[Secure-testing-commits] r53651 - data/CVE
Author: carnil Date: 2017-07-19 06:39:18 + (Wed, 19 Jul 2017) New Revision: 53651 Modified: data/CVE/list Log: Add more mysql server CVEs Modified: data/CVE/list === --- data/CVE/list 2017-07-19 06:31:40 UTC (rev 53650) +++ data/CVE/list 2017-07-19 06:39:18 UTC (rev 53651) @@ -22609,28 +22609,52 @@ RESERVED CVE-2017-3653 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (bug #868788) CVE-2017-3652 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (bug #868788) CVE-2017-3651 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (bug #868788) CVE-2017-3650 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3649 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.6 and 5.7) CVE-2017-3648 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (bug #868788) CVE-2017-3647 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.6 and 5.7) CVE-2017-3646 RESERVED + - mysql-5.7 5.7.17-1 + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3645 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3644 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3643 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3642 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3641 RESERVED - mysql-5.7 (bug #868798) @@ -22645,6 +22669,8 @@ - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3638 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3637 RESERVED - mysql-5.7 (bug #868798) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53650 - data/CVE
Author: carnil Date: 2017-07-19 06:31:40 + (Wed, 19 Jul 2017) New Revision: 53650 Modified: data/CVE/list Log: Record more mysql CVEs Modified: data/CVE/list === --- data/CVE/list 2017-07-19 06:22:06 UTC (rev 53649) +++ data/CVE/list 2017-07-19 06:31:40 UTC (rev 53650) @@ -22633,18 +22633,30 @@ RESERVED CVE-2017-3641 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (bug #868788) CVE-2017-3640 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3639 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3638 RESERVED CVE-2017-3637 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3636 RESERVED + - mysql-5.7 (Only affects MySQL 5.5 and 5.6) + - mysql-5.5 (bug #868788) CVE-2017-3635 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (bug #868788) CVE-2017-3634 RESERVED - mysql-5.7 (bug #868798) @@ -22904,6 +22916,8 @@ NOT-FOR-US: Oracle CVE-2017-3529 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.7) CVE-2017-3528 (Vulnerability in the Oracle Applications Framework component of Oracle ...) NOT-FOR-US: Oracle CVE-2017-3527 (Vulnerability in the PeopleSoft Enterprise PeopleTools component of ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53649 - data/CVE
Author: carnil Date: 2017-07-19 06:22:06 + (Wed, 19 Jul 2017) New Revision: 53649 Modified: data/CVE/list Log: Start adding mysql entries from July 2016 Oracle CPU Modified: data/CVE/list === --- data/CVE/list 2017-07-19 06:09:14 UTC (rev 53648) +++ data/CVE/list 2017-07-19 06:22:06 UTC (rev 53649) @@ -22647,8 +22647,12 @@ RESERVED CVE-2017-3634 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.6 and 5.7) CVE-2017-3633 RESERVED + - mysql-5.7 (bug #868798) + - mysql-5.5 (Only affects MySQL 5.6 and 5.7) CVE-2017-3632 RESERVED CVE-2017-3631 (Vulnerability in the Solaris component of Oracle Sun Systems Products ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53648 - data
Author: carnil Date: 2017-07-19 06:09:14 + (Wed, 19 Jul 2017) New Revision: 53648 Modified: data/dsa-needed.txt Log: Add mysql-5.5 to dsa-needed list Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-07-19 04:49:59 UTC (rev 53647) +++ data/dsa-needed.txt 2017-07-19 06:09:14 UTC (rev 53648) @@ -34,6 +34,8 @@ linux wait until more issues have piled up -- +mysql-5.5 +-- php-horde-image -- php5 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53647 - data/CVE
Author: carnil Date: 2017-07-19 04:49:59 + (Wed, 19 Jul 2017) New Revision: 53647 Modified: data/CVE/list Log: Review more issues included in the last DSA (no CVEs yet assigned) Modified: data/CVE/list === --- data/CVE/list 2017-07-19 04:41:08 UTC (rev 53646) +++ data/CVE/list 2017-07-19 04:49:59 UTC (rev 53647) @@ -238,43 +238,55 @@ NOTE: Fixed by: https://github.com/vadz/libtiff/commit/69bfeec247899776b1b396651adb47436e5f1556 CVE-2017- [avoid a memory leak during screenshot] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867897) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 + [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/556 NOTE: https://github.com/ImageMagick/ImageMagick/commit/8c10b9247509c0484b55330458846115131ec2ae#diff-0a5dc34e461f3c458e758c199f2dc46d CVE-2017- [Avoid heap based overflow for jpeg] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867894) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/556 NOTE: https://github.com/ImageMagick/ImageMagick/commit/948356eec65aea91995d4b7cc487d197d2c5f602 CVE-2017- [memory leak in ReadMATImage in mat.c] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867823) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/525 CVE-2017- [clear jpeg memory in order to avoid data leak] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867893) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/556 NOTE: https://github.com/ImageMagick/ImageMagick/commit/1737ac82b335e53376382c07b9a500d73dd2aa11 CVE-2017- [CPU exhaustion in ReadOneDJVUImage] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867826) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/528 CVE-2017- [CPU exhaustion in ReadOneMNGImage] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867825) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/527 CVE-2017- [CPU exhaustion in ReadOneJNGImage] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867824) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/526 CVE-2017- [memory exhaustion in ReadEPTImage in ept.c] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867821) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/524 CVE-2017- [assertion failed in WriteBlob] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867798) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 + [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/506 CVE-2017- [enable heap overflow check for stdin for mpc files] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867896) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/556 NOTE: https://github.com/ImageMagick/ImageMagick/commit/b007dd3a048097d8f58949297f5b434612e1e1a3#diff-cdb21e3ad4d6e304030bd19bdc881fce @@ -982,14 +994,17 @@ RESERVED CVE-2017- [memory exhaustion in ReadDPXImage in dpx.c] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867812) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/523 CVE-2017- [memory leak in ReadDIBImage in dib.c] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867811) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/522 CVE-2017- [memory exhaustion in ReadCINImage] - imagemagick 8:6.9.7.4+dfsg-12 (bug #867810) + [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1 [jessie] - imagemagick 8:6.8.9.9-5+deb8u10 NOTE: https://github.com/ImageMagick/ImageMagick/issues/519 CVE-2017-11188 (The ReadDPXImage function in coders\dpx.c in ImageMagick 7.0.6-0 has a ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org
[Secure-testing-commits] r53646 - data/CVE
Author: carnil
Date: 2017-07-19 04:41:08 + (Wed, 19 Jul 2017)
New Revision: 53646
Modified:
data/CVE/list
Log:
Record more imagemagick fixes with last DSA
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-19 04:31:15 UTC (rev 53645)
+++ data/CVE/list 2017-07-19 04:41:08 UTC (rev 53646)
@@ -242,32 +242,40 @@
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/8c10b9247509c0484b55330458846115131ec2ae#diff-0a5dc34e461f3c458e758c199f2dc46d
CVE-2017- [Avoid heap based overflow for jpeg]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867894)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/556
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/948356eec65aea91995d4b7cc487d197d2c5f602
CVE-2017- [memory leak in ReadMATImage in mat.c]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867823)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/525
CVE-2017- [clear jpeg memory in order to avoid data leak]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867893)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/556
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/1737ac82b335e53376382c07b9a500d73dd2aa11
CVE-2017- [CPU exhaustion in ReadOneDJVUImage]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867826)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/528
CVE-2017- [CPU exhaustion in ReadOneMNGImage]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867825)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/527
CVE-2017- [CPU exhaustion in ReadOneJNGImage]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867824)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/526
CVE-2017- [memory exhaustion in ReadEPTImage in ept.c]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867821)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/524
CVE-2017- [assertion failed in WriteBlob]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867798)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/506
CVE-2017- [enable heap overflow check for stdin for mpc files]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867896)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/556
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/b007dd3a048097d8f58949297f5b434612e1e1a3#diff-cdb21e3ad4d6e304030bd19bdc881fce
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/529ff26b68febb2ac03062c58452ea0b4c6edbc1#diff-cdb21e3ad4d6e304030bd19bdc881fce
@@ -974,12 +982,15 @@
RESERVED
CVE-2017- [memory exhaustion in ReadDPXImage in dpx.c]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867812)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/523
CVE-2017- [memory leak in ReadDIBImage in dib.c]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867811)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/522
CVE-2017- [memory exhaustion in ReadCINImage]
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867810)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/519
CVE-2017-11188 (The ReadDPXImage function in coders\dpx.c in ImageMagick
7.0.6-0 has a ...)
- imagemagick 8:6.9.7.4+dfsg-12 (bug #867806)
@@ -5154,7 +5165,7 @@
CVE-2017-9405 (In ImageMagick 7.0.5-5, the ReadICONImage function in
icon.c:452 allows ...)
{DLA-1000-1}
- imagemagick 8:6.9.7.4+dfsg-11 (low; bug #864087)
- [jessie] - imagemagick (Minor issue, wait until more severe
issues arise)
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
NOTE: https://github.com/ImageMagick/ImageMagick/issues/457
CVE-2017-9404 (In LibTIFF 4.0.7, a memory leak vulnerability was found in the
function ...)
