Minor issue)
 CVE-2023-0305 (A vulnerability classified as critical was found in 
SourceCodester Onl ...)
NOT-FOR-US: SourceCodester Online Food Ordering System
 CVE-2023-0304 (A vulnerability classified as critical has been found in 
SourceCodeste ...)
@@ -4529,6 +4530,7 @@ CVE-2022-4744
RESERVED
 CVE-2022-4743 (A potential memory leak issue was discovered in SDL2 in 
GLES_CreateTex ...)
- libsdl2 2.26.0+dfsg-1
+   [bullseye] - libsdl2  (Minor issue)
[buster] - libsdl2  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2156290
NOTE: https://github.com/libsdl-org/SDL/pull/6269
@@ -123343,6 +123345,7 @@ CVE-2021-32440 (The Media_RewriteODFrame function in 
GPAC 1.0.1 allows attackers
NOTE: https://github.com/gpac/gpac/issues/1772
 CVE-2021-32439 (Buffer overflow in the stbl_AppendSize function in MP4Box in 
GPAC 1.0. ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (Vulnerable code introduced later, in 
version 0.8.0)
[stretch] - gpac  (Vulnerable code introduced later, in 
version 0.8.0)
NOTE: 
https://github.com/gpac/gpac/commit/77ed81c069e10b3861d88f72e1c6be1277ee7eae 
(v2.0.0)
@@ -190862,6 +190865,7 @@ CVE-2020-17355 (Arista EOS before 4.21.12M, 4.22.x 
before 4.22.7M, 4.23.x before
 CVE-2020-17354
RESERVED
- lilypond 2.22.1-1
+   [bullseye] - lilypond  (Unfixable, marked as insecure in later 
uploads)
NOTE: https://phabricator.wikimedia.org/T259210
NOTE: https://phabricator.wikimedia.org/T257062
NOTE: 
https://www.mediawiki.org/wiki/Extension:Score/2021_security_advisory


=
data/dsa-needed.txt
=
@@ -17,6 +17,8 @@ curl (jmm)
 --
 frr
 --
+jupyter-core
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more recent v5.10.y versions



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ee10f8b298a0e33139452eb1b3eefec0aba4197

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7ee10f8b298a0e33139452eb1b3eefec0aba4197
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-09 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
24493847 by Moritz Muehlenhoff at 2023-01-09T16:59:33+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -3368,34 +3368,42 @@ CVE-2022-47664
RESERVED
 CVE-2022-47663 (GPAC MP4box 2.1-DEV-rev649-ga8f438d20 is vulnerable to buffer 
overflow ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2360
NOTE: 
https://github.com/gpac/gpac/commit/e7e8745f677010a5cb3366d5cbf39df7cffaaa2d 
(v2.2.0)
 CVE-2022-47662 (GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault 
(/stack over ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2359
NOTE: 
https://github.com/gpac/gpac/commit/080a62728ccd251a7f20eaac3fda21b0716e3c9b 
(v2.2.0)
 CVE-2022-47661 (GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 is vulnerable to Buffer 
Overflow ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2358
NOTE: 
https://github.com/gpac/gpac/commit/aa8fbec874b5e040854e5309aa445c234618 
(v2.2.0)
 CVE-2022-47660 (GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is has an integer 
overflow in is ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2357
NOTE: 
https://github.com/gpac/gpac/commit/a8f438d201fb165961ba1d5d3b80daa3637735f4 
(v2.2.0)
 CVE-2022-47659 (GPAC MP4box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to Buffer 
Overflow ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2354
NOTE: 
https://github.com/gpac/gpac/commit/348d7722c1e90c7811b43b0eed5c2aca2cb8a717 
(v2.2.0)
 CVE-2022-47658 (GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer 
overflow ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2356
NOTE: 
https://github.com/gpac/gpac/commit/55c8b3af6f5ef9e51edb41172062ca9b5db4026b 
(v2.2.0)
 CVE-2022-47657 (GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer 
overflow ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2355
NOTE: 
https://github.com/gpac/gpac/commit/9f1e633184904fffc315bd35ebce76b4b42f9097 
(v2.2.0)
 CVE-2022-47656 (GPAC MP4box 2.1-DEV-rev617-g85ce76efd is vulnerable to Buffer 
Overflow ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2353
NOTE: 
https://github.com/gpac/gpac/commit/c9a8118965b53d29837b1b82b6a58543efb23baf 
(v2.2.0)
 CVE-2022-47655 (Libde265 1.0.9 is vulnerable to Buffer Overflow in function 
void put_q ...)
@@ -5168,6 +5176,7 @@ CVE-2022-4516
 CVE-2022-4515 (A flaw was found in Exuberant Ctags in the way it handles the 
"-o" opt ...)
{DLA-3254-1}
- exuberant-ctags 1:5.9~svn20110310-18 (bug #1026995)
+   [bullseye] - exuberant-ctags  (Minor issue)
- universal-ctags  (Fixed before initial upload to Debian)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2153519
NOTE: Fixed by: 
https://github.com/universal-ctags/ctags/commit/e00c55d7a0204dc1d0ae316141323959e1e16162
@@ -5681,6 +5690,7 @@ CVE-2022-4442
RESERVED
 CVE-2019-25078 (A vulnerability classified as problematic was found in 
pacparser up to ...)
- pacparser  (bug #1026106)
+   [bullseye] - pacparser  (Minor issue)
[buster] - pacparser  (Minor issue)
NOTE: https://github.com/manugarg/pacparser/issues/99
NOTE: 
https://github.com/manugarg/pacparser/commit/853e8f45607cb07b877ffd270c63dbcdd5201ad9
 (v1.4.0)


=
data/dsa-needed.txt
=
@@ -66,3 +66,8 @@ sox
 --
 tiff (aron)
 --
+varnish
+--
+xrdp
+  needs some additional clarification, tentatively DSA worthy
+  maybe upgrade to 0.9.21 within bullseye?



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/244938475e37774c5c75690533d9804cd49f61de

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/244938475e37774c5c75690533d9804cd49f61de
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-09 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
3ad52e3d by Moritz Muehlenhoff at 2023-01-09T10:28:37+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -3400,13 +3400,16 @@ CVE-2022-47656 (GPAC MP4box 2.1-DEV-rev617-g85ce76efd 
is vulnerable to Buffer Ov
NOTE: 
https://github.com/gpac/gpac/commit/c9a8118965b53d29837b1b82b6a58543efb23baf 
(v2.2.0)
 CVE-2022-47655 (Libde265 1.0.9 is vulnerable to Buffer Overflow in function 
void put_q ...)
- libde265 
+   [bullseye] - libde265  (Minor issue)
NOTE: https://github.com/strukturag/libde265/issues/367
 CVE-2022-47654 (GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer 
Overflow ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2350
NOTE: 
https://github.com/gpac/gpac/commit/88e7b873da5d3e85d31b601c1560d2e24a1d7b25 
(v2.2.0)
 CVE-2022-47653 (GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer 
Overflow ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2349
NOTE: 
https://github.com/gpac/gpac/commit/a1e197581437cf0a104a9b6543cb4547cfdfc03f 
(v2.2.0)
 CVE-2022-47652
@@ -6271,40 +6274,49 @@ CVE-2022-47096
RESERVED
 CVE-2022-47095 (GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer 
overflow ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2346
NOTE: 
https://github.com/gpac/gpac/commit/1918a58bd0c9789844cf6a377293161506ee312c 
(v2.2.0)
 CVE-2022-47094 (GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Null 
pointer de ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2345
NOTE: 
https://github.com/gpac/gpac/commit/6ddedfb85e617f5e935cb490d5b51f141e13a937 
(v2.2.0)
 CVE-2022-47093 (GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to heap 
use-after- ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2344
NOTE: 
https://github.com/gpac/gpac/commit/706111f4d8babf0cda9fac5f3ca4e89983274d6e 
(v2.2.0)
 CVE-2022-47092 (GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer 
overflow  ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2347
NOTE: 
https://github.com/gpac/gpac/commit/6bb3e4e288f02c9c595e63230979cd5443a1cb7a 
(v2.2.0)
 CVE-2022-47091 (GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer 
Overflow ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2343
NOTE: 
https://github.com/gpac/gpac/commit/65d089bcb5dad6fda668ee61e38a8394ed8bdf1f 
(v2.2.0)
 CVE-2022-47090
RESERVED
 CVE-2022-47089 (GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer 
Overflow ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2338
NOTE: 
https://github.com/gpac/gpac/commit/73a8c425adaad7526de81586fcb053acde807757 
(v2.2.0)
 CVE-2022-47088 (GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer 
Overflow ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2340
NOTE: 
https://github.com/gpac/gpac/commit/48760768611f6766bf9e7378bb7cc66cebd6e49d 
(v2.2.0)
 CVE-2022-47087 (GPAC MP4box 2.1-DEV-rev574-g9d5bb184b has a Buffer overflow in 
gf_vvc_ ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2339
NOTE: 
https://github.com/gpac/gpac/commit/48760768611f6766bf9e7378bb7cc66cebd6e49d 
(v2.2.0)
 CVE-2022-47086 (GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation 
violati ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2337
NOTE: 
https://github.com/gpac/gpac/commit/15e3aece44f24a1c4e8cc0622c59008b1b9ab683 
(v2.2.0)
 CVE-2022-47085
@@ -8070,11 +8082,11 @@ CVE-2022-46458
 CVE-2022-46457 (NASM v2.16 was discovered to contain a segmentation violation 
in the c ...)
- nasm  (unimportant)
NOTE: https://bugzilla.nasm.us/show_bug.cgi?id=3392809
-   NOTE: Negligible security impact
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-46456 (NASM v2.16 was discovered to contain a global buffer overflow 
in the c ...)
- nasm  (unimportant)
NOTE: https://bugzilla.nasm.us/show_bug.cgi?id=3392814
-   NOTE: Negligible security impact
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-46455
RESERVED
 CVE-2022-46454
@@

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-05 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
6117b5b6 by Moritz Muehlenhoff at 2023-01-05T12:19:30+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -114,6 +114,7 @@ CVE-2023-22603
RESERVED
 CVE-2023-0054 (Out-of-bounds Write in GitHub repository vim/vim prior to 
9.0.1145. ...)
- vim 
+   [bullseye] - vim  (Minor issue)
NOTE: https://huntr.dev/bounties/b289ee0f-fd16-4147-bd01-c6289c45e49d
NOTE: 
https://github.com/vim/vim/commit/3ac1d97a1d9353490493d30088256360435f7731 
(v9.0.1145)
 CVE-2023-0053
@@ -121,15 +122,17 @@ CVE-2023-0053
 CVE-2023-0052
RESERVED
 CVE-2023-0051 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.1 ...)
-   - vim 
+   - vim  (unimportant)
NOTE: https://huntr.dev/bounties/1c8686db-baa6-42dc-ba45-aed322802de9
NOTE: 
https://github.com/vim/vim/commit/c32949b0779106ed5710ae3bffc5053e49083ab4 
(v9.0.1144)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-0050
RESERVED
 CVE-2023-0049 (Out-of-bounds Read in GitHub repository vim/vim prior to 
9.0.1143. ...)
-   - vim 
+   - vim  (unimportant)
NOTE: https://huntr.dev/bounties/5e6f325c-ba54-4bf0-b050-dca048fd3fd9
NOTE: 
https://github.com/vim/vim/commit/7b17eb4b063a234376c1ec909ee293e42cff290c 
(v9.0.1143)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2023-0048 (Code Injection in GitHub repository lirantal/daloradius prior 
to maste ...)
TODO: check
 CVE-2023-0047
@@ -50510,6 +50513,7 @@ CVE-2022-31631
RESERVED
- php8.1 
- php7.4 
+   [bullseye] - php7.4  (Minor issue, fix along in next update)
- php7.3 
NOTE: Fixed in 8.1.14
NOTE: PHP Bug: https://bugs.php.net/bug.php?id=81740


=
data/dsa-needed.txt
=
@@ -61,6 +61,5 @@ sox
 --
 tiff
 --
-trafficserver
-  Maintainer asked for an update
+trafficserver (jmm)
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6117b5b68cdcd692a13e4504487cadb48d2b8fb1

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6117b5b68cdcd692a13e4504487cadb48d2b8fb1
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2023-01-03 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
98fdc069 by Moritz Muehlenhoff at 2023-01-03T16:30:37+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -306,6 +306,7 @@ CVE-2020-36637 (** UNSUPPORTED WHEN ASSIGNED ** A 
vulnerability was found in Chr
NOT-FOR-US: Chris92de AdminServ
 CVE-2018-25060 (A vulnerability was found in Macaron csrf and classified as 
problemati ...)
- golang-github-go-macaron-csrf 
+   [bullseye] - golang-github-go-macaron-csrf  (Minor issue)
[buster] - golang-github-go-macaron-csrf  (Minor issue)
NOTE: 
https://github.com/go-macaron/csrf/commit/dadd1711a617000b70e5e408a76531b73187031c
NOTE: https://github.com/go-macaron/csrf/pull/7
@@ -1391,6 +1392,7 @@ CVE-2019-25084 (A vulnerability, which was classified as 
problematic, has been f
TODO: check
 CVE-2022-47952 (lxc-user-nic in lxc through 5.0.1 is installed setuid root, 
and may al ...)
- lxc 
+   [bullseye] - lxc  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2157281
NOTE: https://github.com/MaherAzzouzi/CVE-2022-47952
NOTE: 
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1783591/comments/45
@@ -75182,6 +75184,7 @@ CVE-2022-23468 (xrdp is an open source project which 
provides a graphical login
NOTE: 
https://github.com/neutrinolabs/xrdp/security/advisories/GHSA-8c2f-mw8m-qpx6
 CVE-2022-23467 (OpenRazer is an open source driver and user-space daemon to 
control Ra ...)
- openrazer 3.5.1+dfsg-1
+   [bullseye] - openrazer  (Minor issue)
[buster] - openrazer  (Minor issue)
NOTE: 
https://github.com/openrazer/openrazer/security/advisories/GHSA-39hg-jvc9-fg7h
NOTE: 
https://github.com/openrazer/openrazer/commit/33aa7f07d54ae066f201c6d298cb4a2181cb90e6
 (v3.5.1)


=
data/dsa-needed.txt
=
@@ -21,6 +21,8 @@ hsqldb (apo)
 --
 lava
 --
+libxstream-java
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more recent v5.10.y versions



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/98fdc069b5b3818f3d1320fab5c3f8f6fd038cd4

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/98fdc069b5b3818f3d1320fab5c3f8f6fd038cd4
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-12-27 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
c0205320 by Moritz Mühlenhoff at 2022-12-28T00:09:34+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -115,9 +115,10 @@ CVE-2021-4289 (A vulnerability classified as problematic 
was found in OpenMRS op
 CVE-2021-4288 (A vulnerability was found in OpenMRS 
openmrs-module-referenceapplicati ...)
NOT-FOR-US: OpenMRS
 CVE-2021-4287 (A vulnerability, which was classified as problematic, was found 
in ReF ...)
-   - binwalk 2.3.3+dfsg1-1
+   - binwalk 2.3.3+dfsg1-1 (unimportant)
NOTE: 
https://github.com/ReFirmLabs/binwalk/commit/fa0c0bd59b8588814756942fe4cb5452e76c1dcd
 (v2.3.3)
NOTE: https://github.com/ReFirmLabs/binwalk/pull/556
+   NOTE: This is not a security vulnerability, but only adds a 
security-related feature
 CVE-2021-4286 (A vulnerability, which was classified as problematic, has been 
found i ...)
NOT-FOR-US: cocagne pysrp
 CVE-2021-4285 (A vulnerability classified as problematic was found in Nagios 
NCPA. Th ...)
@@ -2691,10 +2692,12 @@ CVE-2022-4559 (A vulnerability was found in INEX 
IPX-Manager up to 6.2.0. It has
NOT-FOR-US: INEX IPX-Manager
 CVE-2022-4558 (A vulnerability was found in Alinto SOGo up to 5.7.1. It has 
been clas ...)
- sogo 5.8.0-1
+   [bullseye] - sogo  (Minor issue)
NOTE: 
https://github.com/Alinto/sogo/commit/1e0f5f00890f751e84d67be4f139dd7f00faa5f3 
(SOGo-5.8.0)
 CVE-2022-4557
RESERVED
 CVE-2022-4556 (A vulnerability was found in Alinto SOGo up to 5.7.1 and 
classified as ...)
+   [bullseye] - CVE-2022-4556  (Minor issue)
- sogo 5.8.0-1
NOTE: 
https://github.com/Alinto/sogo/commit/efac49ae91a4a325df9931e78e543f707a0f8e5e 
(SOGo-5.8.0)
 CVE-2022-4555 (The WP Shamsi plugin for WordPress is vulnerable to 
authorization bypa ...)
@@ -6910,6 +6913,7 @@ CVE-2022-46176
RESERVED
 CVE-2022-46175 (JSON5 is an extension to the popular JSON file format that 
aims to be  ...)
- node-json5 
+   [bullseye] - node-json5  (Minor issue)
NOTE: 
https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h
NOTE: https://github.com/json5/json5/issues/199
NOTE: https://github.com/json5/json5/issues/295
@@ -7679,9 +7683,7 @@ CVE-2022-4134
NOTE: https://bugs.launchpad.net/ossn/+bug/1990157
 CVE-2022-4133 [reflected XSS]
RESERVED
-   - horizon 
-   NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2147389
-   NOTE: check, unclear if specific to Red Hat OpenStack Platform dashboard
+   NOT-FOR-US: Red Hat OpenStack Platform dashboard
 CVE-2022-4132
RESERVED
 CVE-2021-46855
@@ -25384,6 +25386,7 @@ CVE-2022-3172
 CVE-2022-3171 (A parsing issue with binary data in protobuf-java core and lite 
versio ...)
[experimental] - protobuf 3.21.7-1
- protobuf 3.21.9-3
+   [bullseye] - protobuf  (Minor issue)
NOTE: 
https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2
 CVE-2022-3170 (An out-of-bounds access issue was found in the Linux kernel 
sound subs ...)
- linux  (Vulnerable code not present)
@@ -112100,6 +112103,7 @@ CVE-2021-35066 (An XXE vulnerability exists in 
ConnectWise Automate before 2021.
NOT-FOR-US: ConnectWise Automate
 CVE-2021-35065 (The glob-parent package before 6.0.1 for Node.js allows ReDoS 
(regular ...)
- node-glob-parent 6.0.2+~5.1.1-1
+   [bullseye] - node-glob-parent  (Minor issue)
NOTE: 
https://github.com/gulpjs/glob-parent/commit/3e9f04a3b4349db7e1962d87c9a7398cda51f339
 (v6.0.1)
NOTE: https://github.com/gulpjs/glob-parent/pull/49
 CVE-2021-35064 (KramerAV VIAWare, all tested versions, allow privilege 
escalation thro ...)


=
data/dsa-needed.txt
=
@@ -17,6 +17,8 @@ curl
 --
 frr
 --
+hsqldb
+--
 lava
 --
 linux (carnil)
@@ -59,3 +61,5 @@ sox
 --
 tiff
 --
+trafficserver
+--



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c02053201d55bb287d69686ddff7fa56596f37b2

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c02053201d55bb287d69686ddff7fa56596f37b2
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-12-12 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
03378f2f by Moritz Muehlenhoff at 2022-12-12T18:56:26+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -3113,7 +3113,7 @@ CVE-2022-4135 (Heap buffer overflow in GPU in Google 
Chrome prior to 107.0.5304.
[buster] - chromium  (see DSA 5046)
 CVE-2022-4134
RESERVED
-   - glance 
+   NOTE: There's no code fix, just an update on best practices
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2147462
NOTE: https://wiki.openstack.org/wiki/OSSN/OSSN-0090
NOTE: https://bugs.launchpad.net/ossn/+bug/1990157
@@ -4929,6 +4929,7 @@ CVE-2022-45284
RESERVED
 CVE-2022-45283 (GPAC MP4box v2.0.0 was discovered to contain a stack overflow 
in the s ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
NOTE: https://github.com/gpac/gpac/issues/2295
NOTE: 
https://github.com/gpac/gpac/commit/0fc714872ba4536a1190f93aa278b6e08f8c60df
@@ -13877,6 +13878,7 @@ CVE-2022-42962
RESERVED
 CVE-2022-42961 (An issue was discovered in wolfSSL before 5.5.0. A fault 
injection att ...)
- wolfssl 5.5.3-1 (bug #1023574)
+   [bullseye] - wolfssl  (Minor issue)
NOTE: https://github.com/wolfSSL/wolfssl/releases/tag/v5.5.0-stable
 CVE-2022-42960 (EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 
2.0.4, 2.1.1 ...)
NOT-FOR-US: EqualWeb Accessibility Widget
@@ -14028,10 +14030,12 @@ CVE-2022-3511 (The Awesome Support WordPress plugin 
before 6.1.2 does not ensure
NOT-FOR-US: WordPress plugin
 CVE-2022-3510 (A parsing issue similar to CVE-2022-3171, but with Message-Type 
Extens ...)
- protobuf 
+   [bullseye] - protobuf  (Minor issue)
NOTE: 
https://github.com/protocolbuffers/protobuf/commit/db7c17803320525722f45c1d26fc08bc41d1bf48
 CVE-2022-3509 (A parsing issue similar to CVE-2022-3171, but with textformat 
in proto ...)
[experimental] - protobuf 3.21.7-1
- protobuf 3.21.9-3
+   [bullseye] - protobuf  (Minor issue)
NOTE: 
https://github.com/protocolbuffers/protobuf/commit/a3888f53317a8018e7a439bac4abeb8f3425d5e9
 (v21.7, v3.21.7)
 CVE-2022-3508
RESERVED
@@ -14152,6 +14156,7 @@ CVE-2022-42907
RESERVED
 CVE-2022-42905 (In wolfSSL before 5.5.2, if callback functions are enabled 
(via the WO ...)
- wolfssl 5.5.3-1
+   [bullseye] - wolfssl  (Minor issue)
NOTE: Fixed in 5.5.2 
(https://www.wolfssl.com/docs/security-vulnerabilities/)
 CVE-2022-42904 (Zoho ManageEngine ADManager Plus through 7151 allows 
authenticated adm ...)
NOT-FOR-US: Zoho ManageEngine
@@ -23489,6 +23494,7 @@ CVE-2022-39174
RESERVED
 CVE-2022-39173 (In wolfSSL before 5.5.1, malicious clients can cause a buffer 
overflow ...)
- wolfssl 5.5.3-1 (bug #1021021)
+   [bullseye] - wolfssl  (Minor issue)
 CVE-2022-39172
RESERVED
 CVE-2022-39171
@@ -33855,6 +33861,7 @@ CVE-2022-35410 (mat2 (aka metadata anonymisation 
toolkit) before 0.13.0 allows .
NOTE: https://dustri.org/b/mat2-0130.html
 CVE-2022-35409 (An issue was discovered in Mbed TLS before 2.28.1 and 3.x 
before 3.2.0 ...)
- mbedtls 2.28.1-1
+   [bullseye] - mbedtls  (Minor issue)
NOTE: 
https://github.com/Mbed-TLS/mbedtls-docs/blob/5e9790353d2d9e41e85262eebe52fd90bb49f1e0/security-advisories/advisories/mbedtls-security-advisory-2022-07.md
NOTE: 
https://github.com/Mbed-TLS/mbedtls/commit/f333dfab4a6c2d8a604a61558a8f783145161de4
 (v2.28.1)
NOTE: 
https://github.com/Mbed-TLS/mbedtls/commit/e5af9fabf7d68e3807b6ea78792794b8352dbba2
 (v2.28.1)
@@ -43639,6 +43646,7 @@ CVE-2022-1942 (Heap-based Buffer Overflow in GitHub 
repository vim/vim prior to
 CVE-2022-1941 (A parsing vulnerability for the MessageSet type in the 
ProtocolBuffers ...)
[experimental] - protobuf 3.20.2-1
- protobuf 3.21.9-3
+   [bullseye] - protobuf  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/09/27/1
NOTE: 
https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf
NOTE: 
https://github.com/protocolbuffers/protobuf/commit/806d7e4ce6f1fd0545cae226b94cb0249ea495c7
 (v3.20.2)
@@ -61286,6 +61294,7 @@ CVE-2022-24440 (The package cocoapods-downloader before 
1.6.0, from 1.6.2 and be
NOT-FOR-US: cocoapods-downloader
 CVE-2022-24439 (All versions of package gitpython are vulnerable to Remote 
Code Execut ...)
- python-git 
+   [bullseye] - python-git  (Minor issue)
NOTE: https://security.snyk.io/vuln/SNYK-PYTHON-GITPYTHON-3113858
NOTE: https://github.com/gitpython-developers/GitPython/issues/1515
 CVE-2022-24438
@@ -78784,6 +78793,7 @@ CVE-2021-44733 (A use-after-free exists in

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-12-08 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
b4f7be00 by Moritz Muehlenhoff at 2022-12-08T10:41:00+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -951,13 +951,15 @@ CVE-2022-43443
 CVE-2022-4294
RESERVED
 CVE-2022-4293 (Floating Point Comparison with Incorrect Operator in GitHub 
repository ...)
-   - vim 2:9.0.0813-1
+   - vim 2:9.0.0813-1 (unimportant)
NOTE: https://huntr.dev/bounties/385a835f-6e33-4d00-acce-ac99f3939143
NOTE: 
https://github.com/vim/vim/commit/cdef1cefa2a440911c727558562f83ed9b00e16b 
(v9.0.0804)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-4292 (Use After Free in GitHub repository vim/vim prior to 9.0.0882. 
...)
-   - vim 
+   - vim  (unimportant)
NOTE: https://huntr.dev/bounties/da3d4c47-e57a-451e-993d-9df0ed31f57b
NOTE: 
https://github.com/vim/vim/commit/c3d27ada14acd02db357f2d16347acc22cb17e93 
(v9.0.0882)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-4291 (The aswjsflt.dll library from Avast Antivirus windows contained 
a pote ...)
TODO: check
 CVE-2022-4290



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b4f7be00b524b027e50f66f5035b4d243762cada

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b4f7be00b524b027e50f66f5035b4d243762cada
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-12-07 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
7273a8db by Moritz Muehlenhoff at 2022-12-07T20:11:47+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -1892,6 +1892,7 @@ CVE-2022-46150 (Discourse is an open-source discussion 
platform. Prior to versio
 CVE-2022-46149 (Cap'n Proto is a data interchange format and remote procedure 
call (RP ...)
[experimental] - capnproto 0.9.2-1
- capnproto 
+   [bullseye] - capnproto  (Breaks API and requires rebuilds, 
possibly via point release)
- rust-capnp 
NOTE: 
https://github.com/capnproto/capnproto/security/advisories/GHSA-qqff-4vw4-f6hx
NOTE: 
https://github.com/capnproto/capnproto/commit/25d34c67863fd960af34fc4f82a7ca3362ee74b9
@@ -11084,6 +11085,7 @@ CVE-2022-3698
RESERVED
 CVE-2022-3697 (A flaw was found in Ansible in the amazon.aws collection when 
using th ...)
- ansible 7.0.0+dfsg-1
+   [bullseye] - ansible  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2137664
NOTE: https://github.com/ansible-collections/amazon.aws/pull/1199
 CVE-2022-3696 (A post-auth code injection vulnerability allows admins to 
execute code ...)
@@ -11545,6 +11547,7 @@ CVE-2022-3651
 CVE-2022-3650 [ceph-crash.service allows local ceph user to root exploit]
RESERVED
- ceph 16.2.10+ds-4 (bug #1024932)
+   [bullseye] - ceph  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/10/25/1
NOTE: https://tracker.ceph.com/issues/57967
NOTE: https://github.com/ceph/ceph/pull/48713
@@ -14171,10 +14174,12 @@ CVE-2022-42707 (In Mahara 21.04 before 21.04.7, 21.10 
before 21.10.5, 22.04 befo
- mahara 
 CVE-2022-42706 (An issue was discovered in Sangoma Asterisk through 16.28, 17 
and 18 t ...)
- asterisk 
+   [bullseye] - asterisk  (Minor issue)
NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-30176
NOTE: https://downloads.asterisk.org/pub/security/AST-2022-009.html
 CVE-2022-42705 (A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 
16.28, 18.1 ...)
- asterisk 
+   [bullseye] - asterisk  (Minor issue)
NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-30244
NOTE: https://downloads.asterisk.org/pub/security/AST-2022-008.html
 CVE-2022-42704
@@ -22630,6 +22635,7 @@ CVE-2022-39270 (DiscoTOC is a Discourse theme component 
that generates a table o
NOT-FOR-US: DiscoTOC Discourse theme
 CVE-2022-39269 (PJSIP is a free and open source multimedia communication 
library writt ...)
- asterisk 
+   [bullseye] - asterisk  (Vulnerable code not present)
- pjproject 
- ring 
NOTE: 
https://github.com/pjsip/pjproject/security/advisories/GHSA-wx5m-cj97-4wwg
@@ -22726,6 +22732,7 @@ CVE-2022-39245 (Mist is the command-line interface for 
the makedeb Package Repos
NOT-FOR-US: Makedeb Mist
 CVE-2022-39244 (PJSIP is a free and open source multimedia communication 
library writt ...)
- asterisk 
+   [bullseye] - asterisk  (Vulnerable code not present)
- pjproject 
- ring 
NOTE: 
https://github.com/pjsip/pjproject/security/advisories/GHSA-fq45-m3f7-3mhj
@@ -28243,6 +28250,7 @@ CVE-2022-37326
RESERVED
 CVE-2022-37325 (In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 
18.14.0, an ...)
- asterisk 
+   [bullseye] - asterisk  (Minor issue)
NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-30103
NOTE: https://downloads.asterisk.org/pub/security/AST-2022-007.html
 CVE-2022-37324


=
data/dsa-needed.txt
=
@@ -11,6 +11,8 @@ To pick an issue, simply add your uid behind it.
 
 If needed, specify the release by adding a slash after the name of the source 
package.
 
