[Secure-testing-commits] r38570 - data/CVE
Author: carnil Date: 2015-12-28 07:08:50 + (Mon, 28 Dec 2015) New Revision: 38570 Modified: data/CVE/list Log: Add CVE-2015-8668/tiff Modified: data/CVE/list === --- data/CVE/list 2015-12-28 07:06:04 UTC (rev 38569) +++ data/CVE/list 2015-12-28 07:08:50 UTC (rev 38570) @@ -3,6 +3,11 @@ [squeeze] - phpmyadmin (Vulnerable code not present) NOTE: https://www.phpmyadmin.net/security/PMASA-2015-6/ NOTE: non-issue for Debian-packaged version +CVE-2015-8668 [libtiff bmp file Heap Overflow] + - tiff + - tiff3 + NOTE: http://seclists.org/bugtraq/2015/Dec/138 + TODO: check CVE-2015-8683 [out-of-bounds read in CIE Lab image format] - tiff (bug #809021) - tiff3 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38569 - data/CVE
Author: carnil Date: 2015-12-28 07:06:04 + (Mon, 28 Dec 2015) New Revision: 38569 Modified: data/CVE/list Log: Add two issues in bugzilla4, itp'ed, #669643 Modified: data/CVE/list === --- data/CVE/list 2015-12-28 06:37:39 UTC (rev 38568) +++ data/CVE/list 2015-12-28 07:06:04 UTC (rev 38569) @@ -2369,8 +2369,10 @@ RESERVED CVE-2015-8509 RESERVED + - bugzilla4 (bug #669643) CVE-2015-8508 RESERVED + - bugzilla4 (bug #669643) CVE-2015-8507 (mediaserver in Android 6.0 before 2015-12-01 allows remote attackers ...) - android (bug #459219) CVE-2015-8506 (mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38568 - data/CVE
Author: carnil Date: 2015-12-28 06:37:39 + (Mon, 28 Dec 2015) New Revision: 38568 Modified: data/CVE/list Log: Remove todo item from one linux entry Modified: data/CVE/list === --- data/CVE/list 2015-12-28 06:37:01 UTC (rev 38567) +++ data/CVE/list 2015-12-28 06:37:39 UTC (rev 38568) @@ -3793,7 +3793,6 @@ [squeeze] - linux-2.6 (Vulnerable code not present) NOTE: https://github.com/systemd/systemd/issues/1822 NOTE: Issue in Linux related to unprivileged CLONE_NEWUSER affecting systemd, but we disable unprivileged use by default - TODO: check CVE-2015- [update-smart-drivedb downloads unauthenticated data from the web] - smartmontools (low; bug #804299) [squeeze] - smartmontools (Minor issue) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38567 - data/CVE
Author: carnil Date: 2015-12-28 06:37:01 + (Mon, 28 Dec 2015) New Revision: 38567 Modified: data/CVE/list Log: Fix suite name for one linux issue with no-dsa tag Modified: data/CVE/list === --- data/CVE/list 2015-12-28 06:35:45 UTC (rev 38566) +++ data/CVE/list 2015-12-28 06:37:01 UTC (rev 38567) @@ -3787,7 +3787,7 @@ NOTE: https://git.gnome.org/browse/libxml2/commit/?id=9aa37588ee78a06ca1379a9d9356eab16686099c CVE-2015- [Kernel: Unprivileged user can freeze journald] - linux - [jeesie] - linux (Minor issue) + [jessie] - linux (Minor issue) [wheezy] - linux (Vulnerable code not present) - linux-2.6 [squeeze] - linux-2.6 (Vulnerable code not present) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38566 - data/CVE
Author: carnil Date: 2015-12-28 06:35:45 + (Mon, 28 Dec 2015) New Revision: 38566 Modified: data/CVE/list Log: Update commit references for linux/fuse issue Modified: data/CVE/list === --- data/CVE/list 2015-12-28 06:32:28 UTC (rev 38565) +++ data/CVE/list 2015-12-28 06:35:45 UTC (rev 38566) @@ -1248,7 +1248,8 @@ CVE-2015- [fuse: possible denial of service in fuse_fill_write_pages()] - linux - linux-2.6 - NOTE: Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3ca8138f014a913f98e6ef40e939868e1e9ea876 + NOTE: Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3ca8138f014a913f98e6ef40e939868e1e9ea876 (v4.4-rc5) + NOTE: Introduced in: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ea9b9907b82a09bd1a708004454f7065de77c5b0 (v2.6.26-rc1) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1290642 TODO: check CVE-2015- [remotely triggerable crash] ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38565 - data/CVE