{DLA-984-1 DLA-983-1}
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53645 - data/CVE
Author: carnil Date: 2017-07-19 04:31:15 + (Wed, 19 Jul 2017) New Revision: 53645 Modified: data/CVE/list Log: Filled bug for apport to track issue in BTS Modified: data/CVE/list === --- data/CVE/list 2017-07-19 04:21:13 UTC (rev 53644) +++ data/CVE/list 2017-07-19 04:31:15 UTC (rev 53645) @@ -1987,7 +1987,7 @@ CVE-2017-10709 (The lockscreen on Elephone P9000 devices (running Android 6.0) allows ...) NOT-FOR-US: Elephone P9000 devices CVE-2017-10708 (An issue was discovered in Apport through 2.20.x. In apport/report.py, ...) - [experimental] - apport + [experimental] - apport (bug #868831) NOTE: apport only in experimental, so we cannot track this in security-tracker CVE-2017-10707 RESERVED ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53643 - data/CVE
Author: carnil
Date: 2017-07-19 04:21:05 + (Wed, 19 Jul 2017)
New Revision: 53643
Modified:
data/CVE/list
Log:
Slightly reorder entries
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-19 02:41:16 UTC (rev 53642)
+++ data/CVE/list 2017-07-19 04:21:05 UTC (rev 53643)
@@ -5129,8 +5129,8 @@
RESERVED
CVE-2017-9409 (In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c
allows ...)
{DLA-1000-1}
+ - imagemagick 8:6.9.7.4+dfsg-11 (low; bug #864090)
[jessie] - imagemagick 8:6.8.9.9-5+deb8u10
- - imagemagick 8:6.9.7.4+dfsg-11 (low; bug #864090)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/458
CVE-2017-9408 (In Poppler 0.54.0, a memory leak vulnerability was found in the
...)
- poppler (low; bug #864009)
@@ -5141,8 +5141,8 @@
NOTE:
https://cgit.freedesktop.org/poppler/poppler/commit/?id=b21b041f7948680c03109f0c404400a9dbc4544c
CVE-2017-9407 (In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c
allows ...)
{DLA-1000-1}
+ - imagemagick 8:6.9.7.4+dfsg-11 (low; bug #864089)
[jessie] - imagemagick 8:6.8.9.9-5+deb8u10
- - imagemagick 8:6.9.7.4+dfsg-11 (low; bug #864089)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/459
CVE-2017-9406 (In Poppler 0.54.0, a memory leak vulnerability was found in the
...)
- poppler (low; bug #864010)
@@ -5704,14 +5704,14 @@
NOTE: Controllers shipped in Debian not vulnerable, see #863655
CVE-2017-9262 (In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in
coders/png.c ...)
{DLA-1000-1}
+ - imagemagick 8:6.9.7.4+dfsg-10 (low; bug #863834)
[jessie] - imagemagick 8:6.8.9.9-5+deb8u10
- - imagemagick 8:6.9.7.4+dfsg-10 (low; bug #863834)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/475
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/4649578df8dcbfb2b08d8623d52486dc124da3a8
CVE-2017-9261 (In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in
coders/png.c ...)
{DLA-1000-1}
+ - imagemagick 8:6.9.7.4+dfsg-10 (low; bug #863833)
[jessie] - imagemagick 8:6.8.9.9-5+deb8u10
- - imagemagick 8:6.9.7.4+dfsg-10 (low; bug #863833)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/476
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/01d522e990aa57cbe67d222dd5e8f7196cc6d199
CVE-2017-9260
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53644 - data/DSA
Author: carnil
Date: 2017-07-19 04:21:13 + (Wed, 19 Jul 2017)
New Revision: 53644
Modified:
data/DSA/list
Log:
Add one missing CVE for imagemagick update
Modified: data/DSA/list
===
--- data/DSA/list 2017-07-19 04:21:05 UTC (rev 53643)
+++ data/DSA/list 2017-07-19 04:21:13 UTC (rev 53644)
@@ -1,5 +1,5 @@
[18 Jul 2017] DSA-3914-1 imagemagick - security update
- {CVE-2017-9439 CVE-2017-9440 CVE-2017-9500 CVE-2017-9501 CVE-2017-10928
CVE-2017-11141 CVE-2017-11170 CVE-2017-11188 CVE-2017-11360}
+ {CVE-2017-9439 CVE-2017-9440 CVE-2017-9500 CVE-2017-9501 CVE-2017-10928
CVE-2017-11141 CVE-2017-11170 CVE-2017-11188 CVE-2017-11360 CVE-2017-11352}
[jessie] - imagemagick 8:6.8.9.9-5+deb8u10
[stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1
[18 Jul 2017] DSA-3913-1 apache2 - security update
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53642 - data/CVE
Author: pabs Date: 2017-07-19 02:41:16 + (Wed, 19 Jul 2017) New Revision: 53642 Modified: data/CVE/list Log: gsoap: CVE-2017-9765 Modified: data/CVE/list === --- data/CVE/list 2017-07-18 22:33:40 UTC (rev 53641) +++ data/CVE/list 2017-07-19 02:41:16 UTC (rev 53642) @@ -4065,6 +4065,9 @@ NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=d6e888400ba64de3147da4c23edf389b CVE-2017-9765 RESERVED + - gsoap 2.8.48-1 + NOTE: http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions + NOTE: https://www.genivia.com/changelog.html#Version_2.8.48_upd_(06/21/2017) CVE-2017-9764 RESERVED CVE-2017-9780 (In Flatpak before 0.8.7, a third-party app repository could include ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53641 - data/CVE
Author: jmm Date: 2017-07-18 22:33:40 + (Tue, 18 Jul 2017) New Revision: 53641 Modified: data/CVE/list Log: new cairo issue Modified: data/CVE/list === --- data/CVE/list 2017-07-18 22:29:29 UTC (rev 53640) +++ data/CVE/list 2017-07-18 22:33:40 UTC (rev 53641) @@ -11017,7 +11017,9 @@ NOTE: Fixed by: http://git.savannah.gnu.org/gitweb/?p=gnulib.git;a=commitdiff;h=94e01571 NOTE: Introduced with 4bc76593 and 4e6e16b3f. CVE-2017-7475 (Cairo version 1.15.4 is vulnerable to a NULL pointer dereference ...) - - cairo + - cairo (low) + [stretch] - cairo (Minor issue) + [jessie] - cairo (Minor issue) NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=100763 CVE-2017-7474 (It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not ...) NOT-FOR-US: Keycloak ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53640 - data/CVE
Author: jmm Date: 2017-07-18 22:29:29 + (Tue, 18 Jul 2017) New Revision: 53640 Modified: data/CVE/list Log: yadm no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-07-18 22:12:20 UTC (rev 53639) +++ data/CVE/list 2017-07-18 22:29:29 UTC (rev 53640) @@ -189,6 +189,7 @@ NOT-FOR-US: ASUS CVE-2017-11353 (yadm (yet another dotfile manager) 1.10.0 has a race condition ...) - yadm (bug #868300) + [stretch] - yadm (Minor issue) NOTE: https://github.com/TheLocehiliosan/yadm/issues/74 CVE-2017-11343 (Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN ...) - chicken ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53639 - data/CVE
Author: jmm Date: 2017-07-18 22:12:20 + (Tue, 18 Jul 2017) New Revision: 53639 Modified: data/CVE/list Log: don't bother with two further apple/sqlite issues.. Modified: data/CVE/list === --- data/CVE/list 2017-07-18 22:09:34 UTC (rev 53638) +++ data/CVE/list 2017-07-18 22:12:20 UTC (rev 53639) @@ -12576,7 +12576,7 @@ CVE-2017-6992 RESERVED CVE-2017-6991 (An issue was discovered in certain Apple products. iOS before 10.3.2 ...) - TODO: check, potentially in sqlite3 + NOTE: Unspecified sqlite issue found by Apple, no further details available CVE-2017-6990 (An issue was discovered in certain Apple products. macOS before ...) NOT-FOR-US: Apple CVE-2017-6989 (An issue was discovered in certain Apple products. iOS before 10.3.2 ...) @@ -12593,7 +12593,7 @@ - webkit2gtk 2.16.3-2 (unimportant) NOTE: Not covered by security support CVE-2017-6983 (An issue was discovered in certain Apple products. iOS before 10.3.2 ...) - TODO: check, potentially in sqlite3 + NOTE: Unspecified sqlite issue found by Apple, no further details available CVE-2017-6982 (An issue was discovered in certain Apple products. iOS before 10.3.2 ...) NOT-FOR-US: Apple CVE-2017-6981 (An issue was discovered in certain Apple products. iOS before 10.3.2 ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53638 - data/CVE
Author: jmm Date: 2017-07-18 22:09:34 + (Tue, 18 Jul 2017) New Revision: 53638 Modified: data/CVE/list Log: new epiphany issue Modified: data/CVE/list === --- data/CVE/list 2017-07-18 22:05:43 UTC (rev 53637) +++ data/CVE/list 2017-07-18 22:09:34 UTC (rev 53638) @@ -856,7 +856,7 @@ NOTE: https://github.com/chef/mixlib-archive/pull/6 NOTE: https://github.com/chef/mixlib-archive/pull/6/commits/3a874a24aed6ee93fbccf97efe0ecc999bafe87d CVE-2017-125 (GNOME Web (Epiphany) 3.23 before 3.23.5, 3.22 before 3.22.6, 3.20 ...) - TODO: check + - epiphany-browser 3.22.6-1 CVE-2017-124 (Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable ...) - shotwell 0.25.4+really0.24.5-0.1 (unimportant) CVE-2017-123 (LogicalDoc CommunityEdition 7.5.3 and prior is vulnerable to an XSS ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53637 - data/CVE