+--
+cacti
 --
 frr
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7273a8dbf6549ed1189d224452d086414a70109b

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7273a8dbf6549ed1189d224452d086414a70109b
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-12-05 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
1e706af0 by Moritz Muehlenhoff at 2022-12-05T13:18:41+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -11308,9 +11308,10 @@ CVE-2022-43397 (A vulnerability has been identified in 
Parasolid V34.0 (All vers
 CVE-2022-43396
RESERVED
 CVE-2022-3591 (Use After Free in GitHub repository vim/vim prior to 9.0.0789. 
...)
-   - vim 2:9.0.0813-1
+   - vim 2:9.0.0813-1 (unimportant)
NOTE: https://huntr.dev/bounties/a5a998c2-4b07-47a7-91be-dbc1886b3921
NOTE: 
https://github.com/vim/vim/commit/8f3c3c6cd044e3b5bf08dbfa3b3f04bb3f711bad 
(v9.0.0789)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3590
RESERVED
 CVE-2022-3589 (An API Endpoint used by Miele's "AppWash" MobileApp in all 
versions wa ...)
@@ -12451,9 +12452,10 @@ CVE-2022-42964 (An exponential ReDoS (Regular 
Expression Denial of Service) can
NOTE: 
https://research.jfrog.com/vulnerabilities/pymatgen-redos-xray-257184/
NOTE: Doesn't seem to be reported upstream so far
 CVE-2022-3520 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.0 ...)
-   - vim 2:9.0.0813-1
+   - vim 2:9.0.0813-1 (unimportant)
NOTE: https://huntr.dev/bounties/c1db3b70-f4fe-481f-8a24-0b1449c94246
NOTE: 
https://github.com/vim/vim/commit/36343ae0fb7247e060abfd35fb8e4337b33abb4b 
(v9.0.0765)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3519 (A vulnerability classified as problematic was found in 
SourceCodester  ...)
NOT-FOR-US: SourceCodester Sanitization Management System
 CVE-2022-3518 (A vulnerability classified as problematic has been found in 
SourceCode ...)
@@ -12703,9 +12705,10 @@ CVE-2022-3493 (A vulnerability, which was classified 
as problematic, has been fo
 CVE-2022-3492 (A vulnerability classified as critical was found in 
SourceCodester Hum ...)
NOT-FOR-US: SourceCodester Human Resource Management System
 CVE-2022-3491 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.0 ...)
-   - vim 2:9.0.0813-1
+   - vim 2:9.0.0813-1 (unimportant)
NOTE: https://huntr.dev/bounties/6e6e05c2-2cf7-4aa5-a817-a62007bf92cb
NOTE: 
https://github.com/vim/vim/commit/3558afe9e9e904cabb8475392d859f2d2fc21041 
(v9.0.0742)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3490 (The Checkout Field Editor (Checkout Manager) for WooCommerce 
WordPress ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-3489 (The WP Hide WordPress plugin through 0.0.2 does not have 
authorisation ...)


=
data/dsa-needed.txt
=
@@ -61,7 +61,7 @@ sox
 --
 tiff
 --
-vlc
+vlc (jmm)
   Maintainer proposed update for review, to be acked for upload
 --
 xfce4-settings (corsac)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1e706af008a48a951e49c5a8c4eaa2349df052a9

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1e706af008a48a951e49c5a8c4eaa2349df052a9
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-12-02 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
bc795767 by Moritz Muehlenhoff at 2022-12-02T15:14:36+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -3505,16 +3505,15 @@ CVE-2022-45206 (Jeecg-boot v3.4.3 was discovered to 
contain a SQL injection vuln
 CVE-2022-45205 (Jeecg-boot v3.4.3 was discovered to contain a SQL injection 
vulnerabil ...)
NOT-FOR-US: Jeecg-boot
 CVE-2022-45204 (GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to 
contain a mem ...)
-   - gpac 
-   [buster] - gpac  (EOL in buster LTS)
+   - gpac  (Vulnerable code not present in any version in 
the archive)
NOTE: https://github.com/gpac/gpac/issues/2307
NOTE: Introduced by: 
https://github.com/gpac/gpac/commit/74e53280dad7b29f85386c6a1286fb92643465da
NOTE: Fixed by: 
https://github.com/gpac/gpac/commit/f045be5809808d64ebf8ce5ab628fa55786bea4f
-   TODO: double check, but introducing commit is the fix for CVE-2022-45202
 CVE-2022-45203
RESERVED
 CVE-2022-45202 (GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to 
contain a sta ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
NOTE: https://github.com/gpac/gpac/issues/2296
NOTE: https://github.com/gpac/gpac/issues/2296#issuecomment-1303112783



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bc7957675e39777a56317d5322e533584051dcf5

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bc7957675e39777a56317d5322e533584051dcf5
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-12-02 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
46508902 by Moritz Muehlenhoff at 2022-12-02T11:41:02+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -19266,6 +19266,7 @@ CVE-2022-3168
[experimental] - android-platform-tools 33.0.3-1~exp1
- android-platform-tools 
- android-platform-system-core 
+   [bullseye] - android-platform-system-core  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/10/25/5
 CVE-2019-25076 (The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x 
through 2.1 ...)
- openvswitch  (bug #1021740)
@@ -23110,6 +23111,7 @@ CVE-2022-2991 (A heap-based buffer overflow was found 
in the Linux kernel's Ligh
NOTE: CONFIG_NVM not enabled in Debian
 CVE-2022-2990 (An incorrect handling of the supplementary groups in the 
Buildah conta ...)
- golang-github-containers-buildah 1.28.0+ds1-2
+   [bullseye] - golang-github-containers-buildah  (Minor issue)
NOTE: 
https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
NOTE: https://github.com/containers/buildah/pull/4200
NOTE: 
https://github.com/containers/buildah/commit/9934b17365083ce966b44c5ce3c7e052f516e255
 (v1.28.0)
@@ -54601,6 +54603,7 @@ CVE-2022-27652 (A flaw was found in cri-o, where 
containers were incorrectly sta
 CVE-2022-27651 (A flaw was found in buildah where containers were incorrectly 
started  ...)
[experimental] - golang-github-containers-buildah 1.27.0+ds1-2
- golang-github-containers-buildah 1.28.0+ds1-2 (bug #1009882)
+   [bullseye] - golang-github-containers-buildah  (Minor issue)
NOTE: 
https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b
 (v1.25.1)
NOTE: 
https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h
 CVE-2022-27650 (A flaw was found in crun where containers were incorrectly 
started wit ...)
@@ -86744,6 +86747,7 @@ CVE-2022-20128
[experimental] - android-platform-tools 33.0.3-1~exp1
- android-platform-tools 
- android-platform-system-core 
+   [bullseye] - android-platform-system-core  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/10/25/5
 CVE-2022-20127 (In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of 
bounds w ...)
NOT-FOR-US: Android



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4650890261b3ab4aebfd56d3ad49b2d564ec226c

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4650890261b3ab4aebfd56d3ad49b2d564ec226c
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-30 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
88861372 by Moritz Muehlenhoff at 2022-11-30T23:15:49+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -46299,6 +46299,7 @@ CVE-2022-30257 (An issue was discovered in Technitium 
DNS Server through 8.0.2 t
NOT-FOR-US: Technitium DNS Server
 CVE-2022-30256 (An issue was discovered in MaraDNS Deadwood through 3.5.0021 
that allo ...)
- maradns 
+   [bullseye] - maradns  (Minor issue)
NOTE: https://maradns.samiam.org/security.html#CVE-2022-30256
 CVE-2022-30255
RESERVED
@@ -50203,6 +50204,7 @@ CVE-2022-28949
RESERVED
 CVE-2022-28948 (An issue in the Unmarshal function in Go-Yaml v3 causes the 
program to ...)
- golang-gopkg-yaml.v3 3.0.1-1 (bug #1011338)
+   [bullseye] - golang-gopkg-yaml.v3  (Minor issue)
NOTE: https://github.com/go-yaml/yaml/issues/666
NOTE: 
https://github.com/go-yaml/yaml/commit/8f96da9f5d5eff988554c1aae1784627c4bf6754 
(v3.0.0)
 CVE-2022-28947
@@ -66056,6 +66058,7 @@ CVE-2022-23825 (Aliases in the branch predictor may 
cause some AMD processors to
NOTE: 
https://www.amd.com/system/files/documents/technical-guidance-for-mitigating-branch-type-confusion.pdf
 CVE-2022-23824 (IBPB may not prevent return branch predictions from being 
specified by ...)
- xen 4.16.2+90-g0d39a6d1ae-1
+   [bullseye] - xen  (Fix along in next DSA)
[buster] - xen  (DSA 4677-1)
NOTE: https://xenbits.xen.org/xsa/advisory-422.html
NOTE: 
https://www.amd.com/en/corporate/product-security/bulletin/amd-sb-1040



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8886137260d1520fb34f3ceec72d354a4bf14aae

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8886137260d1520fb34f3ceec72d354a4bf14aae
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-30 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
d6f78138 by Moritz Muehlenhoff at 2022-11-30T22:46:30+01:00
bullseye triage
mplayer spu

- - - - -


2 changed files:

- data/CVE/list
- data/next-point-update.txt


Changes:

=
data/CVE/list
=
@@ -1486,6 +1486,7 @@ CVE-2022-45786
 CVE-2022-4121 [Null pointer dereference in mailimap_mailbox_data_status_free 
in low-level/imap/mailimap_types.c]
RESERVED
- libetpan  (bug #1025120)
+   [bullseye] - libetpan  (Minor issue)
NOTE: https://github.com/dinhvh/libetpan/issues/420
 CVE-2022-4120
RESERVED
@@ -2959,6 +2960,7 @@ CVE-2022-45344
RESERVED
 CVE-2022-45343 (GPAC v2.1-DEV-rev478-g696e6f868-master was discovered to 
contain a hea ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
NOTE: https://github.com/gpac/gpac/issues/2315
NOTE: 
https://github.com/gpac/gpac/commit/1016912db5408b6f38e8eb715279493ae380d1c4
@@ -3341,6 +3343,7 @@ CVE-2022-3964 (A vulnerability classified as problematic 
has been found in ffmpe
 CVE-2022-45197 [missing certificate hostname validation]
RESERVED
- slixmpp 1.8.3-1
+   [bullseye] - slixmpp  (Minor issue)
NOTE: 
https://lab.louiz.org/poezio/slixmpp/-/commit/b60b1b985db928532f97c4f61d6fbc801f0aa7fa
 (slix-1.8.3)
 CVE-2022-45196 (Hyperledger Fabric 2.3 allows attackers to cause a denial of 
service ( ...)
NOT-FOR-US: Hyperledger Fabric
@@ -1,6 +4,7 @@ CVE-2022-38865 (Certain The MPlayer Project products 
are vulnerable to Divide By
NOTE: Crash in CLI tool, no security impact
 CVE-2022-38864 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
- mplayer  (bug #1021013)
+   [bullseye] - mplayer  (Minor issue, will be fixed via spu)
NOTE: https://trac.mplayerhq.hu/ticket/2406
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/36546389ef9fb6b0e0540c5c3f212534c34b0e94
 (r38391)
 CVE-2022-38863 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
@@ -22234,6 +22238,7 @@ CVE-2022-38862 (Certain The MPlayer Project products 
are vulnerable to Buffer Ov
NOTE: https://trac.mplayerhq.hu/ticket/2404
 CVE-2022-38861 (The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to 
memory  ...)
- mplayer  (bug #1021013)
+   [bullseye] - mplayer  (Minor issue, will be fixed via spu)
NOTE: https://trac.mplayerhq.hu/ticket/2407
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/2622e7fbe3605a2f3b4f74900197fefeedc0d2e1
 (r38402)
 CVE-2022-38860 (Certain The MPlayer Project products are vulnerable to Divide 
By Zero  ...)
@@ -29726,9 +29731,11 @@ CVE-2022-36181
RESERVED
 CVE-2022-36180 (Fusiondirectory 1.3 is vulnerable to Cross Site Scripting 
(XSS) via /f ...)
- fusiondirectory 
+   [bullseye] - fusiondirectory  (Minor issue)
NOTE: 
https://yoroi.company/research/cve-advisory-full-disclosure-multiple-vulnerabilities/
 CVE-2022-36179 (Fusiondirectory 1.3 suffers from Improper Session Handling. 
...)
- fusiondirectory 
+   [bullseye] - fusiondirectory  (Minor issue)
NOTE: 
https://yoroi.company/research/cve-advisory-full-disclosure-multiple-vulnerabilities/
 CVE-2022-36178
RESERVED


=
data/next-point-update.txt
=
@@ -68,3 +68,23 @@ CVE-2020-29260
[bullseye] - libvncserver 0.9.13+dfsg-2+deb11u1
 CVE-2022-39353
[bullseye] - node-xmldom 0.5.0-1+deb11u2
+CVE-2022-38866
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38865
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38864
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38863
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38861
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38860
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38858
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38855
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38851
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1
+CVE-2022-38850
+   [bullseye] - mplayer 2:1.4+ds1-1+deb11u1



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d6f78138c9925551da9bf1698da03dbd1876e772

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d6f78138c9925551da9bf1698da03dbd1876e772
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-29 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f8915d75 by Moritz Muehlenhoff at 2022-11-29T09:24:46+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -950,10 +950,10 @@ CVE-2022-45898
 CVE-2022-4144 [QXL: qxl_phys2virt unsafe address translation can lead to 
out-of-bounds read]
RESERVED
- qemu 
+   [bullseye] - qemu  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2148506
NOTE: 
https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg04143.html
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/1336
-   TODO: check details
 CVE-2022-4143
RESERVED
 CVE-2022-4142
@@ -4157,10 +4157,12 @@ CVE-2022-44794 (An issue was discovered in Object First 
1.0.7.712. Management pr
NOT-FOR-US: Object First
 CVE-2022-44793 (handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c 
in Net-S ...)
- net-snmp  (bug #1024020)
+   [bullseye] - net-snmp  (Minor issue)
NOTE: https://github.com/net-snmp/net-snmp/issues/475
NOTE: 
https://gist.github.com/menglong2234/d07a65b5028145c9f4e1d1db8c4c202f
 CVE-2022-44792 (handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in 
Net-SNMP  ...)
- net-snmp  (bug #1024020)
+   [bullseye] - net-snmp  (Minor issue)
NOTE: https://github.com/net-snmp/net-snmp/issues/474
NOTE: 
https://gist.github.com/menglong2234/b7bc13ae1a144f47cc3c95a7ea062428
 CVE-2022-44791
@@ -15353,6 +15355,7 @@ CVE-2022-3325 (Improper access control in the GitLab 
CE/EE API affecting all ver
 CVE-2022-3324 (Stack-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0. ...)
{DLA-3182-1}
- vim 2:9.0.0626-1
+   [bullseye] - vim  (Minor issue)
NOTE: https://huntr.dev/bounties/e414e55b-f332-491f-863b-c18dca97403c/
NOTE: 
https://github.com/vim/vim/commit/8279af514ca7e5fd3c31cf13b0864163d1a0bfeb 
(v9.0.0598)
 CVE-2022-3323 (An SQL injection vulnerability in Advantech iView 5.7.04.6469. 
The spe ...)
@@ -21993,8 +21996,7 @@ CVE-2022-38863 (Certain The MPlayer Project products 
are vulnerable to Buffer Ov
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/b5e745b4bfab2835103a060094fae3c6cc1ba17d
 (r38393)
NOTE: Crash in CLI tool, no security impact
 CVE-2022-38862 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
-   - mplayer  (bug #1021013)
-   [bullseye] - mplayer  (Minor issue)
+   NOTE: Unreproducible issue, probably a bug in the reporter's ASAN setup
NOTE: https://trac.mplayerhq.hu/ticket/2400
NOTE: https://trac.mplayerhq.hu/ticket/2404
 CVE-2022-38861 (The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to 
memory  ...)
@@ -35599,6 +35601,7 @@ CVE-2022-33980 (Apache Commons Configuration performs 
variable interpolation, al
 CVE-2022-2129 (Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. 
...)
{DLA-3204-1}
- vim 2:9.0.0135-1 (bug #1015984)
+   [bullseye] - vim  (Minor issue)
[stretch] - vim  (Minor issue)
NOTE: https://huntr.dev/bounties/3aaf06e7-9ae1-454d-b8ca-8709c98e5352
NOTE: 
https://github.com/vim/vim/commit/d6211a52ab9f53b82f884561ed43d2fe4d24ff7d 
(v8.2.5126)
@@ -43635,6 +43638,7 @@ CVE-2022-31009 (wire-ios is an iOS client for the Wire 
secure messaging applicat
NOT-FOR-US: wire-ios
 CVE-2022-31008 (RabbitMQ is a multi-protocol messaging and streaming broker. 
In affect ...)
- rabbitmq-server 3.10.8-1
+   [bullseye] - rabbitmq-server  (Minor issue)
[buster] - rabbitmq-server  (Vulnerable code introduced 
later)
NOTE: 
https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8
NOTE: https://github.com/rabbitmq/rabbitmq-server/pull/4841



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f8915d750e02b409853c4b5680a4968c8b996dd6

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f8915d750e02b409853c4b5680a4968c8b996dd6
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-27 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
1af13e33 by Moritz Muehlenhoff at 2022-11-27T22:45:21+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -94,6 +94,7 @@ CVE-2022-4142
RESERVED
 CVE-2022-4141 (The target's backtrace indicates that libc has detected a heap 
error o ...)
- vim 
+   [bullseye] - vim  (Minor issue)
NOTE: https://huntr.dev/bounties/20ece512-c600-45ac-8a84-d0931e05541f
NOTE: 
https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5 
(v9.0.0947)
 CVE-2022-4140
@@ -9596,6 +9597,7 @@ CVE-2022-3607 (Failure to Sanitize Special Elements into 
a Different Plane (Spec
- octoprint  (bug #718591)
 CVE-2022-3606 (A vulnerability was found in Linux Kernel. It has been 
classified as p ...)
- libbpf  (bug #1023717)
+   [bullseye] - libbpf  (Minor issue)
NOTE: Introduced by: 
https://github.com/libbpf/libbpf/commit/a3abae5122f30b83baebd4e4dd8ba4578a87cd4b
 (v0.2)
NOTE: Fixed by: 
https://github.com/libbpf/libbpf/commit/3a3ef0c1d09e1894740db71cdcb7be0bfd713671
 CVE-2022-3605
@@ -10803,6 +10805,7 @@ CVE-2022-3535 (A vulnerability classified as 
problematic was found in Linux Kern
NOTE: 
https://git.kernel.org/linus/0152dfee235e87660f52a117fc9f70dc55956bb4 (6.1-rc1)
 CVE-2022-3534 (A vulnerability classified as critical has been found in Linux 
Kernel. ...)
- libbpf  (bug #1023717)
+   [bullseye] - libbpf  (Minor issue)
NOTE: Introduced by: 
https://github.com/libbpf/libbpf/commit/7ac1547f32f060d84b06c74edbb2c6896cc07949
 (v0.2)
NOTE: Fixed by: 
https://github.com/libbpf/libbpf/commit/54caf920db0e489de90f341e2a51ddbcd084
 CVE-2022-3533 (A vulnerability was found in Linux Kernel. It has been rated as 
proble ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1af13e3376f0932c4781fd9a7241373b91e149e8

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1af13e3376f0932c4781fd9a7241373b91e149e8
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-25 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
344ee89a by Moritz Muehlenhoff at 2022-11-25T19:57:06+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -8,6 +8,7 @@ CVE-2021-43173 (In NLnet Labs Routinator prior to 
0.10.2, a validation run can b
- cfrpki 1.4.0-1
- fort-validator 1.5.3-1
- rpki-client 7.5-1
+   [bullseye] - rpki-client  (Fixed versions need more recent 
libretls)
NOTE: 
https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt
NOTE: https://github.com/NLnetLabs/routinator/pull/666
NOTE: https://github.com/NLnetLabs/routinator/pull/612
@@ -82232,6 +82233,7 @@ CVE-2021-43172 (NLnet Labs Routinator prior to 0.10.2 
happily processes a chain
- cfrpki 
[bullseye] - cfrpki  (Minor issue, revisit when fixed 
upstream)
- rpki-client 7.5-1
+   [bullseye] - rpki-client  (Fixed versions need more recent 
libretls)
NOTE: 
https://www.nlnetlabs.nl/downloads/routinator/CVE-2021-43172_CVE-2021-43173_CVE-2021-43174.txt
NOTE: https://github.com/NLnetLabs/routinator/pull/665
 CVE-2021-3917 (A flaw was found in the coreos-installer, where it writes the 
Ignition ...)
@@ -82588,6 +82590,7 @@ CVE-2021-3909 (OctoRPKI does not limit the length of a 
connection, allowing for
- cfrpki 1.4.0-1
- fort-validator 1.5.3-1
- rpki-client 7.5-1
+   [bullseye] - rpki-client  (Fixed versions need more recent 
libretls)
NOTE: 
https://github.com/cloudflare/cfrpki/security/advisories/GHSA-8cvr-4rrf-f244
 CVE-2021-3908 (OctoRPKI does not limit the depth of a certificate chain, 
allowing for ...)
{DSA-5041-1}


=
data/dsa-needed.txt
=
@@ -33,6 +33,8 @@ netatalk
 --
 nodejs
 --
+mujs (jmm)
+--
 multipath-tools
 --
 openexr
@@ -47,9 +49,6 @@ pngcheck (jmm)
 --
 rails
 --
-rpki-client
-  new 7.6 release required libretls, which isn't in Bullseye
---
 ruby-image-processing
 --
 ruby-nokogiri



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/344ee89ac27454282223c7163eeaf21496bf9dab

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/344ee89ac27454282223c7163eeaf21496bf9dab
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-24 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
a9246dbc by Moritz Muehlenhoff at 2022-11-24T16:21:02+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -8456,8 +8456,9 @@ CVE-2022-43761
RESERVED
 CVE-2022-3705 (A vulnerability was found in vim and classified as problematic. 
Affect ...)
{DLA-3182-1}
-   - vim 2:9.0.0813-1
+   - vim 2:9.0.0813-1 (unimportant)
NOTE: 
https://github.com/vim/vim/commit/d0fab10ed2a86698937e3c3fed2f10bd9bb5e731 
(v9.0.0805)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3704 (A vulnerability classified as problematic has been found in 
Ruby on Ra ...)
- rails  (bug #1024274)
NOTE: 
https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4
@@ -13413,6 +13414,7 @@ CVE-2022-41883 (TensorFlow is an open source platform 
for machine learning. When
- tensorflow  (bug #804612)
 CVE-2022-41882 (The Nextcloud Desktop Client is a tool to synchronize files 
from Nextc ...)
- nextcloud-desktop 3.6.1-1
+   [bullseye] - nextcloud-desktop  (Minor issue)
NOTE: 
https://github.com/nextcloud/security-advisories/security/advisories/GHSA-3w86-rm38-8w63
NOTE: https://github.com/nextcloud/desktop/pull/5039
NOTE: https://github.com/nextcloud/server/pull/34559
@@ -13969,9 +13971,10 @@ CVE-2022-3354 (A vulnerability has been found in 
Open5GS up to 2.4.10 and classi
 CVE-2022-3353
RESERVED
 CVE-2022-3352 (Use After Free in GitHub repository vim/vim prior to 9.0.0614. 
...)
-   - vim 2:9.0.0626-1
+   - vim 2:9.0.0626-1 (unimportant)
NOTE: https://huntr.dev/bounties/d058f182-a49b-40c7-9234-43d4c5a29f60
NOTE: 
https://github.com/vim/vim/commit/ef976323e770315b5fca544efb6b2faa25674d15 
(v9.0.0614)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3351 (An issue has been discovered in GitLab EE affecting all 
versions start ...)
- gitlab  (Only affects Gitlab EE)
 CVE-2022-3350 (The Contact Bank WordPress plugin through 3.0.30 does not 
sanitise and ...)
@@ -15153,9 +15156,10 @@ CVE-2022-3258 (Incorrect Permission Assignment for 
Critical Resource vulnerabili
 CVE-2022-3257 (Mattermost version 7.1.x and earlier fails to sufficiently 
process a s ...)
- mattermost-server  (bug #823556)
 CVE-2022-3256 (Use After Free in GitHub repository vim/vim prior to 9.0.0530. 
...)
-   - vim 2:9.0.0626-1
+   - vim 2:9.0.0626-1 (unimportant)
NOTE: https://huntr.dev/bounties/8336a3df-212a-4f8d-ae34-76ef1f936bb3
NOTE: 
https://github.com/vim/vim/commit/8ecfa2c56b4992c7f067b92488aa9acea5a454ad 
(v9.0.0530)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3255 (If an attacker can control a script that is executed in the 
victim's b ...)
NOT-FOR-US: pimcore
 CVE-2022-3254 (The WordPress Classifieds Plugin WordPress plugin before 4.3 
does not  ...)
@@ -16229,9 +16233,10 @@ CVE-2022-3236 (A code injection vulnerability in the 
User Portal and Webadmin al
 CVE-2022-40763
RESERVED
 CVE-2022-3235 (Use After Free in GitHub repository vim/vim prior to 9.0.0490. 
...)
-   - vim 2:9.0.0626-1
+   - vim 2:9.0.0626-1 (unimportant)
NOTE: https://huntr.dev/bounties/96d5f7a0-a834-4571-b73b-0fe523b941af
NOTE: 
https://github.com/vim/vim/commit/1c3dd8ddcba63c1af5112e567215b3cec2de11d0 
(v9.0.0490)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-40762 (A Memory Allocation with Excessive Size Value vulnerablity in 
the TEE_ ...)
NOT-FOR-US: Samsung mTower
 CVE-2022-40761 (The function tee_obj_free in Samsung mTower through 0.3.0 
allows a tru ...)


=
data/dsa-needed.txt
=
@@ -20,6 +20,8 @@ gerbv
 --
 graphicsmagick (jmm)
 --
+jhead
+--
 lava
 --
 linux (carnil)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a9246dbc6b2dc798cd3b97d28d06959f7c693711

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a9246dbc6b2dc798cd3b97d28d06959f7c693711
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-24 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
778bff91 by Moritz Muehlenhoff at 2022-11-24T10:51:59+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -16240,9 +16240,10 @@ CVE-2022-40755 (JasPer 3.0.6 allows denial of service 
via a reachable assertion
NOTE: https://github.com/jasper-software/jasper/issues/338
 CVE-2022-3234 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.0 ...)
{DLA-3182-1}
-   - vim 2:9.0.0626-1
+   - vim 2:9.0.0626-1 (unimportant)
NOTE: https://huntr.dev/bounties/90fdf374-bf04-4386-8a23-38c83b88f0da/
NOTE: 
https://github.com/vim/vim/commit/c249913edc35c0e666d783bfc21595cf9f7d9e0d 
(v9.0.0483)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-40754 (In Apache Airflow 2.3.0 through 2.3.4, there was an open 
redirect in t ...)
- airflow  (bug #819700)
 CVE-2022-40753 (IBM InfoSphere Information Server 11.7 is vulnerable to 
cross-site scr ...)
@@ -20604,11 +20605,11 @@ CVE-2022-3038 (Use after free in Network Service in 
Google Chrome prior to 105.0
- chromium 105.0.5195.52-1
[buster] - chromium  (see DSA 5046)
 CVE-2022-3037 (Use After Free in GitHub repository vim/vim prior to 9.0.0322. 
...)
-   - vim 2:9.0.0626-1 (bug #1019590)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:9.0.0626-1 (bug #1019590; unimportant)
[buster] - vim  (quickfixtextfunc added in 8.2.0869)
NOTE: https://huntr.dev/bounties/af4c2f2d-d754-4607-b565-9e92f3f717b5
NOTE: 
https://github.com/vim/vim/commit/4f1b083be43f351bc107541e7b0c9655a5d2c0bb 
(v9.0.0322)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3036 (The Gettext override translations WordPress plugin before 2.0.0 
does n ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-3035 (Cross-site Scripting (XSS) - Stored in GitHub repository 
snipe/snipe-i ...)
@@ -21416,11 +21417,11 @@ CVE-2022-2984 (In jpg driver, there is a possible out 
of bounds write due to a m
 CVE-2022-2983
RESERVED
 CVE-2022-2982 (Use After Free in GitHub repository vim/vim prior to 9.0.0260. 
...)
-   - vim 2:9.0.0626-1 (bug #1019590)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:9.0.0626-1 (bug #1019590; unimportant)
[buster] - vim  (quickfixtextfunc added in 8.2.0869)
NOTE: https://huntr.dev/bounties/53f53d9a-ba8a-4985-b7ba-23efbe6833be
NOTE: 
https://github.com/vim/vim/commit/d6c67629ed05aae436164eec474832daf8ba7420 
(v9.0.0260)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2981 (The Download Monitor WordPress plugin before 4.5.98 does not 
ensure th ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-2980 (NULL Pointer Dereference in GitHub repository vim/vim prior to 
9.0.025 ...)
@@ -21696,10 +21697,10 @@ CVE-2022-38648 (Server-Side Request Forgery (SSRF) 
vulnerability in Batik of Apa
NOTE: http://svn.apache.org/viewvc?view=revision=1903625
 CVE-2022-2946 (Use After Free in GitHub repository vim/vim prior to 9.0.0246. 
...)
{DLA-3182-1}
-   - vim 2:9.0.0626-1 (bug #1019590)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:9.0.0626-1 (bug #1019590; unimportant)
NOTE: https://huntr.dev/bounties/5d389a18-5026-47df-a5d0-1548a9b555d5
NOTE: 
https://github.com/vim/vim/commit/adce965162dd89bf29ee0e5baf53652e7515762c 
(v9.0.0246)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2945 (The WordPress Infinite Scroll  Ajax Load More plugin for 
WordPr ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-2944
@@ -31930,10 +31931,10 @@ CVE-2022-34894 (In JetBrains Hub before 2022.2.14799, 
insufficient access contro
NOT-FOR-US: JetBrains Hub
 CVE-2022-2285 (Integer Overflow or Wraparound in GitHub repository vim/vim 
prior to 9 ...)
{DLA-3182-1}
-   - vim 2:9.0.0135-1 (bug #1015984)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:9.0.0135-1 (bug #1015984; unimportant)
NOTE: https://huntr.dev/bounties/64574b28-1779-458d-a221-06c434042736/
NOTE: 
https://github.com/vim/vim/commit/27efc62f5d86afcb2ecb7565587fe8dea4b036fe 
(v9.0.0018)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2284 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0. ...)
- vim 2:9.0.0135-1 (unimportant)
NOTE: https://huntr.dev/bounties/571d25ce-8d53-4fa0-b620-27f2a8a14874/


=
data/dsa-needed.txt
=
@@ -68,3 +68,5 @@ sox
 --
 tiff
 --
+xfce4-settings (Corsac)
+--



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/778bff91172866ad880639e69977d7e1f83944f0