Author: carnil Date: 2015-12-28 06:32:28 + (Mon, 28 Dec 2015) New Revision: 38565 Modified: data/CVE/list Log: Add reference to Red Hat bugzilla report for one linux issue Modified: data/CVE/list === --- data/CVE/list 2015-12-27 22:07:36 UTC (rev 38564) +++ data/CVE/list 2015-12-28 06:32:28 UTC (rev 38565) @@ -1249,6 +1249,7 @@ - linux - linux-2.6 NOTE: Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3ca8138f014a913f98e6ef40e939868e1e9ea876 + NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1290642 TODO: check CVE-2015- [remotely triggerable crash] - ruby-eventmachine (bug #678512; bug #696015) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38564 - data/CVE
Author: carnil
Date: 2015-12-27 22:07:36 + (Sun, 27 Dec 2015)
New Revision: 38564
Modified:
data/CVE/list
Log:
Remove no-dsa entry for CVE-2012-3425/libpng for squeeze since got DLA
Modified: data/CVE/list
===
--- data/CVE/list 2015-12-27 21:14:08 UTC (rev 38563)
+++ data/CVE/list 2015-12-27 22:07:36 UTC (rev 38564)
@@ -81052,7 +81052,6 @@
CVE-2012-3425 (The png_push_read_zTXt function in pngpread.c in libpng 1.0.x
before ...)
{DLA-375-1}
- libpng 1.2.49-1 (low; bug #668082)
- [squeeze] - libpng (Minor issue)
CVE-2012-3424 (The decode_credentials method in ...)
- rails (Only affects RoR 3.x)
- ruby-actionpack-3.2 3.2.6-3 (bug #683370)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38563 - data
Author: alteholz Date: 2015-12-27 21:14:08 + (Sun, 27 Dec 2015) New Revision: 38563 Modified: data/dla-needed.txt Log: take srtp and passenger Modified: data/dla-needed.txt === --- data/dla-needed.txt 2015-12-27 21:10:11 UTC (rev 38562) +++ data/dla-needed.txt 2015-12-27 21:14:08 UTC (rev 38563) @@ -28,7 +28,7 @@ NOTE: Trying to sync the solution for CVE-2015-4000 with security team first NOTE: see https://lists.debian.org/debian-lts/2015/12/msg00025.html -- -passenger +passenger (Thorsten Alteholz) NOTE: code is in ext/apache2/Hooks.cpp:sendHeaders() -- php5 (Thorsten Alteholz) @@ -43,7 +43,7 @@ -- samba (Santiago R.R.) -- -srtp +srtp (Thorsten Alteholz) -- sudo (Ben Hutchings) NOTE: Maintainer want to review the updated package: ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38562 - data/CVE
Author: sectracker
Date: 2015-12-27 21:10:11 + (Sun, 27 Dec 2015)
New Revision: 38562
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
===
--- data/CVE/list 2015-12-27 21:01:16 UTC (rev 38561)
+++ data/CVE/list 2015-12-27 21:10:11 UTC (rev 38562)
@@ -1887,6 +1887,7 @@
RESERVED
CVE-2015-8540 [underflow read in png_check_keyword in pngwutil.c]
RESERVED
+ {DLA-375-1}
- libpng (bug #807694)
NOTE: http://www.openwall.com/lists/oss-security/2015/12/10/6
NOTE: https://sourceforge.net/p/libpng/bugs/244/
@@ -3854,6 +3855,7 @@
NOTE: Rendered non-exploitable by toolchain hardening
CVE-2015-8472 [Incomplete fix for CVE-2015-8126]
RESERVED
+ {DLA-375-1}
- libpng (bug #807112)
NOTE: Fixed in 1.6.20, 1.5.25, 1.4.18, 1.2.55, and 1.0.65
NOTE:
https://github.com/glennrp/libpng/commit/7e1ca9ceba4e64259863efdd98bab9b55bdc0b9c
@@ -81048,6 +81050,7 @@
CVE-2012-3426 (OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom
before ...)
