[Secure-testing-commits] r57986 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-24 07:08:06 + (Fri, 24 Nov 2017)
New Revision: 57986

Modified:
   data/CVE/list
Log:
Add CVE-2017-16932/libxml2

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-24 06:48:21 UTC (rev 57985)
+++ data/CVE/list   2017-11-24 07:08:06 UTC (rev 57986)
@@ -1,3 +1,7 @@
+CVE-2017-16932
+   - libxml2 
+   NOTE: https://bugzilla.gnome.org/show_bug.cgi?id=759579
+   NOTE: 
https://github.com/GNOME/libxml2/commit/899a5d9f0ed13b8e32449a08a361e0de127dd961
 CVE-2017-16931
- libxml2 2.9.4+dfsg1-3.1
 [stretch] - libxml2 2.9.4+dfsg1-2.2+deb9u1


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57985 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-24 06:48:21 + (Fri, 24 Nov 2017)
New Revision: 57985

Modified:
   data/CVE/list
Log:
Add CVE-2017-16931

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-24 06:34:09 UTC (rev 57984)
+++ data/CVE/list   2017-11-24 06:48:21 UTC (rev 57985)
@@ -1,3 +1,10 @@
+CVE-2017-16931
+   - libxml2 2.9.4+dfsg1-3.1
+[stretch] - libxml2 2.9.4+dfsg1-2.2+deb9u1
+[jessie] - libxml2 2.9.1+dfsg1-5+deb8u5
+   NOTE: https://bugzilla.gnome.org/show_bug.cgi?id=766956
+   NOTE: 
https://github.com/GNOME/libxml2/commit/e26630548e7d138d2c560844c43820b6767251e3
+   NOTE: Not a duplicate but a variant of the issue of CVE-2017-9049 and 
CVE-2017-9050
 CVE-2017-16930
RESERVED
 CVE-2017-16929


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57984 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-24 06:34:09 + (Fri, 24 Nov 2017)
New Revision: 57984

Modified:
   data/CVE/list
Log:
Add upstream issues for exiv2

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-24 05:19:29 UTC (rev 57983)
+++ data/CVE/list   2017-11-24 06:34:09 UTC (rev 57984)
@@ -178,12 +178,15 @@
 CVE-2017-1000128 (Exiv2 0.26 contains a stack out of bounds read in JPEG2000 
parser ...)
- exiv2 
NOTE: http://www.openwall.com/lists/oss-security/2017/06/30/1
+   NOTE: https://github.com/Exiv2/exiv2/issues/177
 CVE-2017-1000127 (Exiv2 0.26 contains a heap buffer overflow in tiff parser 
...)
- exiv2 
NOTE: http://www.openwall.com/lists/oss-security/2017/06/30/1
+   NOTE: https://github.com/Exiv2/exiv2/issues/176
 CVE-2017-1000126 (exiv2 0.26 contains a Stack out of bounds read in webp 
parser ...)
- exiv2 
NOTE: http://www.openwall.com/lists/oss-security/2017/06/30/1
+   NOTE: https://github.com/Exiv2/exiv2/issues/175
NOTE: Can't seem to reproduce this in wheezy.
 CVE-2017-16879 (Stack-based buffer overflow in the _nc_write_entry function in 
...)
TODO: check


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57983 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-24 05:19:29 + (Fri, 24 Nov 2017)
New Revision: 57983

Modified:
   data/CVE/list
Log:
Mark CVE-2017-5130/libxml2 as no-dsa, reasoning in NOTE

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 22:05:10 UTC (rev 57982)
+++ data/CVE/list   2017-11-24 05:19:29 UTC (rev 57983)
@@ -36113,10 +36113,14 @@
 CVE-2017-5130
RESERVED
- libxml2 2.9.4+dfsg1-5.1 (bug #88)
+   [stretch] - libxml2  (Minor issue)
+   [jessie] - libxml2  (Minor issue)
- chromium-browser 62.0.3202.75-1 (unimportant)
NOTE: chromium-browser uses system libxml2.
NOTE: https://bugs.chromium.org/p/chromium/issues/detail?id=722079 (not 
public)
NOTE: https://bugzilla.gnome.org/show_bug.cgi?id=783026 (not public)
+   NOTE: xmlMemoryStrdup is only for debugging with excpetion in xmlint 
when invoked
+   NOTE: with --maxmem. Similar issue for xmlMallocLoc and xmlReallocLoc.
NOTE: Fixed by: 
https://git.gnome.org/browse/libxml2/commit/?id=897dffbae322b46b83f99a607d527058a72c51ed
NOTE: Needs follow up: 
https://git.gnome.org/browse/libxml2/commit/?id=ed48d65b4d6c5cec7be035ad5eebeba873b4b955
 CVE-2017-5129


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57982 - in data: . CVE DSA

2017-11-23 Thread Moritz Muehlenhoff 
Author: jmm
Date: 2017-11-23 22:05:10 + (Thu, 23 Nov 2017)
New Revision: 57982

Modified:
   data/CVE/list
   data/DSA/list
   data/dsa-needed.txt
Log:
otrs, openjdk-7 DSA


Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 21:47:29 UTC (rev 57981)
+++ data/CVE/list   2017-11-23 22:05:10 UTC (rev 57982)
@@ -3353,6 +3353,7 @@
- frr  (bug #863249)
 CVE-2017-15864 (In the Agent Frontend in Open Ticket Request System (OTRS) 
3.3.x ...)
- otrs2 4.0.7-2
+   [jessie] - otrs2 3.3.18-1+deb8u2
NOTE: 
https://www.otrs.com/security-advisory-2017-06-security-update-otrs-3-3/
NOTE: 
https://github.com/OTRS/otrs/compare/3bc58ebeb9bdbe8107251a03cf7b9b8cfc515f53...80a0a9a138278d63a2621d146eb3c29e982aa2d5
NOTE: Root cause for the issue is the recursive parsing handling in the 
old

Modified: data/DSA/list
===
--- data/DSA/list   2017-11-23 21:47:29 UTC (rev 57981)
+++ data/DSA/list   2017-11-23 22:05:10 UTC (rev 57982)
@@ -1,3 +1,10 @@
+[23 Nov 2017] DSA-4048-1 openjdk-7 - security update
+   {CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 
CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 
CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388}
+   [jessie] - openjdk-7 7u151-2.6.11-2~deb8u1
+[23 Nov 2017] DSA-4047-1 otrs2 - security update
+   {CVE-2017-16664}
+   [jessie] - otrs2 3.3.18-1+deb8u2
+   [stretch] - otrs2 5.0.16-1+deb9u3
 [22 Nov 2017] DSA-4046-1 libspring-ldap-java - security update
{CVE-2017-8028}
[jessie] - libspring-ldap-java 1.3.1.RELEASE-5+deb8u1

Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-23 21:47:29 UTC (rev 57981)
+++ data/dsa-needed.txt 2017-11-23 22:05:10 UTC (rev 57982)
@@ -29,10 +29,6 @@
   due to new dependency being introduced
   Important: original fix would introduce a regression (needs fix upstream)
 --
-openjdk-7/oldstable (jmm)
---
-otrs2 (jmm)
---
 php-horde-image
 --
 php5


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57981 - data

2017-11-23 Thread Santiago Ruano Rincón 
Author: santiago
Date: 2017-11-23 21:47:29 + (Thu, 23 Nov 2017)
New Revision: 57981

Modified:
   data/dsa-needed.txt
Log:
dsa-needed.txt: santiago takes a look at poppler

Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-23 21:20:03 UTC (rev 57980)
+++ data/dsa-needed.txt 2017-11-23 21:47:29 UTC (rev 57981)
@@ -42,6 +42,7 @@
 phpmyadmin/oldstable
 --
 poppler
+  2017-11-23: santiago will prepare a debdiff
 --
 qemu/oldstable
 --


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57980 - in data: . DLA

2017-11-23 Thread Thorsten Alteholz 
Author: alteholz
Date: 2017-11-23 21:20:03 + (Thu, 23 Nov 2017)
New Revision: 57980

Modified:
   data/DLA/list
   data/dla-needed.txt
Log:
Reserve DLA-1188-1 for libxml2

Modified: data/DLA/list
===
--- data/DLA/list   2017-11-23 21:10:12 UTC (rev 57979)
+++ data/DLA/list   2017-11-23 21:20:03 UTC (rev 57980)
@@ -1,3 +1,6 @@
+[23 Nov 2017] DLA-1188-1 libxml2 - security update
+   {CVE-2017-5130}
+   [wheezy] - libxml2 2.8.0+dfsg1-7+wheezy10
 [23 Nov 2017] DLA-1187-1 openjdk-7 - security update
{CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 
CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 
CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388}
[wheezy] - openjdk-7 7u151-2.6.11-2~deb7u2

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 21:10:12 UTC (rev 57979)
+++ data/dla-needed.txt 2017-11-23 21:20:03 UTC (rev 57980)
@@ -55,9 +55,6 @@
   NOTE: theora and sox. Awaiting feedback. Underlying reason for CVE-2017-14160
   NOTE: unclear.
 --
-libxml2 (Thorsten Alteholz)
-  NOTE: bugfix needs confirmation by upstream
---
 linux
 --
 ming (Hugo Lefeuvre)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57979 - data/CVE

2017-11-23 Thread security tracker role 
Author: sectracker
Date: 2017-11-23 21:10:12 + (Thu, 23 Nov 2017)
New Revision: 57979

Modified:
   data/CVE/list
Log:
automatic update

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 21:03:31 UTC (rev 57978)
+++ data/CVE/list   2017-11-23 21:10:12 UTC (rev 57979)
@@ -1,3 +1,7 @@
+CVE-2017-16930
+   RESERVED
+CVE-2017-16929
+   RESERVED
 CVE-2017-16928
RESERVED
 CVE-2017-16927 (The scp_v0s_accept function in sesman/libscp/libscp_v0.c in 
the session ...)
@@ -5321,8 +5325,7 @@
RESERVED
 CVE-2017-15089
RESERVED
-CVE-2017-15088
-   RESERVED
+CVE-2017-15088 (plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 
5 (aka ...)
- krb5 1.15.2-2 (unimportant; bug #871698)
NOTE: https://github.com/krb5/krb5/pull/707
NOTE: Fixed by: 
https://github.com/krb5/krb5/commit/fbb687db1088ddd894d975996e5f6a4252b9a2b4
@@ -19582,7 +19585,7 @@
 CVE-2017-10389 (Vulnerability in the Oracle Hospitality Suite8 component of 
Oracle ...)
NOT-FOR-US: Oracle
 CVE-2017-10388 (Vulnerability in the Java SE, Java SE Embedded component of 
Oracle ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19667,7 +19670,7 @@
 CVE-2017-10358 (Vulnerability in the Oracle Hyperion Financial Reporting 
component of ...)
NOT-FOR-US: Oracle
 CVE-2017-10357 (Vulnerability in the Java SE, Java SE Embedded component of 
Oracle ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19675,7 +19678,7 @@
- openjdk-6 
[wheezy] - openjdk-6 
 CVE-2017-10356 (Vulnerability in the Java SE, Java SE Embedded, JRockit 
component of ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19683,7 +19686,7 @@
- openjdk-6 
[wheezy] - openjdk-6 
 CVE-2017-10355 (Vulnerability in the Java SE, Java SE Embedded, JRockit 
component of ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19699,13 +19702,13 @@
 CVE-2017-10351 (Vulnerability in the PeopleSoft Enterprise PT PeopleTools 
component of ...)
NOT-FOR-US: Oracle
 CVE-2017-10350 (Vulnerability in the Java SE, Java SE Embedded component of 
Oracle ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
- openjdk-7 
 CVE-2017-10349 (Vulnerability in the Java SE, Java SE Embedded component of 
Oracle ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19713,7 +19716,7 @@
- openjdk-6 
[wheezy] - openjdk-6 
 CVE-2017-10348 (Vulnerability in the Java SE, Java SE Embedded component of 
Oracle ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19721,7 +19724,7 @@
- openjdk-6 
[wheezy] - openjdk-6 
 CVE-2017-10347 (Vulnerability in the Java SE, JRockit component of Oracle Java 
SE ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19729,7 +19732,7 @@
- openjdk-6 
[wheezy] - openjdk-6 
 CVE-2017-10346 (Vulnerability in the Java SE, Java SE Embedded component of 
Oracle ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19737,7 +19740,7 @@
- openjdk-6 
[wheezy] - openjdk-6 
 CVE-2017-10345 (Vulnerability in the Java SE, Java SE Embedded, JRockit 
component of ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19854,7 +19857,7 @@
- mysql-5.5  (Only affects MySQL 5.7)
NOTE: 
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html#AppendixMSQL
 CVE-2017-10295 (Vulnerability in the Java SE, Java SE Embedded, JRockit 
component of ...)
-   {DSA-4015-1}
+   {DSA-4015-1 DLA-1187-1}
- openjdk-9 9.0.1+11-1
- openjdk-8 8u151-b12-1
[experimental] - openjdk-7 7u151-2.6.11-2
@@ -19886,7 +19889,7 @@
- mysql-5.5  (Only affects MySQL 5.6 and 5.7)
NOTE: 
http://www.oracle.com/technetwork/securi

