[Secure-testing-commits] r55713 - data/CVE
Author: carnil Date: 2017-09-13 05:13:43 + (Wed, 13 Sep 2017) New Revision: 55713 Modified: data/CVE/list Log: Update information for perl on older versions Modified: data/CVE/list === --- data/CVE/list 2017-09-13 04:53:07 UTC (rev 55712) +++ data/CVE/list 2017-09-13 05:13:43 UTC (rev 55713) @@ -3717,6 +3717,7 @@ CVE-2017-12883 [Buffer over-read in regular expression parser] RESERVED - perl 5.26.0-8 (bug #875597) + [wheezy] - perl (Vulnerable code introduced later) NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131598 (not yet public) NOTE: https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f NOTE: maint-5.26: https://perl5.git.perl.org/perl.git/commitdiff/2692dda97731c37082a0075eff50d741901c665f @@ -4359,6 +4360,7 @@ CVE-2017-12837 [Heap buffer overflow in regular expression compiler] RESERVED - perl 5.26.0-8 (bug #875596) + [wheezy] - perl (Vulnerable code introduced after 5.14.4) NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131582 (not yet public) NOTE: https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5 NOTE: maint-5.26: https://perl5.git.perl.org/perl.git/commitdiff/66288bb3f44c8aa5122e5f40d8cfc0eada8b1695 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55712 - in data: . DSA
Author: carnil
Date: 2017-09-13 04:53:07 + (Wed, 13 Sep 2017)
New Revision: 55712
Modified:
data/DSA/list
data/dsa-needed.txt
Log:
Reserve DSA id for tcpdump update
Modified: data/DSA/list
===
--- data/DSA/list 2017-09-13 04:41:11 UTC (rev 55711)
+++ data/DSA/list 2017-09-13 04:53:07 UTC (rev 55712)
@@ -1,3 +1,7 @@
+[13 Sep 2017] DSA-3971-1 tcpdump - security update
+ {CVE-2017-11108 CVE-2017-11541 CVE-2017-11542 CVE-2017-11543
CVE-2017-12893 CVE-2017-12894 CVE-2017-12895 CVE-2017-12896 CVE-2017-12897
CVE-2017-12898 CVE-2017-12899 CVE-2017-12900 CVE-2017-12901 CVE-2017-12902
CVE-2017-12985 CVE-2017-12986 CVE-2017-12987 CVE-2017-12988 CVE-2017-12989
CVE-2017-12990 CVE-2017-12991 CVE-2017-12992 CVE-2017-12993 CVE-2017-12994
CVE-2017-12995 CVE-2017-12996 CVE-2017-12997 CVE-2017-12998 CVE-2017-12999
CVE-2017-13000 CVE-2017-13001 CVE-2017-13002 CVE-2017-13003 CVE-2017-13004
CVE-2017-13005 CVE-2017-13006 CVE-2017-13007 CVE-2017-13008 CVE-2017-13009
CVE-2017-13010 CVE-2017-13011 CVE-2017-13012 CVE-2017-13013 CVE-2017-13014
CVE-2017-13015 CVE-2017-13016 CVE-2017-13017 CVE-2017-13018 CVE-2017-13019
CVE-2017-13020 CVE-2017-13021 CVE-2017-13022 CVE-2017-13023 CVE-2017-13024
CVE-2017-13025 CVE-2017-13026 CVE-2017-13027 CVE-2017-13028 CVE-2017-13029
CVE-2017-13030 CVE-2017-13031 CVE-2017-13032 CVE-2017-13033 CVE-2017-13034
CVE-2017-13035 CVE-2017-13036 CVE-2
017-13037 CVE-2017-13038 CVE-2017-13039 CVE-2017-13040 CVE-2017-13041
CVE-2017-13042 CVE-2017-13043 CVE-2017-13044 CVE-2017-13045 CVE-2017-13046
CVE-2017-13047 CVE-2017-13048 CVE-2017-13049 CVE-2017-13050 CVE-2017-13051
CVE-2017-13052 CVE-2017-13053 CVE-2017-13054 CVE-2017-13055 CVE-2017-13687
CVE-2017-13688 CVE-2017-13689 CVE-2017-13690 CVE-2017-13725}
+ [jessie] - tcpdump 4.9.2-1~deb8u1
+ [stretch] - tcpdump 4.9.2-1~deb9u1
[12 Sep 2017] DSA-3970-1 emacs24 - security update
[jessie] - emacs24 24.4+1-5+deb8u1
[stretch] - emacs24 24.5+1-11+deb9u1
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-09-13 04:41:11 UTC (rev 55711)
+++ data/dsa-needed.txt 2017-09-13 04:53:07 UTC (rev 55712)
@@ -84,8 +84,6 @@
--
simplesamlphp
--
-tcpdump (carnil)
---
tiff
wait until more issues are around
--
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55711 - data/CVE
Author: carnil Date: 2017-09-13 04:41:11 + (Wed, 13 Sep 2017) New Revision: 55711 Modified: data/CVE/list Log: Cleanup trailing whitespaces, adjust entry for emacs24 Modified: data/CVE/list === --- data/CVE/list 2017-09-13 04:27:26 UTC (rev 55710) +++ data/CVE/list 2017-09-13 04:41:11 UTC (rev 55711) @@ -1,9 +1,9 @@ CVE-2017-14347 (NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to ...) NOT-FOR-US: NexusPHP CVE-2017-14346 (upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file ...) - NOT-FOR-US: tianchoy/blog + NOT-FOR-US: tianchoy/blog CVE-2017-14345 (SQL Injection exists in tianchoy/blog through 2017-09-12 via the id ...) - NOT-FOR-US: tianchoy/blog + NOT-FOR-US: tianchoy/blog CVE-2017-14344 (This vulnerability allows local attackers to escalate privileges on ...) NOT-FOR-US: Jungo WinDriver CVE-2017-14343 (ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in ...) @@ -196,8 +196,8 @@ CVE-2017- [enriched text remote code execution] - emacs25 25.2+1-6 (bug #875447) - emacs24 (bug #875448) + [stretch] - emacs24 24.5+1-11+deb9u1 [jessie] - emacs24 24.4+1-5+deb8u1 - [stretch] - emacs24 24.5+1-11+deb9u1 - emacs23 (bug #875449) NOTE: http://www.openwall.com/lists/oss-security/2017/09/11/1 NOTE: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55710 - data/CVE
Author: carnil Date: 2017-09-13 04:27:26 + (Wed, 13 Sep 2017) New Revision: 55710 Modified: data/CVE/list Log: Add one entry for CVE-2017-10923 included in xen DSA Modified: data/CVE/list === --- data/CVE/list 2017-09-13 04:18:02 UTC (rev 55709) +++ data/CVE/list 2017-09-13 04:27:26 UTC (rev 55710) @@ -12518,6 +12518,7 @@ NOTE: https://github.com/flatpak/flatpak/issues/845 CVE-2017-10923 (Xen through 4.8.x does not validate a vCPU array index upon the sending ...) - xen + [stretch] - xen 4.8.1-1+deb9u3 [jessie] - xen (Vulnerable code not present) [wheezy] - xen (Vulnerable code not present) NOTE: https://xenbits.xen.org/xsa/advisory-225.html ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55709 - data/CVE
Author: carnil
Date: 2017-09-13 04:18:02 + (Wed, 13 Sep 2017)
New Revision: 55709
Modified:
data/CVE/list
Log:
Reference commits for CVE-2017-1434{1,2}
Modified: data/CVE/list
===
--- data/CVE/list 2017-09-13 01:26:21 UTC (rev 55708)
+++ data/CVE/list 2017-09-13 04:18:02 UTC (rev 55709)
@@ -12,10 +12,13 @@
CVE-2017-14342 (ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in
...)