- keystone 2012.1.1-1
CVE-2012-3425 (The png_push_read_zTXt function in pngpread.c in libpng 1.0.x
before ...)
+ {DLA-375-1}
- libpng 1.2.49-1 (low; bug #668082)
[squeeze] - libpng (Minor issue)
CVE-2012-3424 (The decode_credentials method in ...)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38561 - in data: . DLA
Author: alteholz
Date: 2015-12-27 21:01:16 + (Sun, 27 Dec 2015)
New Revision: 38561
Modified:
data/DLA/list
data/dla-needed.txt
Log:
Reserve DLA-375-1 for libpng
Modified: data/DLA/list
===
--- data/DLA/list 2015-12-27 19:35:23 UTC (rev 38560)
+++ data/DLA/list 2015-12-27 21:01:16 UTC (rev 38561)
@@ -1,3 +1,6 @@
+[27 Dec 2015] DLA-375-1 libpng - security update
+ {CVE-2012-3425 CVE-2015-8472 CVE-2015-8540}
+ [squeeze] - libpng 1.2.44-1+squeeze6
[26 Dec 2015] DLA-374-1 cacti - security update
{CVE-2015-8369 CVE-2015-8377}
[squeeze] - cacti 0.8.7g-1+squeeze9+deb6u11
Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2015-12-27 19:35:23 UTC (rev 38560)
+++ data/dla-needed.txt 2015-12-27 21:01:16 UTC (rev 38561)
@@ -14,8 +14,6 @@
dbconfig-common
NOTE: maintainer should take care of this, cf
https://lists.debian.org/565626bf.2010...@debian.org
--
-libpng (Thorsten Alteholz)
---
libraw
--
libvncserver (Mike Gabriel)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38560 - in data: . CVE
Author: carnil Date: 2015-12-27 19:35:23 + (Sun, 27 Dec 2015) New Revision: 38560 Modified: data/CVE/list data/dsa-needed.txt Log: Mark CVE-2015-8547/quassel as no-dsa Modified: data/CVE/list === --- data/CVE/list 2015-12-27 19:20:47 UTC (rev 38559) +++ data/CVE/list 2015-12-27 19:35:23 UTC (rev 38560) @@ -1270,6 +1270,7 @@ CVE-2015-8547 [quassel: op command denial of service issue] RESERVED - quassel 1:0.12.2-3 (bug #807801) + [jessie] - quassel (Minor issue; can be fixed via a point release) [wheezy] - quassel (Vulnerable code not present) [squeeze] - quassel (Vulnerable code not present) NOTE: https://github.com/quassel/quassel/commit/b8edbda019eeb99da8663193e224efc9d1265dc7 Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2015-12-27 19:20:47 UTC (rev 38559) +++ data/dsa-needed.txt 2015-12-27 19:35:23 UTC (rev 38560) @@ -60,10 +60,6 @@ -- pygments -- -quassel/stable - Pierre Schweitzer proposed debdiff for CVE-2015-8547, needs check and sponsoring of upload - NOTE: probably no-dsa, but asked question back to reporter. --- samba (carnil) Maintainer submitted first debdiff for jessie-security, needs review and ack -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38559 - data/CVE
Author: carnil Date: 2015-12-27 19:20:47 + (Sun, 27 Dec 2015) New Revision: 38559 Modified: data/CVE/list Log: Add bug reference for CVE-2015-8618/golang Modified: data/CVE/list === --- data/CVE/list 2015-12-27 19:09:05 UTC (rev 38558) +++ data/CVE/list 2015-12-27 19:20:47 UTC (rev 38559) @@ -509,7 +509,7 @@ TODO: check CVE-2015-8618 [math/big: fix carry propagation in Int.Exp Montgomery code] RESERVED - - golang + - golang (bug #809168) [jessie] - golang (Introduced in 1.5 release) [wheezy] - golang (Introduced in 1.5 release) NOTE: https://go-review.googlesource.com/#/c/17672/ ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38558 - data/CVE