[Secure-testing-commits] r57978 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 21:03:31 + (Thu, 23 Nov 2017)
New Revision: 57978

Modified:
   data/CVE/list
Log:
CVE-2017-16804/redmine fixed in unstable

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 21:01:04 UTC (rev 57977)
+++ data/CVE/list   2017-11-23 21:03:31 UTC (rev 57978)
@@ -736,7 +736,7 @@
 CVE-2017-16802 (In the sharingGroupPopulateOrganisations function in ...)
NOT-FOR-US: MISP
 CVE-2017-16804 (In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders 
function ...)
-   - redmine 
+   - redmine 3.4.2-1
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/issues/25713 (private)
NOTE: upstream fixed in 3.2.7, 3.3.4 and 3.4.0


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57977 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 21:01:04 + (Thu, 23 Nov 2017)
New Revision: 57977

Modified:
   data/CVE/list
Log:
CVE-2017-15577/redmine fixed in unstable

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 21:00:09 UTC (rev 57976)
+++ data/CVE/list   2017-11-23 21:01:04 UTC (rev 57977)
@@ -4158,7 +4158,7 @@
NOTE: https://www.redmine.org/issues/23803 (private)
NOTE: upstream fixed in 3.2.6 and 3.3.3
 CVE-2017-15577 (Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the 
rendering of ...)
-   - redmine 
+   - redmine 3.4.2-1
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/23793 (private)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57976 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 21:00:09 + (Thu, 23 Nov 2017)
New Revision: 57976

Modified:
   data/CVE/list
Log:
CVE-2017-15576/redmine fixed in unstable

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 20:59:12 UTC (rev 57975)
+++ data/CVE/list   2017-11-23 21:00:09 UTC (rev 57976)
@@ -4152,7 +4152,7 @@
NOTE: https://www.redmine.org/issues/24199 (private)
NOTE: upstream fixed in 3.2.6 and 3.3.3
 CVE-2017-15576 (Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time 
Entry ...)
-   - redmine 
+   - redmine 3.4.2-1
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/23803 (private)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57975 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 20:59:12 + (Thu, 23 Nov 2017)
New Revision: 57975

Modified:
   data/CVE/list
Log:
CVE-2017-15575/redmine fixed in unstable

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 20:58:12 UTC (rev 57974)
+++ data/CVE/list   2017-11-23 20:59:12 UTC (rev 57975)
@@ -4140,7 +4140,7 @@
NOTE: https://www.redmine.org/issues/24416 (private)
NOTE: upstream fixed in 3.2.6 and 3.3.3
 CVE-2017-15575 (In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm 
lacks a ...)
-   - redmine 
+   - redmine 3.4.2-1
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/24307 (private)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57974 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 20:58:12 + (Thu, 23 Nov 2017)
New Revision: 57974

Modified:
   data/CVE/list
Log:
CVE-2017-15574/redmine fixed in unstable

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 20:57:21 UTC (rev 57973)
+++ data/CVE/list   2017-11-23 20:58:12 UTC (rev 57974)
@@ -4146,7 +4146,7 @@
NOTE: https://www.redmine.org/issues/24307 (private)
NOTE: upstream fixed in 3.2.6 and 3.3.3
 CVE-2017-15574 (In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is 
possible ...)
-   - redmine 
+   - redmine 3.4.2-1
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/24199 (private)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57973 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 20:57:21 + (Thu, 23 Nov 2017)
New Revision: 57973

Modified:
   data/CVE/list
Log:
CVE-2017-15573/redmine fixed in unstable

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 20:56:09 UTC (rev 57972)
+++ data/CVE/list   2017-11-23 20:57:21 UTC (rev 57973)
@@ -4128,7 +4128,7 @@
NOTE: https://www.redmine.org/issues/27186 (private)
NOTE: 
https://github.com/redmine/redmine/commit/273dd9cb3bcfb1e0a0b90570b3b34eafa07d67aa
 CVE-2017-15573 (In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists 
because ...)
-   - redmine 
+   - redmine 3.4.2-1
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/25503 (private)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57972 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 20:56:09 + (Thu, 23 Nov 2017)
New Revision: 57972

Modified:
   data/CVE/list
Log:
CVE-2017-15572/redmine fixed in 3.3.3 upstream, included in the 3.4.2-1 upload

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 20:54:56 UTC (rev 57971)
+++ data/CVE/list   2017-11-23 20:56:09 UTC (rev 57972)
@@ -4134,7 +4134,7 @@
NOTE: https://www.redmine.org/issues/25503 (private)
NOTE: upstream fixed in 3.2.6 and 3.3.3
 CVE-2017-15572 (In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote 
attackers can ...)
-   - redmine 
+   - redmine 3.4.2-1
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/24416 (private)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57971 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 20:54:56 + (Thu, 23 Nov 2017)
New Revision: 57971

Modified:
   data/CVE/list
Log:
Add bug references for redmine issues

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 20:31:48 UTC (rev 57970)
+++ data/CVE/list   2017-11-23 20:54:56 UTC (rev 57971)
@@ -4103,26 +4103,26 @@
 CVE-2017-15514
RESERVED
 CVE-2017-15568 (In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 
3.4.3, ...)
-   - redmine 
+   - redmine  (bug #882544)
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/27186 (private)
NOTE: upstream fixed in 3.2.8, 3.3.5 and 3.4.3
NOTE: 
https://github.com/redmine/redmine/commit/94f7cfbf990028348b9262578acbc53a94fce448
 CVE-2017-15569 (In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 
3.4.3, ...)
-   - redmine 
+   - redmine  (bug #882545)
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/27186 (private)
NOTE: 
https://github.com/redmine/redmine/commit/56c8ee0440d8555aa7822d947ba9091c8a791508
 CVE-2017-15570 (In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 
3.4.3, ...)
-   - redmine 
+   - redmine  (bug #882547)
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/27186 (private)
NOTE: 
https://github.com/redmine/redmine/commit/1a0976417975a128b0a932ba1552c37e9414953b
 CVE-2017-15571 (In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 
3.4.3, ...)
-   - redmine 
+   - redmine  (bug #882548)
[wheezy] - redmine  (Not supported wheezy LTS)
NOTE: https://www.redmine.org/projects/redmine/wiki/Security_Advisories
NOTE: https://www.redmine.org/issues/27186 (private)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57970 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 20:31:48 + (Thu, 23 Nov 2017)
New Revision: 57970