- imagemagick (unimportant)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/650
+ NOTE:
https://github.com/ImageMagick/ImageMagick/commit/4e378ea8fb99e869768f34e900105e8c769adfcd
+ NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/6d5b22baedd49ef8a35011789bd600762ce1ef21
CVE-2017-14341 (ImageMagick 7.0.6-6 has a large loop vulnerability in
ReadWPGImage in ...)
- imagemagick (low)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/654
- NOTE:
https://github.com/ImageMagick/ImageMagick/commit/4eae304e773bad8a876c3c26fdffac24d4253ae4
+ NOTE:
https://github.com/ImageMagick/ImageMagick/commit/7d63315a64267c565d1f34b9cb523a14616fed24
+ NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/4eae304e773bad8a876c3c26fdffac24d4253ae4
CVE-2017-14348 (LibRaw before 0.18.4 has a heap-based Buffer Overflow in the
...)
- libraw
NOTE: https://github.com/LibRaw/LibRaw/issues/100
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55708 - data/CVE
Author: pabs Date: 2017-09-13 01:26:21 + (Wed, 13 Sep 2017) New Revision: 55708 Modified: data/CVE/list Log: BlueBourne NFUs Modified: data/CVE/list === --- data/CVE/list 2017-09-12 21:16:58 UTC (rev 55707) +++ data/CVE/list 2017-09-13 01:26:21 UTC (rev 55708) @@ -16122,6 +16122,8 @@ RESERVED CVE-2017-8628 RESERVED + NOT-FOR-US: Microsoft Windows + NOTE: https://www.armis.com/blueborne/ CVE-2017-8627 (Windows Subsystem for Linux in Windows 10 1703, allows a denial of ...) NOT-FOR-US: Microsoft CVE-2017-8626 @@ -38627,14 +38629,22 @@ NOT-FOR-US: Broadcom driver for Android CVE-2017-0785 RESERVED + NOT-FOR-US: Android + NOTE: https://www.armis.com/blueborne/ CVE-2017-0784 (A elevation of privilege vulnerability in the Android system (nfc). ...) NOT-FOR-US: Android CVE-2017-0783 RESERVED + NOT-FOR-US: Android + NOTE: https://www.armis.com/blueborne/ CVE-2017-0782 RESERVED + NOT-FOR-US: Android + NOTE: https://www.armis.com/blueborne/ CVE-2017-0781 RESERVED + NOT-FOR-US: Android + NOTE: https://www.armis.com/blueborne/ CVE-2017-0780 (A denial of service vulnerability in the Android runtime (android ...) NOT-FOR-US: Android CVE-2017-0779 (A information disclosure vulnerability in the Android media framework ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55707 - in data: . CVE
Author: jmm Date: 2017-09-12 21:16:58 + (Tue, 12 Sep 2017) New Revision: 55707 Modified: data/CVE/list data/dsa-needed.txt Log: xen DSA released new imagemagick issues Modified: data/CVE/list === --- data/CVE/list 2017-09-12 21:14:25 UTC (rev 55706) +++ data/CVE/list 2017-09-12 21:16:58 UTC (rev 55707) @@ -7,11 +7,15 @@ CVE-2017-14344 (This vulnerability allows local attackers to escalate privileges on ...) NOT-FOR-US: Jungo WinDriver CVE-2017-14343 (ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in ...) - TODO: check + - imagemagick (unimportant) + NOTE: https://github.com/ImageMagick/ImageMagick/issues/649 CVE-2017-14342 (ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ...) - TODO: check + - imagemagick (unimportant) + NOTE: https://github.com/ImageMagick/ImageMagick/issues/650 CVE-2017-14341 (ImageMagick 7.0.6-6 has a large loop vulnerability in ReadWPGImage in ...) - TODO: check + - imagemagick (low) + NOTE: https://github.com/ImageMagick/ImageMagick/issues/654 + NOTE: https://github.com/ImageMagick/ImageMagick/commit/4eae304e773bad8a876c3c26fdffac24d4253ae4 CVE-2017-14348 (LibRaw before 0.18.4 has a heap-based Buffer Overflow in the ...) - libraw NOTE: https://github.com/LibRaw/LibRaw/issues/100 Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-09-12 21:14:25 UTC (rev 55706) +++ data/dsa-needed.txt 2017-09-12 21:16:58 UTC (rev 55707) @@ -104,7 +104,5 @@ wordpress-shibboleth Dom preparing an update -- -xen (jmm) --- zendframework/oldstable -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55706 - data/CVE
Author: jmm Date: 2017-09-12 21:14:25 + (Tue, 12 Sep 2017) New Revision: 55706 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-09-12 21:10:15 UTC (rev 55705) +++ data/CVE/list 2017-09-12 21:14:25 UTC (rev 55706) @@ -1,11 +1,11 @@ CVE-2017-14347 (NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter to ...) - TODO: check + NOT-FOR-US: NexusPHP CVE-2017-14346 (upload.php in tianchoy/blog through 2017-09-12 allows unrestricted file ...) - TODO: check + NOT-FOR-US: tianchoy/blog CVE-2017-14345 (SQL Injection exists in tianchoy/blog through 2017-09-12 via the id ...) - TODO: check + NOT-FOR-US: tianchoy/blog CVE-2017-14344 (This vulnerability allows local attackers to escalate privileges on ...) - TODO: check + NOT-FOR-US: Jungo WinDriver CVE-2017-14343 (ImageMagick 7.0.6-6 has a memory leak vulnerability in ReadXCFImage in ...) TODO: check CVE-2017-14342 (ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in ...) @@ -22,7 +22,7 @@ CVE-2017-14338 RESERVED CVE-2017-14337 (When MISP before 2.4.80 is configured with X.509 certificate ...) - TODO: check + NOT-FOR-US: MISP (Malware Information Sharing Platform and Threat Sharing) CVE-2017-14336 RESERVED CVE-2017-14335 (On Beijing Hanbang Hanbanggaoke devices, because user-controlled input ...) @@ -82,7 +82,7 @@ - xen NOTE: https://xenbits.xen.org/xsa/advisory-231.html CVE-2017-14315 (In Apple iOS 7 through 9, due to a BlueBorne flaw in the implementation ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-14314 (Off-by-one error in the DrawImage function in magick/render.c in ...) - graphicsmagick NOTE: http://hg.code.sf.net/p/graphicsmagick/code/rev/2835184bfb78 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55705 - data/CVE
Author: sectracker
Date: 2017-09-12 21:10:15 + (Tue, 12 Sep 2017)
New Revision: 55705
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
===
--- data/CVE/list 2017-09-12 21:03:05 UTC (rev 55704)
+++ data/CVE/list 2017-09-12 21:10:15 UTC (rev 55705)
@@ -1,4 +1,18 @@
-CVE-2017-14348 [Heap buffer overflow in LibRaw::processCanonCameraInfo]
+CVE-2017-14347 (NexusPHP 1.5.beta5.20120707 has XSS in the returnto parameter
to ...)
