[Secure-testing-commits] r41268 - data/CVE
Author: pabs Date: 2016-04-29 01:51:15 + (Fri, 29 Apr 2016) New Revision: 41268 Modified: data/CVE/list Log: Upcoming gitlab security issue Modified: data/CVE/list === --- data/CVE/list 2016-04-28 21:10:12 UTC (rev 41267) +++ data/CVE/list 2016-04-29 01:51:15 UTC (rev 41268) @@ -1,3 +1,7 @@ +CVE-2016-4340 + - gitlab + NOTE: https://about.gitlab.com/2016/04/28/gitlab-major-security-update-for-cve-2016-4340/ + TODO: check CVE-2016-4087 RESERVED CVE-2016-4086 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41266 - in data: . DLA
Author: santiago
Date: 2016-04-28 21:06:59 + (Thu, 28 Apr 2016)
New Revision: 41266
Modified:
data/DLA/list
data/dla-needed.txt
Log:
reserve DLA-447-1 for mysql-5.5
Modified: data/DLA/list
===
--- data/DLA/list 2016-04-28 20:24:26 UTC (rev 41265)
+++ data/DLA/list 2016-04-28 21:06:59 UTC (rev 41266)
@@ -1,3 +1,6 @@
+[28 Apr 2016] DLA-447-1 mysql-5.5 - security update
+ {CVE-2016-0640 CVE-2016-0641 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644
CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650
CVE-2016-0666 CVE-2016-2047}
+ [wheezy] - mysql-5.5 5.5.49-0+deb7u1
[28 Apr 2016] DLA-446-1 poppler - security update
{CVE-2015-8868}
[wheezy] - poppler 0.18.4-6+deb7u1
Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2016-04-28 20:24:26 UTC (rev 41265)
+++ data/dla-needed.txt 2016-04-28 21:06:59 UTC (rev 41266)
@@ -55,10 +55,6 @@
minissdpd
NOTE: debdiff sent by Thorsten Alteholz to the Security Team on 2016-03-28
--
-mysql-5.5 (Santiago R.R.)
- NOTE: carnil already claimed in dsa-needed.txt
- NOTE: Robie Basak prepared also a wheezy package
http://lists.alioth.debian.org/pipermail/pkg-mysql-maint/2016-April/008959.html
---
nss
--
ntp
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41264 - in data: . DLA
Author: alteholz
Date: 2016-04-28 20:19:20 + (Thu, 28 Apr 2016)
New Revision: 41264
Modified:
data/DLA/list
data/dla-needed.txt
Log:
Reserve DLA-446-1 for poppler
Modified: data/DLA/list
===
--- data/DLA/list 2016-04-28 20:13:19 UTC (rev 41263)
+++ data/DLA/list 2016-04-28 20:19:20 UTC (rev 41264)
@@ -1,3 +1,6 @@
+[28 Apr 2016] DLA-446-1 poppler - security update
+ {CVE-2015-8868}
+ [wheezy] - poppler 0.18.4-6+deb7u1
[03 Mar 2016] DLA-445-2 squid3 - regression update
[squeeze] - squid3 3.1.6-1.2+squeeze7
[29 Feb 2016] DLA-445-1 squid3 - security update
Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2016-04-28 20:13:19 UTC (rev 41263)
+++ data/dla-needed.txt 2016-04-28 20:19:20 UTC (rev 41264)
@@ -76,8 +76,6 @@
policykit-1
NOTE: CVE-2016-2568 doesn't have a fix yet, 20160425
--
-poppler (Thorsten Alteholz)
---
samba
Samba maintainers are preparing updates for regressions
--
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41262 - data/CVE
Author: carnil Date: 2016-04-28 17:12:00 + (Thu, 28 Apr 2016) New Revision: 41262 Modified: data/CVE/list Log: Update status for CVE-2015-0857/tardiff Modified: data/CVE/list === --- data/CVE/list 2016-04-28 17:09:25 UTC (rev 41261) +++ data/CVE/list 2016-04-28 17:12:00 UTC (rev 41262) @@ -35874,9 +35874,12 @@ CVE-2015-0858 [/tmp race condition in handling temporary directory] RESERVED - tardiff 0.1-3 -CVE-2015-0857 [shell command injection through file names] +CVE-2015-0857 [shell command injection through file names and tar file name itself] RESERVED - - tardiff 0.1-3 + - tardiff + NOTE: Assignment is done for injection through file names and tar file name itself + NOTE: First part was addressed in 0.1-3 but does not contain the fix for the tar + NOTE: file name itself. CVE-2015-0856 (daemon/Greeter.cpp in sddm before 0.13.0 does not properly disable the ...) - sddm 0.12.0-5 (bug #803336; low) NOTE: https://github.com/sddm/sddm/commit/4cfed6b0a625593 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41261 - data/CVE