Author: carnil Date: 2015-12-27 19:09:05 + (Sun, 27 Dec 2015) New Revision: 38558 Modified: data/CVE/list Log: Add fixed version for CVE-2015-8617/php7.0 Modified: data/CVE/list === --- data/CVE/list 2015-12-27 17:10:14 UTC (rev 38557) +++ data/CVE/list 2015-12-27 19:09:05 UTC (rev 38558) @@ -474,7 +474,7 @@ [jessie] - t-coffee (Minor issue) CVE-2015-8617 [format string vulnerability] RESERVED - - php7.0 + - php7.0 7.0.1-1 NOTE: https://bugs.php.net/bug.php?id=71105 NOTE: https://github.com/php/php-src/commit/b101a6bbd4f2181c360bd38e7683df4a03cba83e (php-7.0.2RC1) CVE-2015-8616 [Use after free in PHP Collator::sortWithSortKeys function] ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38556 - data/CVE
Author: carnil Date: 2015-12-27 16:55:43 + (Sun, 27 Dec 2015) New Revision: 38556 Modified: data/CVE/list Log: CVE-2015-8697/stalin assigned Modified: data/CVE/list === --- data/CVE/list 2015-12-27 14:10:01 UTC (rev 38555) +++ data/CVE/list 2015-12-27 16:55:43 UTC (rev 38556) @@ -482,12 +482,12 @@ - php7.0 7.0.1-1 NOTE: https://bugs.php.net/bug.php?id=71020 NOTE: http://www.openwall.com/lists/oss-security/2015/12/22/4 -CVE-2015- [Insecure use of temporary files] +CVE-2015-8697 [Insecure use of temporary files] - stalin (bug #808730) [jessie] - stalin (Minor issue) [wheezy] - stalin (Minor issue) [squeeze] - stalin (Minor issue) - NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/12/27/1 + NOTE: http://www.openwall.com/lists/oss-security/2015/12/27/1 CVE-2015-8614 [no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc] RESERVED - claws-mail 3.13.1-1 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38557 - data/CVE
Author: carnil Date: 2015-12-27 17:10:14 + (Sun, 27 Dec 2015) New Revision: 38557 Modified: data/CVE/list Log: phantomjs removed from unstable Modified: data/CVE/list === --- data/CVE/list 2015-12-27 16:55:43 UTC (rev 38556) +++ data/CVE/list 2015-12-27 17:10:14 UTC (rev 38557) @@ -59873,7 +59873,7 @@ - qt4-x11 4:4.8.5+git192-g085f851+dfsg-1 (low; bug #750141) [wheezy] - qt4-x11 (Minor issue) [squeeze] - qt4-x11 (Minor issue) - - phantomjs + - phantomjs NOTE: https://codereview.qt-project.org/#change,70708 CVE-2013-4548 (The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH ...) - openssh 1:6.4p1-1 (bug #729029) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38555 - data/CVE
Author: carnil
Date: 2015-12-27 14:10:01 + (Sun, 27 Dec 2015)
New Revision: 38555
Modified:
data/CVE/list
Log:
llvm-toolchain-3.4 removed from Debian unstable
Modified: data/CVE/list
===
--- data/CVE/list 2015-12-27 11:57:07 UTC (rev 38554)
+++ data/CVE/list 2015-12-27 14:10:01 UTC (rev 38555)
@@ -22626,7 +22626,7 @@
{DSA-3195-1 DLA-233-1}
- php5 5.6.6+dfsg-1 (low; bug #778389)
- olsrd (only when building on Android, see bug #778390)
- - llvm-toolchain-3.4 (low; bug #778391)
+ - llvm-toolchain-3.4 (low; bug #778391)
[jessie] - llvm-toolchain-3.4 (Minor issue)