+ TODO: check
+CVE-2017-14346 (upload.php in tianchoy/blog through 2017-09-12 allows
unrestricted file ...)
+ TODO: check
+CVE-2017-14345 (SQL Injection exists in tianchoy/blog through 2017-09-12 via
the id ...)
+ TODO: check
+CVE-2017-14344 (This vulnerability allows local attackers to escalate
privileges on ...)
+ TODO: check
+CVE-2017-14343 (ImageMagick 7.0.6-6 has a memory leak vulnerability in
ReadXCFImage in ...)
+ TODO: check
+CVE-2017-14342 (ImageMagick 7.0.6-6 has a memory exhaustion vulnerability in
...)
+ TODO: check
+CVE-2017-14341 (ImageMagick 7.0.6-6 has a large loop vulnerability in
ReadWPGImage in ...)
+ TODO: check
+CVE-2017-14348 (LibRaw before 0.18.4 has a heap-based Buffer Overflow in the
...)
- libraw
NOTE: https://github.com/LibRaw/LibRaw/issues/100
CVE-2017-14340
@@ -7,8 +21,8 @@
RESERVED
CVE-2017-14338
RESERVED
-CVE-2017-14337
- RESERVED
+CVE-2017-14337 (When MISP before 2.4.80 is configured with X.509 certificate
...)
+ TODO: check
CVE-2017-14336
RESERVED
CVE-2017-14335 (On Beijing Hanbang Hanbanggaoke devices, because
user-controlled input ...)
@@ -53,26 +67,22 @@
RESERVED
CVE-2017-14320
RESERVED
-CVE-2017-14319 [insufficient grant unmapping checks for x86 PV guests]
- RESERVED
+CVE-2017-14319 (A grant unmapping issue was discovered in Xen through 4.9.x.
When ...)
- xen
NOTE: https://xenbits.xen.org/xsa/advisory-234.html
-CVE-2017-14318 [Missing check for grant table]
- RESERVED
+CVE-2017-14318 (An issue was discovered in Xen 4.5.x through 4.9.x. The
function ...)
- xen
[jessie] - xen (Only affects 4.5 and later)
[wheezy] - xen (Only affects 4.5 and later)
NOTE: https://xenbits.xen.org/xsa/advisory-232.html
-CVE-2017-14317 [cxenstored: Race in domain cleanup]
- RESERVED
+CVE-2017-14317 (A domain cleanup issue was discovered in the C xenstore daemon
(aka ...)
- xen
NOTE: https://xenbits.xen.org/xsa/advisory-233.html
-CVE-2017-14316 [Missing NUMA node parameter verification]
- RESERVED
+CVE-2017-14316 (A parameter verification issue was discovered in Xen through
4.9.x. The ...)
- xen
NOTE: https://xenbits.xen.org/xsa/advisory-231.html
-CVE-2017-14315
- RESERVED
+CVE-2017-14315 (In Apple iOS 7 through 9, due to a BlueBorne flaw in the
implementation ...)
+ TODO: check
CVE-2017-14314 (Off-by-one error in the DrawImage function in magick/render.c
in ...)
- graphicsmagick
NOTE: http://hg.code.sf.net/p/graphicsmagick/code/rev/2835184bfb78
@@ -523,12 +533,12 @@
NOTE:
https://blogs.gentoo.org/ago/2017/08/16/openjpeg-heap-based-buffer-overflow-in-opj_mqc_flush-mqc-c/
NOTE:
https://github.com/uclouvain/openjpeg/commit/afb308b9ccbe129608c9205cf3bb39bbefad90b9
NOTE: https://github.com/uclouvain/openjpeg/issues/982
-CVE-2017-1000251 [stack overflow]
+CVE-2017-1000251 (The native Bluetooth stack in the Linux Kernel (BlueZ),
starting at ...)
- linux
NOTE: Fixed by:
https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3
NOTE: https://www.armis.com/blueborne/
NOTE: https://access.redhat.com/security/vulnerabilities/blueborne
-CVE-2017-1000250 [information leak vulnerability]
+CVE-2017-1000250 (All versions of the SDP server in BlueZ 5.46 and earlier are
...)
- bluez
NOTE: https://www.armis.com/blueborne/
CVE-2017-1000249 (An issue in file() was introduced in commit ...)
@@ -15377,8 +15387,8 @@
- cgiirc
CVE-2017-8919 (NetApp OnCommand API Services before 1.2P3 logs the LDAP BIND
password ...)
NOT-FOR-US: NetApp
-CVE-2017-8918
- RESERVED
+CVE-2017-8918 (XXE in Dive Assistant - Template Builder in Blackwave Dive
Assistant - ...)
+ TODO: check
CVE-2017-8917 (SQL injection vulnerability in Joomla! 3.7.x before 3.7.1
allows ...)
NOT-FOR-US: Joomla
CVE-2017-8916
@@ -94184,8 +94194,7 @@
{DSA-3134-1 DLA-148-1}
- sympa 6.1.23~dfsg-2
NOTE:
https://www.sympa.org/security_advisories#security_breaches_in_newsletter_posting
-CVE-2014-9624 [CAPTCHA bypass]
- RESERVED
+CVE-2014-9624 (CAPTCHA bypass vulnerability in MantisBT before 1.2.19. ...)