Author: jmm Date: 2017-07-18 22:05:43 + (Tue, 18 Jul 2017) New Revision: 53637 Modified: data/CVE/list Log: new cacti issue (might be fixed, needs to be investigated further) Modified: data/CVE/list === --- data/CVE/list 2017-07-18 22:02:18 UTC (rev 53636) +++ data/CVE/list 2017-07-18 22:05:43 UTC (rev 53637) @@ -828,7 +828,7 @@ CVE-2017-138 (WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored ...) NOT-FOR-US: WordPress plugin CVE-2017-137 (RVM automatically loads environment variables from files in $PWD ...) - TODO: check + NOT-FOR-US: RVM CVE-2017-136 (All versions of Candy Chat are vulnerable to an XSS attack by message ...) NOT-FOR-US: Candy Chat CVE-2017-135 (Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener ...) @@ -841,7 +841,8 @@ CVE-2017-132 (Cross-Site scripting (XSS) vulnerabilities in Cacti 0.8.8b allow ...) NOTE: Seems like a duplicate, contacted MITRE for rejection CVE-2017-131 (SQL injection vulnerability in graph_templates_inputs.php in Cacti ...) - TODO: check +- cacti + NOTE: https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-007/?fid=7789 CVE-2017-130 (Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is ...) - glassfish (Vulnerable code not included, see bug #853998) CVE-2017-129 (Oracle, GlassFish Server Open Source Edition 3.0.1 (build 22) is ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53636 - data/CVE
Author: jmm Date: 2017-07-18 22:02:18 + (Tue, 18 Jul 2017) New Revision: 53636 Modified: data/CVE/list Log: new rbenv issue Modified: data/CVE/list === --- data/CVE/list 2017-07-18 21:58:30 UTC (rev 53635) +++ data/CVE/list 2017-07-18 22:02:18 UTC (rev 53636) @@ -814,7 +814,7 @@ CVE-2017-148 (the web framework using ljharb's qs module older than v6.3.2, v6.2.3, ...) NOT-FOR-US: ljharb CVE-2017-147 (rbenv (all current versions) is vulnerable to Directory Traversal in ...) - TODO: check + - rbenv CVE-2017-146 (Mautic 2.6.1 and earlier fails to set flags on session cookies ...) NOT-FOR-US: Mautic CVE-2017-145 (Mautic SSO/OAuth2 plugins are vulnerable to CSRF of the state ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53635 - data/CVE
Author: jmm Date: 2017-07-18 21:58:30 + (Tue, 18 Jul 2017) New Revision: 53635 Modified: data/CVE/list Log: DWF data quality has room for improvement... add duplicate for roundcube Modified: data/CVE/list === --- data/CVE/list 2017-07-18 21:49:53 UTC (rev 53634) +++ data/CVE/list 2017-07-18 21:58:30 UTC (rev 53635) @@ -810,9 +810,7 @@ CVE-2017-151 (Cross-site scripting (XSS) vulnerability in pad export in XWiki labs ...) NOT-FOR-US: XWiki labs CVE-2017-149 (Roundcube Webmail 1.1.5 is vulnerable to Persistent Xss ...) - - roundcube - NOTE: https://github.com/roundcube/roundcubemail/issues/4949 - TODO: check if different from CVE-2015-2181 + NOTE: Duplicate of CVE-2015-8864, requested rejection CVE-2017-148 (the web framework using ljharb's qs module older than v6.3.2, v6.2.3, ...) NOT-FOR-US: ljharb CVE-2017-147 (rbenv (all current versions) is vulnerable to Directory Traversal in ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53634 - data/CVE
Author: jmm Date: 2017-07-18 21:49:53 + (Tue, 18 Jul 2017) New Revision: 53634 Modified: data/CVE/list Log: new libmspack issue Modified: data/CVE/list === --- data/CVE/list 2017-07-18 21:46:58 UTC (rev 53633) +++ data/CVE/list 2017-07-18 21:49:53 UTC (rev 53634) @@ -21,7 +21,7 @@ CVE-2017-11424 RESERVED CVE-2017-11423 (The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, ...) - TODO: check + - libmspack CVE-2017-11422 RESERVED CVE-2017-11420 (Stack-based buffer overflow in ASUS_Discovery.c in networkmap in ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53633 - data/CVE
Author: jmm Date: 2017-07-18 21:46:58 + (Tue, 18 Jul 2017) New Revision: 53633 Modified: data/CVE/list Log: new moodle issue NFUs Modified: data/CVE/list === --- data/CVE/list 2017-07-18 21:44:10 UTC (rev 53632) +++ data/CVE/list 2017-07-18 21:46:58 UTC (rev 53633) @@ -14542,7 +14542,7 @@ CVE-2017-6321 RESERVED CVE-2017-6320 (A remote command injection vulnerability exists in the Barracuda Load ...) - TODO: check + NOT-FOR-US: Barracuda CVE-2017-6319 (The dex_parse_debug_item function in libr/bin/p/bin_dex.c in radare2 ...) - radare2 1.1.0+dfsg-3 (bug #856579) [jessie] - radare2 (Vulnerable code introduced in 1.1.0) @@ -18232,9 +18232,9 @@ CVE-2017-5248 RESERVED CVE-2017-5247 (Biscom Secure File Transfer is vulnerable to cross-site scripting in ...) - TODO: check + NOT-FOR-US: Biscom Secure File Transfer CVE-2017-5246 (Biscom Secure File Transfer is vulnerable to AngularJS expression ...) - TODO: check + NOT-FOR-US: Biscom Secure File Transfer CVE-2017-5245 REJECTED CVE-2017-5244 (Routes used to stop running Metasploit tasks (either particular ones ...) @@ -25387,7 +25387,8 @@ NOTE: https://tracker.moodle.org/browse/MDL-56526 NOTE: http://git.moodle.org/gw?p=moodle.git&a=search&h=HEAD&st=commit&s=MDL-56526 CVE-2017-2642 (Moodle 3.x has user fullname disclosure on the user preferences page. ...) - TODO: check + - moodle + NOTE: https://moodle.org/mod/forum/discuss.php?d=34 CVE-2017-2641 (In Moodle 2.x and 3.x, SQL injection can occur via user preferences. ...) - moodle 2.7.19+dfsg-1 NOTE: https://tracker.moodle.org/browse/MDL-58010 @@ -28272,7 +28273,7 @@ CVE-2017-1319 (IBM Tivoli Federated Identity Manager 6.2 is affected by a ...) NOT-FOR-US: IBM CVE-2017-1318 (IBM MQ Appliance 8.0 and 9.0 could allow an authenticated messaging ...) - TODO: check + NOT-FOR-US: IBM CVE-2017-1317 RESERVED CVE-2017-1316 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53632 - data/CVE
Author: jmm Date: 2017-07-18 21:44:10 + (Tue, 18 Jul 2017) New Revision: 53632 Modified: data/CVE/list Log: new apport issue NFUs Modified: data/CVE/list === --- data/CVE/list 2017-07-18 21:33:09 UTC (rev 53631) +++ data/CVE/list 2017-07-18 21:44:10 UTC (rev 53632) @@ -1459,9 +1459,9 @@ CVE-2017-10963 RESERVED CVE-2017-10962 (REDCap before 7.5.1 has XSS via the query string. ...) - TODO: check + NOT-FOR-US: REDCap CVE-2017-10961 (REDCap before 7.5.1 has CSRF in the deletion feature of the File ...) - TODO: check + NOT-FOR-US: REDCap CVE-2017-10960 RESERVED CVE-2017-10959 @@ -1987,7 +1987,8 @@ CVE-2017-10709 (The lockscreen on Elephone P9000 devices (running Android 6.0) allows ...) NOT-FOR-US: Elephone P9000 devices CVE-2017-10708 (An issue was discovered in Apport through 2.20.x. In apport/report.py, ...) - TODO: check + [experimental] - apport + NOTE: apport only in experimental, so we cannot track this in security-tracker CVE-2017-10707 RESERVED CVE-2017-10706 (When Antiy Antivirus Engine before 5.0.0.05171547 scans a special ZIP ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53631 - in data: . CVE DSA
Author: jmm
Date: 2017-07-18 21:33:09 + (Tue, 18 Jul 2017)
New Revision: 53631
Modified:
data/CVE/list
data/DSA/list
data/dsa-needed.txt
Log:
imagemagick DSA
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-18 21:10:15 UTC (rev 53630)
+++ data/CVE/list 2017-07-18 21:33:09 UTC (rev 53631)
@@ -5125,6 +5125,7 @@
RESERVED
CVE-2017-9409 (In ImageMagick 7.0.5-5, the ReadMPCImage function in mpc.c
allows ...)
{DLA-1000-1}
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
- imagemagick 8:6.9.7.4+dfsg-11 (low; bug #864090)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/458
CVE-2017-9408 (In Poppler 0.54.0, a memory leak vulnerability was found in the
...)
@@ -5136,6 +5137,7 @@
NOTE:
https://cgit.freedesktop.org/poppler/poppler/commit/?id=b21b041f7948680c03109f0c404400a9dbc4544c
CVE-2017-9407 (In ImageMagick 7.0.5-5, the ReadPALMImage function in palm.c
allows ...)
{DLA-1000-1}
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
- imagemagick 8:6.9.7.4+dfsg-11 (low; bug #864089)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/459
CVE-2017-9406 (In Poppler 0.54.0, a memory leak vulnerability was found in the
...)
@@ -5698,11 +5700,13 @@
NOTE: Controllers shipped in Debian not vulnerable, see #863655
CVE-2017-9262 (In ImageMagick 7.0.5-6 Q16, the ReadJNGImage function in
coders/png.c ...)
{DLA-1000-1}
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
- imagemagick 8:6.9.7.4+dfsg-10 (low; bug #863834)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/475
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/4649578df8dcbfb2b08d8623d52486dc124da3a8
CVE-2017-9261 (In ImageMagick 7.0.5-6 Q16, the ReadMNGImage function in
coders/png.c ...)
