[Git][security-tracker-team/security-tracker][master] new Qt issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: c59abb6e by Moritz Muehlenhoff at 2024-02-16T14:16:28+01:00 new Qt issue - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,3 +1,10 @@ +CVE-2024-25580 [QT KTX buffer overflow] + - qt6-base + - qtbase-opensource-src + - qtbase-opensource-src-gles + NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2264423 + NOTE: https://code.qt.io/cgit/qt/qtbase.git/commit/?id=28ecb523ce8490bff38b251b3df703c72e057519 + NOTE: https://download.qt.io/official_releases/qt/5.15/CVE-2024-25580-qtbase-5.15.diff CVE-2024-25415 (A remote code execution (RCE) vulnerability in /admin/define_language. ...) NOT-FOR-US: CE Phoenix CVE-2024-25414 (An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1 ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c59abb6e84de78f88d401638567d773d3d12d47a -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c59abb6e84de78f88d401638567d773d3d12d47a You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new Qt issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: c0c1e5e8 by Moritz Muehlenhoff at 2023-12-25T19:45:06+01:00 new Qt issue - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -29,7 +29,11 @@ CVE-2023-51772 (One Identity Password Manager before 5.13.1 allows Kiosk Escape. CVE-2023-51771 (In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHead ...) NOT-FOR-US: MicroHttpServer CVE-2023-51714 (An issue was discovered in the HTTP2 implementation in Qt before 5.15. ...) - TODO: check + - qt6-base + - qtbase-opensource-src + - qtbase-opensource-src-gles + NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/524864 + NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/524865/3 CVE-2023-49954 (The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 ...) NOT-FOR-US: 3CX CVE-2023-49944 (The Challenge Response feature of BeyondTrust Privilege Management for ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c0c1e5e86095e06bc44615a400dd43f08431aada -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c0c1e5e86095e06bc44615a400dd43f08431aada You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new qt issue (fixed in sid along with another one)
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 89cbc66d by Moritz Muehlenhoff at 2023-07-27T23:24:22+02:00 new qt issue (fixed in sid along with another one) - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,3 +1,15 @@ +CVE-2023-37369 + - qt6-base + [bookworm] - qt6-base (Minor issue) + - qtbase-opensource-src-gles + [bookworm] - qtbase-opensource-src-gles (Minor issue) + [bullseye] - qtbase-opensource-src-gles (Minor issue) + - qtbase-opensource-src 5.15.10+dfsg-3 + [bookworm] - qtbase-opensource-src (Minor issue) + [bullseye] - qtbase-opensource-src (Minor issue) + - qt4-x11 + NOTE: https://www.qt.io/blog/security-advisory-qxmlstreamreader + NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/455027 CVE-2023-3982 (Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s ...) TODO: check CVE-2023-3981 (Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s ...) @@ -1630,7 +1642,7 @@ CVE-2023-38197 (An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, - qtbase-opensource-src-gles (bug #1041106) [bookworm] - qtbase-opensource-src-gles (Minor issue) [bullseye] - qtbase-opensource-src-gles (Minor issue) - - qtbase-opensource-src (bug #1041105) + - qtbase-opensource-src 5.15.10+dfsg-3 (bug #1041105) [bookworm] - qtbase-opensource-src (Minor issue) [bullseye] - qtbase-opensource-src (Minor issue) [buster] - qtbase-opensource-src (Minor issue) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89cbc66d82635e90db1ed24ae95a498309029ff9 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89cbc66d82635e90db1ed24ae95a498309029ff9 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new Qt issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: a9116832 by Moritz Muehlenhoff at 2023-07-14T16:04:32+02:00 new Qt issue - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -158,7 +158,16 @@ CVE-2023-38199 (coreruleset (aka OWASP ModSecurity Core Rule Set) through 3.3.4 CVE-2023-38198 (acme.sh before 3.0.6 runs arbitrary commands from a remote server via ...) NOT-FOR-US: acme.sh CVE-2023-38197 (An issue was