- mantis (bug #780875)
[wheezy] - mantis (Minor issue)
[squeeze] - mantis (Unsupported in
[Secure-testing-commits] r55704 - in data: . CVE DSA
Author: jmm
Date: 2017-09-12 21:03:05 + (Tue, 12 Sep 2017)
New Revision: 55704
Modified:
data/CVE/list
data/DSA/list
data/dsa-needed.txt
Log:
emacs DSA
Modified: data/CVE/list
===
--- data/CVE/list 2017-09-12 20:47:20 UTC (rev 55703)
+++ data/CVE/list 2017-09-12 21:03:05 UTC (rev 55704)
@@ -179,6 +179,8 @@
CVE-2017- [enriched text remote code execution]
- emacs25 25.2+1-6 (bug #875447)
- emacs24 (bug #875448)
+ [jessie] - emacs24 24.4+1-5+deb8u1
+ [stretch] - emacs24 24.5+1-11+deb9u1
- emacs23 (bug #875449)
NOTE: http://www.openwall.com/lists/oss-security/2017/09/11/1
NOTE: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350
Modified: data/DSA/list
===
--- data/DSA/list 2017-09-12 20:47:20 UTC (rev 55703)
+++ data/DSA/list 2017-09-12 21:03:05 UTC (rev 55704)
@@ -1,3 +1,6 @@
+[12 Sep 2017] DSA-3970-1 emacs24 - security update
+ [jessie] - emacs24 24.4+1-5+deb8u1
+ [stretch] - emacs24 24.5+1-11+deb9u1
[12 Sep 2017] DSA-3969-1 xen - security update
{CVE-2017-10912 CVE-2017-10913 CVE-2017-10914 CVE-2017-10915
CVE-2017-10917 CVE-2017-10918 CVE-2017-10920 CVE-2017-10921 CVE-2017-10922
CVE-2017-12135 CVE-2017-12137 CVE-2017-12855}
[jessie] - xen 4.4.1-9+deb8u10
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-09-12 20:47:20 UTC (rev 55703)
+++ data/dsa-needed.txt 2017-09-12 21:03:05 UTC (rev 55704)
@@ -38,8 +38,6 @@
--
emacs25/stable
--
-emacs24
---
ghostscript (carnil)
--
graphicsmagick
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55702 - data
Author: carnil Date: 2017-09-12 20:47:18 + (Tue, 12 Sep 2017) New Revision: 55702 Modified: data/dsa-needed.txt Log: Add bluez to dsa-needed list Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-09-12 20:44:42 UTC (rev 55701) +++ data/dsa-needed.txt 2017-09-12 20:47:18 UTC (rev 55702) @@ -14,6 +14,8 @@ -- 389-ds-base (fw) -- +bluez +-- chromium-browser -- curl (ghedo) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55703 - data
Author: carnil Date: 2017-09-12 20:47:20 + (Tue, 12 Sep 2017) New Revision: 55703 Modified: data/dsa-needed.txt Log: Expand notes for db/db5.3 Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-09-12 20:47:18 UTC (rev 55702) +++ data/dsa-needed.txt 2017-09-12 20:47:20 UTC (rev 55703) @@ -25,12 +25,16 @@ possible to rebase to a new upstream Existing applications might rely on existing behaviour, monitor in unstable for a month + As per 2017-09-12 no obvious regressions were reported, maybe still go via a point + release. -- db5.3 Needs to be seen how it's fixed by Oracle and whether it's isolatable or whether it's possible to rebase to a new upstream Existing applications might rely on existing behaviour, monitor in unstable for a month + As per 2017-09-12 no obvious regressions were reported, maybe still go via a point + release. -- emacs25/stable -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55701 - data/CVE
Author: carnil Date: 2017-09-12 20:44:42 + (Tue, 12 Sep 2017) New Revision: 55701 Modified: data/CVE/list Log: Update status for CVE-2017-14312 Modified: data/CVE/list === --- data/CVE/list 2017-09-12 19:33:51 UTC (rev 55700) +++ data/CVE/list 2017-09-12 20:44:42 UTC (rev 55701) @@ -78,8 +78,9 @@ NOTE: http://hg.code.sf.net/p/graphicsmagick/code/rev/2835184bfb78 NOTE: https://sourceforge.net/p/graphicsmagick/bugs/448/ CVE-2017-14312 (Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root ...) - - nagios3 + - nagios3 (Doesn't affect Nagios as packaged in Debian) NOTE: https://github.com/NagiosEnterprises/nagioscore/issues/424 + NOTE: State is not fully correct, since "affected" source would be there. CVE-2015-9228 (In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for ...) NOT-FOR-US: Photocrati NextGEN Gallery plugin for WordPress CVE-2017- [XSA 235] ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55700 - data/CVE
Author: fgeek-guest Date: 2017-09-12 19:33:51 + (Tue, 12 Sep 2017) New Revision: 55700 Modified: data/CVE/list Log: CVE-2017-14348/libraw Modified: data/CVE/list === --- data/CVE/list 2017-09-12 19:31:10 UTC (rev 55699) +++ data/CVE/list 2017-09-12 19:33:51 UTC (rev 55700) @@ -1,3 +1,6 @@ +CVE-2017-14348 [Heap buffer overflow in LibRaw::processCanonCameraInfo] + - libraw + NOTE: https://github.com/LibRaw/LibRaw/issues/100 CVE-2017-14340 RESERVED CVE-2017-14339 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55699 - data
Author: carnil Date: 2017-09-12 19:31:10 + (Tue, 12 Sep 2017) New Revision: 55699 Modified: data/dsa-needed.txt Log: Add wordpress-shibboleth to dsa-needed Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-09-12 18:50:01 UTC (rev 55698) +++ data/dsa-needed.txt 2017-09-12 19:31:10 UTC (rev 55699) @@ -97,6 +97,9 @@ 2017-05-13: asked balint@ if he wants to prepare an update now 2017-07-28: re-ping balint@ -- +wordpress-shibboleth + Dom preparing an update +-- xen (jmm) -- zendframework/oldstable ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55698 - data/CVE
Author: carnil Date: 2017-09-12 18:50:01 + (Tue, 12 Sep 2017) New Revision: 55698 Modified: data/CVE/list Log: Reference fix for CVE-2017-1000251 Modified: data/CVE/list === --- data/CVE/list 2017-09-12 18:36:37 UTC (rev 55697) +++ data/CVE/list 2017-09-12 18:50:01 UTC (rev 55698) @@ -519,6 +519,7 @@ NOTE: https://github.com/uclouvain/openjpeg/issues/982 CVE-2017-1000251 [stack overflow] - linux + NOTE: Fixed by: https://git.kernel.org/linus/e860d2c904d1a9f38a24eb44c9f34b8f915a6ea3 NOTE: https://www.armis.com/blueborne/ NOTE: https://access.redhat.com/security/vulnerabilities/blueborne CVE-2017-1000250 [information leak vulnerability] ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55697 - data/CVE
Author: carnil
Date: 2017-09-12 18:36:37 + (Tue, 12 Sep 2017)
New Revision: 55697
Modified:
data/CVE/list
Log:
Add CVE-2017-100025{0,1} for bluez and linux
Modified: data/CVE/list
===
--- data/CVE/list 2017-09-12 18:09:36 UTC (rev 55696)
+++ data/CVE/list 2017-09-12 18:36:37 UTC (rev 55697)
@@ -517,6 +517,13 @@
NOTE:
https://blogs.gentoo.org/ago/2017/08/16/openjpeg-heap-based-buffer-overflow-in-opj_mqc_flush-mqc-c/
NOTE:
https://github.com/uclouvain/openjpeg/commit/afb308b9ccbe129608c9205cf3bb39bbefad90b9
NOTE: https://github.com/uclouvain/openjpeg/issues/982
+CVE-2017-1000251 [stack overflow]
+ - linux
+ NOTE: https://www.armis.com/blueborne/
+ NOTE: https://access.redhat.com/security/vulnerabilities/blueborne
+CVE-2017-1000250 [information leak vulnerability]
+ - bluez
+ NOTE: https://www.armis.com/blueborne/
CVE-2017-1000249 (An issue in file() was introduced in commit ...)