-- 
View it on GitLab:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-23 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
55038710 by Moritz Muehlenhoff at 2022-11-23T21:06:46+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -7864,6 +7864,7 @@ CVE-2022-3716 (A vulnerability classified as problematic 
was found in SourceCode
 CVE-2022-3715 [a heap-buffer-overflow in valid_parameter_transform]
RESERVED
- bash 
+   [bullseye] - bash  (Minor issue)
[buster] - bash  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2126720
NOTE: https://lists.gnu.org/archive/html/bug-bash/2022-08/msg00147.html
@@ -8590,6 +8591,7 @@ CVE-2021-46850 (myVesta Control Panel before 0.9.8-26-43 
and Vesta Control Panel
NOT-FOR-US: myVesta Control Panel
 CVE-2021-46849 (pikepdf before 2.10.0 allows an XXE attack against PDF XMP 
metadata pa ...)
- pikepdf 3.2.0+dfsg-1
+   [bullseye] - pikepdf  (Minor issue)
[buster] - pikepdf  (Minor issue)
NOTE: 
https://github.com/pikepdf/pikepdf/blob/v2.10.0/docs/release_notes.rst#v2100
 CVE-2021-46848 (GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array 
size check ...)
@@ -19642,6 +19644,7 @@ CVE-2022-39261 (Twig is a template language for PHP. 
Versions 1.x prior to 1.44.
NOTE: 
https://github.com/twigphp/Twig/commit/35f3035c5deb0041da7b84daf02dea074ddc7a0b 
(v1.44.7, v2.15.3, v3.4.3)
 CVE-2022-39260 (Git is an open source, scalable, distributed revision control 
system.  ...)
- git 1:2.38.1-1 (bug #1022046)
+   [bullseye] - git  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/10/18/5
NOTE: https://lore.kernel.org/git/xmqq4jw1uku5.fsf@gitster.g/T/#u
NOTE: 
https://github.com/git/git/commit/32696a4cbe90929ae79ea442f5102c513ce3dfaa 
(v2.30.6)
@@ -19664,6 +19667,7 @@ CVE-2022-39254 (matrix-nio is a Python Matrix client 
library, designed according
NOTE: 
https://github.com/poljar/matrix-nio/commit/b1cbf234a831daa160673defd596e6450e9c29f0
 (0.20.0)
 CVE-2022-39253 (Git is an open source, scalable, distributed revision control 
system.  ...)
- git 1:2.38.1-1 (bug #1022046)
+   [bullseye] - git  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/10/18/5
NOTE: https://lore.kernel.org/git/xmqq4jw1uku5.fsf@gitster.g/T/#u
NOTE: 
https://github.com/git/git/commit/6f054f9fb3a501c35b55c65e547a244f14c38d56 
(v2.30.6)
@@ -19723,6 +19727,7 @@ CVE-2022-39238 (Arvados is an open source platform for 
managing and analyzing bi
NOT-FOR-US: Arvados
 CVE-2022-39237 (syslabs/sif is the Singularity Image Format (SIF) reference 
implementa ...)
- golang-github-sylabs-sif  (bug #1023570)
+   [bullseye] - golang-github-sylabs-sif  (Minor issue)
- singularity-container 3.10.3+ds1-1
NOTE: 
https://github.com/sylabs/sif/security/advisories/GHSA-m5m3-46gj-wch8
NOTE: 
https://github.com/sylabs/sif/commit/21972852d8783bc93fbf080190de8e1978f1c254 
(v2.8.1)
@@ -38927,10 +38932,10 @@ CVE-2022-1969 (The Mobile browser color select plugin 
for WordPress is vulnerabl
NOT-FOR-US: Mobile browser color select plugin for WordPress
 CVE-2022-1968 (Use After Free in GitHub repository vim/vim prior to 8.2. ...)
{DLA-3182-1 DLA-3053-1}
-   - vim 2:9.0.0135-1 (bug #1015984)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:9.0.0135-1 (bug #1015984; unimportant)
NOTE: https://huntr.dev/bounties/949090e5-f4ea-4edf-bd79-cd98f0498a5b
NOTE: 
https://github.com/vim/vim/commit/409510c588b1eec1ae33511ae97a21eb8e110895 
(v8.2.5050)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-1967 (The WP Championship WordPress plugin before 9.3 is lacking CSRF 
checks ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-1966
@@ -40316,10 +40321,10 @@ CVE-2022-1899 (Out-of-bounds Read in GitHub 
repository radareorg/radare2 prior t
NOTE: 
https://github.com/radareorg/radare2/commit/193f4fe01d7f626e2ea937450f2e0c4604420e9d
 CVE-2022-1898 (Use After Free in GitHub repository vim/vim prior to 8.2. ...)
{DLA-3182-1 DLA-3053-1}
-   - vim 2:9.0.0135-1 (bug #1015984)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:9.0.0135-1 (bug #1015984; unimportant)
NOTE: https://huntr.dev/bounties/45aad635-c2f1-47ca-a4f9-db5b25979cea
NOTE: 
https://github.com/vim/vim/commit/e2fa213cf571041dbd04ab0329303ffdc980678a 
(v8.2.5024)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-1897 (Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. 
...)
- vim 2:9.0.0135-1 (bug #1015984)
[bullseye] - vim  (Minor issue)
@@ -40922,10 +40927,10 @@ CVE-2022-1852 (A NULL pointer dereference flaw was 
found in the Linux kernel
NOTE:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-23 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
70450616 by Moritz Muehlenhoff at 2022-11-23T12:29:05+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -10,6 +10,7 @@ CVE-2022-4122
RESERVED
 CVE-2021-46854 (mod_radius in ProFTPD before 1.3.7c allows memory disclosure 
to RADIUS ...)
- proftpd-dfsg 1.3.7c+dfsg-1
+   [bullseye] - proftpd-dfsg  (Minor issue)
NOTE: https://github.com/proftpd/proftpd/issues/1284
NOTE: https://github.com/proftpd/proftpd/pull/1285
NOTE: Fixed by: 
https://github.com/proftpd/proftpd/commit/10a227b4d50e0a2cd2faf87926f58d865da44e43
 (v1.3.8rc2)
@@ -42870,10 +42871,10 @@ CVE-2022-1721 (Path Traversal in WellKnownServlet in 
GitHub repository jgraph/dr
NOT-FOR-US: jgraph/drawio
 CVE-2022-1720 (Buffer Over-read in function grab_file_name in GitHub 
repository vim/v ...)
{DLA-3182-1 DLA-3053-1}
-   - vim 2:9.0.0135-1 (bug #1015984)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:9.0.0135-1 (bug #1015984; unimportant)
NOTE: https://huntr.dev/bounties/5ccfb386-7eb9-46e5-98e5-243ea4b358a8
NOTE: 
https://github.com/vim/vim/commit/395bd1f6d3edc9f7edb5d1f2d7deaf5a9e3ab93c 
(v8.2.4956)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-1719 (Reflected XSS on ticket filter function in GitHub repository 
polonel/t ...)
NOT-FOR-US: Trudesk
 CVE-2022-1718 (The trudesk application allows large characters to insert in 
the input ...)
@@ -44485,11 +44486,10 @@ CVE-2022-1622 (LibTIFF master branch has an 
out-of-bounds read in LZWDecode in l
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/410
 CVE-2022-1621 (Heap buffer overflow in vim_strncpy find_word in GitHub 
repository vim ...)
{DLA-3011-1}
-   - vim 2:9.0.0135-1 (bug #1015984)
-   [bullseye] - vim  (Minor issue)
-   [buster] - vim  (Minor issue)
+   - vim 2:9.0.0135-1 (bug #1015984; unimportant)
NOTE: https://huntr.dev/bounties/520ce714-bfd2-4646-9458-f52cd22bb2fb
NOTE: 
https://github.com/vim/vim/commit/7c824682d2028432ee082703ef0ab399867a089b 
(v8.2.4919)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2018-25033 (ADMesh through 0.98.4 has a heap-based buffer over-read in 
stl_update_ ...)
{DLA-3019-1}
- admesh 0.98.4-2 (bug #1010770)
@@ -44504,11 +44504,10 @@ CVE-2022-1620 (NULL Pointer Dereference in function 
vim_regexec_string at regexp
NOTE: Crash in CLI tool, no security impact
 CVE-2022-1619 (Heap-based Buffer Overflow in function cmdline_erase_chars in 
GitHub r ...)
{DLA-3011-1}
-   - vim 2:9.0.0135-1 (bug #1015984)
-   [bullseye] - vim  (Minor issue)
-   [buster] - vim  (Minor issue)
+   - vim 2:9.0.0135-1 (bug #1015984; unimportant)
NOTE: https://huntr.dev/bounties/b3200483-624e-4c76-a070-e246f62a7450
NOTE: 
https://github.com/vim/vim/commit/ef02f16609ff0a26ffc6e20263523424980898fe 
(v8.2.4899)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-1618
RESERVED
 CVE-2022-1617
@@ -46905,11 +46904,11 @@ CVE-2022-1422 (The Discy WordPress theme before 5.2 
does not check for CSRF toke
 CVE-2022-1421 (The Discy WordPress theme before 5.2 lacks CSRF checks in some 
AJAX ac ...)
NOT-FOR-US: WordPress theme
 CVE-2022-1420 (Use of Out-of-range Pointer Offset in GitHub repository vim/vim 
prior  ...)
-   - vim 2:8.2.4793-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4793-1 (unimportant)
[buster] - vim  (method call operator -> introduced in 
8.1.1803)
NOTE: https://huntr.dev/bounties/a4323ef8-90ea-4e1c-90e9-c778f0ecf326
NOTE: 
https://github.com/vim/vim/commit/8b91e71441069b1dde9ac9ff9d9a829b1b4aecca 
(v8.2.4774)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-46784 (In Squid 3.x through 3.5.28, 4.x through 4.17, and 5.x before 
5.6, due ...)
{DSA-5171-1}
- squid 5.6-1
@@ -51061,10 +51060,10 @@ CVE-2022-1155 (Old sessions are not blocked by the 
login enable function. in Git
- snipe-it  (bug #1005172)
 CVE-2022-1154 (Use after free in utf_ptr2char in GitHub repository vim/vim 
prior to 8 ...)
{DLA-3182-1 DLA-3011-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/7f0ec6bc-ea0e-45b0-8128-caac72d23425
NOTE: 
https://github.com/vim/vim/commit/b55986c52d4cd88a22d0b0b0e8a79547ba13e1d5 
(v8.2.4646)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-1153 (The LayerSlider WordPress plugin before 7.1.2 does not sanitise 
and es ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-1152 (The Menubar WordPress plugin before 5.8 does not sanitise and 
escape t ...)



View it on GitLab:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-21 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
a2d84d6d by Moritz Muehlenhoff at 2022-11-21T11:57:04+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -12536,6 +12536,7 @@ CVE-2022-41878 (Parse Server is an open source backend 
that can be deployed to a
NOT-FOR-US: Node parse-server
 CVE-2022-41877 (FreeRDP is a free remote desktop protocol library and clients. 
Affecte ...)
- freerdp2  (bug #1024511)
+   [bullseye] - freerdp2  (Minor issue)
[buster] - freerdp2  (Minor issue)
NOTE: 
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-pmv3-wpw4-pw5h
NOTE: 
https://github.com/FreeRDP/FreeRDP/commit/6655841cf2a00b764f855040aecb8803cfc5eaba
@@ -18704,6 +18705,7 @@ CVE-2022-39348 (Twisted is an event-based framework for 
internet applications. S
NOTE: Fixed by: 
https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b
 (twisted-22.10.0rc1)
 CVE-2022-39347 (FreeRDP is a free remote desktop protocol library and clients. 
Affecte ...)
- freerdp2  (bug #1024511)
+   [bullseye] - freerdp2  (Minor issue)
[buster] - freerdp2  (Minor issue)
NOTE: 
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5xq-8v35-pffg
NOTE: 
https://github.com/FreeRDP/FreeRDP/commit/027424c2c6c0991cb9c22f9511478229c9b17e5d
@@ -18766,24 +18768,29 @@ CVE-2022-39321 (GitHub Actions Runner is the 
application that runs a job from a
NOT-FOR-US: GitHub Actions Runner
 CVE-2022-39320 (FreeRDP is a free remote desktop protocol library and clients. 
Affecte ...)
- freerdp2  (bug #1024511)
+   [bullseye] - freerdp2  (Minor issue)
[buster] - freerdp2  (Minor issue)
NOTE: 
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-qfq2-82qr-7f4j
 CVE-2022-39319 (FreeRDP is a free remote desktop protocol library and clients. 
Affecte ...)
- freerdp2  (bug #1024511)
+   [bullseye] - freerdp2  (Minor issue)
[buster] - freerdp2  (Minor issue)
NOTE: 
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mvxm-wfj2-5fvh
NOTE: 
https://github.com/FreeRDP/FreeRDP/commit/11555828d2cf289b350baba5ad1f462f10b80b76
 CVE-2022-39318 (FreeRDP is a free remote desktop protocol library and clients. 
Affecte ...)
- freerdp2  (bug #1024511)
+   [bullseye] - freerdp2  (Minor issue)
[buster] - freerdp2  (Minor issue)
NOTE: 
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-387j-8j96-7q35
NOTE: 
https://github.com/FreeRDP/FreeRDP/commit/80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea
 CVE-2022-39317 (FreeRDP is a free remote desktop protocol library and clients. 
Affecte ...)
- freerdp2  (bug #1024511)
+   [bullseye] - freerdp2  (Minor issue)
[buster] - freerdp2  (Minor issue)
NOTE: 
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-99cm-4gw7-c8jh
 CVE-2022-39316 (FreeRDP is a free remote desktop protocol library and clients. 
In affe ...)
- freerdp2  (bug #1024511)
+   [bullseye] - freerdp2  (Minor issue)
[buster] - freerdp2  (Minor issue)
NOTE: 
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5w4j-mrrh-jjrm
NOTE: 
https://github.com/FreeRDP/FreeRDP/commit/e865c24efc40ebc52e75979c94cdd4ee2c1495b0
@@ -53747,10 +53754,10 @@ CVE-2022-0944 (Template injection in connection test 
endpoint leads to RCE in Gi
NOT-FOR-US: sqlpad
 CVE-2022-0943 (Heap-based Buffer Overflow occurs in vim in GitHub repository 
vim/vim  ...)
{DLA-3182-1 DLA-3053-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/9e4de32f-ad5f-4830-b3ae-9467b5ab90a1
NOTE: 
https://github.com/vim/vim/commit/5c68617d395f9d7b824f68475b24ce3e38d653a3 
(v8.2.4563)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-26981 (Liblouis through 3.21.0 has a buffer overflow in 
compilePassOpcode in  ...)
- liblouis 3.22.0-1 (bug #1008009)
[bullseye] - liblouis  (Minor issue)
@@ -57409,10 +57416,10 @@ CVE-2022-0730 (Under certain ldap conditions, Cacti 
authentication can be bypass
NOTE: 
https://github.com/Cacti/cacti/commit/0bb77ee9b4d1c7a99e0140b88789e050e523e628 
(1.2.x)
 CVE-2022-0729 (Use of Out-of-range Pointer Offset in GitHub repository vim/vim 
prior  ...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/f3f3d992-7bd6-4ee5-a502-ae0e5f8016ea
NOTE: 
https://github.com/vim/vim/commit/6456fae9ba8e72c74b2c0c499eaf09974604ff30 
(v8.2.4440)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-0728 (The Easy Smooth Scroll

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-18 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
7cc7c9f5 by Moritz Muehlenhoff at 2022-11-18T13:08:06+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -7611,6 +7611,7 @@ CVE-2022-43706
 CVE-2022-43705 [malicious OCSP responder could forge OCSP responses]
RESERVED
- botan 2.19.3+dfsg-1
+   [bullseye] - botan  (Minor issue)
NOTE: 
https://github.com/randombit/botan/security/advisories/GHSA-4v9w-qvcq-6q7w
NOTE: 
https://github.com/randombit/botan/commit/fd83d9e262f63fb673e4c13ca37e5b768e41e812
 (2.19.3)
NOTE: 
https://github.com/randombit/botan/commit/4e35073ff356e37c3adcf1ff3522e9d0d48c765f
 (2.19.3)
@@ -61584,10 +61585,10 @@ CVE-2022-0444 (The Backup, Restore and Migrate 
WordPress Sites With the XCloner
NOT-FOR-US: WordPress plugin
 CVE-2022-0443 (Use After Free in GitHub repository vim/vim prior to 8.2. ...)
{DLA-3182-1 DLA-3011-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/b987c8cb-bbbe-4601-8a6c-54ff907c6b51
NOTE: 
https://github.com/vim/vim/commit/9b4a80a66544f2782040b641498754bcb5b8d461 
(v8.2.4281)
+   NOTE: Crash in CLI tool, no security issue
 CVE-2022-0442 (The UsersWP WordPress plugin before 1.2.3.1 is missing access 
controls ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-0441 (The MasterStudy LMS WordPress plugin before 2.7.6 does to 
validate som ...)
@@ -62126,10 +62127,10 @@ CVE-2022-0414 (Business Logic Errors in Packagist 
dolibarr/dolibarr prior to 16.
- dolibarr 
 CVE-2022-0413 (Use After Free in GitHub repository vim/vim prior to 8.2. ...)
{DLA-3182-1 DLA-3011-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/563d1e8f-5c3d-4669-941c-3216f4a87c38
NOTE: 
https://github.com/vim/vim/commit/37f47958b8a2a44abc60614271d9537e7f14e51a 
(v8.2.4253)
+   NOTE: Crash in CLI tool, no security issue
 CVE-2022-0412 (The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI 
WooComm ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-0411 (The Asgaros Forum WordPress plugin before 2.0.0 does not 
sanitise and  ...)
@@ -62163,17 +62164,17 @@ CVE-2022-0409 (Unrestricted Upload of File with 
Dangerous Type in Packagist show
NOT-FOR-US: ShowDoc
 CVE-2022-0408 (Stack-based Buffer Overflow in GitHub repository vim/vim prior 
to 8.2. ...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/5e635bad-5cf6-46cd-aeac-34ef224e179d
NOTE: 
https://github.com/vim/vim/commit/06f15416bb8d5636200a10776f1752c4d6e49f31 
(v8.2.4247)
+   NOTE: Crash in CLI tool, no security issue
 CVE-2022-0407 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 8.2. ...)
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
[buster] - vim  (The vulnerable code is not present)
[stretch] - vim  (The vulnerable code is not present)
NOTE: https://huntr.dev/bounties/81822bf7-aafe-4d37-b836-1255d46e572c
NOTE: 
https://github.com/vim/vim/commit/44db8213d38c39877d2148eff6a72f4beccfb94e 
(v8.2.4219)
+   NOTE: Crash in CLI tool, no security issue
 CVE-2022-24112 (An attacker can abuse the batch-requests plugin to send 
requests to by ...)
NOT-FOR-US: Apache APISIX
 CVE-2022-0406 (Improper Authorization in GitHub repository 
janeczku/calibre-web prior ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7cc7c9f5537e1adfe0f913407ad2a39bc41b82bb

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7cc7c9f5537e1adfe0f913407ad2a39bc41b82bb
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-16 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
d82dbd02 by Moritz Muehlenhoff at 2022-11-16T11:04:49+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -9888,6 +9888,7 @@ CVE-2022-3462 (The Highlight Focus WordPress plugin 
through 1.1 does not sanitis
NOT-FOR-US: WordPress plugin
 CVE-2022-42889 (Apache Commons Text performs variable interpolation, allowing 
properti ...)
- commons-text 1.10.0-1 (bug #1021787)
+   [bullseye] - commons-text  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/10/13/4
NOTE: 
https://securitylab.github.com/advisories/GHSL-2022-018_Apache_Commons_Text/
NOTE: https://blogs.apache.org/security/entry/cve-2022-42889
@@ -62120,12 +62121,12 @@ CVE-2022-0395 (Cross-site Scripting (XSS) - Stored in 
Packagist remdex/livehelpe
 CVE-2022-0394 (Cross-site Scripting (XSS) - Stored in Packagist 
remdex/livehelperchat ...)
NOT-FOR-US: livehelperchat
 CVE-2022-0393 (Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. 
...)
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
[buster] - vim  (The vulnerable code is not present)
[stretch] - vim  (The vulnerable code is not present)
NOTE: https://huntr.dev/bounties/ecc8f488-01a0-477f-848f-e30b8e524bba
NOTE: 
https://github.com/vim/vim/commit/a4bc2dd7cccf5a4a9f78b58b6f35a45d17164323 
(v8.2.4233)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-24069 (An issue was discovered in AhciBusDxe in Insyde InsydeH2O with 
kernel  ...)
NOT-FOR-US: Insyde
 CVE-2022-24064 (This vulnerability allows remote attackers to execute 
arbitrary code o ...)
@@ -62728,10 +62729,10 @@ CVE-2022-21184 (An information disclosure 
vulnerability exists in the License re
NOT-FOR-US: Bachmann Visutec GmbH Atvise
 CVE-2022-0368 (Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. 
...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/bca9ce1f-400a-4bf9-9207-3f3187cb3fa9/
NOTE: 
https://github.com/vim/vim/commit/8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa 
(v8.2.4217)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-0367 (A heap-based buffer overflow flaw was found in libmodbus in 
function m ...)
{DLA-3098-1}
- libmodbus 3.1.6-2.1 (bug #1021270)
@@ -63650,17 +63651,16 @@ CVE-2022-0320 (The Essential Addons for Elementor 
WordPress plugin before 5.0.5
NOT-FOR-US: WordPress plugin
 CVE-2022-0319 (Out-of-bounds Read in vim/vim prior to 8.2. ...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/ba622fd2-e6ef-4ad9-95b4-17f87b68755b
NOTE: 
https://github.com/vim/vim/commit/05b27615481e72e3b338bb12990fb3e0c2ecc2a9 
(v8.2.4154)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-0318 (Heap-based Buffer Overflow in vim/vim prior to 8.2. ...)
-   - vim 2:8.2.4659-1 (bug #1004859)
-   [bullseye] - vim  (Minor issue)
-   [buster] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (bug #1004859; unimportant)
[stretch] - vim  (Fix introduces a test regression)
NOTE: https://huntr.dev/bounties/0d10ba02-b138-4e68-a284-67f781a62d08
NOTE: 
https://github.com/vim/vim/commit/57df9e8a9f9ae1aafdde9b86b10ad907627a87dc 
(v8.2.4151)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-0317 (An improper input validation vulnerability in go-attestation 
before 0. ...)
NOT-FOR-US: go-attestation
 CVE-2022-0316
@@ -67546,9 +67546,10 @@ CVE-2022-0139 (Use After Free in GitHub repository 
radareorg/radare2 prior to 5.
 CVE-2022-0138 (MMP: All versions prior to v1.0.3, PTP C-series: Device 
versions prior ...)
NOT-FOR-US: Airspan Networks
 CVE-2022-0137 (A heap buffer overflow in image_set_mask function of HTMLDOC 
before 1. ...)
-   - htmldoc 1.9.15-1
+   - htmldoc 1.9.15-1 (unimportant)
NOTE: https://github.com/michaelrsweet/htmldoc/issues/461
NOTE: Fixed by: 
https://github.com/michaelrsweet/htmldoc/commit/71fe87878c9cbc3db429f5e5c70f28e4b3d96e3b
 (v1.9.15)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-0136 (A vulnerability was discovered in GitLab versions 10.5 to 
14.5.4, 14.6 ...)
- gitlab 
 CVE-2022-0135 (An out-of-bounds write issue was found in the VirGL virtual 
OpenGL ren ...)


=
data/dsa-needed.txt
=
@@ -26,6 +26,8 @@ heimdal (carnil)
 --
 jackson-databind (apo)
 --
+krb5
+--
 linux (carnil)
   Wait

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-14 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f5311755 by Moritz Muehlenhoff at 2022-11-14T10:35:38+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -6,10 +6,12 @@ CVE-2022-45199 (Pillow before 9.3.0 allows denial of service 
via SAMPLESPERPIXEL
NOTE: https://github.com/python-pillow/Pillow/pull/6700
 CVE-2022-45198 (Pillow before 9.2.0 performs Improper Handling of Highly 
Compressed GI ...)
- pillow 9.2.0-1
+   [bullseye] - pillow  (Minor issue)
NOTE: 
https://github.com/python-pillow/Pillow/commit/11918eac0628ec8ac0812670d9838361ead2d6a4
 (9.2.0)
NOTE: https://github.com/python-pillow/Pillow/pull/6402
 CVE-2022-3979 (A vulnerability was found in NagVis up to 1.9.33 and classified 
as pro ...)
- nagvis 1:1.9.34-1
+   [bullseye] - nagvis  (Minor issue)
NOTE: 
https://github.com/NagVis/nagvis/commit/7574fd8a2903282c2e0d1feef5c4876763db21d5
 (nagvis-1.9.34)
 CVE-2022-3978 (A vulnerability, which was classified as problematic, was found 
in Nod ...)
TODO: check
@@ -64660,10 +64662,10 @@ CVE-2022-0214 (The Popup | Custom Popup Builder 
WordPress plugin before 1.3.1 au
NOT-FOR-US: WordPress plugin
 CVE-2022-0213 (vim is vulnerable to Heap-based Buffer Overflow ...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/f3afe1a5-e6f8-4579-b68a-6e5c7e39afed
NOTE: Fixed by: 
https://github.com/vim/vim/commit/de05bb25733c3319e18dca44e9b59c6ee389eb26 
(v8.2.4074)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-0212 (The SpiderCalendar WordPress plugin through 1.5.65 does not 
sanitise a ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-0211 (The Shield Security WordPress plugin before 13.0.6 does not 
sanitise a ...)
@@ -66031,12 +66033,12 @@ CVE-2021-23154 (In Lens prior to 5.3.4, custom helm 
chart configuration creates
 CVE-2022-0159 (orchardcore is vulnerable to Improper Neutralization of Input 
During W ...)
NOT-FOR-US: orchardcore
 CVE-2022-0158 (vim is vulnerable to Heap-based Buffer Overflow ...)
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
[buster] - vim  (The vulnerable code was introduced later)
[stretch] - vim  (The vulnerable code was introduced 
later)
NOTE: https://huntr.dev/bounties/ac5d7005-07c6-4a0a-b251-ba9cdbf6738b/
NOTE: 
https://github.com/vim/vim/commit/5f25c3855071bd7e26255c68bf458b1b5cf92f39 
(v8.2.4049)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-0157 (phoronix-test-suite is vulnerable to Improper Neutralization of 
Input  ...)
- phoronix-test-suite 
 CVE-2022-22848
@@ -66098,12 +66100,10 @@ CVE-2021-46164 (Zoho ManageEngine Desktop Central 
before 10.0.662 allows remote
 CVE-2021-46163 (Kentico Xperience 13.0.44 allows XSS via an XML document to 
the Media  ...)
NOT-FOR-US: Kentico Xperience CMS
 CVE-2022-0156 (vim is vulnerable to Use After Free ...)
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
-   [buster] - vim  (Minor issue)
-   [stretch] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/47dded34-3767-4725-8c7c-9dcb68c70b36
NOTE: 
https://github.com/vim/vim/commit/9f1a39a5d1cd7989ada2d1cb32f97d84360e050f 
(v8.2.4040)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-22827 (storeAtts in xmlparse.c in Expat (aka libexpat) before 2.4.3 
has an in ...)
{DSA-5073-1 DLA-2904-1}
- expat 2.4.3-1 (bug #1003474)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f5311755dd15aa1f9b32c7030fb46b1931cd5dbf

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f5311755dd15aa1f9b32c7030fb46b1931cd5dbf
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-13 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
7e7e3697 by Moritz Muehlenhoff at 2022-11-13T19:19:20+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -114,9 +114,9 @@ CVE-2022-3959 (A vulnerability, which was classified as 
problematic, has been fo
 CVE-2022-3958
RESERVED
 CVE-2022-3957 (A vulnerability classified as problematic was found in GPAC. 
Affected  ...)
-   - gpac 
-   [buster] - gpac  (EOL in buster LTS)
+   - gpac  (unimportant)
NOTE: 
https://github.com/gpac/gpac/commit/2191e66aa7df750e8ef01781b1930bea87b713bb
+   NOTE: Negligible security impact
 CVE-2022-3956 (A vulnerability classified as critical has been found in 
tsruban HHIMS ...)
NOT-FOR-US: tsruban HHIMS
 CVE-2022-3955 (A vulnerability was found in tholum crm42. It has been rated as 
critic ...)
@@ -56788,12 +56788,10 @@ CVE-2022-0698
 CVE-2022-0697 (Open Redirect in GitHub repository archivy/archivy prior to 
1.7.0. ...)
NOT-FOR-US: Archivy
 CVE-2022-0696 (NULL Pointer Dereference in GitHub repository vim/vim prior to 
8.2.442 ...)
-   - vim 2:8.2.4659-1
-   [bullseye] - vim  (Minor issue)
-   [buster] - vim  (Minor issue)
-   [stretch] - vim  (Minor issue)
+   - vim 2:8.2.4659-1 (unimportant)
NOTE: https://huntr.dev/bounties/7416c2cb-1809-4834-8989-e84ff033f15f/
NOTE: 
https://github.com/vim/vim/commit/0f6e28f686dbb59ab3b562408ab9b2234797b9b1 
(v8.2.4428)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-0695 (Denial of Service in GitHub repository radareorg/radare2 prior 
to 5.6. ...)
- radare2  (bug #1014478)
NOTE: https://huntr.dev/bounties/bdbddc0e-fb06-4211-a90b-7cbedcee2bea



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e7e3697de7a93032b4ce640aef6497234433375