Modified:
   data/CVE/list
Log:
Add bug reference forCVE-2017-16896/tt-rss, #882543

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 20:14:11 UTC (rev 57969)
+++ data/CVE/list   2017-11-23 20:31:48 UTC (rev 57970)
@@ -76,7 +76,7 @@
 CVE-2017-16897
RESERVED
 CVE-2017-16896 (A SQL injection in classes/handler/public.php in the 
forgotpass ...)
-   - tt-rss 
+   - tt-rss  (bug #882543)
NOTE: 
https://discourse.tt-rss.org/t/sql-injection-in-forgotpass-fixed/669
NOTE: 
https://git.tt-rss.org/git/tt-rss/commit/2352c320c2ed34ec7df1ad22f0c55a1b26489815
 CVE-2017-16895


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57969 - data

2017-11-23 Thread Roberto C. Sanchez 
Author: roberto
Date: 2017-11-23 20:14:11 + (Thu, 23 Nov 2017)
New Revision: 57969

Modified:
   data/dla-needed.txt
Log:
Update notes on roundcube

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 19:53:24 UTC (rev 57968)
+++ data/dla-needed.txt 2017-11-23 20:14:11 UTC (rev 57969)
@@ -90,6 +90,7 @@
 --
 roundcube (Roberto C. Sánchez)
   NOTE: 2017118: Patch is ready; because of code differences, waiting on 
upstream to review or provide information on how to reproduce the exploit
+  NOTE: 20171123: Upstream has reviewed the patch and recommended some 
adjustments
 --
 rsync (Thorsten Alteholz)
 --


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57968 - data

2017-11-23 Thread Antoine Beaupré 
Author: anarcat
Date: 2017-11-23 19:53:24 + (Thu, 23 Nov 2017)
New Revision: 57968

Modified:
   data/dla-needed.txt
Log:
propose resolution for exiv2

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 19:51:53 UTC (rev 57967)
+++ data/dla-needed.txt 2017-11-23 19:53:24 UTC (rev 57968)
@@ -17,7 +17,9 @@
 couchdb
   NOTE: Only in wheezy, we are on our own.
 --
-exiv2 (anarcat)
+exiv2
+  NOTE: can't reproduce using valgrind, can't build with ASAN, no-dsa
+  NOTE: or not-affected? https://lists.debian.org/87shd4u61v@curie.anarc.at
 --
 irssi (Rhonda D'Vine)
 --


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57967 - data/DLA

2017-11-23 Thread Emilio Pozuelo Monfort 
Author: pochu
Date: 2017-11-23 19:51:53 + (Thu, 23 Nov 2017)
New Revision: 57967

Modified:
   data/DLA/list
Log:
remove two CVEs not fixed in the openjdk-7 update

These are issues in zlib and lcms, and we use the external copies,
so they are not fixed in this update.


Modified: data/DLA/list
===
--- data/DLA/list   2017-11-23 18:32:01 UTC (rev 57966)
+++ data/DLA/list   2017-11-23 19:51:53 UTC (rev 57967)
@@ -1,5 +1,5 @@
 [23 Nov 2017] DLA-1187-1 openjdk-7 - security update
-   {CVE-2016-9841 CVE-2016-10165 CVE-2017-10274 CVE-2017-10281 
CVE-2017-10285 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 
CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 
CVE-2017-10357 CVE-2017-10388}
+   {CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295 
CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349 
CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388}
[wheezy] - openjdk-7 7u151-2.6.11-2~deb7u2
 [23 Nov 2017] DLA-1186-1 xorg-server - security update
{CVE-2017-2624 CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 
CVE-2017-12180 CVE-2017-12182 CVE-2017-12183 CVE-2017-12184 CVE-2017-12185 
CVE-2017-12187 CVE-2017-13723}


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57966 - data

2017-11-23 Thread Antoine Beaupré 
Author: anarcat
Date: 2017-11-23 18:32:01 + (Thu, 23 Nov 2017)
New Revision: 57966

Modified:
   data/dla-needed.txt
Log:
claim exiv2

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 17:10:54 UTC (rev 57965)
+++ data/dla-needed.txt 2017-11-23 18:32:01 UTC (rev 57966)
@@ -17,7 +17,7 @@
 couchdb
   NOTE: Only in wheezy, we are on our own.
 --
-exiv2
+exiv2 (anarcat)
 --
 irssi (Rhonda D'Vine)
 --


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57965 - in data: . DLA

2017-11-23 Thread Emilio Pozuelo Monfort 
Author: pochu
Date: 2017-11-23 17:10:54 + (Thu, 23 Nov 2017)
New Revision: 57965

Modified:
   data/DLA/list
   data/dla-needed.txt
Log:
Reserve DLA-1187-1 for openjdk-7

Modified: data/DLA/list
===
--- data/DLA/list   2017-11-23 15:52:01 UTC (rev 57964)
+++ data/DLA/list   2017-11-23 17:10:54 UTC (rev 57965)
@@ -1,3 +1,6 @@
+[23 Nov 2017] DLA-1187-1 openjdk-7 - security update
+   {CVE-2016-9841 CVE-2016-10165 CVE-2017-10274 CVE-2017-10281 
CVE-2017-10285 CVE-2017-10295 CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 
CVE-2017-10348 CVE-2017-10349 CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 
CVE-2017-10357 CVE-2017-10388}
+   [wheezy] - openjdk-7 7u151-2.6.11-2~deb7u2
 [23 Nov 2017] DLA-1186-1 xorg-server - security update
{CVE-2017-2624 CVE-2017-12176 CVE-2017-12177 CVE-2017-12178 
CVE-2017-12180 CVE-2017-12182 CVE-2017-12183 CVE-2017-12184 CVE-2017-12185 
CVE-2017-12187 CVE-2017-13723}
[wheezy] - xorg-server 2:1.12.4-6+deb7u8

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 15:52:01 UTC (rev 57964)
+++ data/dla-needed.txt 2017-11-23 17:10:54 UTC (rev 57965)
@@ -76,8 +76,6 @@
 openexr (Guido Günther)
   NOTE: 20170902: CVE-2017-12596: bug reported upstream but no response yet 
(lamby)
 --
-openjdk-7 (Emilio Pozuelo)
---
 otrs2
 --
 python-werkzeug (Thorsten Alteholz)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57964 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 15:52:01 + (Thu, 23 Nov 2017)
New Revision: 57964

Modified:
   data/CVE/list
Log:
Update CVE-2017-9299 status

The state is not fully correct. But the original report ist too vague
and unclear to be tracked down, and after upstream's look at it ist
still not clear where it has been fixed. It's not reproducible but
unclear if really fixed.