{DSA-3965-1}
- file 1:5.32-1
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55696 - data/CVE
Author: carnil Date: 2017-09-12 18:09:36 + (Tue, 12 Sep 2017) New Revision: 55696 Modified: data/CVE/list Log: perl fixed in unstable Modified: data/CVE/list === --- data/CVE/list 2017-09-12 13:36:39 UTC (rev 55695) +++ data/CVE/list 2017-09-12 18:09:36 UTC (rev 55696) @@ -3685,7 +3685,7 @@ RESERVED CVE-2017-12883 [Buffer over-read in regular expression parser] RESERVED - - perl (bug #875597) + - perl 5.26.0-8 (bug #875597) NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131598 (not yet public) NOTE: https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f NOTE: maint-5.26: https://perl5.git.perl.org/perl.git/commitdiff/2692dda97731c37082a0075eff50d741901c665f @@ -4327,7 +4327,7 @@ NOT-FOR-US: NexusPHP CVE-2017-12837 [Heap buffer overflow in regular expression compiler] RESERVED - - perl (bug #875596) + - perl 5.26.0-8 (bug #875596) NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131582 (not yet public) NOTE: https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5 NOTE: maint-5.26: https://perl5.git.perl.org/perl.git/commitdiff/66288bb3f44c8aa5122e5f40d8cfc0eada8b1695 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55695 - data/CVE
Author: carnil Date: 2017-09-12 13:36:39 + (Tue, 12 Sep 2017) New Revision: 55695 Modified: data/CVE/list Log: Add bug references for perl issues, #875596, #875597 Modified: data/CVE/list === --- data/CVE/list 2017-09-12 13:08:27 UTC (rev 55694) +++ data/CVE/list 2017-09-12 13:36:39 UTC (rev 55695) @@ -3685,7 +3685,7 @@ RESERVED CVE-2017-12883 [Buffer over-read in regular expression parser] RESERVED - - perl + - perl (bug #875597) NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131598 (not yet public) NOTE: https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f NOTE: maint-5.26: https://perl5.git.perl.org/perl.git/commitdiff/2692dda97731c37082a0075eff50d741901c665f @@ -4327,7 +4327,7 @@ NOT-FOR-US: NexusPHP CVE-2017-12837 [Heap buffer overflow in regular expression compiler] RESERVED - - perl + - perl (bug #875596) NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131582 (not yet public) NOTE: https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5 NOTE: maint-5.26: https://perl5.git.perl.org/perl.git/commitdiff/66288bb3f44c8aa5122e5f40d8cfc0eada8b1695 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55694 - data/CVE
Author: carnil Date: 2017-09-12 13:08:27 + (Tue, 12 Sep 2017) New Revision: 55694 Modified: data/CVE/list Log: Add commit references for perl issues Modified: data/CVE/list === --- data/CVE/list 2017-09-12 13:04:02 UTC (rev 55693) +++ data/CVE/list 2017-09-12 13:08:27 UTC (rev 55694) @@ -3687,6 +3687,9 @@ RESERVED - perl NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131598 (not yet public) + NOTE: https://perl5.git.perl.org/perl.git/commitdiff/2be4edede4ae226e2eebd4eff28cedd2041f300f + NOTE: maint-5.26: https://perl5.git.perl.org/perl.git/commitdiff/2692dda97731c37082a0075eff50d741901c665f + NOTE: maint-5.24: https://perl5.git.perl.org/perl.git/commitdiff/40b3cdad3649334585cee8f4630ec9a025e62be6 CVE-2017-12882 (Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin ...) NOT-FOR-US: Spring Batch Admin CVE-2017-12881 (Cross-site request forgery (CSRF) vulnerability in the Spring Batch ...) @@ -4326,6 +4329,9 @@ RESERVED - perl NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131582 (not yet public) + NOTE: https://perl5.git.perl.org/perl.git/commitdiff/96c83ed78aeea1a0496dd2b2d935869a822dc8a5 + NOTE: maint-5.26: https://perl5.git.perl.org/perl.git/commitdiff/66288bb3f44c8aa5122e5f40d8cfc0eada8b1695 + NOTE: maint-5.24: https://perl5.git.perl.org/perl.git/commitdiff/f7e5417e7bffba03947b66e4d8622d7c220f2876 CVE-2017-12835 RESERVED CVE-2017-12834 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55692 - data/CVE
Author: carnil
Date: 2017-09-12 13:03:59 + (Tue, 12 Sep 2017)
New Revision: 55692
Modified:
data/CVE/list
Log:
Add CVE-2017-12814/perl
Modified: data/CVE/list
===
--- data/CVE/list 2017-09-12 13:03:30 UTC (rev 55691)
+++ data/CVE/list 2017-09-12 13:03:59 UTC (rev 55692)
@@ -4368,8 +4368,10 @@
NOT-FOR-US: Kaspersky Internet Security for Android
CVE-2017-12815
RESERVED
-CVE-2017-12814
+CVE-2017-12814 [$ENV{$key} stack buffer overflow on Windows]
RESERVED
+ - perl (Windows specific issue)
+ NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131665 (not yet
public)
CVE-2017-12813
RESERVED
CVE-2017-12812
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55693 - data
Author: carnil Date: 2017-09-12 13:04:02 + (Tue, 12 Sep 2017) New Revision: 55693 Modified: data/dsa-needed.txt Log: Add and take perl in dsa-needed list Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-09-12 13:03:59 UTC (rev 55692) +++ data/dsa-needed.txt 2017-09-12 13:04:02 UTC (rev 55693) @@ -60,6 +60,8 @@ -- openjpeg2 -- +perl (carnil) +-- php-horde-image -- php5 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55690 - data/CVE
Author: carnil Date: 2017-09-12 13:03:20 + (Tue, 12 Sep 2017) New Revision: 55690 Modified: data/CVE/list Log: Add CVE-2017-12837/perl Modified: data/CVE/list === --- data/CVE/list 2017-09-12 12:18:59 UTC (rev 55689) +++ data/CVE/list 2017-09-12 13:03:20 UTC (rev 55690) @@ -4320,8 +4320,10 @@ RESERVED CVE-2017-12838 (Cross-site request forgery (CSRF) vulnerability in NexusPHP 1.5 allows ...) NOT-FOR-US: NexusPHP -CVE-2017-12837 +CVE-2017-12837 [Heap buffer overflow in regular expression compiler] RESERVED + - perl + NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131582 (not yet public) CVE-2017-12835 RESERVED CVE-2017-12834 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55691 - data/CVE
Author: carnil Date: 2017-09-12 13:03:30 + (Tue, 12 Sep 2017) New Revision: 55691 Modified: data/CVE/list Log: Add CVE-2017-12883/perl Modified: data/CVE/list === --- data/CVE/list 2017-09-12 13:03:20 UTC (rev 55690) +++ data/CVE/list 2017-09-12 13:03:30 UTC (rev 55691) @@ -3683,8 +3683,10 @@ RESERVED CVE-2017-12884 RESERVED -CVE-2017-12883 +CVE-2017-12883 [Buffer over-read in regular expression parser] RESERVED + - perl + NOTE: https://rt.perl.org/Public/Bug/Display.html?id=131598 (not yet public) CVE-2017-12882 (Stored Cross-site scripting (XSS) vulnerability in Spring Batch Admin ...) NOT-FOR-US: Spring Batch Admin CVE-2017-12881 (Cross-site request forgery (CSRF) vulnerability in the Spring Batch ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55689 - data/CVE