{DLA-1000-1}
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
- imagemagick 8:6.9.7.4+dfsg-10 (low; bug #863833)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/476
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/01d522e990aa57cbe67d222dd5e8f7196cc6d199
Modified: data/DSA/list
===
--- data/DSA/list 2017-07-18 21:10:15 UTC (rev 53630)
+++ data/DSA/list 2017-07-18 21:33:09 UTC (rev 53631)
@@ -1,3 +1,7 @@
+[18 Jul 2017] DSA-3914-1 imagemagick - security update
+ {CVE-2017-9439 CVE-2017-9440 CVE-2017-9500 CVE-2017-9501 CVE-2017-10928
CVE-2017-11141 CVE-2017-11170 CVE-2017-11188 CVE-2017-11360}
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u10
+ [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u1
[18 Jul 2017] DSA-3913-1 apache2 - security update
{CVE-2017-9788}
[jessie] - apache2 2.4.10-10+deb8u10
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-07-18 21:10:15 UTC (rev 53630)
+++ data/dsa-needed.txt 2017-07-18 21:33:09 UTC (rev 53631)
@@ -22,8 +22,6 @@
--
icedove
--
-imagemagick (jmm)
---
ipsec-tools
--
libav/oldstable
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53630 - data/CVE
Author: sectracker
Date: 2017-07-18 21:10:15 + (Tue, 18 Jul 2017)
New Revision: 53630
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-18 20:56:40 UTC (rev 53629)
+++ data/CVE/list 2017-07-18 21:10:15 UTC (rev 53630)
@@ -1,3 +1,29 @@
+CVE-2017-11434
+ RESERVED
+CVE-2017-11433
+ RESERVED
+CVE-2017-11432
+ RESERVED
+CVE-2017-11431
+ RESERVED
+CVE-2017-11430
+ RESERVED
+CVE-2017-11429
+ RESERVED
+CVE-2017-11428
+ RESERVED
+CVE-2017-11427
+ RESERVED
+CVE-2017-11426
+ RESERVED
+CVE-2017-11425
+ RESERVED
+CVE-2017-11424
+ RESERVED
+CVE-2017-11423 (The cabd_read_string function in mspack/cabd.c in libmspack
0.5alpha, ...)
+ TODO: check
+CVE-2017-11422
+ RESERVED
CVE-2017-11420 (Stack-based buffer overflow in ASUS_Discovery.c in networkmap
in ...)
NOT-FOR-US: ASUS
CVE-2017-11419 (Fiyo CMS 2.0.7 has SQL injection in ...)
@@ -41,7 +67,7 @@
RESERVED
CVE-2017-11400
RESERVED
-CVE-2017-11421 [Thumbnail generation for MSI files executes arbitrary VBScript]
+CVE-2017-11421 (gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript
Injection ...)
- gnome-exe-thumbnailer 0.9.5-1 (bug #868705)
[stretch] - gnome-exe-thumbnailer (Minor issue)
NOTE:
http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html
@@ -508,7 +534,7 @@
RESERVED
CVE-2017-183 [Evince command injection vulnerability in CBT handler]
RESERVED
- {DSA-3911-1}
+ {DSA-3911-1 DLA-1031-1}
- evince 3.22.1-4
- atril (bug #868500)
NOTE: https://bugzilla.gnome.org/show_bug.cgi?id=784630
@@ -1432,10 +1458,10 @@
RESERVED
CVE-2017-10963
RESERVED
-CVE-2017-10962
- RESERVED
-CVE-2017-10961
- RESERVED
+CVE-2017-10962 (REDCap before 7.5.1 has XSS via the query string. ...)
+ TODO: check
+CVE-2017-10961 (REDCap before 7.5.1 has CSRF in the deletion feature of the
File ...)
+ TODO: check
CVE-2017-10960
RESERVED
CVE-2017-10959
@@ -1960,8 +1986,8 @@
RESERVED
CVE-2017-10709 (The lockscreen on Elephone P9000 devices (running Android 6.0)
allows ...)
NOT-FOR-US: Elephone P9000 devices
-CVE-2017-10708
- RESERVED
+CVE-2017-10708 (An issue was discovered in Apport through 2.20.x. In
apport/report.py, ...)
+ TODO: check
CVE-2017-10707
RESERVED
CVE-2017-10706 (When Antiy Antivirus Engine before 5.0.0.05171547 scans a
special ZIP ...)
@@ -2763,7 +2789,7 @@
- apache2 (Only affected 2.4.26)
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#2.4.27
CVE-2017-9788 (In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the
value ...)
- {DLA-1028-1}
+ {DSA-3913-1 DLA-1028-1}
- apache2 2.4.27-1 (bug #868467)
NOTE: https://httpd.apache.org/security/vulnerabilities_24.html#2.4.27
NOTE: Fixed by (2.4.x): https://svn.apache.org/r1800955
@@ -10841,8 +10867,7 @@
NOTE:
https://gitlab.com/gnutls/gnutls/commit/4c4d35264fada08b6536425c051fb8e0b05ee86b
NOTE:
https://gitlab.com/gnutls/gnutls/commit/3efb6c5fd0e3822ec11879d5bcbea0e8d322cd03
NOTE:
https://gitlab.com/gnutls/gnutls/commit/e1d6c59a7b0392fb3b8b75035614084a53e2c8c9
-CVE-2017-7506
- RESERVED
+CVE-2017-7506 (spice versions though 0.13 are vulnerable to out-of-bounds
memory ...)
{DSA-3907-1}
- spice (bug #868083)
CVE-2017-7505 (Foreman since version 1.5 is vulnerable to an incorrect
authorization ...)
@@ -14511,8 +14536,8 @@
NOTE: Fixed by:
https://git.kernel.org/linus/8b74d439e1697110c5e5c600643e823eb1dd0762
CVE-2017-6321
RESERVED
-CVE-2017-6320
- RESERVED
+CVE-2017-6320 (A remote command injection vulnerability exists in the
Barracuda Load ...)
+ TODO: check
CVE-2017-6319 (The dex_parse_debug_item function in libr/bin/p/bin_dex.c in
radare2 ...)
- radare2 1.1.0+dfsg-3 (bug #856579)
[jessie] - radare2 (Vulnerable code introduced in 1.1.0)
@@ -18201,12 +18226,12 @@
RESERVED
CVE-2017-5248
RESERVED
-CVE-2017-5247
- RESERVED
-CVE-2017-5246
- RESERVED
+CVE-2017-5247 (Biscom Secure File Transfer is vulnerable to cross-site
scripting in ...)
+ TODO: check
+CVE-2017-5246 (Biscom Secure File Transfer is vulnerable to AngularJS
expression ...)
+ TODO: check
CVE-2017-5245
- RESERVED
+ REJECTED
CVE-2017-5244 (Routes used to stop running Metasploit tasks (either particular
ones ...)
NOT-FOR-US: Metasploit
CVE-2017-5243 (The default SSH configuration in Rapid7 Nexpose hardware
appliances ...)
@@ -28241,8 +28266,8 @@
NOT-FOR-US: IBM
CVE-2017-1319 (IBM Tivoli Federated Identity Manager 6.2 is affected by a ...)
NOT-FOR-US: IBM
-CVE-2017-1318
- RESERVED
+CVE-2017-1318 (IBM MQ App
[Secure-testing-commits] r53629 - data/CVE
Author: jmm Date: 2017-07-18 20:56:40 + (Tue, 18 Jul 2017) New Revision: 53629 Modified: data/CVE/list Log: cairo no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-07-18 20:47:16 UTC (rev 53628) +++ data/CVE/list 2017-07-18 20:56:40 UTC (rev 53629) @@ -2704,7 +2704,9 @@ NOTE: Fixed by: https://github.com/vadz/libtiff/commit/fb3dc46a2fcf6197ff3b93fc76f0c37fddc0333b NOTE: The issue is addressed with the same commit as for CVE-2017-9403 CVE-2017-9814 (cairo-truetype-subset.c in cairo 1.15.6 and earlier allows remote ...) - - cairo (bug #868580) + - cairo (low; bug #868580) + [stretch] - cairo (Minor issue) + [jessie] - cairo (Minor issue) NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=101547 CVE-2017-9813 (In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack ...) NOT-FOR-US: Kaspersky Anti-Virus ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53628 - data
Author: pochu Date: 2017-07-18 20:47:16 + (Tue, 18 Jul 2017) New Revision: 53628 Modified: data/dla-needed.txt Log: dla: claim cairo Modified: data/dla-needed.txt === --- data/dla-needed.txt 2017-07-18 20:41:37 UTC (rev 53627) +++ data/dla-needed.txt 2017-07-18 20:47:16 UTC (rev 53628) @@ -24,6 +24,8 @@ NOTE: #867461. pausing for another week, but patches available. NOTE: -- antoine -- +cairo (Emilio Pozuelo) +-- check-mk NOTE: the code is different in wheezy but from a cursory look, there NOTE: might be multiple places where error messages are not properly ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53627 - in data: . DLA
Author: pochu
Date: 2017-07-18 20:41:37 + (Tue, 18 Jul 2017)
New Revision: 53627
Modified:
data/DLA/list
data/dla-needed.txt
Log:
Reserve DLA-1031-1 for evince
Modified: data/DLA/list
===
--- data/DLA/list 2017-07-18 20:16:43 UTC (rev 53626)
+++ data/DLA/list 2017-07-18 20:41:37 UTC (rev 53627)
@@ -1,3 +1,6 @@
+[18 Jul 2017] DLA-1031-1 evince - security update
+ {CVE-2017-183}
+ [wheezy] - evince 3.4.0-3.1+deb7u1
[17 Jul 2017] DLA-1030-1 vim - security update
{CVE-2017-11109}
[wheezy] - vim 2:7.3.547-7+deb7u4
Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-07-18 20:16:43 UTC (rev 53626)
+++ data/dla-needed.txt 2017-07-18 20:41:37 UTC (rev 53627)
@@ -34,8 +34,6 @@
NOTE: 20170510, patch available, however not yet applied upstream.