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 15:21:50 UTC (rev 57963)
+++ data/CVE/list   2017-11-23 15:52:01 UTC (rev 57964)
@@ -22421,10 +22421,13 @@
[wheezy] - vlc  (Not supported in wheezy LTS)
NOTE: 
https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commit;h=55a82442cfea9dab8b853f3a4610f2880c5fadf3
 CVE-2017-9299 (Open Ticket Request System (OTRS) 3.3.9 has XSS in ...)
-   - otrs2 
+   - otrs2  (unimportant)
NOTE: The issue is most likely fixed in the 3.x series already before 
3.3.17.
NOTE: The exact issue, fixing commits and upstream version was not yet 
tracked
NOTE: down.
+   NOTE: Furthermore the original report is quite vague/unclear and 
upstream can
+   NOTE: not track the issue down to a specific fixed release claims 
though that
+   NOTE: it should not be reproducible with versions later than 3.3.17.
 CVE-2017-9298 (Cross-site scripting vulnerability in Hitachi Device Manager 
before ...)
NOT-FOR-US: Hitacho Device Manager
 CVE-2017-9297 (Open Redirect vulnerability in Hitachi Device Manager before 
8.5.2-01 ...)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57963 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 15:21:50 + (Thu, 23 Nov 2017)
New Revision: 57963

Modified:
   data/CVE/list
Log:
Add bug reference for CVE-2017-12087

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 15:10:30 UTC (rev 57962)
+++ data/CVE/list   2017-11-23 15:21:50 UTC (rev 57963)
@@ -14238,7 +14238,7 @@
RESERVED
 CVE-2017-12087
RESERVED
-   - shairport-sync  (unimportant)
+   - shairport-sync  (unimportant; bug #882508)
NOTE: Debian build uses Avahi instead
NOTE: 
https://bugs.launchpad.net/ubuntu/+source/shairport-sync/+bug/1729668
 CVE-2017-12086


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57962 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 15:10:30 + (Thu, 23 Nov 2017)
New Revision: 57962

Modified:
   data/CVE/list
Log:
Checked CVE-2017-16818/ceph, not affected in Debian

Basic support for IAM policies (and thus the respective code) was only
added with the 12.1.0 release of ceph. All versions in Debian thus not
affected by the issue.

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 14:22:15 UTC (rev 57961)
+++ data/CVE/list   2017-11-23 15:10:30 UTC (rev 57962)
@@ -683,9 +683,9 @@
NOT-FOR-US: b3log Symphony
 CVE-2017-16819 (A stored cross-site scripting vulnerability in the Icon Time 
Systems ...)
NOT-FOR-US: Icon Time Systems RTC-1000
-CVE-2017-16818
+CVE-2017-16818 [Failed assertion through user input in ceph_assert() function 
in rgw_iam_policy.cc]
RESERVED
-   - ceph 
+   - ceph  (Vulnerable code introduced after 12.1.0)
NOTE: 
https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a
 CVE-2017-16817
RESERVED


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57961 - data

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 14:22:15 + (Thu, 23 Nov 2017)
New Revision: 57961

Modified:
   data/next-oldstable-point-update.txt
Log:
Track proposed update for sam2p in jessie

Modified: data/next-oldstable-point-update.txt
===
--- data/next-oldstable-point-update.txt2017-11-23 14:19:14 UTC (rev 
57960)
+++ data/next-oldstable-point-update.txt2017-11-23 14:22:15 UTC (rev 
57961)
@@ -108,3 +108,17 @@
[jessie] - libofx 1:0.9.10-1+deb8u1
 CVE-2017-14731
[jessie] - libofx 1:0.9.10-1+deb8u1
+CVE-2017-14628
+   [jessie] - sam2p 0.49.2-3+deb8u1
+CVE-2017-14629
+   [jessie] - sam2p 0.49.2-3+deb8u1
+CVE-2017-14630
+   [jessie] - sam2p 0.49.2-3+deb8u1
+CVE-2017-14631
+   [jessie] - sam2p 0.49.2-3+deb8u1
+CVE-2017-14636
+   [jessie] - sam2p 0.49.2-3+deb8u1
+CVE-2017-14637
+   [jessie] - sam2p 0.49.2-3+deb8u1
+CVE-2017-16663
+   [jessie] - sam2p 0.49.2-3+deb8u1


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57959 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 14:19:04 + (Thu, 23 Nov 2017)
New Revision: 57959

Modified:
   data/CVE/list
Log:
Process several Huawei specific CVE assignments as NFU

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 14:15:16 UTC (rev 57958)
+++ data/CVE/list   2017-11-23 14:19:04 UTC (rev 57959)
@@ -25516,205 +25516,205 @@
 CVE-2017-8217 (TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 
Build ...)
NOT-FOR-US: TP-Link
 CVE-2017-8216 (Warsaw Huawei Smart phones with software of versions earlier 
than ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8215 (Honor 8,Honor V8,Honor 9,Honor V9,Nova 2,Nova 2 Plus,P9,P10 ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8214 (Honor 8,Honor V8,Honor 9,Honor V9,Nova 2,Nova 2 Plus,P9,P10 ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8213 (Huawei SMC2.0 with software of V100R003C10, V100R005C00SPC100, 
...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8212 (The driver of honor 5C,honor 6x Huawei smart phones with 
software of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8211 (The driver of honor 5C,honor 6x Huawei smart phones with 
software of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8210 (The driver of honor 5C,honor 6x Huawei smart phones with 
software of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8209 (The driver of honor 5C,honor 6x Huawei smart phones with 
software of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8208 (The driver of honor 5C,honor 6x Huawei smart phones with 
software of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8207 (The driver of honor 5C, honor 6x Huawei smart phones with 
software of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8206 (HONOR 7 Lite mobile phones with software of versions earlier 
than ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8205 (The Bastet driver of Honor 9 Huawei smart phones with software 
of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8204 (The Bastet driver of Honor 9 Huawei smart phones with software 
of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8203 (The Bastet Driver of Nova 2 Plus,Nova 2 Huawei smart phones 
with ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8202 (The CameraISP driver of some Huawei smart phones with software 
of ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8201 (MAX PRESENCE V100R001C00, TP3106 V100R002C00, TP3206 
V100R002C00 have ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8200 (MAX PRESENCE V100R001C00, TP3106 V100R002C00, TP3206 
V100R002C00 have ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8199 (MAX PRESENCE V100R001C00, TP3106 V100R002C00, TP3206 
V100R002C00 have ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8198 (FusionSphere V100R006C00SPC102(NFV) has an SQL injection ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8197 (FusionSphere V100R006C00SPC102(NFV) has a command injection ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8196 (FusionSphere V100R006C00SPC102(NFV) has an incorrect 
authorization ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8195 (The FusionSphere OpenStack V100R006C00SPC102(NFV) has an 
improper ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8194 (The FusionSphere OpenStack V100R006C00SPC102(NFV) has an 
improper ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8193 (The FusionSphere OpenStack V100R006C00SPC102(NFV) has a command 
...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8192 (FusionSphere OpenStack V100R006C00 has an improper 
authorization ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8191 (FusionSphere OpenStack V100R006C00SPC102(NFV)has a week 
cryptographic ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8190 (FusionSphere OpenStack V100R006C00SPC102(NFV)has an improper 
...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8189 (FusionSphere OpenStack V100R006C00SPC102(NFV)has a path 
traversal ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8188 (FusionSphere OpenStack V100R006C00SPC102(NFV)has a command 
injection ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8187
RESERVED
 CVE-2017-8186 (The Bastet of some Huawei mobile phones with software of 
earlier than ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8185 (ME906s-158 earlier than ME906S_Installer_13.1805.10.3 versions 
has a ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8184 (MTK platform in Huawei smart phones with software of earlier 
than ...)
-   TODO: check
+   NOT-FOR-US: Huawei
 CVE-2017-8183 (MTK platform in Huawei smart phones with software of earlier 
than ...)
-   TODO: check
+