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7e7e3697de7a93032b4ce640aef6497234433375
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-11 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
a89b938c by Moritz Muehlenhoff at 2022-11-11T16:05:36+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -367,6 +367,7 @@ CVE-2022-3873 (Cross-site Scripting (XSS) - DOM in GitHub 
repository jgraph/draw
NOT-FOR-US: jgraph/drawio
 CVE-2022-3872 (An off-by-one read/write issue was found in the SDHCI device of 
QEMU.  ...)
- qemu 
+   [bullseye] - qemu  (Minor issue)
[buster] - qemu  (Minor issue, DoS, waiting for sanctioned 
patch)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2140567
NOTE: patch proposal 1: 
https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.html
@@ -8623,6 +8624,7 @@ CVE-2022-42919 (Python 3.9.x and 3.10.x through 3.10.8 on 
Linux allows local pri
- python3.11 3.11.0-2
- python3.10 3.10.8-2
- python3.9 
+   [bullseye] - python3.9  (Minor issue)
- python3.7 
[buster] - python3.7  (Vulnerable functionality 
backported later in 3.7.8)
NOTE: https://github.com/python/cpython/issues/97514
@@ -17202,6 +17204,7 @@ CVE-2022-39378 (Discourse is a platform for community 
discussion. Under certain
NOT-FOR-US: Discourse
 CVE-2022-39377 (sysstat is a set of system performance tools for the Linux 
operating s ...)
- sysstat  (bug #1023832)
+   [bullseye] - sysstat  (Minor issue)
NOTE: 
https://github.com/sysstat/sysstat/security/advisories/GHSA-q8r6-g56f-9w7x
NOTE: 
https://github.com/sysstat/sysstat/commit/9c4eaf150662ad40607923389d4519bc83b93540
 (v12.7.1)
 CVE-2022-39376 (GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI 
is a Fre ...)
@@ -68232,16 +68235,16 @@ CVE-2021-4194 (bookstack is vulnerable to Improper 
Access Control ...)
NOT-FOR-US: bookstack
 CVE-2021-4193 (vim is vulnerable to Out-of-bounds Read ...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.3995-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.3995-1 (unimportant)
NOTE: https://huntr.dev/bounties/92c1940d-8154-473f-84ce-0de43b0c2eb0
NOTE: Fixed by: 
https://github.com/vim/vim/commit/94f3192b03ed27474db80b4d3a409e107140738b 
(v8.2.3950)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-4192 (vim is vulnerable to Use After Free ...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.3995-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.3995-1 (unimportant)
NOTE: https://huntr.dev/bounties/6dd9cb2e-a940-4093-856e-59b502429f22
NOTE: Fixed by: 
https://github.com/vim/vim/commit/4c13e5e6763c6eb36a343a2b8235ea227202e952 
(v8.2.3949)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-4191 (An issue has been discovered in GitLab CE/EE affecting versions 
13.0 t ...)
[experimental] - gitlab 14.6.5+ds1
- gitlab 
@@ -69568,12 +69571,10 @@ CVE-2021-45476 (Yordam Library Information Document 
Automation product before ve
 CVE-2021-45475 (Yordam Library Information Document Automation product before 
version  ...)
NOT-FOR-US: Yordam Library Information Document Automation
 CVE-2021-4166 (vim is vulnerable to Out-of-bounds Read ...)
-   - vim 2:8.2.3995-1
-   [bullseye] - vim  (Minor issue)
-   [buster] - vim  (Minor issue)
-   [stretch] - vim  (Minor issue)
+   - vim 2:8.2.3995-1 (unimportant)
NOTE: https://huntr.dev/bounties/229df5dd-5507-44e9-832c-c70364bdf035
NOTE: 
https://github.com/vim/vim/commit/6f98371532fcff911b462d51bc64f2ce8a6ae682 
(v8.2.3884)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-4165
RESERVED
 CVE-2021-4164 (calibre-web is vulnerable to Cross-Site Request Forgery (CSRF) 
...)
@@ -71185,13 +71186,13 @@ CVE-2021-44462 (This vulnerability can be exploited 
by parsing maliciously craft
 CVE-2021-4137
RESERVED
 CVE-2021-4136 (vim is vulnerable to Heap-based Buffer Overflow ...)
-   - vim 2:8.2.3995-1 (bug #1002534)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.3995-1 (bug #1002534; unimportant)
[buster] - vim  (Vulnerable code introduced later)
[stretch] - vim  (Vulnerable code introduced later)
NOTE: https://huntr.dev/bounties/5c6b93c1-2d27-4e98-a931-147877b8c938
NOTE: Introduced by: 
https://github.com/vim/vim/commit/2949cfdbe4335b9abcfeda1be4dfc52090ee1df6 
(v8.2.2257)
NOTE: Fixed by: 
https://github.com/vim/vim/commit/605ec91e5a7330d61be313637e495fa02a6dc264 
(v8.2.3847)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-4135 (A memory leak vulnerability was found in the Linux kernel's 
eBPF for t ...)
{DSA-5096-1 DLA-2941-1}
- linux 5.15.15-1 (unimportant)
@@ -73239,10 +73240,10 @@ CVE-2021-44549 (Apache Sling Commons Messaging Mail 
provides a simple

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-09 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
237bccab by Moritz Muehlenhoff at 2022-11-09T14:13:56+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -9,6 +9,7 @@ CVE-2022-45061 (An issue was discovered in Python before 
3.11.1. An unnecessary
- python3.11 
- python3.10 
- python3.9 
+   [bullseye] - python3.9  (Minor issue)
- python3.7 
NOTE: https://github.com/python/cpython/issues/98433
NOTE: https://github.com/python/cpython/pull/99092
@@ -70366,6 +70367,7 @@ CVE-2021-45267 (An invalid memory address dereference 
vulnerability exists in gp
NOTE: 
https://github.com/gpac/gpac/commit/29f31f431b18278b94c659452562e8a027436487 
(v2.0.0)
 CVE-2021-45266 (A null pointer dereference vulnerability exists in gpac 1.1.0 
via the  ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1985
@@ -70376,12 +70378,14 @@ CVE-2021-45264
RESERVED
 CVE-2021-45263 (An invalid free vulnerability exists in gpac 1.1.0 via the 
gf_svg_dele ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1975
NOTE: 
https://github.com/gpac/gpac/commit/b232648da3b111a0efe500501ee8ca8f32b616e9 
(v2.0.0)
 CVE-2021-45262 (An invalid free vulnerability exists in gpac 1.1.0 via the 
gf_sg_comma ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1980
@@ -75022,12 +75026,12 @@ CVE-2021-3970 (A potential vulnerability in 
LenovoVariable SMI Handler due to in
 CVE-2021-3969 (A Time of Check Time of Use (TOCTOU) vulnerability was reported 
in IMC ...)
NOT-FOR-US: Lenovo
 CVE-2021-3968 (vim is vulnerable to Heap-based Buffer Overflow ...)
-   - vim 2:8.2.3995-1 (bug #1001900)
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.3995-1 (unimportant; bug #1001900)
[buster] - vim  (The vulnerable code is not present)
[stretch] - vim  (The vulnerable code is not present)
NOTE: https://huntr.dev/bounties/00d62924-a7b4-4a61-ba29-acab2eaa1528/
NOTE: 
https://github.com/vim/vim/commit/a062006b9de0b2947ab5fb376c6e67ef92a8cd69 
(v8.2.3610)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-21741 (Tensorflow is an Open Source Machine Learning Framework. ### 
Impact An ...)
- tensorflow  (bug #804612)
 CVE-2022-21740 (Tensorflow is an Open Source Machine Learning Framework. The 
implement ...)
@@ -77963,16 +77967,16 @@ CVE-2021-43358 (Sunnet eHRD has inadequate filtering 
for special characters in U
NOT-FOR-US: Sunnet eHRD
 CVE-2021-3928 (vim is vulnerable to Use of Uninitialized Variable ...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.3995-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.3995-1 (unimportant)
NOTE: https://huntr.dev/bounties/29c3ebd2-d601-481c-bf96-76975369d0cd
NOTE: Fixed by: 
https://github.com/vim/vim/commit/15d9890eee53afc61eb0a03b878a19cb5672f732 
(v8.2.3582)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-3927 (vim is vulnerable to Heap-based Buffer Overflow ...)
{DLA-3182-1 DLA-2947-1}
-   - vim 2:8.2.3995-1
-   [bullseye] - vim  (Minor issue)
+   - vim 2:8.2.3995-1 (unimportant)
NOTE: https://huntr.dev/bounties/9c2b2c82-48bb-4be9-ab8f-a48ea252d1b0
NOTE: Fixed by: 
https://github.com/vim/vim/commit/0b5b06cb4777d1401fdf83e7d48d287662236e7e 
(v8.2.3581)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2021-43357
RESERVED
 CVE-2021-43350 (An unauthenticated Apache Traffic Control Traffic Ops user can 
send a  ...)
@@ -79915,12 +79919,11 @@ CVE-2021-3904 (grav is vulnerable to Improper 
Neutralization of Input During Web
NOT-FOR-US: Grav CMS
 CVE-2021-3903 (vim is vulnerable to Heap-based Buffer Overflow ...)
{DLA-3053-1}
-   - vim 2:8.2.3565-1
-   [bullseye] - vim  (Minor issue)
-   [buster] - vim  (Minor issue)
+   - vim 2:8.2.3565-1 (unimportant)
NOTE: https://huntr.dev/bounties/35738a4f-55ce-446c-b836-2fb0b39625f8
NOTE: 
https://github.com/vim/vim/commit/777e7c21b7627be80961848ac560cb0a9978ff43
NOTE: PoC crashes starting with 
https://github.com/vim/vim/commit/8a7d6542b33e5d2b352262305c3bfdb2d14e1cf8 
(v8.2.0149)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2020-36503 (The Connections Business Directory WordPress plugin before 9.7 
does

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-09 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
1e1b50cb by Moritz Muehlenhoff at 2022-11-09T11:54:20+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -2177,6 +2177,7 @@ CVE-2022-3822
RESERVED
 CVE-2022-3821 (An off-by-one Error issue was discovered in Systemd in 
format_timespan ...)
- systemd 251.3-1
+   [bullseye] - systemd  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2139327
NOTE: https://github.com/systemd/systemd/issues/23928
NOTE: https://github.com/systemd/systemd/pull/23933
@@ -19868,9 +19869,10 @@ CVE-2022-2891 (The WP 2FA WordPress plugin before 
2.3.0 uses comparison operator
 CVE-2022-2890 (Cross-site Scripting (XSS) - Stored in GitHub repository 
yetiforcecomp ...)
NOT-FOR-US: yetiforcecrm
 CVE-2022-2889 (Use After Free in GitHub repository vim/vim prior to 9.0.0225. 
...)
-   - vim 2:9.0.0229-1
+   - vim 2:9.0.0229-1 (unimportant)
NOTE: https://huntr.dev/bounties/d1ac9817-825d-49ce-b514-1d5b12b6bdaa
NOTE: 
https://github.com/vim/vim/commit/91c7cbfe31bbef57d5fcf7d76989fc159f73ef15 
(v9.0.0225)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2888 (If an attacker comes into the possession of a victim's 
OctoPrint sessi ...)
- octoprint  (bug #718591)
 CVE-2022-2887 (The WP Server Health Stats WordPress plugin before 1.7.0 does 
not esca ...)
@@ -20003,10 +20005,11 @@ CVE-2022-2864 (The demon image annotation plugin for 
WordPress is vulnerable to
 CVE-2022-2863 (The Migration, Backup, Staging WordPress plugin before 0.9.76 
does not ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-2862 (Use After Free in GitHub repository vim/vim prior to 9.0.0221. 
...)
-   - vim 2:9.0.0229-1
+   - vim 2:9.0.0229-1 (unimportant)
[buster] - vim  (The vulnerable code was introduced later)
NOTE: https://huntr.dev/bounties/71180988-1ab6-4311-bca8-e9a879b06765
NOTE: 
https://github.com/vim/vim/commit/1889f499a4f248cd84e0e0bf6d0d820016774494 
(v9.0.0221)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2861 (Inappropriate implementation in Extensions API in Google Chrome 
prior  ...)
{DSA-5212-1}
- chromium 104.0.5112.101-1
@@ -20290,10 +20293,11 @@ CVE-2022-2821 (Missing Critical Step in 
Authentication in GitHub repository name
 CVE-2022-2820 (Improper Access Control in GitHub repository 
namelessmc/nameless prior ...)
NOT-FOR-US: NamelessMC/Nameless
 CVE-2022-2819 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.0 ...)
-   - vim 2:9.0.0229-1
+   - vim 2:9.0.0229-1 (unimportant)
[buster] - vim  (The vulnerable code was introduced later)
NOTE: https://huntr.dev/bounties/0a9bd71e-66b8-4eb1-9566-7dfd9b097e59
NOTE: 
https://github.com/vim/vim/commit/d1d8f6bacb489036d0fd479c9dd3c0102c99 
(v9.0.0211)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2818 (Authentication Bypass by Primary Weakness in GitHub repository 
cockpit ...)
NOT-FOR-US: Cockpit-HQ/Cockpit
 CVE-2022-38305 (AeroCMS v0.0.1 was discovered to contain an arbitrary file 
upload vuln ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1e1b50cbbbf564362adeec21bc0cdf185cbcef3e

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1e1b50cbbbf564362adeec21bc0cdf185cbcef3e
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-07 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
72eca0ba by Moritz Muehlenhoff at 2022-11-07T17:40:29+01:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -7908,6 +7908,7 @@ CVE-2022-3552 (Unrestricted Upload of File with Dangerous 
Type in GitHub reposit
NOT-FOR-US: boxbilling
 CVE-2022-3551 (A vulnerability, which was classified as problematic, has been 
found i ...)
- xorg-server 
+   [bullseye] - xorg-server  (Minor issue)
- xwayland 
NOTE: 
https://gitlab.freedesktop.org/xorg/xserver/commit/18f91b950e22c2a342a4fbc55e9ddf7534a707d2
 CVE-2022-3550 (A vulnerability classified as critical was found in X.org 
Server. Affe ...)
@@ -12258,7 +12259,9 @@ CVE-2022-3276 (Command injection is possible in the 
puppetlabs-mysql module prio
NOTE: 
https://github.com/puppetlabs/puppetlabs-mysql/commit/e70e7fd130aaa2fe1cefe4ccb628b304ad3c180a
 (v13.0.0)
 CVE-2022-3275 (Command injection is possible in the puppetlabs-apt module 
prior to ve ...)
- puppet-module-puppetlabs-apt 
+   [bullseye] - puppet-module-puppetlabs-apt  (Minor issue)
NOTE: https://puppet.com/security/cve/CVE-2022-3275
+   NOTE: 
https://github.com/puppetlabs/puppetlabs-apt/commit/c26ad2a54f318b4d6fbe55f837b00cd6afd9f1eb
 CVE-2022-3274 (Cross-Site Request Forgery (CSRF) in GitHub repository 
ikus060/rdiffwe ...)
- rdiffweb  (bug #969974)
 CVE-2022-3273 (Allocation of Resources Without Limits or Throttling in GitHub 
reposit ...)
@@ -20310,9 +20313,10 @@ CVE-2022-38219
 CVE-2022-38218
RESERVED
 CVE-2022-2817 (Use After Free in GitHub repository vim/vim prior to 9.0.0213. 
...)
-   - vim 2:9.0.0229-1
+   - vim 2:9.0.0229-1 (unimportant)
NOTE: https://huntr.dev/bounties/a7b7d242-3d88-4bde-a681-6c986aff886f
NOTE: 
https://github.com/vim/vim/commit/249e1b903a9c0460d618f6dcc59aeb8c03b24b20 
(v9.0.0213)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2816 (Out-of-bounds Read in GitHub repository vim/vim prior to 
9.0.0212. ...)
- vim 2:9.0.0229-1 (unimportant)
NOTE: https://huntr.dev/bounties/e2a83037-fcf9-4218-b2b9-b7507dacde58
@@ -22822,9 +22826,10 @@ CVE-2022-2600 (The Auto-hyperlink URLs WordPress 
plugin through 5.4.1 does not s
 CVE-2022-2599 (The Anti-Malware Security and Brute-Force Firewall WordPress 
plugin be ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-2598 (Undefined Behavior for Input to API in GitHub repository 
vim/vim prior ...)
-   - vim 2:9.0.0135-1
+   - vim 2:9.0.0135-1 (unimportant)
NOTE: https://huntr.dev/bounties/2f08363a-47a2-422d-a7de-ce96a89ad08e/
NOTE: 
https://github.com/vim/vim/commit/4e677b9c40ccbc5f090971b31dc2fe07bf05541d 
(v9.0.0101)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2597 (The Visual Portfolio, Photo Gallery  Post Grid WordPress 
plugin b ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-2596 (Denial of Service in GitHub repository node-fetch/node-fetch 
prior to  ...)
@@ -23554,9 +23559,10 @@ CVE-2022-37014
 CVE-2022-2572 (In affected versions of Octopus Server where access is managed 
by an e ...)
NOT-FOR-US: Octopus Server
 CVE-2022-2571 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.0 ...)
-   - vim 2:9.0.0135-1
+   - vim 2:9.0.0135-1 (unimportant)
NOTE: https://huntr.dev/bounties/2e5a1dc4-2dfb-4e5f-8c70-e1ede21f3571/
NOTE: 
https://github.com/vim/vim/commit/a6f9e300161f4cb54713da22f65b261595e8e614 
(v9.0.0102)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2570
RESERVED
 CVE-2022-37013
@@ -24941,9 +24947,10 @@ CVE-2022-34147
 CVE-2022-31137 (Roxy-WI is a web interface for managing Haproxy, Nginx, Apache 
and Kee ...)
NOT-FOR-US: Roxy-WI
 CVE-2022-2522 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.0 ...)
-   - vim 2:9.0.0135-1 (bug #1016068)
+   - vim 2:9.0.0135-1 (unimportant; bug #1016068)
NOTE: https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22
NOTE: 
https://github.com/vim/vim/commit/5fa9f23a63651a8abdb074b4fc2ec9b1adc6b089 
(v9.0.0061)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2521 (It was found in libtiff 4.4.0rc1 that there is an invalid 
pointer free ...)
- tiff  (unimportant)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/422
@@ -88172,8 +88179,9 @@ CVE-2021-40243
 CVE-2021-40242
RESERVED
 CVE-2021-40241 (xfig 3.2.7 is vulnerable to Buffer Overflow. ...)
-   - xfig 1:3.2.8a-1 (bug #992395)
+   - xfig 1:3.2.8a-1 (unimportant; bug #992395)
NOTE: https://sourceforge.net/p/mcj/tickets/136/
+   NOTE: No security impact
 CVE-2021-40240
RESERVED
 CVE-2021-40239 (A Buffer Overflow vulnerability exists in the latest version 
of

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-11-02 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
5ab6f8f3 by Moritz Muehlenhoff at 2022-11-02T10:04:12+01:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -6239,6 +6239,7 @@ CVE-2022-3480
RESERVED
 CVE-2022-3479 (A vulnerability found in nss. By this security vulnerability, 
nss clie ...)
- nss  (bug #1021786)
+   [bullseye] - nss  (Minor issue)
[buster] - nss  (The vulnerable code was introduced later)
NOTE: https://bugzilla.mozilla.org/show_bug.cgi?id=1774654
 CVE-2022-42907
@@ -6268,6 +6269,7 @@ CVE-2022-3478
RESERVED
 CVE-2022-42906 (powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 
allows arbi ...)
- powerline-gitstatus 1.3.2-1
+   [bullseye] - powerline-gitstatus  (Minor issue)
NOTE: https://github.com/jaspernbrouwer/powerline-gitstatus/issues/45
NOTE: https://github.com/jaspernbrouwer/powerline-gitstatus/pull/46
 CVE-2022-42896
@@ -16052,9 +16054,9 @@ CVE-2022-38858 (Certain The MPlayer Project products 
are vulnerable to Buffer Ov
 CVE-2022-38857
RESERVED
 CVE-2022-38856 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
-   - mplayer  (bug #1021013)
+   - mplayer  (unimportant; bug #1021013)
NOTE: https://trac.mplayerhq.hu/ticket/2395
-   TODO: Fixed by other fixes, but not pin pointed upstream, try to 
isolate revision to fix issue
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38855 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
- mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2392
@@ -16947,10 +16949,11 @@ CVE-2022-38602
 CVE-2022-38601
RESERVED
 CVE-2022-38600 (Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via 
vf.c and vf ...)
-   - mplayer  (bug #1021013)
+   - mplayer  (unimportant; bug #1021013)
NOTE: https://trac.mplayerhq.hu/ticket/2390#comment:2
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/59792bad144c11b21b27171a93a36e3fbd21eb5e
 (r38380)
NOTE: Followup: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/48ca1226397974bb2bc53de878411f88a80fe1f8
 (r38392)
+   NOTE: Memory leak in CLI tool, no security impact
 CVE-2022-38599
RESERVED
 CVE-2022-38598
@@ -27639,6 +27642,7 @@ CVE-2022-34668 (NVFLARE, versions prior to 2.1.4, 
contains a vulnerability that
 CVE-2022-34667
RESERVED
- nvidia-cuda-toolkit  (bug #1021625)
+   [bullseye] - nvidia-cuda-toolkit  (Non-free not supported)
[buster] - nvidia-cuda-toolkit  (Minor issue)
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5373
 CVE-2022-34666
@@ -69432,36 +69436,42 @@ CVE-2021-44928
RESERVED
 CVE-2021-44927 (A null pointer dereference vulnerability exists in gpac 1.1.0 
in the g ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1960
NOTE: 
https://github.com/gpac/gpac/commit/eaea647cc7dec7b452c17e72f4ce46be35348c92 
(v2.0.0)
 CVE-2021-44926 (A null pointer dereference vulnerability exists in gpac 
1.1.0-DEV in t ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1961
NOTE: 
https://github.com/gpac/gpac/commit/f73da86bf32992f62b9ff2b9c9e853e3c97edf8e 
(v2.0.0)
 CVE-2021-44925 (A null pointer dereference vulnerability exists in gpac 1.1.0 
in the g ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1967
NOTE: 
https://github.com/gpac/gpac/commit/a5a8dbcdd95666f763fe59ab65154ae9271a18f2 
(v2.0.0)
 CVE-2021-44924 (An infinite loop vulnerability exists in gpac 1.1.0 in the 
gf_log func ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1959
NOTE: 
https://github.com/gpac/gpac/commit/e2acb1511d1e69115141ea3080afd1cce6a15497 
(v2.0.0)
 CVE-2021-44923 (A null pointer dereference vulnerability exists in gpac 1.1.0 
in the g ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1962
NOTE:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-10-25 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
9ce5b6e9 by Moritz Muehlenhoff at 2022-10-25T12:33:08+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -5988,9 +5988,10 @@ CVE-2022-3297 (Use After Free in GitHub repository 
vim/vim prior to 9.0.0579. ..
NOTE: 
https://github.com/vim/vim/commit/0ff01835a40f549c5c4a550502f62a2ac9ac447c 
(v9.0.0579)
NOTE: Crash in CLI tool, no security impact
 CVE-2022-3296 (Stack-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0. ...)
-   - vim 2:9.0.0626-1
+   - vim 2:9.0.0626-1 (unimportant)
NOTE: https://huntr.dev/bounties/958866b8-526a-4979-9471-39392e0c9077
NOTE: 
https://github.com/vim/vim/commit/96b9bf8f74af8abf1e30054f996708db7dc285be 
(v9.0.0577)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3295 (Allocation of Resources Without Limits or Throttling in GitHub 
reposit ...)
- rdiffweb  (bug #969974)
 CVE-2022-3294
@@ -49437,6 +49438,7 @@ CVE-2022-0700 (The Simple Tracking WordPress plugin 
before 1.7 does not sanitise
NOT-FOR-US: WordPress plugin
 CVE-2022-0699 (A double-free condition exists in contrib/shpsort.c of shapelib 
1.5.0  ...)
- shapelib 1.5.0-3 (bug #1022557)
+   [bullseye] - shapelib  (Minor issue)
NOTE: 
https://github.com/OSGeo/shapelib/commit/c75b9281a5b9452d92e1682bdfe6019a13ed819f
NOTE: https://github.com/OSGeo/shapelib/issues/39
 CVE-2022-25597 (ASUS RT-AC86Us LPD service has insufficient filtering 
for speci ...)


=
data/dsa-needed.txt
=
@@ -56,9 +56,13 @@ ruby-tzinfo
 --
 salt
 --
+samba
+--
 sofia-sip
   Maintainer proposed debdiff, though as rebuild of the testing version
 --
 sox
   patch needed for CVE-2021-40426, check with upstream
 --
+thunderbird (jmm)
+--



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ce5b6e9ab5505b40b5cc89387e82e44cd9f6e5a

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9ce5b6e9ab5505b40b5cc89387e82e44cd9f6e5a
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-10-25 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f75a9f52 by Moritz Muehlenhoff at 2022-10-25T09:00:30+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -903,8 +903,9 @@ CVE-2022-3594 (A vulnerability was found in Linux Kernel. 
It has been declared a
- linux 6.0.3-1
NOTE: 
https://git.kernel.org/linus/93e2be344a7db169b7119de21ac1bf253b8c6907 (6.1-rc1)
 CVE-2022-3593 (A vulnerability was found in Linux Kernel. It has been 
classified as p ...)
-   - iproute2 5.19.0-1
+   - iproute2 5.19.0-1 (unimportant)
NOTE: 
https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/commit/?id=2cb76253ed852559a4f2b315f5e23457a15d71e5
+   NOTE: Memory leak in CLI tool, no security impact
 CVE-2022-3592
RESERVED
 CVE-2022-43399
@@ -1968,17 +1969,21 @@ CVE-2022-3531 (A vulnerability was found in Linux 
Kernel. It has been classified
NOTE: 
https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=6d2e21dc4db3933db65293552ecc1ede26febeca
NOTE: Issue only in selftest/bpf.
 CVE-2022-3530 (A vulnerability was found in Linux Kernel and classified as 
problemati ...)
-   - iproute2 5.19.0-1
+   - iproute2 5.19.0-1 (unimportant)
NOTE: 
https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/commit/?id=1d540336b026ed5bfe10eefac383db7f434d842f
+   NOTE: Memory leak in CLI tool, no security impact
 CVE-2022-3529 (A vulnerability has been found in Linux Kernel and classified 
as probl ...)
-   - iproute2 5.19.0-1
+   - iproute2 5.19.0-1 (unimportant)
NOTE: 
https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/commit/?id=6db01afd60748afbba114be2773be338c5be28ff
+   NOTE: Memory leak in CLI tool, no security impact
 CVE-2022-3528 (A vulnerability, which was classified as problematic, was found 
in Lin ...)
-   - iproute2 5.19.0-1
+   - iproute2 5.19.0-1 (unimportant)
NOTE: 
https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/commit/?id=afdbb0204a5872f1f76058a0db5a529b1f0c8de7
+   NOTE: Memory leak in CLI tool, no security impact
 CVE-2022-3527 (A vulnerability, which was classified as problematic, has been 
found i ...)
-   - iproute2 5.19.0-1
+   - iproute2 5.19.0-1 (unimportant)
NOTE: 
https://git.kernel.org/pub/scm/network/iproute2/iproute2-next.git/commit/?id=c5433c4b7a57d380f4cb351316f5ba5ebae9538e
+   NOTE: Memory leak in CLI tool, no security impact
 CVE-2022-3526 (A vulnerability classified as problematic was found in Linux 
Kernel. T ...)
- linux 5.17.6-1
[bullseye] - linux  (Vulnerable code not present)
@@ -68709,10 +68714,11 @@ CVE-2022-21695 (OnionShare is an open source tool 
that lets you securely and ano
[buster] - onionshare  (Vulnerable code not present)
NOTE: 
https://github.com/onionshare/onionshare/security/advisories/GHSA-99p8-9p2c-49j4
 CVE-2022-21694 (OnionShare is an open source tool that lets you securely and 
anonymous ...)
-   - onionshare 2.5-1 (bug #1014966)
+   - onionshare 2.5-1 (unimportant; bug #1014966)
[buster] - onionshare  (Vulnerable code not present)
NOTE: 
https://github.com/onionshare/onionshare/security/advisories/GHSA-h29c-wcm8-883h
NOTE: https://github.com/onionshare/onionshare/issues/1389
+   NOTE: This isn't a security vulnerability by itself
 CVE-2022-21693 (OnionShare is an open source tool that lets you securely and 
anonymous ...)
- onionshare 2.5-1 (bug #1014966)
[bullseye] - onionshare  (Vulnerable code not present)
@@ -68738,7 +68744,7 @@ CVE-2022-21689 (OnionShare is an open source tool that 
lets you securely and ano
NOTE: 
https://github.com/onionshare/onionshare/security/advisories/GHSA-jh82-c5jw-pxpc
NOTE: 
https://github.com/onionshare/onionshare/commit/096178a9e6133fd6ca9d95a00a67bba75ccab377
 (v2.5)
 CVE-2022-21688 (OnionShare is an open source tool that lets you securely and 
anonymous ...)
-   - onionshare 2.5-1 (bug #1014966)
+   NOTE: The report against OnionShare is just a stop gap, this needs to 
be tracked down/fixed in Qt
NOTE: 
https://github.com/onionshare/onionshare/security/advisories/GHSA-x7wr-283h-5h2v
 CVE-2022-21687 (gh-ost is a triggerless online schema migration solution for 
MySQL. Ve ...)
NOT-FOR-US: GitHub Online Schema
@@ -77583,6 +77589,7 @@ CVE-2021-41869 (SuiteCRM 7.10.x before 7.10.33 and 
7.11.x before 7.11.22 is vuln
 CVE-2021-41868 (OnionShare 2.3 before 2.4 allows remote unauthenticated 
attackers to u ...)
- onionshare 2.5-1 (bug #1014966)
[buster] - onionshare  (Vulnerable code not present)
+   NOTE: https://github.com/onionshare/onionshare/issues/1396
 CVE-2021-41867 (An information disclosure vulnerability

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-10-23 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
8db5037c by Moritz Muehlenhoff at 2022-10-23T23:24:55+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -1649,6 +1649,7 @@ CVE-2022-3560
RESERVED
 CVE-2022-3559 (A vulnerability was found in Exim and classified as 
problematic. This  ...)
- exim4 4.96-4
+   [bullseye] - exim4  (Minor issue)
NOTE: 
https://git.exim.org/exim.git/commit/4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2
 CVE-2022-3558
RESERVED


=
data/dsa-needed.txt
=
@@ -22,6 +22,8 @@ frr
 --
 gerbv
 --
+libxml2
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more recent v5.10.y versions



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8db5037cc8de95b1bbb41341b236d5847e6ebda8