discovered in Qt before 5.15.15, 6.x before 6.2.10, and 6 ...) - TODO: check + - qt6-base + [bookworm] - qt6-base (Minor issue) + - qtbase-opensource-src-gles + [bookworm] - qtbase-opensource-src-gles (Minor issue) + [bullseye] - qtbase-opensource-src-gles (Minor issue) + - qtbase-opensource-src + [bookworm] - qtbase-opensource-src (Minor issue) + [bullseye] - qtbase-opensource-src (Minor issue) + - qt4-x11 + NOTE: https://codereview.qt-project.org/c/qt/qtbase/+/488960 CVE-2023-37568 (ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC- ...) NOT-FOR-US: ELECOM CVE-2023-37567 (ELECOM wireless LAN router WRC-1167GHBK3-A v1.24 and earlier allows a ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a91168321a3a0e3e5d7121897d51a63ccf751998 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a91168321a3a0e3e5d7121897d51a63ccf751998 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new qt issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 8de4aa7a by Moritz Muehlenhoff at 2023-02-14T15:29:51+01:00 new qt issue - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -3105,8 +3105,16 @@ CVE-2022-48287 (The HwContacts module has a logic bypass vulnerability. Successf NOT-FOR-US: Huawei CVE-2022-48286 (The multi-screen collaboration module has a privilege escalation vulne ...) NOT-FOR-US: Huawei -CVE-2023-24607 +CVE-2023-24607 [When using the Qt SQL ODBC driver plugin, then it is possible to trigger a DOS with a specifically crafted string] RESERVED + - qtbase-opensource-src + [bullseye] - qtbase-opensource-src (Minor issue) + - qt6-base + - qtbase-opensource-src-gles + [bullseye] - qtbase-opensource-src-gles (Minor issue) + NOTE: https://www.qt.io/blog/security-advisory-qt-sql-odbc-driver-plugin + NOTE: https://github.com/qt/qtbase/commit/aaf1381eab6292aa0444a5eadcc24165b6e1c02d (6.4) + NOTE: https://download.qt.io/official_releases/qt/5.15/CVE-2023-24607-qtbase-5.15.diff CVE-2023-24606 RESERVED CVE-2023-24605 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8de4aa7a443e846dddbe9ea3485b4db0d3e52466 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8de4aa7a443e846dddbe9ea3485b4db0d3e52466 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new QT issue (n/a)
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 757848bd by Moritz Muehlenhoff at 2020-05-15T09:46:08+02:00 new QT issue (n/a) - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1464,7 +1464,10 @@ CVE-2020-12268 (jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20332 NOTE: https://github.com/ArtifexSoftware/jbig2dec/commit/0726320a4b55078e9d8deb590e477d598b3da66e CVE-2020-12267 (setMarkdown in Qt before 5.14.2 has a use-after-free related to QTextM ...) - TODO: check + - qtbase-opensource-src (Vulnerable code not present) + NOTE: https://github.com/qt/qtbase/commit/7447e2b337f12b4d04935d0f30fc673e4327d5a0 + NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20450 + NOTE: The 5.14 in experimental contains the code, but is already fixed CVE-2019-20790 (OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, ...) - opendmarc NOTE: https://bugs.launchpad.net/pypolicyd-spf/+bug/1838816 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/757848bd7796bbb9bdcce02d8dc98534cc103a46 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/757848bd7796bbb9bdcce02d8dc98534cc103a46 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new QT issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: fc21ff24 by Moritz Muehlenhoff at 2020-02-10T15:14:47+01:00 new QT issue - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1908,7 +1908,10 @@ CVE-2020-7963 CVE-2019-20420 RESERVED CVE-2015-9541 (Qt through 5.14 allows an exponential XML entity expansion attack via ...) - TODO: check + - qtbase-opensource-src (low) + [buster] - qtbase-opensource-src (Minor issue) + [stretch] - qtbase-opensource-src (Minor issue) + NOTE: https://bugreports.qt.io/browse/QTBUG-47417 CVE-2020-7962 RESERVED CVE-2020-7961 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/fc21ff24ff8c9c0cda87433e14ee4b37f3015e3c -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/fc21ff24ff8c9c0cda87433e14ee4b37f3015e3c You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] new qt issue