[Secure-testing-commits] r57960 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 14:19:14 + (Thu, 23 Nov 2017)
New Revision: 57960

Modified:
   data/CVE/list
Log:
Remove note, package status tracked

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 14:19:04 UTC (rev 57959)
+++ data/CVE/list   2017-11-23 14:19:14 UTC (rev 57960)
@@ -610,9 +610,6 @@
- pnp4nagios 
[wheezy] - pnp4nagios  (/etc/pnp4nagios and its content 
is installed as root by the Debian package)
NOTE: https://github.com/lingej/pnp4nagios/issues/140
-   NOTE: Fixed by dh_fixperms, surely? eg.
-   NOTE: $ ls -l /etc/pnp4nagios/npcd.cfg
-   NOTE: -rw-r--r-- 1 root root 4149 Nov 25  2012 /etc/pnp4nagios/npcd.cfg
 CVE-2017-16833 (Stored cross-site scripting (XSS) vulnerability in Gemirro 
before ...)
NOT-FOR-US: Gemirro
 CVE-2017-16853 (The DynamicMetadataProvider class in ...)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57958 - data/CVE

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 14:15:16 + (Thu, 23 Nov 2017)
New Revision: 57958

Modified:
   data/CVE/list
Log:
Mark wheezy as not affected by CVE-2017-16834

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 14:03:24 UTC (rev 57957)
+++ data/CVE/list   2017-11-23 14:15:16 UTC (rev 57958)
@@ -608,6 +608,7 @@
RESERVED
 CVE-2017-16834 (PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned 
by an ...)
- pnp4nagios 
+   [wheezy] - pnp4nagios  (/etc/pnp4nagios and its content 
is installed as root by the Debian package)
NOTE: https://github.com/lingej/pnp4nagios/issues/140
NOTE: Fixed by dh_fixperms, surely? eg.
NOTE: $ ls -l /etc/pnp4nagios/npcd.cfg


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57957 - in data: . CVE

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 14:03:24 + (Thu, 23 Nov 2017)
New Revision: 57957

Modified:
   data/CVE/list
   data/dla-needed.txt
Log:
Add couchdb to dla-needed.txt

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 13:09:09 UTC (rev 57956)
+++ data/CVE/list   2017-11-23 14:03:24 UTC (rev 57957)
@@ -12749,9 +12749,12 @@
 CVE-2017-12636 (CouchDB administrative users can configure the database server 
via ...)
- couchdb 
NOTE: http://www.openwall.com/lists/oss-security/2017/11/14/6
+   NOTE: Likely patch for 1.2.x: 
https://github.com/apache/couchdb/commit/9a28df7e9703a1a3420e7616c4d33a523ee06354
+   NOTE: Possibly needs more updates: 
https://github.com/apache/couchdb/commit/bf6b6a1c84321baee2c4ad354059a45e0b8fdec7
 CVE-2017-12635 (Due to differences in the Erlang-based JSON parser and ...)
- couchdb 
NOTE: http://www.openwall.com/lists/oss-security/2017/11/14/6
+   NOTE: Likely patch for 1.2.x: 
https://github.com/apache/couchdb/commit/3706a77c13a78672e5a3fbde06e7bffd3665f73b
 CVE-2017-12634 (The camel-castor component in Apache Camel 2.x before 2.19.4 
and ...)
NOT-FOR-US: Apache Camel
 CVE-2017-12633 (The camel-hessian component in Apache Camel 2.x before 2.19.4 
and ...)

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 13:09:09 UTC (rev 57956)
+++ data/dla-needed.txt 2017-11-23 14:03:24 UTC (rev 57957)
@@ -14,6 +14,9 @@
   NOTE: 20170719: maintainer will handle the upload, see 
https://lists.debian.org/d0b9674a-ac5b-5cc9-1982-fb6f36155...@pbandjelly.org
   NOTE: 20171013: anarcat pinged maintainer: 
https://lists.debian.org/87efpuc95w@curie.anarc.at
 --
+couchdb
+  NOTE: Only in wheezy, we are on our own.
+--
 exiv2
 --
 irssi (Rhonda D'Vine)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57956 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 13:09:09 + (Thu, 23 Nov 2017)
New Revision: 57956

Modified:
   data/CVE/list
Log:
Mark CVE-2017-16663/sam2p as no-dsa

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 12:26:23 UTC (rev 57955)
+++ data/CVE/list   2017-11-23 13:09:09 UTC (rev 57956)
@@ -1059,6 +1059,7 @@
 CVE-2017-16663 (In sam2p 0.49.4, there are integer overflows (with resultant 
heap-based ...)
{DLA-1185-1}
- sam2p 
+   [jessie] - sam2p  (Minor issue)
NOTE: https://github.com/pts/sam2p/issues/16
 CVE-2017-16662
RESERVED


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57955 - data/CVE

2017-11-23 Thread Moritz Muehlenhoff 
Author: jmm
Date: 2017-11-23 12:26:23 + (Thu, 23 Nov 2017)
New Revision: 57955