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8db5037cc8de95b1bbb41341b236d5847e6ebda8
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-10-23 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
3c660b8a by Moritz Muehlenhoff at 2022-10-23T21:00:42+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1487,28 +1487,36 @@ CVE-2022-43046
RESERVED
 CVE-2022-43045 (GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to 
contain a segm ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2277
NOTE: 
https://github.com/gpac/gpac/commit/c5249ee4b62dfc604fecb4dce2fc480b3e388bbb
 CVE-2022-43044 (GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to 
contain a segm ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2282
NOTE: 
https://github.com/gpac/gpac/commit/8a0e8e4ab13348cb1ab8e93b950a03d93f158a35
 CVE-2022-43043 (GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to 
contain a segm ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2276
NOTE: 
https://github.com/gpac/gpac/commit/6bff06cdb8e9b4e8ed2e789ee9340877759536fd
 CVE-2022-43042 (GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to 
contain a heap ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2278
NOTE: 
https://github.com/gpac/gpac/commit/3661da280b3eba75490e75ff20ad440c66e24de9
 CVE-2022-43041
RESERVED
 CVE-2022-43040 (GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to 
contain a heap ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
+   [buster] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2280
NOTE: 
https://github.com/gpac/gpac/commit/f17dae31ebf6ea7af8c512165d9b954c2a6ea46e
 CVE-2022-43039 (GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to 
contain a segm ...)
- gpac 
+   [bullseye] - gpac  (Vulnerable code not present)
+   [buster] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2281
NOTE: 
https://github.com/gpac/gpac/commit/62dbd5caad6b89b33535dfa19ef65419f0378303
 CVE-2022-43038 (Bento4 v1.6.0-639 was discovered to contain a heap overflow 
via the AP ...)
@@ -1650,9 +1658,11 @@ CVE-2022-3556
RESERVED
 CVE-2022-3555 (A vulnerability was found in X.org libX11 and classified as 
problemati ...)
- libx11 2:1.7.4-1
+   [bullseye] - libx11  (Minor issue)
NOTE: 
https://gitlab.freedesktop.org/xorg/lib/libx11/commit/8a368d808fec166b5fb3dfe6312aab22c7ee20af
 (libX11-1.7.4)
 CVE-2022-3554 (A vulnerability has been found in X.org libX11 and classified 
as probl ...)
- libx11 
+   [bullseye] - libx11  (Minor issue)
NOTE: 
https://gitlab.freedesktop.org/xorg/lib/libx11/commit/1d11822601fd24a396b354fa616b04ed3df8b4ef
 CVE-2022-3553 (A vulnerability, which was classified as problematic, was found 
in X.o ...)
- xorg-server 2:21.1.4-1 (unimportant)
@@ -69162,6 +69172,7 @@ CVE-2022-21619 (Vulnerability in the Oracle Java SE, 
Oracle GraalVM Enterprise E
- openjdk-11 11.0.17+8-1
[bullseye] - openjdk-11  (Minor issue, fix along with next 
CPU)
- openjdk-17 
+   [bullseye] - openjdk-17  (Minor issue, fix along with next 
CPU)
 CVE-2022-21618 (Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise 
Edition ...)
- openjdk-17 17.0.5+8-1
[bullseye] - openjdk-17  (Minor issue, fix along with next 
CPU)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3c660b8add95c68dfc060298c966ae4b674524b4

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3c660b8add95c68dfc060298c966ae4b674524b4
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-10-12 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
e3d9e484 by Moritz Muehlenhoff at 2022-10-12T14:07:11+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -5376,9 +5376,9 @@ CVE-2022-40627
RESERVED
 CVE-2022-40626 (An unauthenticated user can create a link with reflected 
Javascript co ...)
- zabbix 1:6.0.7+dfsg-2
+   [bullseye] - zabbix  (Minor issue)
NOTE: https://support.zabbix.com/browse/ZBX-21350
NOTE: 
https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/55eb14d0a394b362d5df00ed9e06a3918472deec
 (6.0.7rc1)
-   TODO: check, verify it really did not affect versions before 6.0.0
 CVE-2022-40625
RESERVED
 CVE-2022-40624
@@ -10656,7 +10656,7 @@ CVE-2022-2925 (Cross-site Scripting (XSS) - Stored in 
GitHub repository appwrite
 CVE-2022-2924 (Cross-site Scripting (XSS) - Stored in GitHub repository 
yetiforcecomp ...)
NOT-FOR-US: yetiforcecrm
 CVE-2022-2923 (NULL Pointer Dereference in GitHub repository vim/vim prior to 
9.0.024 ...)
-   - vim 2:9.0.0242-1
+   - vim 2:9.0.0242-1 (unimportant)
NOTE: https://huntr.dev/bounties/fd3a3ab8-ab0f-452f-afea-8c613e283fd2
NOTE: 
https://github.com/vim/vim/commit/6669de1b235843968e88844ca6d3c8dec4b01a9e 
(v9.0.0240)
NOTE: Crash in CLI tool, no security impact
@@ -11632,9 +11632,10 @@ CVE-2022-2817 (Use After Free in GitHub repository 
vim/vim prior to 9.0.0213. ..
NOTE: https://huntr.dev/bounties/a7b7d242-3d88-4bde-a681-6c986aff886f
NOTE: 
https://github.com/vim/vim/commit/249e1b903a9c0460d618f6dcc59aeb8c03b24b20 
(v9.0.0213)
 CVE-2022-2816 (Out-of-bounds Read in GitHub repository vim/vim prior to 
9.0.0212. ...)
-   - vim 2:9.0.0229-1
+   - vim 2:9.0.0229-1 (unimportant)
NOTE: https://huntr.dev/bounties/e2a83037-fcf9-4218-b2b9-b7507dacde58
NOTE: 
https://github.com/vim/vim/commit/dbdd16b62560413abcc3c8e893cc3010ccf31666 
(v9.0.0212)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38217
RESERVED
 CVE-2022-2815
@@ -13130,6 +13131,7 @@ CVE-2022-37617 (Prototype pollution vulnerability in 
function resolveShims in re
NOT-FOR-US: Node browserify-shim
 CVE-2022-37616 (A prototype pollution vulnerability exists in the function 
copy in dom ...)
- node-xmldom  (bug #1021618)
+   [bullseye] - node-xmldom  (Minor issue)
NOTE: https://github.com/xmldom/xmldom/issues/436
NOTE: 
https://github.com/xmldom/xmldom/security/advisories/GHSA-9pgh-qqpf-7wqj
NOTE: Fixed by: 
https://github.com/xmldom/xmldom/commit/6956ec406fd4658dfb028a327c7a39238b24c3cd
 (0.9.0-beta.2)
@@ -77752,6 +77754,7 @@ CVE-2021-3783 (yourls is vulnerable to Improper 
Neutralization of Input During W
NOT-FOR-US: yourls
 CVE-2021-3782 (An internal reference count is held on the buffer pool, 
incremented ev ...)
- wayland 1.21.0-1
+   [bullseye] - wayland  (Minor issue)
NOTE: https://gitlab.freedesktop.org/wayland/wayland/-/issues/224
NOTE: 
https://gitlab.freedesktop.org/wayland/wayland/-/commit/b19488c7154b902354cb26a27f11415d7799b0b2
 (1.20.91)
 CVE-2021-3781 (A trivial sandbox (enabled with the `-dSAFER` option) escape 
flaw was  ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e3d9e4849fe58b368f33fed7567106c64665ae16

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e3d9e4849fe58b368f33fed7567106c64665ae16
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-10-05 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f2089065 by Moritz Muehlenhoff at 2022-10-05T17:02:42+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -7460,11 +7460,13 @@ CVE-2022-39210 (Nextcloud android is the official 
Android client for the Nextclo
 CVE-2022-39209 (cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and 
renderin ...)
- cmark-gfm  (bug #1020588)
- python-cmarkgfm 
-   - ghostwriter 
+   - ghostwriter  (unimportant)
- ruby-commonmarker 
- r-cran-commonmark 
+   [bullseye] - r-cran-commonmark  (Minor issue)
NOTE: 
https://github.com/github/cmark-gfm/security/advisories/GHSA-cgh3-p57x-9q7q
NOTE: 
https://github.com/github/cmark-gfm/commit/cfcaa0068bf319974fdec283416fcee5035c2d70
 (0.29.0.gfm.6)
+   NOTE: For ghostwriter just a hang/crash in GUI tool, no security impact
 CVE-2022-39208 (Onedev is an open source, self-hosted Git Server with CI/CD 
and Kanban ...)
NOT-FOR-US: Onedev
 CVE-2022-39207 (Onedev is an open source, self-hosted Git Server with CI/CD 
and Kanban ...)
@@ -7824,6 +7826,7 @@ CVE-2006-20001
RESERVED
 CVE-2022- [wordpress 6.0.2]
- wordpress 6.0.2+dfsg1-1 (bug #1018863)
+   [bullseye] - wordpress  (Minor issue)
NOTE: 
https://wordpress.org/news/2022/08/wordpress-6-0-2-security-and-maintenance-release/
 CVE-2022-39079
RESERVED
@@ -18258,11 +18261,13 @@ CVE-2022-2321 (Improper Restriction of Excessive 
Authentication Attempts in GitH
 CVE-2022-35230 (An authenticated user can create a link with reflected 
Javascript code ...)
[experimental] - zabbix 1:6.0.6+dfsg-1
- zabbix 1:6.0.7+dfsg-2 (bug #1014994)
+   [bullseye] - zabbix  (Minor issue)
NOTE: https://support.zabbix.com/browse/ZBX-21305
NOTE: Fixed in: 
https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/3b47a97676ee9ca4e16566f1931c456459108eae
 (5.0.25rc1)
 CVE-2022-35229 (An authenticated user can create a link with reflected 
Javascript code ...)
[experimental] - zabbix 1:6.0.6+dfsg-1
- zabbix 1:6.0.7+dfsg-2 (bug #1014992)
+   [bullseye] - zabbix  (Minor issue)
NOTE: https://support.zabbix.com/browse/ZBX-21306
NOTE: Fixed in: 
https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/b546c3f10ce98b0c914e5fc4114bd43042880c3c
 (5.0.25rc1)
 CVE-2022-35228 (SAP BusinessObjects CMC allows an unauthenticated attacker to 
retrieve ...)
@@ -47753,16 +47758,19 @@ CVE-2022-24920
 CVE-2022-24919 (An authenticated user can create a link with reflected 
Javascript code ...)
{DLA-2980-1}
- zabbix 1:6.0.7+dfsg-2
+   [bullseye] - zabbix  (Minor issue)
NOTE: https://support.zabbix.com/browse/ZBX-20680
NOTE: 
https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/ff70e709719e4e9f25f5d187637fd53fd61c8bbe
 (5.0.21rc1)
 CVE-2022-24918 (An authenticated user can create a link with reflected 
Javascript code ...)
- zabbix 1:6.0.7+dfsg-2
+   [bullseye] - zabbix  (Minor issue)
[stretch] - zabbix  (The vulnerable code was introduced 
later)
NOTE: https://support.zabbix.com/browse/ZBX-20680
NOTE: 
https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/ff70e709719e4e9f25f5d187637fd53fd61c8bbe
 (5.0.21rc1)
 CVE-2022-24917 (An authenticated user can create a link with reflected 
Javascript code ...)
{DLA-2980-1}
- zabbix 1:6.0.7+dfsg-2
+   [bullseye] - zabbix  (Minor issue)
NOTE: https://support.zabbix.com/browse/ZBX-20680
NOTE: 
https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/ff70e709719e4e9f25f5d187637fd53fd61c8bbe
 (5.0.21rc1)
 CVE-2022-24911
@@ -48391,6 +48399,7 @@ CVE-2022-24725 (Shescape is a shell escape package for 
JavaScript. An issue in v
 CVE-2022-24724 (cmark-gfm is GitHub's extended version of the C reference 
implementati ...)
- cmark-gfm 0.29.0.gfm.3-3 (bug #1006756)
- ghostwriter  (bug #1006757)
+   [bullseye] - ghostwriter  (Minor issue)
- python-cmarkgfm 0.7.0-1 (bug #1006758)
- ruby-commonmarker  (bug #1006759)
- r-cran-commonmark 1.8.0-1 (bug #1006760)
@@ -49549,6 +49558,7 @@ CVE-2022-24350
 CVE-2022-24349 (An authenticated user can create a link with reflected XSS 
payload for ...)
{DLA-2980-1}
- zabbix 1:6.0.7+dfsg-2
+   [bullseye] - zabbix  (Minor issue)
NOTE: https://support.zabbix.com/browse/ZBX-20680
NOTE: 
https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/ff70e709719e4e9f25f5d187637fd53fd61c8bbe
 (5.0.21rc1)
 CVE-2022-24348 (Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory 
traversal ...)
@@ -54285,10 +54295,12 @@ CVE-2022-23135 (There is a directory traversal 
vulnerability in some home gatewa
 CVE-2022-23134

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-10-05 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
90fa8546 by Moritz Muehlenhoff at 2022-10-05T12:27:29+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -3962,6 +3962,7 @@ CVE-2022-3223 (Cross-site Scripting (XSS) - Stored in 
GitHub repository jgraph/d
NOT-FOR-US: jgraph/drawio
 CVE-2022-3222 (Uncontrolled Recursion in GitHub repository gpac/gpac prior to 
2.1.0-D ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
NOTE: https://huntr.dev/bounties/b29c69fa-3eac-41e4-9d4f-d861aba18235/
NOTE: 
https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf
@@ -6119,6 +6120,7 @@ CVE-2022-39836
RESERVED
 CVE-2022-39835 (An issue was discovered in Gajim through 1.4.7. The 
vulnerability allo ...)
- gajim 1.5.0-1
+   [bullseye] - gajim  (Minor issue)
NOTE: 
https://dev.gajim.org/gajim/gajim/-/commit/af02c6bd53fad4e0065951597bd7ec801c002067
 (1.5.0)
 CVE-2022-39834
RESERVED
@@ -40933,6 +40935,7 @@ CVE-2022-1036 (Able to create an account with long 
password leads to memory corr
NOT-FOR-US: microweber
 CVE-2022-1035 (Segmentation Fault caused by MP4Box -lsr in GitHub repository 
gpac/gpa ...)
- gpac  (bug #1016443)
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://huntr.dev/bounties/851942a4-1d64-4553-8fdc-9fccd167864b
@@ -44986,6 +44989,7 @@ CVE-2022-21802 (The package grapesjs before 0.19.5 are 
vulnerable to Cross-site
NOT-FOR-US: grapejs
 CVE-2022-21797 (The package joblib from 0 and before 1.2.0 are vulnerable to 
Arbitrary ...)
- joblib  (bug #1020820)
+   [bullseye] - joblib  (Minor issue)
NOTE: https://github.com/joblib/joblib/issues/1128
NOTE: https://github.com/joblib/joblib/pull/1321
NOTE: 
https://github.com/joblib/joblib/commit/b90f10efeb670a2cc877fb88ebb3f2019189e059
 (1.2.0)
@@ -58332,6 +58336,7 @@ CVE-2021-45832 (A Stack-based Buffer Overflow 
Vulnerability exists in HDF5 1.13.
NOTE: Negligible security impact, malicous scientific data has more 
issues than a crash...
 CVE-2021-45831 (A Null Pointer Dereference vulnerability exitgs in GPAC 1.0.1 
in MP4Bo ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/1990
@@ -134539,6 +134544,7 @@ CVE-2020-29261
 CVE-2020-29260 (libvncclient v0.9.13 was discovered to contain a memory leak 
via the f ...)
{DLA-3125-1}
- libvncserver  (bug #1019228)
+   [bullseye] - libvncserver  (Minor issue)
NOTE: 
https://github.com/LibVNC/libvncserver/commit/bef41f6ec4097a8ee094f90a1b34a708fbd757ec
 CVE-2020-29259 (Cross-site scripting (XSS) vulnerability in Online Examination 
System  ...)
NOT-FOR-US: Online Examination System


=
data/dsa-needed.txt
=
@@ -29,6 +29,8 @@ netatalk
 --
 nodejs
 --
+openexr
+--
 php-horde-mime-viewer
 --
 php-horde-turba



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/90fa85463e85b04807a7152399578c7f2f05c0c7

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/90fa85463e85b04807a7152399578c7f2f05c0c7
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-29 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
02d2c710 by Moritz Muehlenhoff at 2022-09-29T17:22:02+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1101,6 +1101,7 @@ CVE-2022-3288
RESERVED
 CVE-2022-3287 (When creating an OPERATOR user account on the BMC, the redfish 
plugin  ...)
- fwupd 1.8.5-1
+   [bullseye] - fwupd  (Minor issue)
NOTE: 
https://github.com/fwupd/fwupd/commit/ea676855f2119e36d433fbd2ed604039f53b2091 
(1.8.5)
 CVE-2022-3286
RESERVED
@@ -7284,6 +7285,7 @@ CVE-2022-38752 (Using snakeYAML to parse untrusted YAML 
files may be vulnerable
[bullseye] - snakeyaml  (Minor issue)
NOTE: 
https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081 (not 
public)
+   NOTE: Fixed in 1.32
 CVE-2022-38751 (Using snakeYAML to parse untrusted YAML files may be 
vulnerable to Den ...)
- snakeyaml 1.31-1
[bullseye] - snakeyaml  (Minor issue)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/02d2c710a1feaf9f571d639f7a246409430a0353

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/02d2c710a1feaf9f571d639f7a246409430a0353
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-27 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
25dfd340 by Moritz Muehlenhoff at 2022-09-27T14:16:42+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -548,9 +548,10 @@ CVE-2022-41338
 CVE-2022-41337
RESERVED
 CVE-2022-3297 (Use After Free in GitHub repository vim/vim prior to 9.0.0579. 
...)
-   - vim 
+   - vim  (unimportant)
NOTE: https://huntr.dev/bounties/1aa9ec92-0355-4710-bf85-5bce9effa01c
NOTE: 
https://github.com/vim/vim/commit/0ff01835a40f549c5c4a550502f62a2ac9ac447c 
(v9.0.0579)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-3296 (Stack-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0. ...)
- vim 
NOTE: https://huntr.dev/bounties/958866b8-526a-4979-9471-39392e0c9077
@@ -633,8 +634,8 @@ CVE-2022-3278 (NULL Pointer Dereference in GitHub 
repository vim/vim prior to 9.
 CVE-2022-3277 [unrestricted creation of security groups]
RESERVED
- neutron 
+   [bullseye] - neutron  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2129193
-   TODO: details missing on RH bugzilla entry
 CVE-2020-36604 (hoek before 8.5.1 and 9.x before 9.0.3 allows prototype 
poisoning in t ...)
- node-hoek 9.0.3+~5.0.0+~4.0.0-1
[buster] - node-hoek  (Vulnerable code not present)
@@ -6382,16 +6383,18 @@ CVE-2022-38861 (The MPlayer Project mplayer 
SVN-r38374-13.0.1 is vulnerable to m
NOTE: https://trac.mplayerhq.hu/ticket/2407
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/2622e7fbe3605a2f3b4f74900197fefeedc0d2e1
 (r38402)
 CVE-2022-38860 (Certain The MPlayer Project products are vulnerable to Divide 
By Zero  ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2402
NOTE: Duplicate of https://trac.mplayerhq.hu/ticket/2401
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/62fe0c63cf4fba91efd29bbc85309280e1a99a47
 (r38389)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38859
RESERVED
 CVE-2022-38858 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2396
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/92e0d0b1a04dfdd4ac741e0d07005e3ece2c92ca
 (r38385)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38857
RESERVED
 CVE-2022-38856 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
@@ -27633,6 +27636,7 @@ CVE-2022-31034 (Argo CD is a declarative, GitOps 
continuous delivery tool for Ku
NOT-FOR-US: Argo CD
 CVE-2022-31033 (The Mechanize library is used for automating interaction with 
websites ...)
- ruby-mechanize 2.8.5-1 (bug #1014809)
+   [bullseye] - ruby-mechanize  (Minor issue)
NOTE: 
https://github.com/sparklemotion/mechanize/security/advisories/GHSA-64qm-hrgp-pgr9
NOTE: Prerequisite to clear credential headers when redirecting to 
cross site
NOTE: 
https://github.com/sparklemotion/mechanize/commit/17e5381032c90caf240ac3d2e52b353f40c18d83
 (v2.8.0)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/25dfd340d1e0e9597da9f9a3c267237e46007974

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/25dfd340d1e0e9597da9f9a3c267237e46007974
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-23 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
21fe653a by Moritz Mühlenhoff at 2022-09-23T14:32:37+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -52,6 +52,7 @@ CVE-2022-3266
RESERVED
 CVE-2022-41322 (In Kitty before 0.26.2, insufficient validation in the desktop 
notific ...)
- kitty 
+   [bullseye] - kitty  (Minor issue)
NOTE: 
https://github.com/kovidgoyal/kitty/commit/f05783e64d5fa62e1aed603e8d69aced5e49824f
 (v0.26.2)
 CVE-2022-41318 [Buffer Over Read in SSPI and SMB Authentication]
RESERVED
@@ -2777,6 +2778,7 @@ CVE-2022-40147
RESERVED
 CVE-2022-40146 (Server-Side Request Forgery (SSRF) vulnerability in Batik of 
Apache XM ...)
- batik 
+   [bullseye] - batik  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/09/22/3
NOTE: https://issues.apache.org/jira/browse/BATIK-1335
NOTE: http://svn.apache.org/viewvc?view=revision=1903910
@@ -5774,9 +5776,9 @@ CVE-2022-38863 (Certain The MPlayer Project products are 
vulnerable to Buffer Ov
NOTE: Crash in CLI tool, no security impact
 CVE-2022-38862 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
- mplayer 
+   [bullseye] - mplayer  (Minor issue)
NOTE: https://trac.mplayerhq.hu/ticket/2400
NOTE: https://trac.mplayerhq.hu/ticket/2404
-   TODO: check, unclear if fixed, upstream cannot reproduce
 CVE-2022-38861 (The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to 
memory  ...)
- mplayer 
NOTE: https://trac.mplayerhq.hu/ticket/2407
@@ -5799,9 +5801,10 @@ CVE-2022-38856 (Certain The MPlayer Project products are 
vulnerable to Buffer Ov
NOTE: https://trac.mplayerhq.hu/ticket/2395
TODO: Fixed by other fixes, but not pin pointed upstream, try to 
isolate revision to fix issue
 CVE-2022-38855 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2392
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/2f6e69e59e2614acdde5505b049c48f80a3d0eb7
 (r38384)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38854
RESERVED
 CVE-2022-38853 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
@@ -6518,6 +6521,7 @@ CVE-2022-38649
RESERVED
 CVE-2022-38648 (Server-Side Request Forgery (SSRF) vulnerability in Batik of 
Apache XM ...)
- batik 
+   [bullseye] - batik  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/09/22/4
NOTE: https://issues.apache.org/jira/browse/BATIK-1333
NOTE: http://svn.apache.org/viewvc?view=revision=1903625
@@ -7244,6 +7248,7 @@ CVE-2020-36592
RESERVED
 CVE-2022-38398 (Server-Side Request Forgery (SSRF) vulnerability in Batik of 
Apache XM ...)
- batik 
+   [bullseye] - batik  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/09/22/2
NOTE: https://issues.apache.org/jira/browse/BATIK-1331
NOTE: http://svn.apache.org/viewvc?view=revision=1903462
@@ -16174,6 +16179,7 @@ CVE-2022-35020 (Advancecomp v2.3 was discovered to 
contain a heap buffer overflo
NOTE: Crash in CLI tool, no security impact
 CVE-2022-35019 (Advancecomp v2.3 was discovered to contain a segmentation 
fault. ...)
- advancecomp  (bug #1019592)
+   [bullseye] - advancecomp  (Minor issue)
[buster] - advancecomp  (Minor issue)
NOTE: 
https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35019.md
 CVE-2022-35018 (Advancecomp v2.3 was discovered to contain a segmentation 
fault. ...)
@@ -16787,6 +16793,7 @@ CVE-2022-2256 (A Stored Cross-site scripting (XSS) 
vulnerability was found in ke
 CVE-2022-2255 (A vulnerability was found in mod_wsgi. The X-Client-IP header 
is not r ...)
{DLA-3111-1}
- mod-wsgi 4.9.0-1.1 (bug #1016476)
+   [bullseye] - mod-wsgi  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2100563
NOTE: 
https://github.com/GrahamDumpleton/mod_wsgi/commit/af3c0c2736bc0b0b01fa0f0aad3c904b7fa9c751
 (4.9.3)
NOTE: WSGITrustedProxies and vulnerable code introduced in 
https://github.com/GrahamDumpleton/mod_wsgi/commit/543fc33c23b4cb5e623d574b7efbf85c8dedb396
 (4.4.10)
@@ -27160,6 +27167,7 @@ CVE-2022-1796 (Use After Free in GitHub repository 
vim/vim prior to 8.2.4979. ..
NOTE: Crash in CLI tool, no security impact
 CVE-2022-1795 (Use After Free in GitHub repository gpac/gpac prior to 
v2.1.0-DEV. ...)
- gpac  (bug #1016443)
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-20 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
b9ae6ff5 by Moritz Mühlenhoff at 2022-09-20T17:03:48+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -5240,20 +5240,23 @@ CVE-2022-38855 (Certain The MPlayer Project products 
are vulnerable to Buffer Ov
 CVE-2022-38854
RESERVED
 CVE-2022-38853 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2398
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/59792bad144c11b21b27171a93a36e3fbd21eb5e
 (r38380)
NOTE: Followup: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/48ca1226397974bb2bc53de878411f88a80fe1f8
 (r38392)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38852
RESERVED
 CVE-2022-38851 (Certain The MPlayer Project products are vulnerable to 
Out-of-bounds R ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2393
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/58db9292a414ebf13a2cacdb3ffa967fb9036935
 (r38382)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38850 (The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable 
to Divide ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2399
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/d19ea1ce173e95c31b0e8acbe471ea26c292be2b
 (r38390)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38849
RESERVED
 CVE-2022-38848
@@ -8585,6 +8588,7 @@ CVE-2022-37704
RESERVED
 CVE-2022-37703 (In Amanda 3.5.1, an information leak vulnerability was found 
in the ca ...)
- amanda 
+   [bullseye] - amanda  (Minor issue)
NOTE: https://github.com/MaherAzzouzi/CVE-2022-37703
 CVE-2022-37702
RESERVED
@@ -33634,6 +33638,7 @@ CVE-2022-1228 (The Opensea WordPress plugin before 
1.0.3 does not sanitize and e
NOT-FOR-US: WordPress plugin
 CVE-2022-1227 (A privilege escalation flaw was found in Podman. This flaw 
allows an a ...)
- libpod 3.4.7+ds1-1
+   [bullseye] - libpod  (Minor issue)
- golang-github-containers-psgo 1.7.1+ds1-1
[bullseye] - golang-github-containers-psgo  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2070368
@@ -36530,6 +36535,7 @@ CVE-2022-27650 (A flaw was found in crun where 
containers were incorrectly start
NOTE: 
https://github.com/containers/crun/commit/b847d146d496c9d7beba166fd595488e85488562
 (1.4.4)
 CVE-2022-27649 (A flaw was found in Podman, where containers were started 
incorrectly  ...)
- libpod 3.4.6+ds1-1
+   [bullseye] - libpod  (Minor issue)
NOTE: https://github.com/containers/podman/releases/tag/v4.0.3
NOTE: 
https://github.com/containers/podman/commit/aafa80918a245edcbdaceb1191d749570f1872d0
 (main)
NOTE: 
https://github.com/containers/podman/commit/7b368768c2990b9781b2b6813e1c7f91c7e6cb13
 (v4.0.3)
@@ -41359,6 +41365,7 @@ CVE-2022-25871 (All versions of package querymen are 
vulnerable to Prototype Pol
NOT-FOR-US: Node querymen
 CVE-2022-25869 (All versions of package angular are vulnerable to Cross-site 
Scripting ...)
- angular.js 
+   [bullseye] - angular.js  (Minor issue)
NOTE: https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781
 CVE-2022-25867 (The package io.socket:socket.io-client before 2.0.1 are 
vulnerable to  ...)
NOT-FOR-US: socket.io-client-java
@@ -41414,6 +41421,7 @@ CVE-2022-25845 (The package com.alibaba:fastjson before 
1.2.83 are vulnerable to
NOT-FOR-US: com.alibaba:fastjson
 CVE-2022-25844 (The package angular after 1.7.0 are vulnerable to Regular 
Expression D ...)
- angular.js  (bug #1014779)
+   [bullseye] - angular.js  (Minor issue)
[stretch] - angular.js  (Nodejs in stretch not covered by 
security support)
NOTE: https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735
 CVE-2022-25843
@@ -44956,6 +44964,7 @@ CVE-2022-24730 (Argo CD is a declarative, GitOps 
continuous delivery tool for Ku
NOT-FOR-US: Argo CD
 CVE-2022-24729 (CKEditor4 is an open source what-you-see-is-what-you-get HTML 
editor.  ...)
- ckeditor 4.19.0+dfsg-1
+   [bullseye] - ckeditor  (Minor issue)
- ckeditor3  (bug #1015217)
[bullseye] - ckeditor3  (Minor issue)
[buster] - ckeditor3  (No longer supported in LTS)
@@ -44963,6 +44972,7 @@ CVE-2022-24729 (CKEditor4 is an open source 
what-you-see-is-what-you-get HTML ed
NOTE: 
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
 CVE-2022-24728 (CKEditor4 is an open source what-you-see-is-what-you-get HTML 
editor.  ...)
-