NOTE: 20170706: no change upstream, patch disputed.
--
-evince (Emilio Pozuelo)
---
exiv2
NOTE: 20170702, no upstream fix yet, so no need to bother maintainer yet,
sent email later
--
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53626 - in data: . DSA
Author: carnil
Date: 2017-07-18 20:16:43 + (Tue, 18 Jul 2017)
New Revision: 53626
Modified:
data/DSA/list
data/dsa-needed.txt
Log:
Reserve DSA number for apache2
Modified: data/DSA/list
===
--- data/DSA/list 2017-07-18 20:05:46 UTC (rev 53625)
+++ data/DSA/list 2017-07-18 20:16:43 UTC (rev 53626)
@@ -1,3 +1,7 @@
+[18 Jul 2017] DSA-3913-1 apache2 - security update
+ {CVE-2017-9788}
+ [jessie] - apache2 2.4.10-10+deb8u10
+ [stretch] - apache2 2.4.25-3+deb9u2
[16 Jul 2017] DSA-3912-1 heimdal - security update
{CVE-2017-11103}
[jessie] - heimdal 1.6~rc2+dfsg-9+deb8u1
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-07-18 20:05:46 UTC (rev 53625)
+++ data/dsa-needed.txt 2017-07-18 20:16:43 UTC (rev 53626)
@@ -14,9 +14,6 @@
--
389-ds-base (fw)
--
-apache2 (carnil)
- sf prepared an update for jessie and stretch
---
atril
--
chromium-browser
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53625 - data/CVE
Author: carnil Date: 2017-07-18 20:05:46 + (Tue, 18 Jul 2017) New Revision: 53625 Modified: data/CVE/list Log: Six freeradius issues fixed in unstable Modified: data/CVE/list === --- data/CVE/list 2017-07-18 20:02:00 UTC (rev 53624) +++ data/CVE/list 2017-07-18 20:05:46 UTC (rev 53625) @@ -1264,32 +1264,32 @@ CVE-2017-10988 REJECTED CVE-2017-10987 (An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - ...) - - freeradius (bug #868765) + - freeradius 3.0.15+dfsg-1 (bug #868765) [jessie] - freeradius (Only affects 3.x series) [wheezy] - freeradius (Only affects 3.x series) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-304 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/19a18bf7c8af649c9e9742fb6a046f6aff639866 CVE-2017-10986 (An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - ...) - - freeradius (bug #868765) + - freeradius 3.0.15+dfsg-1 (bug #868765) [jessie] - freeradius (Only affects 3.x series) [wheezy] - freeradius (Only affects 3.x series) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-303 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/21e2e95751bfb54c0fb0328392d06671a75c191c CVE-2017-10985 (An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite ...) - - freeradius (bug #868765) + - freeradius 3.0.15+dfsg-1 (bug #868765) [jessie] - freeradius (Only affects 3.x series) [wheezy] - freeradius (Only affects 3.x series) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-302 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/6726c16549b131ed39f6f8886cdf5d9d922a9a97 CVE-2017-10984 (An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write ...) - - freeradius (bug #868765) + - freeradius 3.0.15+dfsg-1 (bug #868765) [jessie] - freeradius (Only affects 3.x series) [wheezy] - freeradius (Only affects 3.x series) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-301 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/931850e5d2f65193520c2d9c9878148c0cdc16a6 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/4b059296e14b6ab75dc17163077490528a819806 CVE-2017-10983 (An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before ...) - - freeradius (bug #868765) + - freeradius 3.0.15+dfsg-1 (bug #868765) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-206 NOTE: 2.x: https://github.com/FreeRADIUS/freeradius-server/commit/ec08b30f87066f82073d02fab57e8ffeef81373d NOTE: 3.x: https://github.com/FreeRADIUS/freeradius-server/commit/5759b20af99af6d30924f0efd8da5eac2a17163d @@ -1322,7 +1322,7 @@ NOTE: This is not fully technically correct, the issue affects only the 2.x NOTE: series but not 3.x. CVE-2017-10978 (An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before ...) - - freeradius (bug #868765) + - freeradius 3.0.15+dfsg-1 (bug #868765) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-201 NOTE: 2.x: https://github.com/FreeRADIUS/freeradius-server/commit/38ee90f2a5a28dc5887a30bdfdc98109c0418e68 NOTE: 3.x: https://github.com/FreeRADIUS/freeradius-server/commit/fc8662d7e827f630d515eaa0bddfa94754c8047f ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53624 - data/CVE
Author: carnil Date: 2017-07-18 20:02:00 + (Tue, 18 Jul 2017) New Revision: 53624 Modified: data/CVE/list Log: Add fixed version for CVE-2017-11421 Modified: data/CVE/list === --- data/CVE/list 2017-07-18 19:33:54 UTC (rev 53623) +++ data/CVE/list 2017-07-18 20:02:00 UTC (rev 53624) @@ -42,7 +42,7 @@ CVE-2017-11400 RESERVED CVE-2017-11421 [Thumbnail generation for MSI files executes arbitrary VBScript] - - gnome-exe-thumbnailer (bug #868705) + - gnome-exe-thumbnailer 0.9.5-1 (bug #868705) [stretch] - gnome-exe-thumbnailer (Minor issue) NOTE: http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html NOTE: https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53623 - data/CVE
Author: carnil
Date: 2017-07-18 19:33:54 + (Tue, 18 Jul 2017)
New Revision: 53623
Modified:
data/CVE/list
Log:
Add fixing version for CVE-2017-314{2,3}
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-18 18:56:44 UTC (rev 53622)
+++ data/CVE/list 2017-07-18 19:33:54 UTC (rev 53623)
@@ -23980,13 +23980,13 @@
CVE-2017-3143 [An error in TSIG authentication can permit unauthorized dynamic
updates]
RESERVED
{DSA-3904-1 DLA-1025-1}
- - bind9 (bug #866564)
+ - bind9 1:9.10.3.dfsg.P4-12.4 (bug #866564)
NOTE: https://kb.isc.org/article/AA-01503
NOTE: Fixed by (master):
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=581c1526ab0f74a177980da9ff0514f795ed8669
CVE-2017-3142 [An error in TSIG authentication can permit unauthorized zone
transfers]
RESERVED
{DSA-3904-1 DLA-1025-1}
- - bind9 (bug #866564)
+ - bind9 1:9.10.3.dfsg.P4-12.4 (bug #866564)
NOTE: https://kb.isc.org/article/AA-01504
NOTE: Fixed by (master):
https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=581c1526ab0f74a177980da9ff0514f795ed8669
CVE-2017-3141
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53622 - data
Author: carnil Date: 2017-07-18 18:56:44 + (Tue, 18 Jul 2017) New Revision: 53622 Modified: data/dsa-needed.txt Log: Take apache2 from dsa-needed list Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-07-18 18:51:29 UTC (rev 53621) +++ data/dsa-needed.txt 2017-07-18 18:56:44 UTC (rev 53622) @@ -14,8 +14,8 @@ -- 389-ds-base (fw) -- -apache2 - sf will likely be able to prepare an update +apache2 (carnil) + sf prepared an update for jessie and stretch -- atril -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53621 - data/CVE
Author: carnil Date: 2017-07-18 18:51:29 + (Tue, 18 Jul 2017) New Revision: 53621 Modified: data/CVE/list Log: CVE-2017-11421/gnome-exe-thumbnailer, #868705 assigned Modified: data/CVE/list === --- data/CVE/list 2017-07-18 18:26:07 UTC (rev 53620) +++ data/CVE/list 2017-07-18 18:51:29 UTC (rev 53621) @@ -41,7 +41,7 @@ RESERVED CVE-2017-11400 RESERVED -CVE-2017- [Thumbnail generation for MSI files executes arbitrary VBScript] +CVE-2017-11421 [Thumbnail generation for MSI files executes arbitrary VBScript] - gnome-exe-thumbnailer (bug #868705) [stretch] - gnome-exe-thumbnailer (Minor issue) NOTE: http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53620 - data/CVE
Author: carnil Date: 2017-07-18 18:26:07 + (Tue, 18 Jul 2017) New Revision: 53620 Modified: data/CVE/list Log: Remove some no-dsa tagged entries which are included in the planned qemu update Modified: data/CVE/list === --- data/CVE/list 2017-07-18 16:06:16 UTC (rev 53619) +++ data/CVE/list 2017-07-18 18:26:07 UTC (rev 53620) @@ -2094,7 +2094,6 @@ CVE-2017-10664 [qemu-nbd: server breaks with SIGPIPE upon client abort] RESERVED - qemu (bug #866674) - [stretch] - qemu (Minor issue) [jessie] - qemu (Minor issue) - qemu-kvm [wheezy] - qemu-kvm (qemu-nbd shipped from qemu package) @@ -5209,7 +5208,6 @@ NOTE: Fixed by: http://git.qemu.org/?p=qemu.git;a=commitdiff;h=96d87bdda3919bb16f754b3d3fd1227e1f38f13c CVE-2017-9374 (Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI ...) - qemu (bug #864568) - [stretch] - qemu (Minor issue) [jessie] - qemu (Minor issue) [wheezy] - qemu (Minor issue) - qemu-kvm @@ -5359,7 +5357,6 @@ NOTE: Patch: http://lists.nongnu.org/archive/html/chicken-hackers/2017-05/msg00099.html CVE-2017-9330 (QEMU (aka Quick Emulator), when built with the USB OHCI Emulation ...) - qemu (bug #863943) - [stretch] - qemu (Minor issue) [jessie] - qemu (Minor issue) [wheezy] - qemu (Vulnerable code no present) - qemu-kvm @@ -5568,7 +5565,6 @@ NOTE: https://www.sudo.ws/repos/sudo/raw-rev/b5460cbbb11b CVE-2017-9310 (QEMU (aka Quick Emulator), when built with the e1000e NIC emulation ...) - qemu (bug #863840) - [stretch] - qemu (Minor issue) [jessie] - qemu (Vulnerable code not present; e1000e introduced in 2.7.0-rc0) [wheezy] - qemu (Vulnerable code not present) - qemu-kvm ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53619 - data/CVE