Author: jmm Date: 2017-09-12 12:18:59 + (Tue, 12 Sep 2017) New Revision: 55689 Modified: data/CVE/list Log: one xen issue n/a for jessie/wheezy Modified: data/CVE/list === --- data/CVE/list 2017-09-12 12:11:26 UTC (rev 55688) +++ data/CVE/list 2017-09-12 12:18:59 UTC (rev 55689) @@ -57,6 +57,8 @@ CVE-2017-14318 [Missing check for grant table] RESERVED - xen + [jessie] - xen (Only affects 4.5 and later) + [wheezy] - xen (Only affects 4.5 and later) NOTE: https://xenbits.xen.org/xsa/advisory-232.html CVE-2017-14317 [cxenstored: Race in domain cleanup] RESERVED ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55688 - data/CVE
Author: carnil Date: 2017-09-12 12:11:26 + (Tue, 12 Sep 2017) New Revision: 55688 Modified: data/CVE/list Log: Add four new xen issues Modified: data/CVE/list === --- data/CVE/list 2017-09-12 11:20:41 UTC (rev 55687) +++ data/CVE/list 2017-09-12 12:11:26 UTC (rev 55688) @@ -50,14 +50,22 @@ RESERVED CVE-2017-14320 RESERVED -CVE-2017-14319 +CVE-2017-14319 [insufficient grant unmapping checks for x86 PV guests] RESERVED -CVE-2017-14318 + - xen + NOTE: https://xenbits.xen.org/xsa/advisory-234.html +CVE-2017-14318 [Missing check for grant table] RESERVED -CVE-2017-14317 + - xen + NOTE: https://xenbits.xen.org/xsa/advisory-232.html +CVE-2017-14317 [cxenstored: Race in domain cleanup] RESERVED -CVE-2017-14316 + - xen + NOTE: https://xenbits.xen.org/xsa/advisory-233.html +CVE-2017-14316 [Missing NUMA node parameter verification] RESERVED + - xen + NOTE: https://xenbits.xen.org/xsa/advisory-231.html CVE-2017-14315 RESERVED CVE-2017-14314 (Off-by-one error in the DrawImage function in magick/render.c in ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55687 - data/CVE
Author: carnil Date: 2017-09-12 11:20:41 + (Tue, 12 Sep 2017) New Revision: 55687 Modified: data/CVE/list Log: Process NFUs Modified: data/CVE/list === --- data/CVE/list 2017-09-12 10:55:11 UTC (rev 55686) +++ data/CVE/list 2017-09-12 11:20:41 UTC (rev 55687) @@ -9,7 +9,7 @@ CVE-2017-14336 RESERVED CVE-2017-14335 (On Beijing Hanbang Hanbanggaoke devices, because user-controlled input ...) - TODO: check + NOT-FOR-US: Beijing Hanbang Hanbanggaoke devices CVE-2017-14334 RESERVED CVE-2017-14333 (The process_version_sections function in readelf.c in GNU Binutils 2.29 ...) @@ -68,7 +68,7 @@ - nagios3 NOTE: https://github.com/NagiosEnterprises/nagioscore/issues/424 CVE-2015-9228 (In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for ...) - TODO: check + NOT-FOR-US: Photocrati NextGEN Gallery plugin for WordPress CVE-2017- [XSA 235] - xen [stretch] - xen 4.8.1-1+deb9u3 @@ -18786,9 +18786,9 @@ CVE-2017-7736 RESERVED CVE-2017-7735 (A Cross-Site Scripting vulnerability in Fortinet FortiOS versions ...) - TODO: check + NOT-FOR-US: Fortinet FortiOS CVE-2017-7734 (A Cross-Site Scripting vulnerability in Fortinet FortiOS versions ...) - TODO: check + NOT-FOR-US: Fortinet FortiOS CVE-2017-7733 RESERVED CVE-2017-7732 @@ -33083,11 +33083,11 @@ CVE-2017-3134 (An escalation of privilege vulnerability in Fortinet FortiWLC-SD ...) NOT-FOR-US: Fortinet FortiWLC-SD CVE-2017-3133 (A Cross-Site Scripting vulnerability in Fortinet FortiOS versions ...) - TODO: check + NOT-FOR-US: Fortinet FortiOS CVE-2017-3132 (A Cross-Site Scripting vulnerability in Fortinet FortiOS versions ...) - TODO: check + NOT-FOR-US: Fortinet FortiOS CVE-2017-3131 (A Cross-Site Scripting vulnerability in Fortinet FortiOS versions ...) - TODO: check + NOT-FOR-US: Fortinet FortiOS CVE-2017-3130 (An information disclosure vulnerability in Fortinet FortiOS 5.6.0, ...) NOT-FOR-US: Fortinet CVE-2017-3129 (A Cross-Site Scripting vulnerability in Fortinet FortiWeb versions ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55686 - data/CVE
Author: carnil Date: 2017-09-12 10:55:11 + (Tue, 12 Sep 2017) New Revision: 55686 Modified: data/CVE/list Log: Record source package for CVE-2017-14312 Modified: data/CVE/list === --- data/CVE/list 2017-09-12 10:53:41 UTC (rev 55685) +++ data/CVE/list 2017-09-12 10:55:11 UTC (rev 55686) @@ -65,7 +65,8 @@ NOTE: http://hg.code.sf.net/p/graphicsmagick/code/rev/2835184bfb78 NOTE: https://sourceforge.net/p/graphicsmagick/bugs/448/ CVE-2017-14312 (Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root ...) - TODO: check + - nagios3 + NOTE: https://github.com/NagiosEnterprises/nagioscore/issues/424 CVE-2015-9228 (In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for ...) TODO: check CVE-2017- [XSA 235] ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55685 - data/CVE
Author: carnil Date: 2017-09-12 10:53:41 + (Tue, 12 Sep 2017) New Revision: 55685 Modified: data/CVE/list Log: Add new graphicsmagick issue Modified: data/CVE/list === --- data/CVE/list 2017-09-12 10:50:24 UTC (rev 55684) +++ data/CVE/list 2017-09-12 10:53:41 UTC (rev 55685) @@ -61,7 +61,9 @@ CVE-2017-14315 RESERVED CVE-2017-14314 (Off-by-one error in the DrawImage function in magick/render.c in ...) - TODO: check + - graphicsmagick + NOTE: http://hg.code.sf.net/p/graphicsmagick/code/rev/2835184bfb78 + NOTE: https://sourceforge.net/p/graphicsmagick/bugs/448/ CVE-2017-14312 (Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root ...) TODO: check CVE-2015-9228 (In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55684 - data/CVE
Author: carnil
Date: 2017-09-12 10:50:24 + (Tue, 12 Sep 2017)
New Revision: 55684
Modified:
data/CVE/list
Log:
libidn and libidn2-0 issues fixed in unstable
Modified: data/CVE/list
===
--- data/CVE/list 2017-09-12 10:48:15 UTC (rev 55683)
+++ data/CVE/list 2017-09-12 10:50:24 UTC (rev 55684)
@@ -765,11 +765,11 @@
NOTE:
https://github.com/flori/json/commit/8f782fd8e181d9cfe9387ded43a5ca9692266b85
CVE-2017-14062 (Integer overflow in the decode_digit function in puny_decode.c
in ...)