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-20 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
719ca565 by Moritz Mühlenhoff at 2022-09-20T12:28:45+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -988,6 +988,7 @@ CVE-2022-3214 (Delta Industrial Automation's DIAEnergy, an 
industrial energy man
NOT-FOR-US: Delta
 CVE-2022-3213 (A heap buffer overflow issue was found in ImageMagick. When an 
applica ...)
- imagemagick 
+   [bullseye] - imagemagick  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2126824
NOTE: 
https://github.com/ImageMagick/ImageMagick/commit/30ccf9a0da1f47161b5935a95be854fe84e6c2a2
NOTE: 
https://github.com/ImageMagick/ImageMagick6/commit/1aea203eb36409ce6903b9e41fe7cb70030e8750
@@ -1529,6 +1530,7 @@ CVE-2022-40469
RESERVED
 CVE-2022-40468 (Tinyproxy commit 84f203f and earlier does not process HTTP 
request lin ...)
- tinyproxy 
+   [bullseye] - tinyproxy  (Minor issue)
NOTE: https://github.com/tinyproxy/tinyproxy/issues/457
NOTE: 
https://github.com/tinyproxy/tinyproxy/commit/3764b8551463b900b5b4e3ec0cd9bb9182191cb7
 CVE-2022-40467
@@ -5187,21 +5189,24 @@ CVE-2022-38868
 CVE-2022-38867
RESERVED
 CVE-2022-38866 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2403#comment:2
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/373517da3bb5781726565eb3114a2697b13f00f2
 (r38388)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38865 (Certain The MPlayer Project products are vulnerable to Divide 
By Zero  ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2401
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/33d9295663c37a37216633d7e3f07e7155da6144
 (r38386)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38864 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
- mplayer 
NOTE: https://trac.mplayerhq.hu/ticket/2406
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/36546389ef9fb6b0e0540c5c3f212534c34b0e94
 (r38391)
 CVE-2022-38863 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
-   - mplayer 
+   - mplayer  (unimportant)
NOTE: https://trac.mplayerhq.hu/ticket/2405
NOTE: 
https://git.ffmpeg.org/gitweb/mplayer.git/commit/b5e745b4bfab2835103a060094fae3c6cc1ba17d
 (r38393)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-38862 (Certain The MPlayer Project products are vulnerable to Buffer 
Overflow ...)
- mplayer 
NOTE: https://trac.mplayerhq.hu/ticket/2400
@@ -10471,6 +10476,7 @@ CVE-2022-2567 (The Form Builder CP WordPress plugin 
before 1.2.32 does not sanit
 CVE-2022-2566
RESERVED
- ffmpeg 7:5.1.1-1
+   [bullseye] - ffmpeg  (Minor issue, wait until it lands in 
4.3.x)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2126833
NOTE: 
https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=6f53f0d09ea4c9c7f7354f018a87ef840315207d
 (n5.1.1)
 CVE-2022-2565 (The Simple Payment Donations  Subscriptions WordPress 
plugin befo ...)
@@ -150230,6 +150236,7 @@ CVE-2020-22670
RESERVED
 CVE-2020-22669 (Modsecurity owasp-modsecurity-crs 3.2.0 (Paranoia level at 
PL1) has a  ...)
- modsecurity-crs 
+   [bullseye] - modsecurity-crs  (Minor issue)
NOTE: https://github.com/coreruleset/coreruleset/pull/1793
NOTE: 
https://github.com/coreruleset/coreruleset/commit/1a6e9e097587cecc038f1a1a76fc067c7797bbcd
 (v3.3.1-rc1)
NOTE: 
https://github.com/coreruleset/coreruleset/commit/909cab560b56f998faee88dd8a7aa9cf086d2d9f
 (v3.3.1-rc1)


=
data/dsa-needed.txt
=
@@ -60,3 +60,7 @@ sofia-sip
 sox
   patch needed for CVE-2021-40426, check with upstream
 --
+webkit2gtk
+--
+wpewebkit
+--



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/719ca565913246f9e1b5a0378c25297d8145e0c0

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/719ca565913246f9e1b5a0378c25297d8145e0c0
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-14 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
01392162 by Moritz Muehlenhoff at 2022-09-14T17:25:06+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -186,6 +186,7 @@ CVE-2022-3191
RESERVED
 CVE-2022-3190 (Infinite loop in the F5 Ethernet Trailer protocol dissector in 
Wiresha ...)
- wireshark 3.6.8-1
+   [bullseye] - wireshark  (Minor issue)
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/18307
NOTE: https://www.wireshark.org/security/wnpa-sec-2022-06.html
 CVE-2022-3189
@@ -1482,6 +1483,7 @@ CVE-2022-40024
RESERVED
 CVE-2022-40023 (Sqlalchemy mako before 1.2.2 is vulnerable to Regular 
expression Denia ...)
- mako 1.2.2+ds1-1
+   [bullseye] - mako  (Minor issue)
NOTE: 
https://github.com/sqlalchemy/mako/commit/925760291d6efec64fda6e9dd1fd9cfbd5be068c
 (rel_1_2_2)
NOTE: https://github.com/sqlalchemy/mako/issues/366
 CVE-2022-40022
@@ -3284,12 +3286,14 @@ CVE-2022-39178
RESERVED
 CVE-2022-39177 (BlueZ before 5.59 allows physically proximate attackers to 
cause a den ...)
- bluez 5.61-1
+   [bullseye] - bluez  (Minor issue)
NOTE: 
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=e2b0f0d8d63e1223bb714a9efb37e2257818268b
 (5.59)
NOTE: 
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=7a80d2096f1b7125085e21448112aa02f49f5e9a
 (5.59)
NOTE: 
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=0388794dc5fdb73a4ea88bcf148de0a12b4364d4
 (5.60)
NOTE: https://bugs.launchpad.net/ubuntu/+source/bluez/+bug/1977968
 CVE-2022-39176 (BlueZ before 5.59 allows physically proximate attackers to 
obtain sens ...)
- bluez 5.61-1
+   [bullseye] - bluez  (Minor issue)
NOTE: 
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=e2b0f0d8d63e1223bb714a9efb37e2257818268b
 (5.59)
NOTE: 
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=7a80d2096f1b7125085e21448112aa02f49f5e9a
 (5.59)
NOTE: 
https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=0388794dc5fdb73a4ea88bcf148de0a12b4364d4
 (5.60)
@@ -4488,18 +4492,22 @@ CVE-2022-2994
RESERVED
 CVE-2022-38752 (Using snakeYAML to parse untrusted YAML files may be 
vulnerable to Den ...)
- snakeyaml 
+   [bullseye] - snakeyaml  (Minor issue)
NOTE: 
https://bitbucket.org/snakeyaml/snakeyaml/issues/531/stackoverflow-oss-fuzz-47081
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47081 (not 
public)
 CVE-2022-38751 (Using snakeYAML to parse untrusted YAML files may be 
vulnerable to Den ...)
- snakeyaml 
+   [bullseye] - snakeyaml  (Minor issue)
NOTE: 
https://bitbucket.org/snakeyaml/snakeyaml/issues/530/stackoverflow-oss-fuzz-47039
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47039
 CVE-2022-38750 (Using snakeYAML to parse untrusted YAML files may be 
vulnerable to Den ...)
- snakeyaml 
+   [bullseye] - snakeyaml  (Minor issue)
NOTE: 
https://bitbucket.org/snakeyaml/snakeyaml/issues/526/stackoverflow-oss-fuzz-47027
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47027
 CVE-2022-38749 (Using snakeYAML to parse untrusted YAML files may be 
vulnerable to Den ...)
- snakeyaml 
+   [bullseye] - snakeyaml  (Minor issue)
NOTE: 
https://bitbucket.org/snakeyaml/snakeyaml/issues/525/got-stackoverflowerror-for-many-open
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47024
 CVE-2022-38748
@@ -4531,6 +4539,7 @@ CVE-2022-2990 (An incorrect handling of the supplementary 
groups in the Buildah
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2121453
 CVE-2022-2989 (An incorrect handling of the supplementary groups in the Podman 
contai ...)
- libpod  (bug #1019591)
+   [bullseye] - libpod  (Minor issue)
NOTE: 
https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2121445
 CVE-2022-2988
@@ -5143,6 +5152,7 @@ CVE-2022-38529 (tinyexr commit 0647fb3 was discovered to 
contain a heap-buffer o
NOTE: 
https://github.com/syoyo/tinyexr/commit/82984a37d1dba67000a35b083b26df5e57a2bb72
 CVE-2022-38528 (Open Asset Import Library (assimp) commit 3c253ca was 
discovered to co ...)
- assimp 
+   [bullseye] - assimp  (Minor issue)
NOTE: https://github.com/assimp/assimp/issues/4662
 CVE-2022-38527
RESERVED
@@ -6422,9 +6432,11 @@ CVE-2022-38154
RESERVED
 CVE-2022-38153 (An issue was discovered in wolfSSL before 5.5.0 (when 
--enable-session ...)
- wolfssl 
+   [bullseye] - wolfssl  (Vulnerable code not present and 
session tickets not enabled)

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-12 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
39444394 by Moritz Muehlenhoff at 2022-09-12T15:57:12+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -364,6 +364,7 @@ CVE-2022-3173
RESERVED
 CVE-2022-40320 (cfg_tilde_expand in confuse.c in libConfuse 3.3 has a 
heap-based buffe ...)
- libconfuse 
+   [bullseye] - libconfuse  (Minor issue)
NOTE: https://github.com/libconfuse/libconfuse/issues/163
NOTE: Fixed by: 
https://github.com/libconfuse/libconfuse/commit/d73777c2c3566fb2647727bb56d9a2295b81669b
 CVE-2022-40319
@@ -553,6 +554,7 @@ CVE-2022-3168
RESERVED
 CVE-2019-25076 (The TSS (Tuple Space Search) algorithm in Open vSwitch 2.x 
through 2.1 ...)
- openvswitch 
+   [bullseye] - openvswitch  (Minor issue)
NOTE: https://arxiv.org/abs/2011.09107
NOTE: https://sites.google.com/view/tuple-space-explosion
NOTE: https://dl.acm.org/doi/10.1145/3359989.3365431
@@ -4043,6 +4045,7 @@ CVE-2022-2997 (Session Fixation in GitHub repository 
snipe/snipe-it prior to 6.0
- snipe-it  (bug #1005172)
 CVE-2022-2996 (A flaw was found in the python-scciclient when making an HTTPS 
connect ...)
- python-scciclient  (bug #1018213)
+   [bullseye] - python-scciclient  (Minor issue)
NOTE: 
https://opendev.org/x/python-scciclient/commit/274dca0344b65b4ac113d3271d21c17e970a636c
 (0.12)
 CVE-2022-2995
RESERVED
@@ -11193,6 +11196,7 @@ CVE-2022-36110 (Netmaker makes networks with WireGuard. 
Prior to version 0.15.1,
TODO: check
 CVE-2022-36109 (Moby is an open-source project created by Docker to enable 
software co ...)
- docker.io 
+   [bullseye] - docker.io  (Minor issue)
NOTE: 
https://github.com/moby/moby/security/advisories/GHSA-rc4r-wh2q-q6c4
NOTE: 
https://github.com/moby/moby/commit/de7af816e76a7fd3fbf06bffa6832959289fba32
 CVE-2022-36108
@@ -41481,6 +41485,7 @@ CVE-2022-0671 (A flaw was found in vscode-xml in 
versions prior to 0.19.0. Schem
NOT-FOR-US: vscode-xml
 CVE-2022-0670 (A flaw was found in Openstack manilla owning a Ceph File system 
"share ...)
- ceph 16.2.10+ds-1 (bug #1016069)
+   [bullseye] - ceph  (Minor issue)
[buster] - ceph  (Minor issue)
NOTE: https://ceph.io/en/news/blog/2022/v17-2-2-quincy-released/
NOTE: https://docs.ceph.com/en/latest/security/CVE-2022-0670/
@@ -43917,12 +43922,14 @@ CVE-2022-24578 (GPAC 1.0.1 is affected by a 
heap-based buffer overflow in SFS_Ad
NOTE: 
https://github.com/gpac/gpac/commit/b5741da08e88e8dcc8da0a7669b92405b9862850 
(v2.0.0)
 CVE-2022-24577 (GPAC 1.0.1 is affected by a NULL pointer dereference in 
gf_utf8_wcslen ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://huntr.dev/bounties/0758b3a2-8ff2-45fc-8543-7633d605d24e/
NOTE: 
https://github.com/gpac/gpac/commit/586e817dcd531bb3e75438390f1f753cfe6e940a 
(v2.0.0)
 CVE-2022-24576 (GPAC 1.0.1 is affected by Use After Free through MP4Box. ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/2061
@@ -44663,6 +44670,7 @@ CVE-2022-24303 (Pillow before 9.0.1 allows attackers to 
delete files because spa
 CVE-2022-24302 (In Paramiko before 2.10.1, a race condition (between creation 
and chmo ...)
{DLA-2959-1}
- paramiko 2.10.3-1 (bug #1008012)
+   [bullseye] - paramiko  (Minor issue)
NOTE: 
https://github.com/paramiko/paramiko/commit/4c491e299c9b800358b16fa4886d8d94f45abe2e
 (2.10.1)
 CVE-2022-24296 (Use of a Broken or Risky Cryptographic Algorithm vulnerability 
in Air  ...)
NOT-FOR-US: Mitsubishi
@@ -79262,10 +79270,12 @@ CVE-2021-37820
RESERVED
 CVE-2021-37819 (PDF Labs pdftk-java v3.2.3 was discovered to contain an 
infinite loop  ...)
- pdftk-java 3.3.2-1
-   - pdftk 
+   [bullseye] - pdftk-java  (Minor issue)
+   - pdftk 2.02-5
NOTE: https://gitlab.com/pdftk-java/pdftk/-/merge_requests/21
NOTE: 
https://gitlab.com/pdftk-java/pdftk/-/commit/75deacdf5c46fd4eefb310c784eb9dfdc7b9fdc9
 (v3.3.0)
NOTE: 
https://gitlab.com/pdftk-java/pdftk/-/commit/9b0cbb76c8434a8505f02ada02a94263dcae9247
 (v3.3.0)
+   NOTE: Starting with 2.02-5 src:pdftk is just a transition package 
towards src:pdftk-java
TODO: check impact on other sources embedding 
lowagie/text/pdf/PdfReader.java
 CVE-2021-37818
RESERVED


=
data/dsa-needed.txt
=
@@ -20,6 +20,8 @@

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-09 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
cacc85a3 by Moritz Muehlenhoff at 2022-09-09T11:49:27+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -17,9 +17,10 @@ CVE-2022-40300
RESERVED
 CVE-2022-40299 (In Singular before 4.3.1, a predictable /tmp pathname is used 
(e.g., b ...)
[experimental] - singular 1:4.3.1-p1+ds-1
-   - singular 
+   - singular  (unimportant)
NOTE: 
https://github.com/Singular/Singular/commit/5f28fbf066626fa9c4a8f0e6408c0bb362fb386c
 (Release-4-3-1)
NOTE: https://github.com/Singular/Singular/issues/1137
+   NOTE: Neutralised by kernel hardening (fs.protected_symlinks = 1)
 CVE-2022-40298
RESERVED
 CVE-2022-40297 (UBports Ubuntu Touch 16.04 allows the screen-unlock passcode 
to be use ...)
@@ -4926,9 +4927,10 @@ CVE-2022-2850 [SIGSEGV in sync_repl]
NOTE: 
https://github.com/389ds/389-ds-base/commit/bd566957f85c889f13cd24f903c91c16c955acbd
 (389-ds-base-1.3.10)
NOTE: Results from an incomplete fix for CVE-2021-3514
 CVE-2022-2849 (Heap-based Buffer Overflow in GitHub repository vim/vim prior 
to 9.0.0 ...)
-   - vim 2:9.0.0229-1
+   - vim 2:9.0.0229-1 (unimportant)
NOTE: https://huntr.dev/bounties/389aeccd-deb9-49ae-9b6a-24c12d79b02e
NOTE: 
https://github.com/vim/vim/commit/f6d39c31d2177549a986d170e192d8351bd571e2 
(v9.0.0220)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2848
RESERVED
 CVE-2022-2847 (A vulnerability, which was classified as critical, has been 
found in S ...)
@@ -4936,9 +4938,10 @@ CVE-2022-2847 (A vulnerability, which was classified as 
critical, has been found
 CVE-2022-2846 (A vulnerability classified as problematic was found in Calendar 
Event  ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-2845 (Buffer Over-read in GitHub repository vim/vim prior to 
9.0.0218. ...)
-   - vim 2:9.0.0229-1
+   - vim 2:9.0.0229-1 (unimportant)
NOTE: https://huntr.dev/bounties/3e1d31ac-1cfd-4a9f-bc5c-213376b69445
NOTE: 
https://github.com/vim/vim/commit/e98c88c44c308edaea5994b8ad4363e65030968c 
(v9.0.0218)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2844 (A vulnerability classified as problematic has been found in 
MotoPress  ...)
NOT-FOR-US: WordPress plugin
 CVE-2022-2843 (A vulnerability was found in MotoPress Timetable and Event 
Schedule. I ...)
@@ -24497,6 +24500,7 @@ CVE-2022-1776 (The Popups, Welcome Bar, Optins and Lead 
Generation Plugin WordPr
NOT-FOR-US: WordPress plugin
 CVE-2022-30976 (GPAC 2.0.0 misuses a certain Unicode utf8_wcslen (renamed 
gf_utf8_wcsl ...)
- gpac  (bug #1016443)
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/2179
@@ -43496,6 +43500,7 @@ CVE-2022-24576 (GPAC 1.0.1 is affected by Use After 
Free through MP4Box. ...)
NOTE: 
https://github.com/gpac/gpac/commit/96699aabae042f8f55cf8a85fa5758e3db752bae 
(v2.0.0)
 CVE-2022-24575 (GPAC 1.0.1 is affected by a stack-based buffer overflow 
through MP4Box ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/2058
@@ -63757,6 +63762,7 @@ CVE-2021-43178
REJECTED
 CVE-2021-43177 (As a result of an incomplete fix for CVE-2015-7225, in 
versions of dev ...)
- ruby-devise-two-factor 4.0.2-1 (bug #1009636)
+   [bullseye] - ruby-devise-two-factor  (Minor issue)
NOTE: 
https://github.com/tinfoil/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp
NOTE: https://github.com/tinfoil/devise-two-factor/pull/108
NOTE: 
https://github.com/tinfoil/devise-two-factor/commit/64576bb9e7d29800c5f92bb86fb6ecff91ad6105
 (v4.0.2)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cacc85a3dee80e45a3f10fb953e17cd59a396db1

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cacc85a3dee80e45a3f10fb953e17cd59a396db1
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-07 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
aa62fa10 by Moritz Muehlenhoff at 2022-09-07T11:31:45+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -396,6 +396,7 @@ CVE-2022-3135
RESERVED
 CVE-2022-3134 (Use After Free in GitHub repository vim/vim prior to 9.0.0388. 
...)
- vim 
+   [bullseye] - vim  (Minor issue)
NOTE: https://huntr.dev/bounties/6ec79e49-c7ab-4cd6-a517-e7934c2eb9dc
NOTE: 
https://github.com/vim/vim/commit/ccfde4d028e891a41e3548323c3d47b06fb0b83e 
(v9.0.0389)
 CVE-2022-39959
@@ -684,9 +685,11 @@ CVE-2022-39833
RESERVED
 CVE-2022-39832 (An issue was discovered in PSPP 1.6.2. There is a heap-based 
buffer ov ...)
- pspp 
+   [bullseye] - pspp  (Minor issue)
NOTE: https://savannah.gnu.org/bugs/index.php?63000
 CVE-2022-39831 (An issue was discovered in PSPP 1.6.2. There is a heap-based 
buffer ov ...)
- pspp 
+   [bullseye] - pspp  (Minor issue)
NOTE: https://savannah.gnu.org/bugs/?62977
 CVE-2022-39830 (sign_pFwInfo in Samsung mTower through 0.3.0 has a missing 
check on th ...)
NOT-FOR-US: Samsung mTower
@@ -3904,6 +3907,7 @@ CVE-2022-38531
RESERVED
 CVE-2022-38530 (GPAC v2.1-DEV-rev232-gfcaa01ebb-master was discovered to 
contain a sta ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
NOTE: https://github.com/gpac/gpac/issues/2216
NOTE: 
https://github.com/gpac/gpac/commit/4e56ad72ac1afb4e049a10f2d99e7512d7141f9d
 CVE-2022-38529 (tinyexr commit 0647fb3 was discovered to contain a heap-buffer 
overflo ...)
@@ -10488,6 +10492,7 @@ CVE-2022-36060
 CVE-2022-36059
RESERVED
- node-matrix-js-sdk  (bug #1018970)
+   [bullseye] - node-matrix-js-sdk  (Minor issue)
- thunderbird 1:102.2.1-1
[bullseye] - thunderbird  (Only affects ESR102)
[buster] - thunderbird  (Only affects ESR102)
@@ -39025,6 +39030,7 @@ CVE-2022-25324 (All versions of package bignum are 
vulnerable to Denial of Servi
NOT-FOR-US: justmoon/node-bignum
 CVE-2022-25304 (All versions of package opcua; all versions of package asyncua 
are vul ...)
- python-opcua 
+   [bullseye] - python-opcua  (Minor issue)
NOTE: https://github.com/FreeOpcUa/python-opcua/issues/1466
NOTE: https://security.snyk.io/vuln/SNYK-PYTHON-OPCUA-2988730
 CVE-2022-25303 (The package whoogle-search before 0.7.2 are vulnerable to 
Cross-site S ...)
@@ -42396,6 +42402,7 @@ CVE-2022-24758 (The Jupyter notebook is a web-based 
notebook environment for int
NOTE: 
https://github.com/jupyter/notebook/commit/c219ce43c1ea25123fa70d264e7735bdf4585b1e
 (6.4.10)
 CVE-2022-24757 (The Jupyter Server provides the backend (i.e. the core 
services, APIs, ...)
- jupyter-server 1.16.0-1 (bug #1008319)
+   [bullseye] - jupyter-server  (Minor issue)
NOTE: 
https://github.com/jupyter-server/jupyter_server/commit/a5683aca0b0e412672ac6218d09f74d44ca0de5a
 (v1.15.4)
NOTE: 
https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-p737-p57g-4cpr
 CVE-2022-24756 (Bareos is open source software for backup, archiving, and 
recovery of  ...)
@@ -177949,6 +177956,7 @@ CVE-2020-10735
- python3.11 
- python3.10 
- python3.9 
+   [bullseye] - python3.9  (Minor issue)
- python3.7 
NOTE: https://github.com/python/cpython/issues/95778
NOTE: https://github.com/python/cpython/pull/96499


=
data/dsa-needed.txt
=
@@ -14,6 +14,8 @@ If needed, specify the release by adding a slash after the 
name of the source pa
 --
 asterisk (apo)
 --
+commons-configuration
+--
 connman (carnil)
 --
 freecad (aron)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aa62fa10b5423e05c629cb3b6b58652a0a91af0b

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/aa62fa10b5423e05c629cb3b6b58652a0a91af0b
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-05 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
545f141d by Moritz Muehlenhoff at 2022-09-05T18:28:43+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -2787,6 +2787,7 @@ CVE-2022-2963
 CVE-2022-2962
RESERVED
- qemu  (bug #1018055)
+   [bullseye] - qemu  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2120631
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/1171
NOTE: 
https://lore.kernel.org/qemu-devel/20220821124343.1336880-1-zheyum...@gmail.com/
@@ -18886,6 +18887,7 @@ CVE-2022-32512
RESERVED
 CVE-2022-32511 (jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses 
JSON.load in a s ...)
- ruby-jmespath 1.6.1-1 (bug #1014807)
+   [bullseye] - ruby-jmespath  (Minor issue)
NOTE: https://github.com/jmespath/jmespath.rb/pull/55
NOTE: 
https://github.com/jmespath/jmespath.rb/commit/e8841280053a9d9a0c90f36223f926c8b9e4ec49
 (v1.6.1)
 CVE-2022-32510
@@ -38544,6 +38546,7 @@ CVE-2019-25058 (An issue was discovered in USBGuard 
before 1.1.0. On systems wit
{DLA-2979-1}
[experimental] - usbguard 1.1.0+ds-1
- usbguard 1.1.0+ds-2 (bug #1008026)
+   [bullseye] - usbguard  (Minor issue)
NOTE: https://github.com/USBGuard/usbguard/issues/273
NOTE: https://github.com/USBGuard/usbguard/issues/403
NOTE: https://github.com/USBGuard/usbguard/pull/531


=
data/dsa-needed.txt
=
@@ -46,6 +46,8 @@ rails
 rpki-client
   new 7.6 release required libretls, which isn't in Bullseye
 --
+ruby-image-processing
+--
 ruby-rack
 --
 ruby-tzinfo



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/545f141d6f46325742e996ed14b9cd2331ab116f

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/545f141d6f46325742e996ed14b9cd2331ab116f
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-05 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
3fe0d32f by Moritz Muehlenhoff at 2022-09-05T16:59:40+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -4765,6 +4765,7 @@ CVE-2022-2735
- pcs 0.11.3-2 (bug #1018930)
NOTE: https://www.openwall.com/lists/oss-security/2022/09/01/4
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2116815
+   NOTE: 
https://github.com/ClusterLabs/pcs/commit/de068e2066e377d1cc77edf25aed0198e4c77f7b
 CVE-2022-2734 (Improper Restriction of Rendered UI Layers or Frames in GitHub 
reposit ...)
NOT-FOR-US: OpenEMR
 CVE-2022-2733 (Cross-site Scripting (XSS) - Reflected in GitHub repository 
openemr/op ...)
@@ -34918,24 +34919,28 @@ CVE-2022-27149
REJECTED
 CVE-2022-27148 (GPAC mp4box 1.1.0-DEV-rev1663-g881c6a94a-master is vulnerable 
to Integ ...)
- gpac 2.0.0+dfsg1-2
-   [buster] - gpac  (EOL in buster LTS)
+   [bullseye] - gpac  (Vulnerable code not present)
+   [buster] - gpac  (Vulnerable code not present)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/2067
NOTE: 
https://github.com/gpac/gpac/commit/0cd19f4db70615d707e0e6202933c2ea0c1d36df 
(v2.0.0)
 CVE-2022-27147 (GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a 
use-after-free v ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/2109
NOTE: 
https://github.com/gpac/gpac/commit/9723dd0955894f2cb7be13b94cf7a47f2754b893 
(v2.0.0)
 CVE-2022-27146 (GPAC mp4box 1.1.0-DEV-rev1759-geb2d1e6dd-has a 
heap-buffer-overflow vu ...)
- gpac 2.0.0+dfsg1-2
-   [buster] - gpac  (EOL in buster LTS)
+   [bullseye] - gpac  (Vulnerable code not present)
+   [buster] - gpac  (Vulnerable code not present)
[stretch] - gpac  (No longer supported in LTS)
NOTE: https://github.com/gpac/gpac/issues/2120
NOTE: 
https://github.com/gpac/gpac/commit/f0a41d178a2dc5ac185506d9fa0b0a58356b16f7 
(v2.0.0)
 CVE-2022-27145 (GPAC mp4box 1.1.0-DEV-rev1727-g8be34973d-master has a 
stack-overflow v ...)
- gpac 2.0.0+dfsg1-2
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
[stretch] - gpac  (No longer supported in LTS)
NOTE: 
https://github.com/gpac/gpac/commit/d7daa8aeb6df4b6c3ec102622e1599279310a19e 
(v2.0.0)


=
data/dsa-needed.txt
=
@@ -33,6 +33,8 @@ netatalk
 --
 nodejs
 --
+pcs (jmm)
+--
 php-horde-mime-viewer
 --
 php-horde-turba



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3fe0d32f5f72ecf42066838cdecbeec91194de30

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3fe0d32f5f72ecf42066838cdecbeec91194de30
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-05 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
16b896bb by Moritz Muehlenhoff at 2022-09-05T12:20:25+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -25478,6 +25478,7 @@ CVE-2022-28702 (Incorrect Default Permissions 
vulnerability in ABB e-Design allo
NOT-FOR-US: ABB e-Design
 CVE-2022-1615 (In Samba, GnuTLS gnutls_rnd() can fail and give predictable 
random val ...)
- samba 
+   [bullseye] - samba  (Minor issue)
NOTE: https://bugzilla.samba.org/show_bug.cgi?id=15103
NOTE: 
https://gitlab.com/samba-team/samba/-/commit/9849e7440e30853c61a80ce1f11b7b244ed766fe
 (v4-17-stable)
 CVE-2022-1614 (The WP-EMail WordPress plugin before 2.69.0 prioritizes getting 
a visi ...)
@@ -41751,12 +41752,14 @@ CVE-2022-24730 (Argo CD is a declarative, GitOps 
continuous delivery tool for Ku
 CVE-2022-24729 (CKEditor4 is an open source what-you-see-is-what-you-get HTML 
editor.  ...)
- ckeditor 4.19.0+dfsg-1
- ckeditor3  (bug #1015217)
+   [bullseye] - ckeditor3  (Minor issue)
[buster] - ckeditor3  (No longer supported in LTS)
[stretch] - ckeditor3  (EOL'd for stretch)
NOTE: 
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-f6rf-9m92-x2hh
 CVE-2022-24728 (CKEditor4 is an open source what-you-see-is-what-you-get HTML 
editor.  ...)
- ckeditor 4.19.0+dfsg-1
- ckeditor3  (bug #1015217)
+   [bullseye] - ckeditor3  (Minor issue)
[buster] - ckeditor3  (No longer supported in LTS)
[stretch] - ckeditor3  (EOL'd for stretch)
NOTE: 
https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-4fc4-4p5g-6w89
@@ -55668,6 +55671,7 @@ CVE-2021-44739 (Acrobat Reader DC ActiveX Control 
versions 21.007.20099 (and ear
NOT-FOR-US: Adobe
 CVE-2021-44545 (Improper input validation for some Intel(R) PROSet/Wireless 
WiFi and K ...)
- firmware-nonfree 
+   [bullseye] - firmware-nonfree  (Non-free not supported)
NOTE: 
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html
NOTE: Fixed upstream in 20220815
NOTE: 
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=63a87d2f1f7ea029e8d32ed03d972947a7bb60fd
@@ -55697,6 +55701,7 @@ CVE-2021-23188 (Improper access control for some 
Intel(R) PROSet/Wireless WiFi a
NOT-FOR-US: Intel
 CVE-2021-23168 (Out of bounds read for some Intel(R) PROSet/Wireless WiFi and 
Killer(T ...)
- firmware-nonfree 
+   [bullseye] - firmware-nonfree  (Non-free not supported)
NOTE: 
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html
NOTE: Fixed upstream in 20220815
NOTE: 
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=63a87d2f1f7ea029e8d32ed03d972947a7bb60fd
@@ -56681,6 +56686,7 @@ CVE-2021-4036
RESERVED
 CVE-2021-37409 (Improper access control for some Intel(R) PROSet/Wireless WiFi 
and Kil ...)
- firmware-nonfree 
+   [bullseye] - firmware-nonfree  (Non-free not supported)
NOTE: 
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html
NOTE: Fixed upstream in 20220815
NOTE: 
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=63a87d2f1f7ea029e8d32ed03d972947a7bb60fd
@@ -56708,6 +56714,7 @@ CVE-2021-26251
RESERVED
 CVE-2021-23223 (Improper initialization for some Intel(R) PROSet/Wireless WiFi 
and Kil ...)
- firmware-nonfree 
+   [bullseye] - firmware-nonfree  (Non-free not supported)
NOTE: 
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html
NOTE: Fixed upstream in 20220815
NOTE: 
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=63a87d2f1f7ea029e8d32ed03d972947a7bb60fd
@@ -60384,6 +60391,7 @@ CVE-2022-21203 (Improper permissions in the SafeNet 
Sentinel driver for Intel(R)
NOT-FOR-US: Intel
 CVE-2022-21181 (Improper input validation for some Intel(R) PROSet/Wireless 
WiFi and K ...)
- firmware-nonfree 
+   [bullseye] - firmware-nonfree  (Non-free not supported)
NOTE: 
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00621.html
NOTE: Fixed upstream in 20220815
NOTE: 
https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/commit/?id=63a87d2f1f7ea029e8d32ed03d972947a7bb60fd
@@ -69006,6 +69014,7 @@ CVE-2021-41165 (CKEditor4 is an open source WYSIWYG 
HTML editor. In affected ver
[buster] - ckeditor  (Minor issue)
[stretch] - ckeditor  (Minor issue)
- ckeditor3  (bug #1015217)
+   [bullseye] - ckeditor3  (Minor issue)
[buster] - ckeditor3  (No longer