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 63e492b7 by Moritz Muehlenhoff at 2019-10-25T17:09:17Z new qt issue new libssh issue new horde issues collectd n/a NFUs libntlm, golang-1.[78] no-dsa - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -298,7 +298,13 @@ CVE-2019-18283 CVE-2019-18282 RESERVED CVE-2019-18281 (An out-of-bounds memory access in the generateDirectionalRuns() functi ...) - TODO: check + - qtbase-opensource-src-gles + - qtbase-opensource-src + [buster] - qtbase-opensource-src (Minor issue) + [stretch] - qtbase-opensource-src (Vulnerable code not present) + [jessie] - qtbase-opensource-src (Vulnerable code not present) + NOTE: https://github.com/qt/qtbase/commit/af6ac444c97ed2dc234f93fe457440c9da5482ea + NOTE: https://bugreports.qt.io/browse/QTBUG-77819 CVE-2019-18280 (Sourcecodester Online Grading System 1.0 is affected by a Cross Site R ...) NOT-FOR-US: Sourcecodester Online Grading System CVE-2019-18279 @@ -448,9 +454,9 @@ CVE-2019-18215 CVE-2019-18214 (The Video_Converter app 0.1.0 for Nextcloud allows denial of service ( ...) NOT-FOR-US: Video_Converter app for Nextcloud CVE-2019-18213 (XML Language Server (aka lsp4xml) before 0.9.1, as used in Red Hat XML ...) - TODO: check + NOT-FOR-US: XML Language Server (aka lsp4xml) CVE-2019-18212 (XMLLanguageService.java in XML Language Server (aka lsp4xml) before 0. ...) - TODO: check + NOT-FOR-US: XML Language Server (aka lsp4xml) CVE-2019-18211 RESERVED CVE-2019-18210 @@ -2728,12 +2734,15 @@ CVE-2019-17596 (Go before 1.12.11 and 1.3.x before 1.13.2 can panic upon an atte - golang-1.12 1.12.12-1 (bug #942629) - golang-1.11 - golang-1.8 + [stretch] - golang-1.8 (Minor issue) - golang-1.7 + [stretch] - golang-1.7 (Minor issue) - golang [jessie] - golang (Minor issue) NOTE: https://golang.org/issue/34960 NOTE: https://github.com/golang/go/issues/34962 (1.13 backport) NOTE: https://github.com/golang/go/issues/34961 (1.12 backport) + NOTE: https://groups.google.com/forum/#!msg/golang-announce/lVEm7llp0w0/VbafyRkgCgAJ CVE-2019-17595 (There is a heap-based buffer over-read in the fmt_entry function in ti ...) - ncurses 6.1+20191019-1 (low; bug #942401) [buster] - ncurses (Minor issue) @@ -3026,7 +3035,7 @@ CVE-2019-17528 (An issue was discovered in Bento4 1.5.1.0. There is a SEGV in th CVE-2019-17527 RESERVED CVE-2019-17526 (** DISPUTED ** An issue was discovered in SageMath Sage Cell Server th ...) - TODO: check + NOT-FOR-US: Sage Cell Server (not part of SafeMath as packaged in Debian) CVE-2019-17525 RESERVED CVE-2019-17524 @@ -3088,7 +3097,9 @@ CVE-2019-17500 CVE-2019-17499 (The setter.xml component of the Common Gateway Interface on Compal CH7 ...) NOT-FOR-US: Compal CH7465LG devices CVE-2019-17498 (In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic i ...) - TODO: check + - libssh + NOTE: https://github.com/libssh2/libssh2/commit/dedcbd106f8e52d5586b0205bc7677e4c9868f9c + NOTE: https://blog.semmle.com/libssh2-integer-overflow-CVE-2019-17498/ CVE-2018-21028 (Boa through 0.94.14rc21 allows remote attackers to trigger a memory le ...) - boa CVE-2018-21027 (Boa through 0.94.14rc21 allows remote attackers to trigger an out-of-m ...) @@ -3218,6 +3229,8 @@ CVE-2019-17456 RESERVED CVE-2019-17455 (Libntlm through 1.5 relies on a fixed buffer size for tSmbNtlmAuthRequ ...) - libntlm (bug #942145) + [buster] - libntlm (Minor issue) + [stretch] - libntlm (Minor issue) NOTE: https://gitlab.com/jas/libntlm/issues/2 CVE-2019-17454 (Bento4 1.5.1.0 has a NULL pointer dereference in AP4_Descriptor::GetTa ...) NOT-FOR-US: Bento4 @@ -19451,9 +19464,11 @@ CVE-2019-12097 (Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of Enab CVE-2019-12096 RESERVED CVE-2019-12095 (Horde Trean, as used in Horde Groupware Webmail Edition through 5.2.22 ...) - TODO: check + - php-horde-trean + NOTE: https://bugs.horde.org/ticket/14926 CVE-2019-12094 (Horde Groupware Webmail Edition through 5.2.22 allows XSS via an admin ...) - TODO: check + - php-horde-groupware + NOTE: https://bugs.horde.org/ticket/14926 CVE-2019-12093 RESERVED CVE-2019-12092 @@ -81867,7 +81882,7 @@ CVE-2018- [Multiple vulnerabilities in CiviCRM] - civicrm 4.7.30+dfsg-1 (bug #887330) NOTE: https://civicrm.org/blog/dev-team/security-release-civicrm-4726-and-4633-monthly-release-4727 CVE-2017-18240 (The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownersh ...) -