- llvm-toolchain-3.5 1:3.5.2-2 (low; bug #778392)
[jessie] - llvm-toolchain-3.5 (Minor issue)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38554 - data/CVE
Author: santiago Date: 2015-12-27 11:57:07 + (Sun, 27 Dec 2015) New Revision: 38554 Modified: data/CVE/list Log: CVE-2015-8669/phpmyadmin squeeze not affected Modified: data/CVE/list === --- data/CVE/list 2015-12-27 11:34:50 UTC (rev 38553) +++ data/CVE/list 2015-12-27 11:57:07 UTC (rev 38554) @@ -1,5 +1,6 @@ CVE-2015-8669 [Full path disclosure vulnerability] - phpmyadmin 4:4.5.3.1-1 (unimportant) + [squeeze] - phpmyadmin (Vulnerable code not present) NOTE: https://www.phpmyadmin.net/security/PMASA-2015-6/ NOTE: non-issue for Debian-packaged version CVE-2015-8683 [out-of-bounds read in CIE Lab image format] ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38553 - data
Author: jmm Date: 2015-12-27 11:34:50 + (Sun, 27 Dec 2015) New Revision: 38553 Modified: data/dsa-needed.txt Log: take icedove Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2015-12-27 11:31:23 UTC (rev 38552) +++ data/dsa-needed.txt 2015-12-27 11:34:50 UTC (rev 38553) @@ -21,7 +21,7 @@ -- git -- -icedove +icedove (jmm) Maintainer prepared update to 38.5.0 -- icedtea-web ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38552 - data/CVE
Author: jmm Date: 2015-12-27 11:31:23 + (Sun, 27 Dec 2015) New Revision: 38552 Modified: data/CVE/list Log: mark as non-issue Modified: data/CVE/list === --- data/CVE/list 2015-12-27 11:05:12 UTC (rev 38551) +++ data/CVE/list 2015-12-27 11:31:23 UTC (rev 38552) @@ -1,8 +1,7 @@ CVE-2015-8669 [Full path disclosure vulnerability] - - phpmyadmin 4:4.5.3.1-1 - [jessie] - phpmyadmin (Minor issue) - [wheezy] - phpmyadmin (Minor issue) + - phpmyadmin 4:4.5.3.1-1 (unimportant) NOTE: https://www.phpmyadmin.net/security/PMASA-2015-6/ + NOTE: non-issue for Debian-packaged version CVE-2015-8683 [out-of-bounds read in CIE Lab image format] - tiff (bug #809021) - tiff3 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38551 - data/CVE
Author: carnil
Date: 2015-12-27 11:05:12 + (Sun, 27 Dec 2015)
New Revision: 38551
Modified:
data/CVE/list
Log:
Update CVEs affecting icedove
Modified: data/CVE/list
===
--- data/CVE/list 2015-12-27 10:54:27 UTC (rev 38550)
+++ data/CVE/list 2015-12-27 11:05:12 UTC (rev 38551)
@@ -6359,16 +6359,22 @@
{DSA-3422-1}
- iceweasel 38.5.0esr-1
[squeeze] - iceweasel
+ - icedove 38.5.0-1
+ [squeeze] - icedove
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2015-149/
CVE-2015-7213 (Integer overflow in the MPEG4Extractor::readMetaData function
in ...)
{DSA-3422-1}
- iceweasel 38.5.0esr-1
[squeeze] - iceweasel
+ - icedove 38.5.0-1
+ [squeeze] - icedove
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2015-146/
CVE-2015-7212 (Integer overflow in the ...)
{DSA-3422-1}
- iceweasel 38.5.0esr-1
[squeeze] - iceweasel
+ - icedove 38.5.0-1
+ [squeeze] - icedove
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2015-139/
CVE-2015-7211 (Mozilla Firefox before 43.0 mishandles the # (number sign)
character ...)