Modified:
   data/CVE/list
Log:
shairpoint non-issue
a few no-dsa


Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 11:50:22 UTC (rev 57954)
+++ data/CVE/list   2017-11-23 12:26:23 UTC (rev 57955)
@@ -218,6 +218,7 @@
REJECTED
 CVE-2017-1000203 (ROOT version 6.9.03 and below is vulnerable to an 
authenticated shell ...)
- root-system 
+   [jessie] - root-system  (Minor issue)
[wheezy] - root-system  (Minor issue as it's restricted to 
authenticated users)
NOTE: 
https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145#diff-6cd6f6c31bac70116b7ca7abdc8e517e
 CVE-2017-1000192 (Cygnux sysPass version 2.1.7 and older is vulnerable to a 
Local File ...)
@@ -356,6 +357,8 @@
NOT-FOR-US: EllisLab ExpressionEngine
 CVE-2017-1000158 (CPython (aka Python) up to 2.7.13 is vulnerable to an 
integer overflow ...)
- python2.7 2.7.13-4
+   [stretch] - python2.7  (Minor issue)
+   [jessie] - python2.7  (Minor issue)
- python2.6 
NOTE: https://bugs.python.org/issue30657
NOTE: 
https://github.com/python/cpython/commit/c3c9db89273fabc62ea1b48389d9a3000c1c03ae
@@ -3356,6 +3359,8 @@
 CVE-2016-10517 (networking.c in Redis before 3.2.7 allows "Cross Protocol 
Scripting" ...)
{DLA-1161-1}
- redis 3:3.2.7-1
+   [stretch] - redis  (Minor issue)
+   [jessie] - redis  (Minor issue)
NOTE: 
https://github.com/antirez/redis/commit/874804da0c014a7d704b3d285aa500098a931f50
 CVE-2017-15863 (Cross Site Scripting (XSS) exists in the wp-noexternallinks 
plugin ...)
NOT-FOR-US: WordPress plugin wp-noexternallinks
@@ -14231,6 +14236,9 @@
RESERVED
 CVE-2017-12087
RESERVED
+   - shairport-sync  (unimportant)
+   NOTE: Debian build uses Avahi instead
+   NOTE: 
https://bugs.launchpad.net/ubuntu/+source/shairport-sync/+bug/1729668
 CVE-2017-12086
RESERVED
 CVE-2017-12085 (An exploitable routing vulnerability exists in the Circle with 
Disney ...)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57954 - data

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 11:50:22 + (Thu, 23 Nov 2017)
New Revision: 57954

Modified:
   data/dla-needed.txt
Log:
Add xrdp to dla-needed.txt

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 11:50:19 UTC (rev 57953)
+++ data/dla-needed.txt 2017-11-23 11:50:22 UTC (rev 57954)
@@ -128,3 +128,7 @@
 --
 xen
 --
+xrdp
+  NOTE: Please wait until pull request has been merged or confirmed to fix the
+  NOTE: problem. See 
https://groups.google.com/forum/#!topic/xrdp-devel/PmVfMuy_xBA
+--


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57953 - data/CVE

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 11:50:19 + (Thu, 23 Nov 2017)
New Revision: 57953

Modified:
   data/CVE/list
Log:
CVE-2017-15288: Indicate which pull request apply to each version

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 11:50:05 UTC (rev 57952)
+++ data/CVE/list   2017-11-23 11:50:19 UTC (rev 57953)
@@ -4750,9 +4750,9 @@
 CVE-2017-15288 (The compilation daemon in Scala before 2.10.7, 2.11.x before 
2.11.12, ...)
- scala 
NOTE: http://scala-lang.org/news/security-update-nov17.html
-   NOTE: https://github.com/scala/scala/pull/6108
-   NOTE: https://github.com/scala/scala/pull/6120
-   NOTE: https://github.com/scala/scala/pull/6128
+   NOTE: For 2.11.x: https://github.com/scala/scala/pull/6108
+   NOTE: For 2.12.x: https://github.com/scala/scala/pull/6120
+   NOTE: For 2.10.x: https://github.com/scala/scala/pull/6128
TODO: check
 CVE-2017-15287 (There is XSS in the BouquetEditor WebPlugin for Dream 
Multimedia ...)
NOT-FOR-US: BouquetEditor WebPlugin


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57952 - data/CVE

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 11:50:05 + (Thu, 23 Nov 2017)
New Revision: 57952

Modified:
   data/CVE/list
Log:
Ignore CVE-2017-1000203 in wheezy

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 11:49:52 UTC (rev 57951)
+++ data/CVE/list   2017-11-23 11:50:05 UTC (rev 57952)
@@ -218,6 +218,7 @@
REJECTED
 CVE-2017-1000203 (ROOT version 6.9.03 and below is vulnerable to an 
authenticated shell ...)
- root-system 
+   [wheezy] - root-system  (Minor issue as it's restricted to 
authenticated users)
NOTE: 
https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145#diff-6cd6f6c31bac70116b7ca7abdc8e517e
 CVE-2017-1000192 (Cygnux sysPass version 2.1.7 and older is vulnerable to a 
Local File ...)
NOT-FOR-US: Cygnux sysPass


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57951 - data

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 11:49:52 + (Thu, 23 Nov 2017)
New Revision: 57951

Modified:
   data/dla-needed.txt
Log:
Add back xen to dla-needed.txt

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 10:42:43 UTC (rev 57950)
+++ data/dla-needed.txt 2017-11-23 11:49:52 UTC (rev 57951)
@@ -126,3 +126,5 @@
 --
 wordpress
 --
+xen
+--


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57950 - data

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 10:42:43 + (Thu, 23 Nov 2017)
New Revision: 57950

Modified:
   data/dla-needed.txt
Log:
Add otrs2 to dla-needed.txt

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 10:33:28 UTC (rev 57949)
+++ data/dla-needed.txt 2017-11-23 10:42:43 UTC (rev 57950)
@@ -75,6 +75,8 @@
 --
 openjdk-7 (Emilio Pozuelo)
 --
+otrs2
+--
 python-werkzeug (Thorsten Alteholz)
 --
 python2.6 (Roberto C. Sánchez)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57949 - data

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 10:33:28 + (Thu, 23 Nov 2017)
New Revision: 57949