Author: jmm Date: 2017-07-18 16:06:16 + (Tue, 18 Jul 2017) New Revision: 53619 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-07-18 11:28:30 UTC (rev 53618) +++ data/CVE/list 2017-07-18 16:06:16 UTC (rev 53619) @@ -861,7 +861,7 @@ - phpmyadmin 4:4.6.6-1 (unimportant) NOTE: https://www.phpmyadmin.net/security/PMASA-2017-1 CVE-2017-112 (MySQL Dumper version 1.24 is vulnerable to stored XSS when displaying ...) - TODO: check + NOT-FOR-US: MySQL Dumper CVE-2017-111 (MyWebSQL version 3.6 is vulnerable to stored XSS in the database ...) NOT-FOR-US: MyWebSQL CVE-2017-110 (Audacity version 2.1.2 is vulnerable to Dll HIjacking in the ...) @@ -2407,9 +2407,9 @@ - tiff3 NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2704 CVE-2017-9934 (Missing CSRF token checks and improper input validation in Joomla! CMS ...) - TODO: check + NOT-FOR-US: Joomla CVE-2017-9933 (Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2 leads ...) - TODO: check + NOT-FOR-US: Joomla CVE-2017-9932 RESERVED CVE-2017-9931 @@ -2708,13 +2708,13 @@ - cairo (bug #868580) NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=101547 CVE-2017-9813 (In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack ...) - TODO: check + NOT-FOR-US: Kaspersky Anti-Virus CVE-2017-9812 (The reportId parameter of the getReportStatus action method can be ...) - TODO: check + NOT-FOR-US: Kaspersky Anti-Virus CVE-2017-9811 (The kluser is able to interact with the kav4fs-control binary in ...) - TODO: check + NOT-FOR-US: Kaspersky Anti-Virus CVE-2017-9810 (There are no Anti-CSRF tokens in any forms on the web interface in ...) - TODO: check + NOT-FOR-US: Kaspersky Anti-Virus CVE-2017-9809 RESERVED CVE-2017-9808 @@ -4567,7 +4567,7 @@ CVE-2017-9610 RESERVED CVE-2017-9609 (Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2 allows ...) - TODO: check + NOT-FOR-US: Blackcat CMS CVE-2017-9608 RESERVED CVE-2017-9607 @@ -5323,11 +5323,11 @@ CVE-2017-9341 RESERVED CVE-2017-9340 (An attacker is logged in as a normal user and can somehow make admin ...) - TODO: check + - owncloud CVE-2017-9339 (A logical error in ownCloud Server before 10.0.2 caused disclosure of ...) - TODO: check + - owncloud CVE-2017-9338 (Inadequate escaping lead to XSS vulnerability in the search module in ...) - TODO: check + - owncloud CVE-2017-9337 (The Markdown on Save Improved plugin 2.5 for WordPress has a stored XSS ...) NOT-FOR-US: Wordpress plugin CVE-2017-9336 (The WP Editor.MD plugin 1.6 for WordPress has a stored XSS ...) @@ -6815,7 +6815,7 @@ CVE-2017-8897 (Invision Power Services (IPS) Community Suite 4.1.19.2 and earlier has ...) NOT-FOR-US: Invision Power Services CVE-2017-8896 (ownCloud Server before 8.2.12, 9.0.x before 9.0.10, 9.1.x before ...) - TODO: check + - owncloud CVE-2017-8895 (In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before ...) NOT-FOR-US: Veritas CVE-2017-8894 (AeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software ...) @@ -13188,23 +13188,23 @@ CVE-2017-6745 RESERVED CVE-2017-6744 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6743 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6742 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6741 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6740 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6739 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6738 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6737 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6736 (The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-6735 (A vulnerability in the backup and restore functionality of Cisco ...) NOT-FOR-US: Cisco CVE-2017-6734 (A vulnerability in the web-based management interface of Cisco Identity ...) ___ Secure-testing-commits mailing list Secu
[Secure-testing-commits] r53618 - data/CVE
Author: carnil Date: 2017-07-18 11:28:30 + (Tue, 18 Jul 2017) New Revision: 53618 Modified: data/CVE/list Log: CVE-2017-10988 is REJECTED Modified: data/CVE/list === --- data/CVE/list 2017-07-18 11:28:20 UTC (rev 53617) +++ data/CVE/list 2017-07-18 11:28:30 UTC (rev 53618) @@ -1261,13 +1261,8 @@ NOTE: https://bugs.launchpad.net/ubuntu/+source/sqlite3/+bug/1700937 NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=2405 NOTE: http://marc.info/?l=sqlite-users&m=149933696214713&w=2 -CVE-2017-10988 [Decode 'signed' attributes correctly] +CVE-2017-10988 REJECTED - - freeradius - [jessie] - freeradius (Only affects 3.x series) - [wheezy] - freeradius (Only affects 3.x series) - NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-305 - NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/de3b3b2e4153db26442facbd5e9b268a3bf795ba CVE-2017-10987 (An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - ...) - freeradius (bug #868765) [jessie] - freeradius (Only affects 3.x series) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53617 - data/CVE
Author: carnil Date: 2017-07-18 11:28:20 + (Tue, 18 Jul 2017) New Revision: 53617 Modified: data/CVE/list Log: Add bug for freeradius Modified: data/CVE/list === --- data/CVE/list 2017-07-18 11:06:44 UTC (rev 53616) +++ data/CVE/list 2017-07-18 11:28:20 UTC (rev 53617) @@ -1269,32 +1269,32 @@ NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-305 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/de3b3b2e4153db26442facbd5e9b268a3bf795ba CVE-2017-10987 (An FR-GV-304 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - ...) - - freeradius + - freeradius (bug #868765) [jessie] - freeradius (Only affects 3.x series) [wheezy] - freeradius (Only affects 3.x series) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-304 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/19a18bf7c8af649c9e9742fb6a046f6aff639866 CVE-2017-10986 (An FR-GV-303 issue in FreeRADIUS 3.x before 3.0.15 allows "DHCP - ...) - - freeradius + - freeradius (bug #868765) [jessie] - freeradius (Only affects 3.x series) [wheezy] - freeradius (Only affects 3.x series) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-303 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/21e2e95751bfb54c0fb0328392d06671a75c191c CVE-2017-10985 (An FR-GV-302 issue in FreeRADIUS 3.x before 3.0.15 allows "Infinite ...) - - freeradius + - freeradius (bug #868765) [jessie] - freeradius (Only affects 3.x series) [wheezy] - freeradius (Only affects 3.x series) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-302 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/6726c16549b131ed39f6f8886cdf5d9d922a9a97 CVE-2017-10984 (An FR-GV-301 issue in FreeRADIUS 3.x before 3.0.15 allows "Write ...) - - freeradius + - freeradius (bug #868765) [jessie] - freeradius (Only affects 3.x series) [wheezy] - freeradius (Only affects 3.x series) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-301 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/931850e5d2f65193520c2d9c9878148c0cdc16a6 NOTE: https://github.com/FreeRADIUS/freeradius-server/commit/4b059296e14b6ab75dc17163077490528a819806 CVE-2017-10983 (An FR-GV-206 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before ...) - - freeradius + - freeradius (bug #868765) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-206 NOTE: 2.x: https://github.com/FreeRADIUS/freeradius-server/commit/ec08b30f87066f82073d02fab57e8ffeef81373d NOTE: 3.x: https://github.com/FreeRADIUS/freeradius-server/commit/5759b20af99af6d30924f0efd8da5eac2a17163d @@ -1327,7 +1327,7 @@ NOTE: This is not fully technically correct, the issue affects only the 2.x NOTE: series but not 3.x. CVE-2017-10978 (An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before ...) - - freeradius + - freeradius (bug #868765) NOTE: http://freeradius.org/security/fuzzer-2017.html#FR-GV-201 NOTE: 2.x: https://github.com/FreeRADIUS/freeradius-server/commit/38ee90f2a5a28dc5887a30bdfdc98109c0418e68 NOTE: 3.x: https://github.com/FreeRADIUS/freeradius-server/commit/fc8662d7e827f630d515eaa0bddfa94754c8047f ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53616 - data/CVE
Author: jmm Date: 2017-07-18 11:06:44 + (Tue, 18 Jul 2017) New Revision: 53616 Modified: data/CVE/list Log: remove thumbnailer tmp issue, not a security issue with our kernels Modified: data/CVE/list === --- data/CVE/list 2017-07-18 10:34:08 UTC (rev 53615) +++ data/CVE/list 2017-07-18 11:06:44 UTC (rev 53616) @@ -41,9 +41,6 @@ RESERVED CVE-2017-11400 RESERVED -CVE-2017- [unsafe use of /tmp] - - gnome-exe-thumbnailer (bug #868737) - [stretch] - gnome-exe-thumbnailer (Minor issue) CVE-2017- [Thumbnail generation for MSI files executes arbitrary VBScript] - gnome-exe-thumbnailer (bug #868705) [stretch] - gnome-exe-thumbnailer (Minor issue) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53615 - data/CVE
Author: fgeek-guest
Date: 2017-07-18 10:34:08 + (Tue, 18 Jul 2017)
New Revision: 53615
Modified:
data/CVE/list
Log:
NFU
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-18 10:06:08 UTC (rev 53614)
+++ data/CVE/list 2017-07-18 10:34:08 UTC (rev 53615)
@@ -40045,6 +40045,7 @@
NOT-FOR-US: Apache Cordova
CVE-2016-6798
RESERVED
+ NOT-FOR-US: Apache Sling
CVE-2016-6797 [Apache Tomcat Unrestricted Access to Global Resources]
RESERVED
{DSA-3721-1 DSA-3720-1 DLA-729-1 DLA-728-1}
@@ -44856,6 +44857,7 @@
NOT-FOR-US: Apache Ranger
CVE-2016-5394
RESERVED
+ NOT-FOR-US: Apache Sling
CVE-2016-5393 (In Apache Hadoop 2.6.x before 2.6.5 and 2.7.x before 2.7.3, a
remote ...)