{DLA-1085-1 DLA-1084-1}
- - libidn2-0 (bug #873902)
- - libidn (bug #873903)
+ - libidn2-0 2.0.2-4 (bug #873902)
+ - libidn 1.33-2 (bug #873903)
NOTE:
https://gitlab.com/libidn/libidn2/commit/3284eb342cd0ed1a18786e3fcdf0cdd7e76676bd
CVE-2017-14061 (Integer overflow in the _isBidi function in bidi.c in Libidn2
before ...)
- - libidn2-0 (bug #873904)
+ - libidn2-0 2.0.2-4 (bug #873904)
[stretch] - libidn2-0 (Vulnerable code not present)
[jessie] - libidn2-0 (Vulnerable code not present)
[wheezy] - libidn2-0 (Vulnerable code not present)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55683 - data/CVE
Author: carnil
Date: 2017-09-12 10:48:15 + (Tue, 12 Sep 2017)
New Revision: 55683
Modified:
data/CVE/list
Log:
Add two more imagemagick issues, mark all CVE-2017-1432{4,5,6} as unimportant
Modified: data/CVE/list
===
--- data/CVE/list 2017-09-12 09:24:49 UTC (rev 55682)
+++ data/CVE/list 2017-09-12 10:48:15 UTC (rev 55683)
@@ -31,14 +31,17 @@
CVE-2017-14327
RESERVED
CVE-2017-14326 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was
found in ...)
- - imagemagick
+ - imagemagick (unimportant)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/740
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/dfefe8de5068a547ae4097c69456f02f93935164
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/a542c9f9a53327b62150874d4e5a5b3bcbd0
CVE-2017-14325 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was
found in ...)
- TODO: check
+ - imagemagick (unimportant)
+ NOTE: https://github.com/ImageMagick/ImageMagick/issues/741
CVE-2017-14324 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was
found in ...)
- TODO: check
+ - imagemagick (unimportant)
+ NOTE: https://github.com/ImageMagick/ImageMagick/issues/739
+ NOTE:
https://github.com/ImageMagick/ImageMagick/commit/399631650b38eaf21c2f3c306b8b74e66be6a0d2
CVE-2017-14323
RESERVED
CVE-2017-14322
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55682 - data/CVE
Author: carnil Date: 2017-09-12 09:24:49 + (Tue, 12 Sep 2017) New Revision: 55682 Modified: data/CVE/list Log: Add CVE-2017-14326/imagemagick Modified: data/CVE/list === --- data/CVE/list 2017-09-12 09:22:53 UTC (rev 55681) +++ data/CVE/list 2017-09-12 09:24:49 UTC (rev 55682) @@ -31,7 +31,10 @@ CVE-2017-14327 RESERVED CVE-2017-14326 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in ...) - TODO: check + - imagemagick + NOTE: https://github.com/ImageMagick/ImageMagick/issues/740 + NOTE: https://github.com/ImageMagick/ImageMagick/commit/dfefe8de5068a547ae4097c69456f02f93935164 + NOTE: ImageMagick-6: https://github.com/ImageMagick/ImageMagick/commit/a542c9f9a53327b62150874d4e5a5b3bcbd0 CVE-2017-14325 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in ...) TODO: check CVE-2017-14324 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was found in ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55681 - data/CVE
Author: carnil Date: 2017-09-12 09:22:53 + (Tue, 12 Sep 2017) New Revision: 55681 Modified: data/CVE/list Log: Add new binutils issue Modified: data/CVE/list === --- data/CVE/list 2017-09-12 09:10:12 UTC (rev 55680) +++ data/CVE/list 2017-09-12 09:22:53 UTC (rev 55681) @@ -13,7 +13,11 @@ CVE-2017-14334 RESERVED CVE-2017-14333 (The process_version_sections function in readelf.c in GNU Binutils 2.29 ...) - TODO: check + - binutils + [stretch] - binutils (Minor issue) + [jessie] - binutils (Minor issue) + NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=21990 + NOTE: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=452bf675ea772002aa86fb1d28f3474da70ee1de CVE-2017-14332 RESERVED CVE-2017-14331 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55680 - data/CVE
Author: sectracker
Date: 2017-09-12 09:10:12 + (Tue, 12 Sep 2017)
New Revision: 55680
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
===
--- data/CVE/list 2017-09-12 08:15:55 UTC (rev 55679)
+++ data/CVE/list 2017-09-12 09:10:12 UTC (rev 55680)
@@ -1,3 +1,61 @@
+CVE-2017-14340
+ RESERVED
+CVE-2017-14339
+ RESERVED
+CVE-2017-14338
+ RESERVED
+CVE-2017-14337
+ RESERVED
+CVE-2017-14336
+ RESERVED
+CVE-2017-14335 (On Beijing Hanbang Hanbanggaoke devices, because
user-controlled input ...)
+ TODO: check
+CVE-2017-14334
+ RESERVED
+CVE-2017-14333 (The process_version_sections function in readelf.c in GNU
Binutils 2.29 ...)
+ TODO: check
+CVE-2017-14332
+ RESERVED
+CVE-2017-14331
+ RESERVED
+CVE-2017-14330
+ RESERVED
+CVE-2017-14329
+ RESERVED
+CVE-2017-14328
+ RESERVED
+CVE-2017-14327
+ RESERVED
+CVE-2017-14326 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was
found in ...)
+ TODO: check
+CVE-2017-14325 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was
found in ...)
+ TODO: check
+CVE-2017-14324 (In ImageMagick 7.0.7-1 Q16, a memory leak vulnerability was
found in ...)
+ TODO: check
+CVE-2017-14323
+ RESERVED
+CVE-2017-14322
+ RESERVED
+CVE-2017-14321
+ RESERVED
+CVE-2017-14320
+ RESERVED
+CVE-2017-14319
+ RESERVED
+CVE-2017-14318
+ RESERVED
+CVE-2017-14317
+ RESERVED
+CVE-2017-14316
+ RESERVED
+CVE-2017-14315
+ RESERVED
+CVE-2017-14314 (Off-by-one error in the DrawImage function in magick/render.c
in ...)