- iceweasel (ESR38 series not affected)
@@ -6392,6 +6398,8 @@
{DSA-3422-1}
- iceweasel 38.5.0esr-1
[squeeze] - iceweasel
+ - icedove 38.5.0-1
+ [squeeze] - icedove
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2015-145/
CVE-2015-7204 (Mozilla Firefox before 43.0 does not properly store the
properties of ...)
- iceweasel (ESR38 series not affected)
@@ -6406,6 +6414,8 @@
{DSA-3422-1}
- iceweasel 38.5.0esr-1
[squeeze] - iceweasel
+ - icedove 38.5.0-1
+ [squeeze] - icedove
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2015-134/
CVE-2015-7200 (The CryptoKey interface implementation in Mozilla Firefox
before 42.0 ...)
{DSA-3410-1 DSA-3393-1}
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38550 - data/CVE
Author: carnil Date: 2015-12-27 10:54:27 + (Sun, 27 Dec 2015) New Revision: 38550 Modified: data/CVE/list Log: CVE-2015-8669/phpmyadmin fixed in unstable Modified: data/CVE/list === --- data/CVE/list 2015-12-27 10:27:56 UTC (rev 38549) +++ data/CVE/list 2015-12-27 10:54:27 UTC (rev 38550) @@ -1,5 +1,5 @@ CVE-2015-8669 [Full path disclosure vulnerability] - - phpmyadmin + - phpmyadmin 4:4.5.3.1-1 [jessie] - phpmyadmin (Minor issue) [wheezy] - phpmyadmin (Minor issue) NOTE: https://www.phpmyadmin.net/security/PMASA-2015-6/ ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38549 - data/CVE
Author: carnil
Date: 2015-12-27 10:27:56 + (Sun, 27 Dec 2015)
New Revision: 38549
Modified:
data/CVE/list
Log:
Update CVE-2015-836{6,7}/libraw, mark as no-dsa
Modified: data/CVE/list
===
--- data/CVE/list 2015-12-27 09:27:51 UTC (rev 38548)
+++ data/CVE/list 2015-12-27 10:27:56 UTC (rev 38549)
@@ -3106,14 +3106,21 @@
CVE-2015-8367 [Memory objects are not intialized properly]
RESERVED
- libraw 0.17.1-1 (bug #806809)
+ [jessie] - libraw (Minor issue)
+ [wheezy] - libraw (Vulnerable code not present)
[squeeze] - libraw (Vulerable code not present)
- NOTE:
https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2
- TODO: check other copies containing libraw code
+ NOTE: Fixed by:
https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2
+ NOTE: Introduced by:
https://github.com/LibRaw/LibRaw/commit/7b1430c76a19c93f3cc755bb2ff9bda0ba9b4082
(0.15.0)
+ TODO: check other copies containing libraw code, double check
introducing commit
CVE-2015-8366 [Index overflow in smal_decode_segment]
RESERVED
- libraw 0.17.1-1 (bug #806809)
- NOTE:
https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2
- TODO: check other copies containing libraw code
+ [jessie] - libraw (Minor issue)
+ [wheezy] - libraw (Vulnerable code not present)
+ [squeeze] - libraw (Vulnerable code not present)
+ NOTE: Fixed by:
https://github.com/LibRaw/LibRaw/commit/89d065424f09b788f443734d44857289489ca9e2
+ NOTE: Introduced by:
https://github.com/LibRaw/LibRaw/commit/cfe3ab8da7276fb339de770a3d1b7bfb212620b7
+ TODO: check other copies containing libraw code, double check
introducing commit
CVE-2015-8365 (The smka_decode_frame function in libavcodec/smacker.c in
FFmpeg ...)