- hadoop (bug #793644)
CVE-2016-5392 (The API server in Kubernetes, as used in Red Hat OpenShift
Enterprise ...)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53614 - data/CVE
Author: carnil
Date: 2017-07-18 10:06:08 + (Tue, 18 Jul 2017)
New Revision: 53614
Modified:
data/CVE/list
Log:
Move note for moodle entry to CVE
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-18 09:41:11 UTC (rev 53613)
+++ data/CVE/list 2017-07-18 10:06:08 UTC (rev 53614)
@@ -10726,9 +10726,9 @@
NOTE: https://moodle.org/mod/forum/discuss.php?d=36
CVE-2017-7531 (In Moodle 3.3, the course overview block reveals activities in
hidden ...)
- moodle (Only affects 3.3)
+ NOTE: https://moodle.org/mod/forum/discuss.php?d=35
CVE-2017-7530
RESERVED
- NOTE: https://moodle.org/mod/forum/discuss.php?d=35
CVE-2017-7529 (Nginx versions since 0.5.6 up to and including 1.13.2 are
vulnerable ...)
{DSA-3908-1 DLA-1024-1}
- nginx 1.13.3-1 (bug #868109)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53613 - data/CVE
Author: jmm
Date: 2017-07-18 09:41:11 + (Tue, 18 Jul 2017)
New Revision: 53613
Modified:
data/CVE/list
Log:
new moodle issues
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-18 09:37:23 UTC (rev 53612)
+++ data/CVE/list 2017-07-18 09:41:11 UTC (rev 53613)
@@ -9274,7 +9274,7 @@
NOTE: edgebuffer scan converter was made default only in:
http://git.ghostscript.com/?p=ghostpdl.git;h=dd5da2cb3e08398ac6d86598b36b00994d058308
NOTE: But the vulnerable code via base/gxscan.c, a new scan converter
introduced in 9.20 is present.
CVE-2017-7947 (NetApp Clustered Data ONTAP before 8.3.2P11, 9.0 before P4, and
9.1 ...)
- TODO: check
+ NOT-FOR-US: NetApp
CVE-2016-10347
RESERVED
CVE-2016-10346
@@ -10722,11 +10722,13 @@
CVE-2017-7533
RESERVED
CVE-2017-7532 (In Moodle 3.x, course creators are able to change system
default ...)
- TODO: check
+ - moodle
+ NOTE: https://moodle.org/mod/forum/discuss.php?d=36
CVE-2017-7531 (In Moodle 3.3, the course overview block reveals activities in
hidden ...)
- TODO: check
+ - moodle (Only affects 3.3)
CVE-2017-7530
RESERVED
+ NOTE: https://moodle.org/mod/forum/discuss.php?d=35
CVE-2017-7529 (Nginx versions since 0.5.6 up to and including 1.13.2 are
vulnerable ...)
{DSA-3908-1 DLA-1024-1}
- nginx 1.13.3-1 (bug #868109)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53612 - data/CVE
Author: jmm Date: 2017-07-18 09:37:23 + (Tue, 18 Jul 2017) New Revision: 53612 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-07-18 09:22:20 UTC (rev 53611) +++ data/CVE/list 2017-07-18 09:37:23 UTC (rev 53612) @@ -1,21 +1,21 @@ CVE-2017-11420 (Stack-based buffer overflow in ASUS_Discovery.c in networkmap in ...) - TODO: check + NOT-FOR-US: ASUS CVE-2017-11419 (Fiyo CMS 2.0.7 has SQL injection in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-11418 (Fiyo CMS 2.0.7 has SQL injection in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-11417 (Fiyo CMS 2.0.7 has SQL injection in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-11416 (Fiyo CMS 2.0.7 has SQL injection in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-11415 (Fiyo CMS 2.0.7 has SQL injection in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-11414 (Fiyo CMS 2.0.7 has SQL injection in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-11413 (Fiyo CMS 2.0.7 has SQL injection in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-11412 (Fiyo CMS 2.0.7 has SQL injection in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-11411 RESERVED CVE-2017-11410 @@ -29,9 +29,9 @@ CVE-2017-11406 RESERVED CVE-2017-11405 (In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators ...) - TODO: check + NOT-FOR-US: CMS Made Simple CVE-2017-11404 (In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators ...) - TODO: check + NOT-FOR-US: CMS Made Simple CVE-2017-11403 (The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has ...) - graphicsmagick 1.3.26-3 NOTE: http://hg.code.sf.net/p/graphicsmagick/code/rev/d0a76868ca37 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53611 - in data: . CVE
Author: jmm Date: 2017-07-18 09:22:20 + (Tue, 18 Jul 2017) New Revision: 53611 Modified: data/CVE/list data/dsa-needed.txt Log: two struts issues n/a NFU Modified: data/CVE/list === --- data/CVE/list 2017-07-18 09:16:47 UTC (rev 53610) +++ data/CVE/list 2017-07-18 09:22:20 UTC (rev 53611) @@ -2777,7 +2777,8 @@ NOTE: 2.4.x: https://github.com/apache/httpd/commit/549ba6a39aa0df78a610025f74f3a06503a70f67 NOTE: trunk: https://github.com/apache/httpd/commit/c5d3719133b9e5dab0d540c5aa03b2fdabc30395 CVE-2017-9787 (When using a Spring AOP functionality to secure Struts actions it is ...) - TODO: check + - libstruts1.2-java (Vulnerable code not present) + NOTE: Issue is specific to Struts 2.x. CVE-2017-9786 RESERVED CVE-2017-9785 @@ -9055,7 +9056,7 @@ CVE-2017-8035 RESERVED CVE-2017-8034 (The Cloud Controller and Router in Cloud Foundry (CAPI-release capi ...) - TODO: check + NOT-FOR-US: Cloud Foundry CVE-2017-8033 RESERVED CVE-2017-8032 (In Cloud Foundry cf-release versions prior to v264; UAA release all ...) @@ -10286,7 +10287,8 @@ CVE-2017-7673 (Apache OpenMeetings 1.0.0 uses not very strong cryptographic storage, ...) NOT-FOR-US: Apache OpenMeetings CVE-2017-7672 (If an application allows enter an URL in a form field and built-in ...) - TODO: check + - libstruts1.2-java (Vulnerable code not present) + NOTE: Issue is specific to Struts 2.x. CVE-2017-7671 RESERVED CVE-2017-7670 (The Traffic Router component of the incubating Apache Traffic Control ...) Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-07-18 09:16:47 UTC (rev 53610) +++ data/dsa-needed.txt 2017-07-18 09:22:20 UTC (rev 53611) @@ -25,7 +25,7 @@ -- icedove -- -imagemagick +imagemagick (jmm) -- ipsec-tools -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53610 - data/CVE
Author: carnil Date: 2017-07-18 09:16:47 + (Tue, 18 Jul 2017) New Revision: 53610 Modified: data/CVE/list Log: Add fixed version for graphicsmagick Modified: data/CVE/list === --- data/CVE/list 2017-07-18 09:15:53 UTC (rev 53609) +++ data/CVE/list 2017-07-18 09:16:47 UTC (rev 53610) @@ -33,7 +33,7 @@ CVE-2017-11404 (In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators ...) TODO: check CVE-2017-11403 (The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has ...) - - graphicsmagick + - graphicsmagick 1.3.26-3 NOTE: http://hg.code.sf.net/p/graphicsmagick/code/rev/d0a76868ca37 CVE-2017-11402 RESERVED ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53609 - data/CVE
Author: carnil Date: 2017-07-18 09:15:53 + (Tue, 18 Jul 2017) New Revision: 53609 Modified: data/CVE/list Log: Add new graphicsmagick issue Modified: data/CVE/list === --- data/CVE/list 2017-07-18 09:10:12 UTC (rev 53608) +++ data/CVE/list 2017-07-18 09:15:53 UTC (rev 53609) @@ -33,7 +33,8 @@ CVE-2017-11404 (In CMS Made Simple (CMSMS) 2.2.2, remote authenticated administrators ...) TODO: check CVE-2017-11403 (The ReadMNGImage function in coders/png.c in GraphicsMagick 1.3.26 has ...) - TODO: check + - graphicsmagick + NOTE: http://hg.code.sf.net/p/graphicsmagick/code/rev/d0a76868ca37 CVE-2017-11402 RESERVED CVE-2017-11401 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53608 - data/CVE
Author: sectracker
Date: 2017-07-18 09:10:12 + (Tue, 18 Jul 2017)
New Revision: 53608
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
===
--- data/CVE/list 2017-07-18 09:09:40 UTC (rev 53607)
+++ data/CVE/list 2017-07-18 09:10:12 UTC (rev 53608)
@@ -1,3 +1,45 @@
+CVE-2017-11420 (Stack-based buffer overflow in ASUS_Discovery.c in networkmap
in ...)