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-02 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
7fa5035b by Moritz Muehlenhoff at 2022-09-02T09:07:16+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -3914,10 +3914,10 @@ CVE-2022-37772
 CVE-2022-37771
RESERVED
 CVE-2022-37770 (libjpeg commit 281daa9 was discovered to contain a 
segmentation fault  ...)
-   - libjpeg 
-   [bullseye] - libjpeg  (Minor issue)
+   - libjpeg  (unimportant)
NOTE: https://github.com/thorfdbg/libjpeg/issues/79
NOTE: 
https://github.com/thorfdbg/libjpeg/commit/281daa9ccee18742b83a77cd29bd2726b69b7977
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-37769 (libjpeg commit 281daa9 was discovered to contain a 
segmentation fault  ...)
- libjpeg 
[bullseye] - libjpeg  (Minor issue)
@@ -5716,11 +5716,13 @@ CVE-2022-37049 (The component tcpprep in Tcpreplay 
v4.4.1 was discovered to cont
NOTE: https://github.com/appneta/tcpreplay/issues/718
NOTE: Crash in CLI tool, no security impact
 CVE-2022-37048 (The component tcprewrite in Tcpreplay v4.4.1 was discovered to 
contain ...)
-   - tcpreplay  (bug #1018057)
+   - tcpreplay  (unimportant; bug #1018057)
NOTE: https://github.com/appneta/tcpreplay/issues/735
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-37047 (The component tcprewrite in Tcpreplay v4.4.1 was discovered to 
contain ...)
-   - tcpreplay  (bug #1018057)
+   - tcpreplay  (unimportant; bug #1018057)
NOTE: https://github.com/appneta/tcpreplay/issues/734
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-37046
RESERVED
 CVE-2022-37045
@@ -7963,11 +7965,13 @@ CVE-2022-36192
RESERVED
 CVE-2022-36191 (A heap-buffer-overflow had occurred in function 
gf_isom_dovi_config_ge ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
NOTE: https://github.com/gpac/gpac/issues/2218
NOTE: 
https://github.com/gpac/gpac/commit/fef6242c69be4f7ba22b32578e4b62648a3d4ed3
 CVE-2022-36190 (GPAC mp4box 2.1-DEV-revUNKNOWN-master has a use-after-free 
vulnerabili ...)
- gpac 
+   [bullseye] - gpac  (Minor issue)
[buster] - gpac  (EOL in buster LTS)
NOTE: https://github.com/gpac/gpac/issues/2220
NOTE: Fixed along with: https://github.com/gpac/gpac/issues/2218
@@ -10582,8 +10586,9 @@ CVE-2022-35168 (Due to improper input sanitization of 
XML input in SAP Business
 CVE-2022-35167 (Printix Cloud Print Management v1.3.1149.0 for Windows was 
discovered  ...)
NOT-FOR-US: Printix Cloud Print Management
 CVE-2022-35166 (libjpeg commit 842c7ba was discovered to contain an infinite 
loop via  ...)
-   - libjpeg 
+   - libjpeg  (unimportant)
NOTE: https://github.com/thorfdbg/libjpeg/issues/7
+   NOTE: Hang in CLI tool, no security impact
 CVE-2022-35165 (An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 
allows at ...)
NOT-FOR-US: Bento4
 CVE-2022-35164 (LibreDWG v0.12.4.4608  commit f2dea29 was discovered to 
contain a ...)
@@ -41297,6 +41302,7 @@ CVE-2022-21795
RESERVED
 CVE-2022-21233 (Improper isolation of shared resources in some Intel(R) 
Processors may ...)
- intel-microcode 3.20220809.1
+   [bullseye] - intel-microcode  (Minor issue, only impacts SGX)
NOTE: 
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00657.html
NOTE: 
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20220809
 CVE-2022-21128 (Insufficient control flow management in the Intel(R) Advisor 
software  ...)
@@ -43083,6 +43089,7 @@ CVE-2022-0368 (Out-of-bounds Read in GitHub repository 
vim/vim prior to 8.2. ...
NOTE: 
https://github.com/vim/vim/commit/8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa 
(v8.2.4217)
 CVE-2022-0367 (A heap-based buffer overflow flaw was found in libmodbus in 
function m ...)
- libmodbus 
+   [bullseye] - libmodbus  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2045571
NOTE: https://github.com/stephane/libmodbus/issues/614
NOTE: Fixed by: 
https://github.com/stephane/libmodbus/commit/b4ef4c17d618eba0adccc4c7d9e9a1ef809fc9b6
 (v3.1.7)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7fa5035b624ace13d3e469a2299b5e0acfea442c

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/7fa5035b624ace13d3e469a2299b5e0acfea442c
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-09-01 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
93a402ef by Moritz Muehlenhoff at 2022-09-01T15:44:24+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -7076,23 +7076,26 @@ CVE-2022-2522 (Heap-based Buffer Overflow in GitHub 
repository vim/vim prior to
NOTE: https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22
NOTE: 
https://github.com/vim/vim/commit/5fa9f23a63651a8abdb074b4fc2ec9b1adc6b089 
(v9.0.0061)
 CVE-2022-2521 (It was found in libtiff 4.4.0rc1 that there is an invalid 
pointer free ...)
-   - tiff 
+   - tiff  (unimportant)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/422
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/378
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/8fe3735942ea1d90d8cef843b55b3efe8ab6feaf
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/bad48e90b410df32172006c7876da449ba62cdba
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2520 (A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc 
assertion f ...)
-   - tiff 
+   - tiff  (unimportant)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/424
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/378
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/8fe3735942ea1d90d8cef843b55b3efe8ab6feaf
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/bad48e90b410df32172006c7876da449ba62cdba
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2519 (There is a double free or corruption in rotateImage() at 
tiffcrop.c:88 ...)
-   - tiff 
+   - tiff  (unimportant)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/423
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/378
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/8fe3735942ea1d90d8cef843b55b3efe8ab6feaf
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/bad48e90b410df32172006c7876da449ba62cdba
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2518
RESERVED
 CVE-2022-2517
@@ -7756,7 +7759,8 @@ CVE-2022-36187
RESERVED
 CVE-2022-36186 (A Null Pointer dereference vulnerability exists in GPAC 
2.1-DEV-revUNK ...)
- gpac 
-   [buster] - gpac  (EOL in buster LTS)
+   [bullseye] - gpac  (Vulnerable code not present)
+   [buster] - gpac  (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2223
NOTE: 
https://github.com/gpac/gpac/commit/b43f9d1a4b4e33d08edaef6d313e6ce4bdf554d3
 CVE-2022-36185
@@ -54042,6 +54046,7 @@ CVE-2021-44716 (net/http in Go before 1.16.12 and 
1.17.x before 1.17.5 allows un
- golang-1.8 
- golang-1.7 
- golang-golang-x-net 1:0.0+git20211209.491a49a+dfsg-1
+   [bullseye] - golang-golang-x-net  (Minor issue)
- golang-golang-x-net-dev 
[stretch] - golang-golang-x-net-dev  (Limited support in 
stretch)
NOTE: https://github.com/golang/go/issues/50058
@@ -100469,6 +100474,7 @@ CVE-2021-28133 (Zoom through 5.5.4 sometimes allows 
attackers to read private in
NOT-FOR-US: Zoom
 CVE-2021-3427 (The Deluge Web-UI is vulnerable to XSS through a crafted 
torrent file. ...)
- deluge 
+   [bullseye] - deluge  (Minor issue)
NOTE: https://dev.deluge-torrent.org/ticket/3459
NOTE: https://dev.deluge-torrent.org/changeset/8ece03677
NOTE: https://dev.deluge-torrent.org/changeset/a5503c0c606


=
data/dsa-needed.txt
=
@@ -16,6 +16,8 @@ asterisk (apo)
 --
 chromium
 --
+connman
+--
 freecad (aron)
 --
 gdk-pixbuf (carnil)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/93a402efa03e97dd44b9c75612815b4e025ae670

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/93a402efa03e97dd44b9c75612815b4e025ae670
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-30 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
fe2a6c9c by Moritz Muehlenhoff at 2022-08-30T10:30:39+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -614,9 +614,10 @@ CVE-2022-3018
 CVE-2022-3017 (Cross-Site Request Forgery (CSRF) in GitHub repository 
froxlor/froxlor ...)
TODO: check
 CVE-2022-3016 (Use After Free in GitHub repository vim/vim prior to 9.0.0286. 
...)
-   - vim 
+   - vim  (unimportant)
NOTE: https://huntr.dev/bounties/260516c2-5c4a-4b7f-a01c-04b1aeeea371
NOTE: 
https://github.com/vim/vim/commit/6d24a51b94beb1991cddce221f90b455e2d50db7 
(v9.0.0286)
+   NOTE: Crash in CLI toool, no security impact
 CVE-2022-3015 (A vulnerability, which was classified as problematic, has been 
found i ...)
NOT-FOR-US: oretnom23 Fast Food Ordering System
 CVE-2022-3014 (A vulnerability classified as problematic was found in 
SourceCodester  ...)
@@ -1025,10 +1026,11 @@ CVE-2022-38668 (HTTP applications (servers) based on 
Crow through 1.0+4 may reve
 CVE-2022-38667 (HTTP applications (servers) based on Crow through 1.0+4 may 
allow a Us ...)
NOT-FOR-US: CrowCpp
 CVE-2022-2953 (LibTIFF 4.4.0 has an out-of-bounds read in extractImageSection 
in tool ...)
-   - tiff 
+   - tiff  (unimportant)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/414
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/8fe3735942ea1d90d8cef843b55b3efe8ab6feaf
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/bad48e90b410df32172006c7876da449ba62cdba
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-2952
RESERVED
 CVE-2022-2951
@@ -10434,32 +10436,38 @@ CVE-2022-35022
 CVE-2022-35021
RESERVED
 CVE-2022-35020 (Advancecomp v2.3 was discovered to contain a heap buffer 
overflow via  ...)
-   - advancecomp 
+   - advancecomp  (unimportant)
NOTE: 
https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35020.md
+   NOTE: Crash in CLI tool, no security impact
TODO: check, unclear reporting to upstream
 CVE-2022-35019 (Advancecomp v2.3 was discovered to contain a segmentation 
fault. ...)
- advancecomp 
NOTE: 
https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35019.md
TODO: check, unclear reporting to upstream
 CVE-2022-35018 (Advancecomp v2.3 was discovered to contain a segmentation 
fault. ...)
-   - advancecomp 
+   - advancecomp  (unimportant)
NOTE: 
https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35018.md
+   NOTE: Crash in CLI tool, no security impact
TODO: check, unclear reporting to upstream
 CVE-2022-35017 (Advancecomp v2.3 was discovered to contain a heap buffer 
overflow. ...)
-   - advancecomp 
+   - advancecomp  (unimportant)
NOTE: 
https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35017.md
+   NOTE: Crash in CLI tool, no security impact
TODO: check, unclear reporting to upstream
 CVE-2022-35016 (Advancecomp v2.3 was discovered to contain a heap buffer 
overflow. ...)
-   - advancecomp 
+   - advancecomp  (unimportant)
NOTE: 
https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35016.md
+   NOTE: Crash in CLI tool, no security impact
TODO: check, unclear reporting to upstream
 CVE-2022-35015 (Advancecomp v2.3 was discovered to contain a heap buffer 
overflow via  ...)
-   - advancecomp 
+   - advancecomp  (unimportant)
NOTE: 
https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35015.md
+   NOTE: Crash in CLI tool, no security impact
TODO: check, unclear reporting to upstream
 CVE-2022-35014 (Advancecomp v2.3 contains a segmentation fault. ...)
-   - advancecomp 
+   - advancecomp  (unimportant)
NOTE: 
https://github.com/Cvjark/Poc/blob/main/advancecomp/CVE-2022-35014.md
+   NOTE: Crash in CLI tool, no security impact
TODO: check, unclear reporting to upstream
 CVE-2022-35013 (PNGDec commit 8abf6be was discovered to contain a FPE via 
SaveBMP at / ...)
NOT-FOR-US: bitbank2/PNGdec
@@ -85243,6 +85251,7 @@ CVE-2021-3575 (A heap-based buffer overflow was found 
in openjpeg in color.c:379
 CVE-2021-3574 (A vulnerability was found in ImageMagick-7.0.11-5, where 
executing a c ...)
[experimental] - imagemagick 8:6.9.12.20+dfsg1-1
- imagemagick 
+   [bullseye] - imagemagick  (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/3540
NOTE: 
https://github.com/ImageMagick/ImageMagick/commit/c6ad94fbb7b280f39c2fbbdc1c140e51b1b466e9
NOTE: 
https://github.com/ImageMagick/ImageMagick6/commit/cd7f9fb7751b0d59d5a74b12d971155caad5a792



View it on GitLab:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-26 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
3d0ad999 by Moritz Muehlenhoff at 2022-08-26T09:50:22+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -62563,18 +62563,22 @@ CVE-2022-20113 (In mPreference of 
DefaultUsbConfigurationPreferenceController.ja
 CVE-2022-20112 (In getAvailabilityStatus of 
PrivateDnsPreferenceController.java, there ...)
NOT-FOR-US: Android
 CVE-2021-42523 (There are two Information Disclosure vulnerabilities in 
colord, and th ...)
-   - colord 1.4.6-1
+   - colord 1.4.6-1 (unimportant)
NOTE: https://github.com/hughsie/colord/issues/110
NOTE: 
https://github.com/hughsie/colord/commit/adf41f36cf7214d7d6fa8d528b74eba47c377405
 (1.4.6)
+   NOTE: Memory leak in a system-local daemon, negligible security impact
 CVE-2021-42522 (There is a Information Disclosure vulnerability in 
anjuta/plugins/docu ...)
-   - anjuta 
+   - anjuta  (unimportant)
NOTE: https://gitlab.gnome.org/Archive/anjuta/-/issues/12
+   NOTE: Memory leak in GUI application, no security impact
 CVE-2021-42521 (There is a NULL pointer dereference vulnerability in VTK, and 
it lies  ...)
- vtk9 
+   [bullseye] - vtk9  (Minor issue)
- vtk7 
+   [bullseye] - vtk7  (Minor issue)
- vtk6 
+   [bullseye] - vtk6  (Minor issue)
NOTE: https://gitlab.kitware.com/vtk/vtk/-/issues/17818
-   TODO: check, potentially as well src:paraview, but needs to check impact
 CVE-2021-42520
RESERVED
 CVE-2021-42519
@@ -127621,6 +127625,7 @@ CVE-2020-28590 (An out-of-bounds read vulnerability 
exists in the Obj File Trian
NOTE: Crash in enduser application, no security impact
 CVE-2020-28589 (An improper array index validation vulnerability exists in the 
LoadObj ...)
- tinyobjloader  (bug #1014776)
+   [bullseye] - tinyobjloader  (Minor issue)
NOTE: 
https://talosintelligence.com/vulnerability_reports/TALOS-2020-1212
 CVE-2020-28588 (An information disclosure vulnerability exists in the 
/proc/pid/syscal ...)
- linux 5.9.15-1


=
data/dsa-needed.txt
=
@@ -51,3 +51,7 @@ sox
 --
 thunderbird (jmm)
 --
+webkit2gtk
+--
+wpewebkit
+--



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d0ad999e218a3e65817af7df4effe54c638657c

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3d0ad999e218a3e65817af7df4effe54c638657c
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-24 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
432d4ffb by Moritz Muehlenhoff at 2022-08-24T10:35:59+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1173,16 +1173,19 @@ CVE-2022-2835
 CVE-2022-2834
RESERVED
 CVE-2022-2833 (Endless Infinite loop in Blender-thumnailing due to logical 
bugs. ...)
-   - blender 3.2.2+dfsg-1
+   - blender 3.2.2+dfsg-1 (unimportant)
NOTE: 
https://developer.blender.org/rB24a2b5cb1292f769dd86e314471443976d5e9512
NOTE: https://developer.blender.org/T99711
+   NOTE: Hang in CLI tool, no security impact
 CVE-2022-2832 (When rendering with headless builds, show an error instead of 
crashing ...)
- blender 
+   [bullseye] - blender  (Minor issue)
NOTE: https://developer.blender.org/T99706
NOTE: https://developer.blender.org/D15463
NOTE: 
https://developer.blender.org/rB00dc7477022acdd969e4d709a235c0be819efa6c
 CVE-2022-2831 (A loaded (and valid) image can be crafted such that an 
out-of-bounds r ...)
- blender 3.2.2+dfsg-1
+   [bullseye] - blender  (Minor issue)
NOTE: https://developer.blender.org/T99705
NOTE: 
https://developer.blender.org/rB32df09b2416a6961704eca0fe73534c8c4e715b2
NOTE: 
https://developer.blender.org/rBb1329d7eaa52a11c73b75d19d20bd8f6d11ac535
@@ -2657,13 +2660,19 @@ CVE-2022-37771
RESERVED
 CVE-2022-37770 (libjpeg commit 281daa9 was discovered to contain a 
segmentation fault  ...)
- libjpeg 
+   [bullseye] - libjpeg  (Minor issue)
NOTE: https://github.com/thorfdbg/libjpeg/issues/79
+   NOTE: 
https://github.com/thorfdbg/libjpeg/commit/281daa9ccee18742b83a77cd29bd2726b69b7977
 CVE-2022-37769 (libjpeg commit 281daa9 was discovered to contain a 
segmentation fault  ...)
- libjpeg 
+   [bullseye] - libjpeg  (Minor issue)
NOTE: https://github.com/thorfdbg/libjpeg/issues/78
+   NOTE: 
https://github.com/thorfdbg/libjpeg/commit/281daa9ccee18742b83a77cd29bd2726b69b7977
 CVE-2022-37768 (libjpeg commit 281daa9 was discovered to contain an infinite 
loop via  ...)
-   - libjpeg 
+   - libjpeg  (unimportant)
NOTE: https://github.com/thorfdbg/libjpeg/issues/77
+   NOTE: 
https://github.com/thorfdbg/libjpeg/commit/281daa9ccee18742b83a77cd29bd2726b69b7977
+   NOTE: Hang in CLI tool, no security impact
 CVE-2022-37767
RESERVED
 CVE-2022-37766
@@ -3437,6 +3446,7 @@ CVE-2022-37429
RESERVED
 CVE-2022-37428 (PowerDNS Recursor up to and including 4.5.9, 4.6.2 and 4.7.1, 
when pro ...)
- pdns-recursor 
+   [bullseye] - pdns-recursor  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/08/23/1
NOTE: https://downloads.powerdns.com/patches/2022-02/
 CVE-2022-37427
@@ -3554,10 +3564,11 @@ CVE-2022-2654
 CVE-2022-2653 (With this vulnerability an attacker can read many sensitive 
files like ...)
NOT-FOR-US: plankanban/planka
 CVE-2022-2652 (Depending on the way the format strings in the card label are 
crafted  ...)
-   - v4l2loopback 0.12.7-1 (bug #1016685)
+   - v4l2loopback 0.12.7-1 (unimportant; bug #1016685)
NOTE: https://huntr.dev/bounties/1b055da5-7a9e-4409-99d7-030280d242d5
NOTE: 
https://github.com/umlaeute/v4l2loopback/commit/e4cd225557486c420f6a34411f98c575effd43dd
 (main)
NOTE: 
https://github.com/umlaeute/v4l2loopback/commit/64a216af4c09c9ba9326057d7e78994271827eff
 (v0.12.6)
+   NOTE: Negligible security impact
 CVE-2022-2651 (Authentication Bypass by Primary Weakness in GitHub repository 
bookwyr ...)
NOT-FOR-US: BookWyrm
 CVE-2022-2650



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/432d4ffb335a8cec10a21f4c75890d617d122720

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/432d4ffb335a8cec10a21f4c75890d617d122720
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-22 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
5e95043f by Moritz Muehlenhoff at 2022-08-22T17:57:45+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -682,15 +682,18 @@ CVE-2022-2870 (A vulnerability was found in laravel 5.1 
and classified as proble
NOTE: Additional misreport for laravel, likely to be rejected
 CVE-2022-2869 (libtiff's tiffcrop tool has a uint32_t underflow which leads to 
out of ...)
- tiff 4.4.0~rc1-1
+   [bullseye] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/352
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/07d79fcac2ead271b60e32aeb80f7b4f3be9ac8c
 (v4.4.0rc1)
 CVE-2022-2868 (libtiff's tiffcrop utility has a improper input validation flaw 
that c ...)
- tiff 4.4.0~rc1-1
+   [bullseye] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/335
NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/294
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/07d79fcac2ead271b60e32aeb80f7b4f3be9ac8c
 (v4.4.0rc1)
 CVE-2022-2867 (libtiff's tiffcrop utility has a uint32_t underflow that can 
lead to o ...)
- tiff 4.4.0~rc1-1
+   [bullseye] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/350
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/351
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/07d79fcac2ead271b60e32aeb80f7b4f3be9ac8c
 (v4.4.0rc1)
@@ -6508,6 +6511,7 @@ CVE-2022-2448
 CVE-2022-2447
RESERVED
- keystone 
+   [bullseye] - keystone  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2105419
 CVE-2017-20143 (A vulnerability, which was classified as critical, has been 
found in I ...)
NOT-FOR-US: Itech Movie Portal Script
@@ -86691,6 +86695,7 @@ CVE-2021-32748 (Nextcloud Richdocuments in an open 
source self hosted online off
 CVE-2021-32747 (Icinga Web 2 is an open source monitoring web interface, 
framework, an ...)
[experimental] - icingaweb2 2.8.3-1~exp1
- icingaweb2 2.8.4-1 (bug #991116)
+   [bullseye] - icingaweb2  (Minor issue)
[buster] - icingaweb2  (Minor issue)
[stretch] - icingaweb2  (Minor issue)
NOTE: 
https://github.com/Icinga/icingaweb2/security/advisories/GHSA-2xv9-886q-p7xx
@@ -86698,6 +86703,7 @@ CVE-2021-32747 (Icinga Web 2 is an open source 
monitoring web interface, framewo
 CVE-2021-32746 (Icinga Web 2 is an open source monitoring web interface, 
framework and ...)
[experimental] - icingaweb2 2.8.3-1~exp1
- icingaweb2 2.8.4-1 (bug #991116)
+   [bullseye] - icingaweb2  (Minor issue)
[buster] - icingaweb2  (Minor issue)
[stretch] - icingaweb2  (Minor issue)
NOTE: 
https://github.com/Icinga/icingaweb2/security/advisories/GHSA-cmgc-h4cx-3v43
@@ -174030,6 +174036,7 @@ CVE-2020-10689 (A flaw was found in the Eclipse Che 
up to version 7.8.x, where i
 CVE-2020-10688 (A cross-site scripting (XSS) flaw was found in RESTEasy in 
versions be ...)
- resteasy  (bug #970328)
- resteasy3.0  (bug #1015001)
+   [bullseye] - resteasy3.0  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1814974
NOTE: https://github.com/quarkusio/quarkus/issues/7248
NOTE: https://issues.redhat.com/browse/RESTEASY-2519 (restricted)


=
data/dsa-needed.txt
=
@@ -18,6 +18,8 @@ freecad (aron)
 --
 gdk-pixbuf (carnil)
 --
+libxslt
+--
 linux (carnil)
   Wait until more issues have piled up, though try to regulary rebase for point
   releases to more recent v5.10.y versions



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e95043fea4796f62114c98630e3266d1ac6e3ab

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5e95043fea4796f62114c98630e3266d1ac6e3ab
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-22 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
b4819afe by Moritz Muehlenhoff at 2022-08-22T16:43:21+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -316,6 +316,7 @@ CVE-2022-38494
RESERVED
 CVE-2022-38493 (Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the 
RSA priva ...)
- rhonabwy 1.1.7-1
+   [bullseye] - rhonabwy  (Vulnerable code not present)
NOTE: 
https://github.com/babelouest/rhonabwy/commit/dd528b3aabd13863f855a68e76966e4e019fc399
 CVE-2022-38492
RESERVED
@@ -6423,28 +6424,36 @@ CVE-2022-36148 (fdkaac commit 53fe239 was discovered to 
contain a floating point
 CVE-2022-36147
RESERVED
 CVE-2022-36146 (SWFMill commit 53d7690 was discovered to contain a memory 
allocation i ...)
-   - swfmill 
+   - swfmill  (unimportant)
NOTE: https://github.com/djcsdy/swfmill/issues/65
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-36145 (SWFMill commit 53d7690 was discovered to contain a 
segmentation violat ...)
-   - swfmill 
+   - swfmill  (unimportant)
NOTE: https://github.com/djcsdy/swfmill/issues/64
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-36144 (SWFMill commit 53d7690 was discovered to contain a heap-buffer 
overflo ...)
- swfmill 
+   [bullseye] - swfmill  (Minor issue)
NOTE: https://github.com/djcsdy/swfmill/issues/63
 CVE-2022-36143 (SWFMill commit 53d7690 was discovered to contain a heap-buffer 
overflo ...)
-   - swfmill 
+   - swfmill  (unimportant)
NOTE: https://github.com/djcsdy/swfmill/issues/62
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-36142 (SWFMill commit 53d7690 was discovered to contain a heap-buffer 
overflo ...)
-   - swfmill 
+   - swfmill  (unimportant)
NOTE: https://github.com/djcsdy/swfmill/issues/61
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-36141 (SWFMill commit 53d7690 was discovered to contain a 
segmentation violat ...)
-   - swfmill 
+   - swfmill  (unimportant)
NOTE: https://github.com/djcsdy/swfmill/issues/58
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-36140 (SWFMill commit 53d7690 was discovered to contain a 
segmentation violat ...)
-   - swfmill 
+   - swfmill  (unimportant)
NOTE: https://github.com/djcsdy/swfmill/issues/57
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-36139 (SWFMill commit 53d7690 was discovered to contain a heap-buffer 
overflo ...)
- swfmill 
+   [bullseye] - swfmill  (Minor issue)
NOTE: https://github.com/djcsdy/swfmill/issues/56
 CVE-2022-36138
RESERVED
@@ -34931,6 +34940,7 @@ CVE-2022-25758 (All versions of package scss-tokenizer 
are vulnerable to Regular
- node-scss-tokenizer  (bug #885456)
 CVE-2022-25648 (The package git before 1.11.0 are vulnerable to Command 
Injection via  ...)
- ruby-git  (bug #1009926)
+   [bullseye] - ruby-git  (Minor issue)
NOTE: https://github.com/ruby-git/ruby-git/pull/569
NOTE: Fixed by: 
https://github.com/ruby-git/ruby-git/commit/291ca0946bec7164b90ad5c572ac147f512c7159
 (v1.11.0)
NOTE: https://security.snyk.io/vuln/SNYK-RUBY-GIT-2421270
@@ -35647,6 +35657,7 @@ CVE-2022-0719 (Cross-site Scripting (XSS) - Reflected 
in GitHub repository micro
 CVE-2022-0718
RESERVED
- python-oslo.utils 4.10.1-1
+   [bullseye] - python-oslo.utils  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2056850
NOTE: https://bugs.launchpad.net/oslo.utils/+bug/1949623
NOTE: Fixed by: 
https://opendev.org/openstack/oslo.utils/commit/6e17ae1f7959c64dfd20a5f67edf422e702426aa
 (4.12.1)
@@ -57174,6 +57185,7 @@ CVE-2021-43557 (The uri-block plugin in Apache APISIX 
before 2.10.2 uses $reques
 CVE-2021-3941 (In ImfChromaticities.cpp routine RGBtoXYZ(), there are some 
division o ...)
[experimental] - openexr 3.1.3-1
- openexr 3.1.5-2 (bug #1014828)
+   [bullseye] - openexr  (Minor issue)
[stretch] - openexr  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2019789
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39084
@@ -57361,6 +57373,7 @@ CVE-2021-3934 (ohmyzsh is vulnerable to Improper 
Neutralization of Special Eleme
 CVE-2021-3933 (An integer overflow could occur when OpenEXR processes a 
crafted file  ...)
[experimental] - openexr 3.1.3-1
- openexr 3.1.5-2 (bug #1014828)
+   [bullseye] - openexr  (Minor issue)
[stretch] - openexr  (Vulnerable code not present)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2019783
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=38912