- ffmpeg 7:2.8.3-1 (bug #806519)
[squeeze] - ffmpeg (Not supported in Squeeze LTS)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38548 - data
Author: carnil Date: 2015-12-27 09:27:51 + (Sun, 27 Dec 2015) New Revision: 38548 Modified: data/embedded-code-copies Log: lemonldap-ng embedds jqueryui, but starting from 1.4.6-3 it is removed from the binary package and replaced by the shared library Modified: data/embedded-code-copies === --- data/embedded-code-copies 2015-12-27 09:10:13 UTC (rev 38547) +++ data/embedded-code-copies 2015-12-27 09:27:51 UTC (rev 38548) @@ -1013,6 +1013,7 @@ jqueryui - request-tracker4 (embed; bug #693821) + - lemonldap-ng 1.4.6-3 (embed) tablesorter (jquery plugin, not packaged yet) - wesnoth (embed) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38547 - data/CVE
Author: sectracker Date: 2015-12-27 09:10:13 + (Sun, 27 Dec 2015) New Revision: 38547 Modified: data/CVE/list Log: automatic update Modified: data/CVE/list === --- data/CVE/list 2015-12-27 08:26:39 UTC (rev 38546) +++ data/CVE/list 2015-12-27 09:10:13 UTC (rev 38547) @@ -1135,6 +1135,7 @@ NOTE: http://xenbits.xen.org/xsa/advisory-120.html TODO: check CVE-2015-8552 [Linux pciback missing sanity checks leading to crash] + RESERVED [experimental] - linux 4.4~rc6-1~exp1 - linux - linux-2.6 @@ -1146,6 +1147,7 @@ NOTE: https://git.kernel.org/linus/7cfb905b9638982862f0331b36ccaaca5d383b49 NOTE: https://git.kernel.org/linus/408fb0e5aa7fda0059db282ff58c3b2a4278baa0 CVE-2015-8551 [Linux pciback missing sanity checks leading to crash] + RESERVED [experimental] - linux 4.4~rc6-1~exp1 - linux - linux-2.6 @@ -1157,6 +1159,7 @@ NOTE: https://git.kernel.org/linus/7cfb905b9638982862f0331b36ccaaca5d383b49 NOTE: https://git.kernel.org/linus/408fb0e5aa7fda0059db282ff58c3b2a4278baa0 CVE-2015-8550 [paravirtualized drivers incautious about shared memory contents] + RESERVED [experimental] - linux 4.4~rc6-1~exp1 - linux - linux-2.6 @@ -5646,6 +5649,7 @@ CVE-2015-7510 RESERVED CVE-2015-7509 [Mounting ext4 filesystems in no-journal mode could have lead to a system crash.] + RESERVED - linux 3.8-1~experimental.1 [wheezy] - linux 3.2.68-1 - linux-2.6 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38546 - data/CVE
Author: carnil Date: 2015-12-27 08:26:39 + (Sun, 27 Dec 2015) New Revision: 38546 Modified: data/CVE/list Log: Add CVE request reference for stalin Modified: data/CVE/list === --- data/CVE/list 2015-12-27 08:06:50 UTC (rev 38545) +++ data/CVE/list 2015-12-27 08:26:39 UTC (rev 38546) @@ -487,6 +487,7 @@ [jessie] - stalin (Minor issue) [wheezy] - stalin (Minor issue) [squeeze] - stalin (Minor issue) + NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/12/27/1 CVE-2015-8614 [no bounds checking on the output buffer in conv_jistoeuc, conv_euctojis, conv_sjistoeuc] RESERVED - claws-mail 3.13.1-1 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r38545 - data
Author: carnil Date: 2015-12-27 08:06:50 + (Sun, 27 Dec 2015) New Revision: 38545 Modified: data/dsa-needed.txt Log: Added note for CVE-2015-8547/quassel Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2015-12-27 06:52:07 UTC (rev 38544) +++ data/dsa-needed.txt 2015-12-27 08:06:50 UTC (rev 38545) @@ -62,6 +62,7 @@ -- quassel/stable Pierre Schweitzer proposed debdiff for CVE-2015-8547, needs check and sponsoring of upload + NOTE: probably no-dsa, but asked question back to reporter. -- samba (carnil) Maintainer submitted first debdiff for jessie-security, needs review and ack ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