+ TODO: check
+CVE-2017-11419 (Fiyo CMS 2.0.7 has SQL injection in ...)
+ TODO: check
+CVE-2017-11418 (Fiyo CMS 2.0.7 has SQL injection in ...)
+ TODO: check
+CVE-2017-11417 (Fiyo CMS 2.0.7 has SQL injection in ...)
+ TODO: check
+CVE-2017-11416 (Fiyo CMS 2.0.7 has SQL injection in ...)
+ TODO: check
+CVE-2017-11415 (Fiyo CMS 2.0.7 has SQL injection in ...)
+ TODO: check
+CVE-2017-11414 (Fiyo CMS 2.0.7 has SQL injection in ...)
+ TODO: check
+CVE-2017-11413 (Fiyo CMS 2.0.7 has SQL injection in ...)
+ TODO: check
+CVE-2017-11412 (Fiyo CMS 2.0.7 has SQL injection in ...)
+ TODO: check
+CVE-2017-11411
+ RESERVED
+CVE-2017-11410
+ RESERVED
+CVE-2017-11409
+ RESERVED
+CVE-2017-11408
+ RESERVED
+CVE-2017-11407
+ RESERVED
+CVE-2017-11406
+ RESERVED
+CVE-2017-11405 (In CMS Made Simple (CMSMS) 2.2.2, remote authenticated
administrators ...)
+ TODO: check
+CVE-2017-11404 (In CMS Made Simple (CMSMS) 2.2.2, remote authenticated
administrators ...)
+ TODO: check
+CVE-2017-11403 (The ReadMNGImage function in coders/png.c in GraphicsMagick
1.3.26 has ...)
+ TODO: check
+CVE-2017-11402
+ RESERVED
+CVE-2017-11401
+ RESERVED
+CVE-2017-11400
+ RESERVED
CVE-2017- [unsafe use of /tmp]
- gnome-exe-thumbnailer (bug #868737)
[stretch] - gnome-exe-thumbnailer (Minor issue)
@@ -938,6 +980,7 @@
[wheezy] - catdoc (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1468471
CVE-2017-11109 (Vim 8.0 allows attackers to cause a denial of service (invalid
free) or ...)
+ {DLA-1030-1}
- vim 2:8.0.0197-5 (low; bug #867720)
[stretch] - vim (Minor issue)
[jessie] - vim (Minor issue)
@@ -2370,10 +2413,10 @@
- tiff (bug #866109)
- tiff3
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2704
-CVE-2017-9934
- RESERVED
-CVE-2017-9933
- RESERVED
+CVE-2017-9934 (Missing CSRF token checks and improper input validation in
Joomla! CMS ...)
+ TODO: check
+CVE-2017-9933 (Improper cache invalidation in Joomla! CMS 1.7.3 through 3.7.2
leads ...)
+ TODO: check
CVE-2017-9932
RESERVED
CVE-2017-9931
@@ -2671,14 +2714,14 @@
CVE-2017-9814 (cairo-truetype-subset.c in cairo 1.15.6 and earlier allows
remote ...)
- cairo (bug #868580)
NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=101547
-CVE-2017-9813
- RESERVED
-CVE-2017-9812
- RESERVED
-CVE-2017-9811
- RESERVED
-CVE-2017-9810
- RESERVED
+CVE-2017-9813 (In Kaspersky Anti-Virus for Linux File Server before
Maintenance Pack ...)
+ TODO: check
+CVE-2017-9812 (The reportId parameter of the getReportStatus action method can
be ...)
+ TODO: check
+CVE-2017-9811 (The kluser is able to interact with the kav4fs-control binary
in ...)
+ TODO: check
+CVE-2017-9810 (There are no Anti-CSRF tokens in any forms on the web interface
in ...)
+ TODO: check
CVE-2017-9809
RESERVED
CVE-2017-9808
@@ -4393,8 +4436,7 @@
NOT-FOR-US: SimpleCE
CVE-2017-9672
RESERVED
-CVE-2017-9671
- RESERVED
+CVE-2017-9671 (A heap overflow in apk (Alpine Linux's package manager) allows
a ...)
NOT-FOR-US: apk (Alpine's package manager)
CVE-2017-9670 (An uninitialized stack variable vulnerability in
load_tic_series() in ...)
- gnuplot 5.0.5+dfsg1-7 (unimportant; bug #864901)
@@ -4408,8 +4450,7 @@
NOTE: Fixed by:
https://github.com/gnuplot/gnuplot/commit/4e39b1d7b274c7d4a69cbaba85ff321264f4457e
NOTE: Introduced by:
https://github.com/gnuplot/gnuplot/commit/cd4b777389379598740fc02decff772b0e7bcbd6
NOTE: Crash in a CLI tool, no security impact
-CVE-2017-9669
- RESERVED
+CVE-2017-9669 (A heap overflow in apk (Alpine Linux's package manager) allows
a ...)
NOT-FOR-US: apk (Alpine's package manager)
CVE-2017-9668 (In admin\addgroup.php in CMS Made Simple 2.1.6, when adding a
user ...)
NOT-FOR-US: CMS Made Simple
@@ -4531,8 +4572,8 @@
RESERVED
CVE-2017-9610
RESERVED
-CVE-2017-9609
- RESERVED
+CVE-2017-9609 (Cross-site scripting (XSS) vulnerability in Blackcat CMS 1.2
allows ...)
+ TODO: check
CVE-2017-9608
RESERVED
CVE-2017-9607
@@ -4567,7 +4608,7 @@
NOT-FOR-US: "FNB Kemp Mobile Banking" by First National Bank of Kemp app
CVE-2017-9600 (The "Peoples Bank Tulsa" by Peoples Bank - OK app
3.0.2 -- aka ...)
NOT-FOR-US:
[Secure-testing-commits] r53607 - data
Author: hertzog Date: 2017-07-18 09:09:40 + (Tue, 18 Jul 2017) New Revision: 53607 Modified: data/dla-needed.txt Log: Drop samba4 since it doesn't use the embedded heimdal Modified: data/dla-needed.txt === --- data/dla-needed.txt 2017-07-18 08:38:12 UTC (rev 53606) +++ data/dla-needed.txt 2017-07-18 09:09:40 UTC (rev 53607) @@ -149,8 +149,6 @@ rkhunter (Thorsten Alteholz) NOTE: 20170702 sent email to maintainer -- -samba4 --- spice NOTE: CVE-2017-7506 already fixed in jessie. Can take patch there. -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53606 - data/CVE
Author: carnil Date: 2017-07-18 08:38:12 + (Tue, 18 Jul 2017) New Revision: 53606 Modified: data/CVE/list Log: Add entry for #868737 Modified: data/CVE/list === --- data/CVE/list 2017-07-18 08:23:52 UTC (rev 53605) +++ data/CVE/list 2017-07-18 08:38:12 UTC (rev 53606) @@ -1,3 +1,6 @@ +CVE-2017- [unsafe use of /tmp] + - gnome-exe-thumbnailer (bug #868737) + [stretch] - gnome-exe-thumbnailer (Minor issue) CVE-2017- [Thumbnail generation for MSI files executes arbitrary VBScript] - gnome-exe-thumbnailer (bug #868705) [stretch] - gnome-exe-thumbnailer (Minor issue) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53605 - data/CVE
Author: seb Date: 2017-07-18 08:23:52 + (Tue, 18 Jul 2017) New Revision: 53605 Modified: data/CVE/list Log: Mark #868705 (gnome-exe-thumbnailer) as no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-07-18 07:10:49 UTC (rev 53604) +++ data/CVE/list 2017-07-18 08:23:52 UTC (rev 53605) @@ -1,5 +1,6 @@ CVE-2017- [Thumbnail generation for MSI files executes arbitrary VBScript] - gnome-exe-thumbnailer (bug #868705) + [stretch] - gnome-exe-thumbnailer (Minor issue) NOTE: http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html NOTE: https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5 CVE-2017-11399 (Integer overflow in the ape_decode_frame function in ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r53604 - data/CVE
Author: jmm Date: 2017-07-18 07:10:49 + (Tue, 18 Jul 2017) New Revision: 53604 Modified: data/CVE/list Log: NFU chicken no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-07-18 06:51:42 UTC (rev 53603) +++ data/CVE/list 2017-07-18 07:10:49 UTC (rev 53604) @@ -122,6 +122,8 @@ NOTE: https://github.com/TheLocehiliosan/yadm/issues/74 CVE-2017-11343 (Due to an incomplete fix for CVE-2012-6125, all versions of CHICKEN ...) - chicken + [stretch] - chicken (Minor issue) + [jessie] - chicken (Minor issue) NOTE: http://lists.nongnu.org/archive/html/chicken-announce/2017-07/msg0.html CVE-2017-11342 (There is an illegal address access in ast.cpp of LibSass 3.4.5. A ...) - libsass (bug #868577) @@ -14696,7 +14698,7 @@ CVE-2017-6250 (NVIDIA GeForce Experience contains a vulnerability in NVIDIA Web ...) NOT-FOR-US: NVIDIA GeForce Experience CVE-2017-6249 (An elevation of privilege vulnerability in the NVIDIA sound driver ...) - TODO: check + NOT-FOR-US: NVIDIA driver for Android CVE-2017-6248 (An elevation of privilege vulnerability in the NVIDIA sound driver ...) NOT-FOR-US: NVIDIA driver for Android CVE-2017-6247 (An elevation of privilege vulnerability in the NVIDIA sound driver ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