=

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-19 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
e3673978 by Moritz Mühlenhoff at 2022-08-19T23:11:47+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1893,10 +1893,10 @@ CVE-2022-37783
 CVE-2022-37782
RESERVED
 CVE-2022-37781 (fdkaac v1.0.3 was discovered to contain a heap buffer overflow 
via __i ...)
-   - fdkaac  (bug #1017754)
-   [bullseye] - fdkaac  (Minor issue; contrib not supported)
+   - fdkaac  (unimportant; bug #1017754)
NOTE: https://github.com/nu774/fdkaac/issues/54
NOTE: 
https://github.com/nu774/fdkaac/commit/ecddb7d63306e01d137d65bbbe7b78c1e779943c
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-37780
RESERVED
 CVE-2022-37779
@@ -3698,9 +3698,10 @@ CVE-2022-37051
 CVE-2022-37050
RESERVED
 CVE-2022-37049 (The component tcpprep in Tcpreplay v4.4.1 was discovered to 
contain a  ...)
-   - tcpreplay 
+   - tcpreplay  (unimportant)
NOTE: https://github.com/appneta/tcpreplay/issues/736
NOTE: https://github.com/appneta/tcpreplay/issues/718
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-37048 (The component tcprewrite in Tcpreplay v4.4.1 was discovered to 
contain ...)
- tcpreplay 
NOTE: https://github.com/appneta/tcpreplay/issues/735
@@ -6017,10 +6018,10 @@ CVE-2022-36150 (tifig v0.2.2 was discovered to contain 
a heap-buffer overflow vi
 CVE-2022-36149 (tifig v0.2.2 was discovered to contain a heap-use-after-free 
via temIn ...)
NOT-FOR-US: tifig
 CVE-2022-36148 (fdkaac commit 53fe239 was discovered to contain a floating 
point excep ...)
-   - fdkaac  (bug #1017751)
-   [bullseye] - fdkaac  (Minor issue; contrib not supported)
+   - fdkaac  (unimportant; bug #1017751)
NOTE: https://github.com/nu774/fdkaac/issues/52
NOTE: 
https://github.com/nu774/fdkaac/commit/4ec1422bd951a137225ffa4052da120e2ab0a0f4 
(v1.0.3)
+   NOTE: Crash in CLI tool, no security impact
 CVE-2022-36147
RESERVED
 CVE-2022-36146 (SWFMill commit 53d7690 was discovered to contain a memory 
allocation i ...)
@@ -130606,7 +130607,7 @@ CVE-2020-27788 (An out-of-bounds read access 
vulnerability was discovered in UPX
NOTE: https://github.com/upx/upx/issues/332
NOTE: 
https://github.com/upx/upx/commit/1bb93d4fce9f1d764ba57bf5ac154af515b3fc83 
(v3.96)
 CVE-2020-27787 (A Segmentaation fault was found in UPX in invert_pt_dynamic() 
function ...)
-   - upx-ucl 3.96-1 (unimportant)
+   - upx-ucl 3.96-1
NOTE: https://github.com/upx/upx/issues/333
NOTE: 
https://github.com/upx/upx/commit/e2f60adc95334f47e286838dac33160819c5d74d 
(v3.96)
 CVE-2020-27786 (A flaw was found in the Linux kernels implementation of 
MIDI, w ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e3673978a90232026b4d5c18a53c88c41bc072a5

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e3673978a90232026b4d5c18a53c88c41bc072a5
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-12 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
9a8af819 by Moritz Muehlenhoff at 2022-08-12T09:33:58+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -2805,6 +2805,7 @@ CVE-2022-2590
NOTE: https://www.openwall.com/lists/oss-security/2022/08/08/1
 CVE-2022-2589 (Cross-site Scripting (XSS) - Reflected in GitHub repository 
beancount/ ...)
- fava  (bug #1016971)
+   [bullseye] - fava  (Minor issue)
NOTE: https://huntr.dev/bounties/8705800d-cf2f-433d-9c3e-dbef6a3f7e08/
NOTE: 
https://github.com/beancount/fava/commit/68bbb6e39319deb35ab9f18d0b6aa9fa70472539
 (v1.22.3)
 CVE-2022-37037
@@ -4273,6 +4274,7 @@ CVE-2022-33963
RESERVED
 CVE-2022-2523 (Cross-site Scripting (XSS) - Reflected in GitHub repository 
beancount/ ...)
- fava  (bug #1016971)
+   [bullseye] - fava  (Minor issue)
NOTE: https://huntr.dev/bounties/2a1802d8-1c2e-4919-96a7-d4dcf7ffcf8f
NOTE: 
https://github.com/beancount/fava/commit/dccfb6a2f4567f35ce2e9a78e24f92ebf946bc9b
 (v1.22.2)
 CVE-2022-36381
@@ -4410,6 +4412,7 @@ CVE-2022-2515
RESERVED
 CVE-2022-2514 (The time and filter parameters in Fava prior to v1.22 are 
vulnerable t ...)
- fava  (bug #1016971)
+   [bullseye] - fava  (Minor issue)
NOTE: https://huntr.dev/bounties/dbf77139-4384-4dc5-9994-45a5e0747429
NOTE: 
https://github.com/beancount/fava/commit/ca9e3882c7b5fbf5273ba52340b9fea6a99f3711
 (v1.22)
 CVE-2022-2513
@@ -20658,16 +20661,19 @@ CVE-2022-30324 (HashiCorp Nomad and Nomad Enterprise 
version 0.2.0 up to 1.3.0 w
- nomad  (In Debian Nomad doesn't bundle go-getter, but 
build depends a shared deb)
 CVE-2022-30323 (go-getter up to 1.5.11 and 2.0.2 panicked when processing 
password-pro ...)
- golang-github-hashicorp-go-getter  (bug #1011741)
+   [bullseye] - golang-github-hashicorp-go-getter  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
NOTE: https://github.com/hashicorp/go-getter/pull/359
NOTE: 
https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
 (v1.6.0)
 CVE-2022-30322 (go-getter up to 1.5.11 and 2.0.2 allowed asymmetric resource 
exhaustio ...)
- golang-github-hashicorp-go-getter  (bug #1011741)
+   [bullseye] - golang-github-hashicorp-go-getter  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
NOTE: https://github.com/hashicorp/go-getter/pull/359
NOTE: 
https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
 (v1.6.0)
 CVE-2022-30321 (go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access 
via go- ...)
- golang-github-hashicorp-go-getter  (bug #1011741)
+   [bullseye] - golang-github-hashicorp-go-getter  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
NOTE: https://github.com/hashicorp/go-getter/pull/359
NOTE: 
https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
 (v1.6.0)
@@ -30647,6 +30653,7 @@ CVE-2022-26946
RESERVED
 CVE-2022-26945 (go-getter up to 1.5.11 and 2.0.2 allowed protocol switching, 
endless r ...)
- golang-github-hashicorp-go-getter  (bug #1011741)
+   [bullseye] - golang-github-hashicorp-go-getter  (Minor issue)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2022-13-multiple-vulnerabilities-in-go-getter-library/39930
NOTE: https://github.com/hashicorp/go-getter/pull/359
NOTE: 
https://github.com/hashicorp/go-getter/commit/a2ebce998f8d4105bd4b78d6c99a12803ad97a45
 (v1.6.0)
@@ -64579,6 +64586,7 @@ CVE-2021-41040 (In Eclipse Wakaama, ever since its 
inception until 2021-01-14, t
NOT-FOR-US: Eclipse Wakaama
 CVE-2021-41039 (In versions 1.6 to 2.0.11 of Eclipse Mosquitto, an MQTT v5 
client conn ...)
- mosquitto  (bug #1001028)
+   [bullseye] - mosquitto  (Minor issue)
[buster] - mosquitto  (Vulnerable code introduced later)
[stretch] - mosquitto  (Vulnerable code introduced later)
NOTE: https://bugs.eclipse.org/bugs/show_bug.cgi?id=575314
@@ -80991,6 +80999,7 @@ CVE-2021-34435 (In Eclipse Theia 0.3.9 to 1.8.1, the 
"mini-browser" extension al
NOT-FOR-US: Eclipse Theia
 CVE-2021-34434 (In Eclipse Mosquitto versions 2.0 to 2.0.11, when using the 
dynamic se ...)
- mosquitto  (bug #993400)
+   [bullseye] - mosquitto  (Minor issue)
[buster] - mosquitto  (Vulnerable code introduced later)
[stretch] - mosquitto  (Vulnerable code introduced later)
NOTE: https://bugs.eclipse.org/bugs/show_bug.cgi?id=575324
@@

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-11 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
1fb5242a by Moritz Muehlenhoff at 2022-08-12T00:16:58+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -6836,6 +6836,7 @@ CVE-2022-2348
 CVE-2022-2347 [Unchecked Download Size and Direction in U-Boot USB DFU]
RESERVED
- u-boot  (bug #1014959)
+   [bullseye] - u-boot  (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2022/07/08/2
 CVE-2022-35399
REJECTED
@@ -19437,10 +19438,12 @@ CVE-2022-30700 (An incorrect permission assignment 
vulnerability in Trend Micro
NOT-FOR-US: Trend Micro
 CVE-2022-30699 (NLnet Labs Unbound, up to and including version 1.16.1, is 
vulnerable  ...)
- unbound  (bug #1016493)
+   [bullseye] - unbound  (Minor issue)
NOTE: 
https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txt
NOTE: 
https://github.com/NLnetLabs/unbound/commit/f6753a0f1018133df552347a199e0362fc1dac68
 (release-1.16.2)
 CVE-2022-30698 (NLnet Labs Unbound, up to and including version 1.16.1 is 
vulnerable t ...)
- unbound  (bug #1016493)
+   [bullseye] - unbound  (Minor issue)
NOTE: 
https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-30698_CVE-2022-30699.txt
NOTE: 
https://github.com/NLnetLabs/unbound/commit/f6753a0f1018133df552347a199e0362fc1dac68
 (release-1.16.2)
 CVE-2022-30697 (Local privilege escalation due to insecure folder permissions. 
The fol ...)
@@ -63241,6 +63244,7 @@ CVE-2021-41557 (Sofico Miles RIA 2020.2 Build 127964T 
is affected by Stored Cros
NOT-FOR-US: Sofico
 CVE-2021-41556 (sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 
allows an ou ...)
- squirrel3  (bug #1016212)
+   [bullseye] - squirrel3  (Minor issue)
NOTE: 
https://github.com/albertodemichelis/squirrel/commit/23a0620658714b996d20da3d4dd1a0dcf9b0bd98
 (v3.2)
NOTE: https://blog.sonarsource.com/squirrel-vm-sandbox-escape/
 CVE-2021-41555 (** UNSUPPORTED WHEN ASSIGNED ** In ARCHIBUS Web Central 
21.3.3.815 (a  ...)


=
data/dsa-needed.txt
=
@@ -48,6 +48,8 @@ ruby-tzinfo
 --
 salt
 --
+sofia-sip
+--
 sox
   patch needed for CVE-2021-40426, check with upstream
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1fb5242a2a2dc6cbc150a31fd145fb0a8b212c18

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1fb5242a2a2dc6cbc150a31fd145fb0a8b212c18
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-11 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
95d31930 by Moritz Muehlenhoff at 2022-08-11T23:41:25+02:00
bullseye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=
data/CVE/list
=
@@ -1653,8 +1653,11 @@ CVE-2022-37452 (Exim before 4.95 has a heap-based buffer 
overflow for the alias
NOTE: 
https://github.com/Exim/exim/commit/d4bc023436e4cce7c23c5f8bb5199e178b4cc743 
(exim-4.95-RC0)
 CVE-2022-37451 (Exim before 4.96 has an invalid free in pam_converse in 
auths/call_pam ...)
- exim4 4.95-4
+   [bullseye] - exim4  (Vulnerable code not present)
+   [buster] - exim4  (Vulnerable code not present)
NOTE: https://github.com/ivd38/exim_invalid_free
NOTE: 
https://github.com/Exim/exim/commit/51be321b27825c01829dffd90f11bfff256f7e42 
(exim-4.96-RC0)
+   NOTE: Introduced in 
https://github.com/Exim/exim/commit/1e30b0199daf7a7a882458251a3dc10d45d4c7d1 
(exim-4.95-RC0)
 CVE-2022-37450 (Go Ethereum (aka geth) through 1.10.21 allows attackers to 
increase re ...)
- golang-github-go-ethereum  (bug #890541)
 CVE-2022-37449
@@ -1915,6 +1918,7 @@ CVE-2022-37395
RESERVED
 CVE-2022-37394 (An issue was discovered in OpenStack Nova before 23.2.2, 24.x 
before 2 ...)
- nova  (bug #1016980)
+   [bullseye] - nova  (Minor issue)
NOTE: https://bugs.launchpad.net/ossa/+bug/1981813
NOTE: https://review.opendev.org/c/openstack/nova/+/849985
NOTE: https://review.opendev.org/c/openstack/nova/+/850003
@@ -2113,6 +2117,7 @@ CVE-2022-2625 [extension scripts replace objects not 
owned by the extension]
{DLA-3072-1}
- postgresql-14 14.5-1
- postgresql-13 
+   [bullseye] - postgresql-13  (Minor issue, fix along in next 
update)
- postgresql-11 
NOTE: https://www.postgresql.org/support/security/CVE-2022-2625/
 CVE-2022-2624
@@ -2808,6 +2813,7 @@ CVE-2022-37036
RESERVED
 CVE-2022-37035 (An issue was discovered in bgpd in FRRouting (FRR) 8.3. In 
bgp_notify_ ...)
- frr  (bug #1016978)
+   [bullseye] - frr  (Minor issue)
NOTE: https://github.com/FRRouting/frr/issues/11698
 CVE-2022-37034
RESERVED
@@ -5732,6 +5738,7 @@ CVE-2022-35864 (This vulnerability allows remote 
attackers to disclose sensitive
NOT-FOR-US: BMC Track-It!
 CVE-2022-2414 (Access to external entities when parsing XML documents can lead 
to XML ...)
- dogtag-pki  (bug #1014957)
+   [bullseye] - dogtag-pki  (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2104676
NOTE: https://github.com/dogtagpki/pki/pull/4021
NOTE: 
https://github.com/dogtagpki/pki/commit/4e893243d72ad766558c10c907841f5f9c047055
@@ -6746,6 +6753,7 @@ CVE-2022-35415
RESERVED
 CVE-2022-35414 (softmmu/physmem.c in QEMU through 7.0.0 can perform an 
uninitialized r ...)
- qemu  (bug #1014958)
+   [bullseye] - qemu  (Minor issue)
NOTE: https://gitlab.com/qemu-project/qemu/-/issues/1065
NOTE: 
https://github.com/qemu/qemu/commit/418ade7849ce7641c0f7333718caf5091a02fd4c
NOTE: https://sick.codes/sick-2022-113
@@ -7880,9 +7888,10 @@ CVE-2022-34929
 CVE-2022-34928 (JFinal CMS v5.1.0 was discovered to contain a SQL injection 
vulnerabil ...)
NOT-FOR-US: JFinal CMS
 CVE-2022-34927 (MilkyTracker v1.03.00 was discovered to contain a stack 
overflow via t ...)
-   - milkytracker  (bug #1016578)
+   - milkytracker  (unimportant; bug #1016578)
NOTE: 
https://github.com/milkytracker/MilkyTracker/commit/3a5474f9102cbdc10fbd9e7b1b2c8d3f3f45d91b
NOTE: https://github.com/milkytracker/MilkyTracker/issues/275
+   NOTE: Crash in GUI tool, no security impact
 CVE-2022-34926
RESERVED
 CVE-2022-34925
@@ -8468,6 +8477,7 @@ CVE-2022-34750 (An issue was discovered in MediaWiki 
through 1.38.1. The lemma l
NOT-FOR-US: MediaWiki extension WikiBase
 CVE-2022-34749 (In mistune through 2.0.2, support of inline markup is 
implemented by u ...)
- mistune 2.0.3-1 (bug #1016089)
+   [bullseye] - mistune  (Minor issue)
NOTE: 
https://github.com/lepture/mistune/commit/a6d43215132fe4f3d93f8d7e90ba83b16a0838b2
 (v2.0.3)
 CVE-2022-34748 (A vulnerability has been identified in Simcenter Femap (All 
versions & ...)
NOT-FOR-US: Siemens
@@ -9063,6 +9073,7 @@ CVE-2022-34527 (D-Link DSL-3782 v1.03 and below was 
discovered to contain a comm
NOT-FOR-US: D-Link
 CVE-2022-34526 (A stack overflow was discovered in the _TIFFVGetField function 
of Tiff ...)
- tiff 4.4.0-4
+   [bullseye] - tiff  (Minor issue)
NOTE: https://gitlab.com/libtiff/libtiff/-/issues/433
NOTE: 
https://gitlab.com/libtiff/libtiff/-/commit/275735d0354e39c0ac1dc3c0db2120d6f31d1990
 CVE-2022-34525
@@ -25712,6 +25723,7 @@ CVE-2022-1228 (The

[Git][security-tracker-team/security-tracker][master] bullseye triage

2022-08-02 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
bd2b3e45 by Moritz Muehlenhoff at 2022-08-02T09:55:31+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -26225,6 +26225,7 @@ CVE-2022-27651 (A flaw was found in buildah where 
containers were incorrectly st
NOTE: 
https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h
 CVE-2022-27650 (A flaw was found in crun where containers were incorrectly 
started wit ...)
- crun  (bug #1009881)
+   [bullseye] - crun  (Minor issue)
NOTE: 
https://github.com/containers/crun/commit/b847d146d496c9d7beba166fd595488e85488562
 (1.4.4)
 CVE-2022-27649 (A flaw was found in Podman, where containers were started 
incorrectly  ...)
- libpod 3.4.6+ds1-1
@@ -59805,6 +59806,7 @@ CVE-2021-41946 (In FiberHome VDSL2 Modem HG150-Ub_V3.0, 
a stored cross-site scri
NOT-FOR-US: FiberHome VDSL2 Modem
 CVE-2021-41945 (Encode OSS httpx  0.23.0 is affected by improper input 
validation  ...)
- httpx 0.23.0-1 (bug #1010336)
+   [bullseye] - httpx  (Minor issue)
NOTE: https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
NOTE: https://github.com/encode/httpx/discussions/1831
NOTE: https://github.com/encode/httpx/issues/2184



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bd2b3e4521734ecde25ac7ed428a4d34872b3e8c

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bd2b3e4521734ecde25ac7ed428a4d34872b3e8c
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2021-08-08 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
85dd0c17 by Moritz Muehlenhoff at 2021-08-08T19:59:10+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -162,6 +162,8 @@ CVE-2021-38156
RESERVED
 CVE-2021-38155 (OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x 
before 17.0.1 ...)
- keystone 
+   [bullseye] - keystone  (Minor issue)
+   [buster] - keystone  (Minor issue)
[stretch] - keystone  (Keystone not supported in stretch)
NOTE: https://launchpad.net/bugs/1688137
 CVE-2021-38165 (Lynx through 2.8.9 mishandles the userinfo subcomponent of a 
URI, whic ...)
@@ -336,6 +338,8 @@ CVE-2021-38085
RESERVED
 CVE-2021-38084 (An issue was discovered in the POP3 component of Courier Mail 
Server b ...)
- courier  (bug #989375)
+   [bullseye] - courier  (Minor issue)
+   [buster] - courier  (Minor issue)
NOTE: 
https://sourceforge.net/p/courier/mailman/courier-imap/thread/cone.1382574216.483027.8082.1000%40monster.email-scan.com/#msg3183
NOTE: https://sourceforge.net/p/courier/mailman/message/37329216/
NOTE: 
https://sourceforge.net/p/courier/courier-libs.git/ci/97ed62b17a2616c758d09105b5a14dd1038cff6f/
 (1.1.5)
@@ -2667,6 +2671,8 @@ CVE-2021-3655 (A vulnerability was found in the Linux 
kernel in versions before
 CVE-2021-3654 [novnc allows open redirection]
RESERVED
- nova  (bug #991441)
+   [bullseye] - nova  (Minor issue)
+   [buster] - nova  (Minor issue)
NOTE: https://bugs.launchpad.net/nova/+bug/1927677
 CVE-2021-26263
RESERVED
@@ -3182,6 +3188,7 @@ CVE-2021-36774
RESERVED
 CVE-2021-36773 (uBlock Origin before 1.36.2 and nMatrix before 4.4.9 support 
an arbitr ...)
- ublock-origin  (bug #991386)
+   [bullseye] - ublock-origin  (Minor issue)
[buster] - ublock-origin  (Minor issue)
[stretch] - ublock-origin  (Minor issue)
- umatrix  (bug #991344)
@@ -3196,6 +3203,7 @@ CVE-2021-36770
 CVE-2021-36769 (A reordering issue exists in Telegram before 7.8.1 for 
Android, Telegr ...)
[experimental] - telegram-desktop 2.9.0+ds-1
- telegram-desktop  (bug #991493)
+   [bullseye] - telegram-desktop  (Minor issue)
[buster] - telegram-desktop  (Minor issue)
NOTE: https://mtpsym.github.io/
 CVE-2021-36768
@@ -4390,7 +4398,9 @@ CVE-2021-36222 (ec_verify in kdc/kdc_preauth_ec.c in the 
Key Distribution Center
 CVE-2021-36221 (Go before 1.15.15 and 1.16.x before 1.16.7 has a race 
condition that c ...)
- golang-1.16 1.16.7-1
- golang-1.15  (bug #991961)
+   [bullseye] - golang-1.15  (Minor issue)
- golang-1.11 
+   [buster] - golang-1.11  (Minor issue)
- golang-1.8 
- golang-1.7 
NOTE: https://github.com/golang/go/issues/46866
@@ -6416,6 +6426,8 @@ CVE-2021-35369
 CVE-2021-35368 [CRS Request Body Bypass]
RESERVED
- modsecurity-crs  (bug #992000)
+   [bullseye] - modsecurity-crs  (Minor issue)
+   [buster] - modsecurity-crs  (Minor issue)
NOTE: 
https://coreruleset.org/20210630/cve-2021-35368-crs-request-body-bypass/
 CVE-2021-35367
RESERVED
@@ -8857,6 +8869,8 @@ CVE-2021-3584
 CVE-2021-3583 [Template Injection through yaml multi-line strings with ansible 
facts used in template]
RESERVED
- ansible 
+   [bullseye] - ansible  (Minor issue)
+   [buster] - ansible  (Minor issue)
- ansible-base 
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1968412
NOTE: 
https://github.com/ansible/ansible/commit/4c8c40fd3d4a58defdc80e7d22aa8d26b731353e.patch
@@ -12799,6 +12813,8 @@ CVE-2021-32610 (In Archive_Tar before 1.4.14, symlinks 
can refer to targets outs
{DLA-2721-1}
- drupal7 
- php-pear  (bug #991541)
+   [bullseye] - php-pear  (Minor issue)
+   [buster] - php-pear  (Minor issue)
NOTE: https://www.drupal.org/sa-core-2021-004
NOTE: https://pear.php.net/package/Archive_Tar/download/1.4.14/
NOTE: 
https://github.com/pear/Archive_Tar/commit/b5832439b1f37331fb4f87e67fe4f61ca26bf7d4
 (1.4.14)
@@ -12913,6 +12929,7 @@ CVE-2021-32575 (HashiCorp Nomad and Nomad Enterprise up 
to version 1.0.4 bridge
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2021-14-nomad-bridge-networking-mode-allows-arp-spoofing-from-other-bridged-tasks-on-same-node/24296
 CVE-2021-32574 (HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 
Envoy prox ...)
- consul  (bug #991719)
+   [bullseye] - consul  (Minor issue)
[buster] - consul  (Only affects 1.3.0 and later)
NOTE: 
https://discuss.hashicorp.com/t/hcsec-2021-17-consul-s-envoy-tls-configuration-did-not-validate-destination-service-subject-alternative-names/26856
NOTE:

[Git][security-tracker-team/security-tracker][master] bullseye triage

2021-08-05 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
a9e39c4a by Moritz Muehlenhoff at 2021-08-05T09:47:29+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -590,10 +590,14 @@ CVE-2021-37835
 CVE-2021-37834
RESERVED
 CVE-2021-37833 (A reflected cross-site scripting (XSS) vulnerability exists in 
multipl ...)
-   - hoteldruid 
+   - hoteldruid  (bug #991910)
+   [bullseye] - hoteldruid  (Minor issue)
+   [buster] - hoteldruid  (Minor issue)
NOTE: https://github.com/dievus/CVE-2021-37833
 CVE-2021-37832 (A SQL injection vulnerability exists in version 3.0.2 of Hotel 
Druid w ...)
-   - hoteldruid 
+   - hoteldruid  (bug #991910)
+   [bullseye] - hoteldruid  (Minor issue)
+   [buster] - hoteldruid  (Minor issue)
NOTE: https://github.com/dievus/CVE-2021-37832
 CVE-2021-37831
RESERVED
@@ -767,9 +771,11 @@ CVE-2021-37747
RESERVED
 CVE-2021-37746 (textview_uri_security_check in textview.c in Claws Mail before 
3.18.0, ...)
- claws-mail  (bug #991722)
+   [bullseye] - claws-mail  (Minor issue)
[buster] - claws-mail  (Minor issue)
[stretch] - claws-mail  (Minor issue)
- sylpheed  (bug #991723)
+   [bullseye] - sylpheed  (Minor issue)
[buster] - sylpheed  (Minor issue)
[stretch] - sylpheed  (Minor issue)
NOTE: 
https://git.claws-mail.org/?p=claws.git;a=commit;h=ac286a71ed78429e16c612161251b9ea90ccd431
@@ -68139,11 +68145,13 @@ CVE-2020-22285
RESERVED
 CVE-2020-22284 (A buffer overflow vulnerability in the zepif_linkoutput() 
function of  ...)
- lwip  (bug #991646)
+   [bullseye] - lwip  (Minor issue)
[buster] - lwip  (Minor issue)
NOTE: https://savannah.nongnu.org/bugs/index.php?58554
NOTE: 
https://git.savannah.nongnu.org/cgit/lwip.git/commit/?id=8363c24e45a32728e385cfc2c3c36d88a8a9e70b
 CVE-2020-22283 (A buffer overflow vulnerability in the 
icmp6_send_response_with_addrs_ ...)
- lwip  (bug #991645)
+   [bullseye] - lwip  (Minor issue)
[buster] - lwip  (Minor issue)
NOTE: https://savannah.nongnu.org/bugs/index.php?58553
NOTE: Pre-requisite: 
http://git.savannah.nongnu.org/cgit/lwip.git/commit/?id=d843e47a1d65451bd7f7aaa5017b408bd108be88



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a9e39c4a1a84134a68675ff41a1fab8a59f14be2

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a9e39c4a1a84134a68675ff41a1fab8a59f14be2
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

[Git][security-tracker-team/security-tracker][master] bullseye triage

2021-07-29 Thread Moritz Muehlenhoff (@jmm)



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
23afa7e7 by Moritz Muehlenhoff at 2021-07-29T20:48:08+02:00
bullseye triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
@@ -1323,6 +1323,9 @@ CVE-2021-23184
RESERVED
 CVE-2021-36980 (Open vSwitch (aka openvswitch) 2.11.0 through 2.15.0 has a 
use-after-f ...)
- openvswitch  (bug #991308)
+   [bullseye] - openvswitch  (Minor issue)
+   [buster] - openvswitch  (Vulnerable code not present, 
introduced in 2.11)
+   [stretch] - openvswitch  (Vulnerable code not present, 
introduced in 2.11)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27851
NOTE: 
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/openvswitch/OSV-2020-2197.yaml
NOTE: 
https://github.com/openvswitch/ovs/commit/38744b1bcb022c611712527f039722115300f58f
@@ -1330,6 +1333,8 @@ CVE-2021-36980 (Open vSwitch (aka openvswitch) 2.11.0 
through 2.15.0 has a use-a
NOTE: 
https://github.com/openvswitch/ovs/commit/6d67310f4d2524b466b98f05ebccc1add1e8cf35
NOTE: 
https://github.com/openvswitch/ovs/commit/7774deede443e8b9102299efc869a52b65b2
NOTE: 
https://github.com/openvswitch/ovs/commit/8ce8dc34b5f73b30ce0c1869af9947013c3c6575
+   NOTE: 
https://github.com/openvswitch/ovs/commit/9926637a80d0d243dbf9c49761046895e9d1a8e2
+   NOTE: Introduced in: 
https://github.com/openvswitch/ovs/commit/418a7a84245f5fbe589dd1267463fc9ba27a1dd6
 CVE-2021-36979 (Unicorn Engine 1.0.2 has an out-of-bounds write in 
tb_flush_armeb (cal ...)
NOT-FOR-US: Unicorn Engine
 CVE-2021-36978 (QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a 
heap-based buffer ...)
@@ -1829,6 +1834,8 @@ CVE-2021-36768
 CVE-2021-3652 [CRYPT password hash with asterisk allows any bind attempt to 
succeed]
RESERVED
- 389-ds-base  (bug #991405)
+   [bullseye] - 389-ds-base  (Minor issue)
+   [buster] - 389-ds-base  (Minor issue)
NOTE: https://github.com/389ds/389-ds-base/issues/4817
NOTE: 
https://github.com/389ds/389-ds-base/commit/aeb90eb0c41fc48541d983f323c627b2e6c328c7
 (master)
NOTE: 
https://github.com/389ds/389-ds-base/commit/c1926dfc6591b55c4d33f9944de4d7ebe077e964
 (1.4.4.x)
@@ -6466,6 +6473,7 @@ CVE-2021-3605 [Heap buffer overflow in the rleUncompress 
function]
NOTE: not to be confused with CVE-2020-11760 whose fix is similar but 
applied around 10 lines above, in the other branch of the 'if'
 CVE-2021-3603 (PHPMailer 6.4.1 and earlier contain a vulnerability that can 
result in ...)
- libphp-phpmailer 
+   [bullseye] - libphp-phpmailer  (Minor issue)
[buster] - libphp-phpmailer  (Minor issue)
[stretch] - libphp-phpmailer  (Minor issue, fix along with 
next DLA)
NOTE: https://www.huntr.dev/bounties/1-PHPMailer/PHPMailer/
@@ -10603,6 +10611,9 @@ CVE-2021-3551
RESERVED
- dogtag-pki 
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1959971
+   NOTE: 
https://github.com/dogtagpki/pki/commit/0c2f3b84499584bb6029f5ba3988ed3cb081e548
+   NOTE: 
https://github.com/dogtagpki/pki/commit/b01cd8cc7d3e391e69ed2c8161f7e15fa84553e6
+   NOTE: 
https://github.com/dogtagpki/pki/commit/5b09fcaff11d33010469e695ef365a91c91674b5
 CVE-2021-3550 (A DLL search path vulnerability was reported in Lenovo 
PCManager, prio ...)
NOT-FOR-US: Microsoft
 CVE-2021-32925 (admin/user_import.php in Chamilo 1.11.14 reads XML data 
without disabl ...)
@@ -19324,6 +19335,7 @@ CVE-2021-29500 (bubble fireworks is an open source java 
package relating to Spri
NOT-FOR-US: bubble fireworks
 CVE-2021-29499 (SIF is an open source implementation of the Singularity 
Container Imag ...)
- golang-github-sylabs-sif 
+   [bullseye] - golang-github-sylabs-sif  (Minor issue)
NOTE: 
https://github.com/sylabs/sif/security/advisories/GHSA-4gh8-x3vv-phhg
 CVE-2021-29498
RESERVED



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/23afa7e7a112170cb24598e9d97b3510d83e5701

-- 
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/23afa7e7a112170cb24598e9d97b3510d83e5701
You're receiving this email because of your account on salsa.debian.org.


___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits

1 2 >

1 - 100 of 135 matches

Mail list logo