+ TODO: check
+CVE-2017-14312 (Nagios Core through 4.3.4 initially executes /usr/sbin/nagios
as root ...)
+ TODO: check
+CVE-2015-9228 (In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10
for ...)
+ TODO: check
CVE-2017- [XSA 235]
- xen
[stretch] - xen 4.8.1-1+deb9u3
@@ -98,7 +156,7 @@
NOTE: http://www.openwall.com/lists/oss-security/2017/09/11/1
NOTE: https://debbugs.gnu.org/cgi/bugreport.cgi?bug=28350
NOTE:
https://git.savannah.gnu.org/cgit/emacs.git/commit/?h=emacs-25=9ad0fcc54442a9a01d41be19880250783426db70
-CVE-2017-14313 [XSS due to add_query_arg]
+CVE-2017-14313 (The shibboleth_login_form function in shibboleth.php in the
Shibboleth ...)
- wordpress-shibboleth 1.8-1 (bug #874416)
NOTE:
https://github.com/michaelryanmcneill/shibboleth/commit/1d65ad6786282d23ba1865f56e2fd19188e7c26a
NOTE:
https://make.wordpress.org/plugins/2015/04/20/fixing-add_query_arg-and-remove_query_arg-usage/
@@ -108,8 +166,8 @@
NOT-FOR-US: EE 4GEE WiFi MBB
CVE-2017-14267 (EE 4GEE WiFi MBB (before EE60_00_05.00_31) devices have CSRF,
related ...)
NOT-FOR-US: EE 4GEE WiFi MBB
-CVE-2017-14266
- RESERVED
+CVE-2017-14266 (tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow
...)
+ TODO: check
CVE-2017-14265 (A Stack-based Buffer Overflow was discovered in
xtrans_interpolate in ...)
- libraw
NOTE: https://github.com/LibRaw/LibRaw/issues/99
@@ -4191,6 +4249,7 @@
- simplesamlphp 1.14.15-1
NOTE: https://simplesamlphp.org/security/201708-01
CVE-2017-12855 (Xen maintains the _GTF_{read,writ}ing bits as appropriate, to
inform ...)
+ {DSA-3969-1}
- xen
NOTE: https://xenbits.xen.org/xsa/advisory-230.html
CVE-2017-12853 (The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is
...)
@@ -5970,6 +6029,7 @@
CVE-2017-12138 (XOOPS Core 2.5.8 has a stored URL redirect bypass
vulnerability in ...)
NOT-FOR-US: XOOPS
CVE-2017-12137 (arch/x86/mm.c in Xen allows local PV guest OS users to gain
host OS ...)
+ {DSA-3969-1}
- xen
NOTE: https://xenbits.xen.org/xsa/advisory-227.html
CVE-2017-12136 (Race condition in the grant table code in Xen 4.6.x through
4.9.x ...)
@@ -5979,6 +6039,7 @@
[wheezy] - xen (Only affects 4.6 and later)
NOTE: https://xenbits.xen.org/xsa/advisory-228.html
CVE-2017-12135 (Xen allows local OS guest users to cause a denial of service
(crash) ...)
+ {DSA-3969-1}
- xen
NOTE: https://xenbits.xen.org/xsa/advisory-226.html
CVE-2017-12134 (The xen_biovec_phys_mergeable function in
drivers/xen/biomerge.c in ...)
@@ -12395,12 +12456,15 @@
[wheezy] - xen (Vulnerable code not present)
NOTE: https://xenbits.xen.org/xsa/advisory-225.html
CVE-2017-10922 (The grant-table feature in Xen through 4.8.x mishandles MMIO
region ...)
+ {DSA-3969-1}
- xen
NOTE: https://xenbits.xen.org/xsa/advisory-224.html
CVE-2017-10921 (The grant-table feature in Xen through 4.8.x does not ensure
sufficient ...)
+ {DSA-3969-1}
- xen
NOTE: https://xenbits.xen.org/xsa/advisory-224.html
CVE-2017-10920 (The grant-table feature in Xen
[Secure-testing-commits] r55679 - data/CVE
Author: carnil Date: 2017-09-12 08:15:55 + (Tue, 12 Sep 2017) New Revision: 55679 Modified: data/CVE/list Log: Clarify note for CVE-2017-14103 Modified: data/CVE/list === --- data/CVE/list 2017-09-12 06:37:35 UTC (rev 55678) +++ data/CVE/list 2017-09-12 08:15:55 UTC (rev 55679) @@ -591,8 +591,8 @@ NOTE: Fixed by: https://git.kernel.org/linus/499350a5a6e7512d9ed369ed63a4244b6536f4f8 (v4.12-rc3) CVE-2017-14103 (The ReadJNGImage and ReadOneJNGImage functions in coders/png.c in ...) - graphicsmagick 1.3.26-8 - [stretch] - graphicsmagick (Incomplete fix not applied) - [jessie] - graphicsmagick (Incomplete fix not applied) + [stretch] - graphicsmagick (Incomplete fix for CVE-2017-11403 not applied) + [jessie] - graphicsmagick (Incomplete fix for CVE-2017-11403 not applied) NOTE: Fixed by: http://hg.code.sf.net/p/graphicsmagick/code/rev/98721124e51f NOTE: http://www.openwall.com/lists/oss-security/2017/09/01/6 NOTE: https://blogs.gentoo.org/ago/2017/07/12/graphicsmagick-use-after-free-in-closeblob-blob-c/ ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55678 - data/CVE
Author: lamby Date: 2017-09-12 06:37:35 + (Tue, 12 Sep 2017) New Revision: 55678 Modified: data/CVE/list Log: Triage typo3-src for wheezy. Modified: data/CVE/list === --- data/CVE/list 2017-09-12 06:25:21 UTC (rev 55677) +++ data/CVE/list 2017-09-12 06:37:35 UTC (rev 55678) @@ -141,6 +141,7 @@ NOT-FOR-US: EyesOfNetwork (EON) CVE-2017-14251 (Unrestricted File Upload vulnerability in the fileDenyPattern in ...) - typo3-src + [wheezy] - typo3-src (Not supported in Wheezy LTS) CVE-2017-14250 RESERVED CVE-2017-14249 (ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImage in ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r55677 - data/CVE
Author: carnil Date: 2017-09-12 06:25:21 + (Tue, 12 Sep 2017) New Revision: 55677 Modified: data/CVE/list Log: Add CVE-2017-12164 Modified: data/CVE/list === --- data/CVE/list 2017-09-12 04:54:12 UTC (rev 55676) +++ data/CVE/list 2017-09-12 06:25:21 UTC (rev 55677) @@ -5898,8 +5898,10 @@ RESERVED CVE-2017-12165 RESERVED -CVE-2017-12164 +CVE-2017-12164 [lock screen can be circumvented when autologin is set] RESERVED + - gdm3 + NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1490417 CVE-2017-12163 RESERVED CVE-2017-12162 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