Author: carnil Date: 2016-04-28 17:09:25 + (Thu, 28 Apr 2016) New Revision: 41261 Modified: data/CVE/list Log: Add more CVEs for php Modified: data/CVE/list === --- data/CVE/list 2016-04-28 17:05:37 UTC (rev 41260) +++ data/CVE/list 2016-04-28 17:09:25 UTC (rev 41261) @@ -5077,6 +5077,22 @@ NOTE: Fixed in 5.6.18, 5.5.32, 7.0.3 - hhvm 3.12.1+dfsg-1 NOTE: https://github.com/facebook/hhvm/commit/eae73029336e4d577707cb8a0527f22cb8a4588a +CVE-2016-4346 [Multiple Heap Overflow due to integer overflows | xml/filter_url/addcslashes -- ext/standard/string.c] + - php7.0 + - php5 + NOTE: https://bugs.php.net/bug.php?id=71637 +CVE-2016-4345 [Multiple Heap Overflow due to integer overflows | xml/filter_url/addcslashes -- ext/filter/sanitizing_filters.c] + - php7.0 + - php5 + NOTE: https://bugs.php.net/bug.php?id=71637 +CVE-2016-4344 [Multiple Heap Overflow due to integer overflows | xml/filter_url/addcslashes -- ext/xml/xml.c] + - php7.0 + - php5 + NOTE: https://bugs.php.net/bug.php?id=71637 +CVE-2016-4343 [Uninitialized pointer in phar_make_dirstream()] + - php7.0 + - php5 + NOTE: https://bugs.php.net/bug.php?id=71331 CVE-2016-4342 [Heap corruption in tar/zip/phar parser] - php5 5.6.18+dfsg-1 [jessie] - php5 5.6.19+dfsg-0+deb8u1 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41260 - data/CVE
Author: carnil Date: 2016-04-28 17:05:37 + (Thu, 28 Apr 2016) New Revision: 41260 Modified: data/CVE/list Log: CVE-2016-4342/php assigned Modified: data/CVE/list === --- data/CVE/list 2016-04-28 17:00:29 UTC (rev 41259) +++ data/CVE/list 2016-04-28 17:05:37 UTC (rev 41260) @@ -5077,14 +5077,13 @@ NOTE: Fixed in 5.6.18, 5.5.32, 7.0.3 - hhvm 3.12.1+dfsg-1 NOTE: https://github.com/facebook/hhvm/commit/eae73029336e4d577707cb8a0527f22cb8a4588a -CVE-2016- [Heap corruption in tar/zip/phar parser] +CVE-2016-4342 [Heap corruption in tar/zip/phar parser] - php5 5.6.18+dfsg-1 [jessie] - php5 5.6.19+dfsg-0+deb8u1 [wheezy] - php5 (Minor issue, can be fixed in next update round) + [squeeze] - php5 5.3.3.1-7+squeeze29 - php5.6 5.6.18+dfsg-1 - php7.0 7.0.3-1 - [squeeze] - php5 5.3.3.1-7+squeeze29 - NOTE: temporary workaround until CVE assigned to explitly tag for squeeze NOTE: https://bugs.php.net/bug.php?id=71354 NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1305536 NOTE: https://git.php.net/?p=php-src.git;a=commit;h=13ad4d3e971807f9a58ab5933182907dc2958539 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41259 - data
Author: apo Date: 2016-04-28 17:00:29 + (Thu, 28 Apr 2016) New Revision: 41259 Modified: data/dla-needed.txt Log: Add gdk-pixbuf to dla-needed.txt and claim it. Modified: data/dla-needed.txt === --- data/dla-needed.txt 2016-04-28 16:04:31 UTC (rev 41258) +++ data/dla-needed.txt 2016-04-28 17:00:29 UTC (rev 41259) @@ -21,6 +21,8 @@ -- extplorer (Thorsten Alteholz) -- +gdk-pixbuf (Markus Koschany) +-- gosa (Mike Gabriel) NOTE: .debdiff sent to the Security Team, waiting for feedback NOTE: asked about jessie status (seb) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41257 - data/CVE
Author: carnil Date: 2016-04-28 16:04:18 + (Thu, 28 Apr 2016) New Revision: 41257 Modified: data/CVE/list Log: Add two new subversion issues Modified: data/CVE/list === --- data/CVE/list 2016-04-28 10:02:31 UTC (rev 41256) +++ data/CVE/list 2016-04-28 16:04:18 UTC (rev 41257) @@ -5652,8 +5652,12 @@ RESERVED CVE-2016-2168 RESERVED + - subversion + NOTE: https://subversion.apache.org/security/CVE-2016-2168-advisory.txt CVE-2016-2167 RESERVED + - subversion + NOTE: https://subversion.apache.org/security/CVE-2016-2167-advisory.txt CVE-2016-2166 (The (1) proton.reactor.Connector, (2) proton.reactor.Container, and ...) - qpid-proton (Vulnerable code not present) NOTE: https://issues.apache.org/jira/browse/PROTON-1157 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41258 - data
Author: carnil Date: 2016-04-28 16:04:31 + (Thu, 28 Apr 2016) New Revision: 41258 Modified: data/dsa-needed.txt Log: Add subversion to dsa-needed list Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2016-04-28 16:04:18 UTC (rev 41257) +++ data/dsa-needed.txt 2016-04-28 16:04:31 UTC (rev 41258) @@ -67,6 +67,8 @@ -- squid3 -- +subversion +-- tardiff fw asked maintainer for preparing debdiffs for wheezy- and jessie-security https://anonscm.debian.org/cgit/collab-maint/tardiff.git/log/?h=jessie ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41256 - data
Author: santiago Date: 2016-04-28 10:02:31 + (Thu, 28 Apr 2016) New Revision: 41256 Modified: data/dla-needed.txt Log: take mysql-5.5 in dla-needed Modified: data/dla-needed.txt === --- data/dla-needed.txt 2016-04-28 09:32:55 UTC (rev 41255) +++ data/dla-needed.txt 2016-04-28 10:02:31 UTC (rev 41256) @@ -53,8 +53,9 @@ minissdpd NOTE: debdiff sent by Thorsten Alteholz to the Security Team on 2016-03-28 -- -mysql-5.5 +mysql-5.5 (Santiago R.R.) NOTE: carnil already claimed in dsa-needed.txt + NOTE: Robie Basak prepared also a wheezy package http://lists.alioth.debian.org/pipermail/pkg-mysql-maint/2016-April/008959.html -- nss -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41255 - data/CVE
Author: jmm Date: 2016-04-28 09:32:55 + (Thu, 28 Apr 2016) New Revision: 41255 Modified: data/CVE/list Log: hhvm n/a for libgd issue Modified: data/CVE/list === --- data/CVE/list 2016-04-28 08:36:58 UTC (rev 41254) +++ data/CVE/list 2016-04-28 09:32:55 UTC (rev 41255) @@ -2622,7 +2622,7 @@ - libgd2 2.1.1-4.1 (bug #822242) - php5 (unimportant) - php7.0 (unimportant) - - hhvm + - hhvm (Implements additional sanity checks) NOTE: PoC: https://github.com/dyntopia/exploits/tree/master/CVE-2016-3074 NOTE: Upstream fix: https://github.com/libgd/libgd/commit/2bb97f407c1145c850416a3bfbcc8cf124e68a19 NOTE: Starting with 5.4.0-1 Debian uses the system copy of libgd ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41254 - data/CVE
Author: carnil Date: 2016-04-28 08:36:58 + (Thu, 28 Apr 2016) New Revision: 41254 Modified: data/CVE/list Log: Add CVE-2016-3078/php7.0 Modified: data/CVE/list === --- data/CVE/list 2016-04-28 06:10:35 UTC (rev 41253) +++ data/CVE/list 2016-04-28 08:36:58 UTC (rev 41254) @@ -2594,8 +2594,12 @@ NOT-FOR-US: Red Hat Satellite / Spacewalk / spacewalk-monitoring CVE-2016-3079 (Multiple cross-site scripting (XSS) vulnerabilities in the Web UI in ...) NOT-FOR-US: Red Hat Satellite / Spacewalk -CVE-2016-3078 +CVE-2016-3078 [integer overflow in ZipArchive::getFrom*] RESERVED + - php7.0 + NOTE: http://www.openwall.com/lists/oss-security/2016/04/28/1 + NOTE: Fixed in 7.0.6 + TODO: check other php versions if affected CVE-2016-3077 RESERVED NOT-FOR-US: ovirt-engine ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r41253 - data/CVE
Author: carnil Date: 2016-04-28 06:10:35 + (Thu, 28 Apr 2016) New Revision: 41253 Modified: data/CVE/list Log: Mark CVE-2016-3708 as NFU Modified: data/CVE/list === --- data/CVE/list 2016-04-28 04:21:12 UTC (rev 41252) +++ data/CVE/list 2016-04-28 06:10:35 UTC (rev 41253) @@ -1174,6 +1174,7 @@ RESERVED CVE-2016-3708 RESERVED + NOT-FOR-US: OpenShiftEnterprise / Red Hat CVE-2016-3707 RESERVED CVE-2016-3706 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