Modified:
   data/dla-needed.txt
Log:
Add ohcount to dla-needed.txt

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 09:56:59 UTC (rev 57948)
+++ data/dla-needed.txt 2017-11-23 10:33:28 UTC (rev 57949)
@@ -65,6 +65,11 @@
   NOTE: For CVE-2017-14409, 
https://security-tracker.debian.org/tracker/CVE-2017-9872 might be of interest, 
files are very similar
   NOTE: adapting/writing patches seems to be very time consuming, mp3gain is 
dead upstream so this might be a candidate for no-dsa -- Hugo Lefeuvre
 --
+ohcount
+  NOTE: No upstream bug tracker found (except on old copies of the code on
+  NOTE: github). Pinged sourceforge project owner with sourceforge's
+  NOTE: integrated messaging feature. -- Raphaël Hertzog
+--
 openexr (Guido Günther)
   NOTE: 20170902: CVE-2017-12596: bug reported upstream but no response yet 
(lamby)
 --


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57948 - data

2017-11-23 Thread Raphaël Hertzog 
Author: hertzog
Date: 2017-11-23 09:56:59 + (Thu, 23 Nov 2017)
New Revision: 57948

Modified:
   data/dla-needed.txt
Log:
Add exiv2 to dla-needed.txt

Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2017-11-23 09:10:18 UTC (rev 57947)
+++ data/dla-needed.txt 2017-11-23 09:56:59 UTC (rev 57948)
@@ -14,6 +14,8 @@
   NOTE: 20170719: maintainer will handle the upload, see 
https://lists.debian.org/d0b9674a-ac5b-5cc9-1982-fb6f36155...@pbandjelly.org
   NOTE: 20171013: anarcat pinged maintainer: 
https://lists.debian.org/87efpuc95w@curie.anarc.at
 --
+exiv2
+--
 irssi (Rhonda D'Vine)
 --
 jasperreports


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r57947 - data/CVE

2017-11-23 Thread security tracker role 
Author: sectracker
Date: 2017-11-23 09:10:18 + (Thu, 23 Nov 2017)
New Revision: 57947

Modified:
   data/CVE/list
Log:
automatic update

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 09:03:06 UTC (rev 57946)
+++ data/CVE/list   2017-11-23 09:10:18 UTC (rev 57947)
@@ -1,4 +1,6 @@
-CVE-2017-16927 [buffer oveflow in scp_v0s_accept function]
+CVE-2017-16928
+   RESERVED
+CVE-2017-16927 (The scp_v0s_accept function in sesman/libscp/libscp_v0.c in 
the session ...)
- xrdp  (bug #882463)
NOTE: Proposed pull request: 
https://github.com/neutrinolabs/xrdp/pull/958
NOTE: https://groups.google.com/forum/#!topic/xrdp-devel/PmVfMuy_xBA
@@ -179,8 +181,8 @@
- exiv2 
NOTE: http://www.openwall.com/lists/oss-security/2017/06/30/1
NOTE: Can't seem to reproduce this in wheezy.
-CVE-2017-16879
-   RESERVED
+CVE-2017-16879 (Stack-based buffer overflow in the _nc_write_entry function in 
...)
+   TODO: check
 CVE-2017-16878
RESERVED
 CVE-2017-16877 (ZEIT Next.js before 2.4.1 has directory traversal under the 
/_next and ...)
@@ -9407,7 +9409,7 @@
 CVE-2017-13724 (On the Axesstel MU553S MU55XS-V1.14, there is a Stored Cross 
Site ...)
NOT-FOR-US: Axesstel MU553S MU55XS-V1.14
 CVE-2017-13723 (In X.Org Server (aka xserver and xorg-server) before 1.19.4, a 
local ...)
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.4-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=94f11ca5cf011ef123bd222cabeaef6f424d76ac
NOTE: This is in libxkbfile in wheezy
@@ -13882,7 +13884,7 @@
NOTE: https://www.spinics.net/lists/kvm/msg156651.html
 CVE-2017-12187
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
 CVE-2017-12186
@@ -13893,22 +13895,22 @@
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
 CVE-2017-12185
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
 CVE-2017-12184 [Unvalidated lengths]
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=cad5a1050b7184d828aef9c1dd151c3ab649d37e
 CVE-2017-12183 [xfixes: unvalidated lengths]
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=55caa8b08c84af2b50fbc936cf334a5a93dd7db5
 CVE-2017-12182 [hw/xfree86: unvalidated lengths]
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=1b1d4c04695dced2463404174b50b3581dbd857b
 CVE-2017-12181 [hw/xfree86: unvalidated lengths]
@@ -13919,7 +13921,7 @@
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=1b1d4c04695dced2463404174b50b3581dbd857b
 CVE-2017-12180 [hw/xfree86: unvalidated lengths]
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=1b1d4c04695dced2463404174b50b3581dbd857b
 CVE-2017-12179 [Xi: integer overflow and unvalidated length in 
(S)ProcXIBarrierReleasePointer]
@@ -13929,17 +13931,17 @@
[wheezy] - xorg-server  (Vulnerable code introduced later)
 CVE-2017-12178 [Xi: fix wrong extra length check in ProcXIChangeHierarchy]
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=859b08d523307eebde7724fd1a0789c44813e821
 CVE-2017-12177 [dbe: Unvalidated variable-length request in 
ProcDbeGetVisualInfo]
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=4ca68b878e851e2136c234f40a25008297d8d831
 CVE-2017-12176 [Unvalidated extra length in ProcEstablishConnection]
RESERVED
-   {DSA-4000-1}
+   {DSA-4000-1 DLA-1186-1}
- xorg-server 2:1.19.5-1
NOTE: 
https://cgit.freedesktop.org/xorg/xserver/commit/?id=b747da5e25be944337a9cd1415506fc06b70aa81
 CVE-2017-12175
@@ -13955,8 +13957,7 @@
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1498173
NOTE: Fixed by: 
https://pagure.io/SSSD/sssd/c/1f2662c8f97c9c0fa250055d4b6750abfc6d0835
NOTE: Introduced by 
https://pagure.io/SSSD/sssd/c/7ecb5aea65cb1899f16e7a41bffa93d074defd4a 
(sssd-1_12_0)
-CVE-2017-12172
-   RESERVED
+CVE-2017-12172

[Secure-testing-commits] r57946 - data/CVE

2017-11-23 Thread Salvatore Bonaccorso 
Author: carnil
Date: 2017-11-23 09:03:06 + (Thu, 23 Nov 2017)
New Revision: 57946

Modified:
   data/CVE/list
Log:
Add bug reference for xrdp issue, #882463

Modified: data/CVE/list
===
--- data/CVE/list   2017-11-23 06:58:28 UTC (rev 57945)
+++ data/CVE/list   2017-11-23 09:03:06 UTC (rev 57946)
@@ -1,5 +1,5 @@
 CVE-2017-16927 [buffer oveflow in scp_v0s_accept function]
-   - xrdp 
+   - xrdp  (bug #882463)
NOTE: Proposed pull request: 
https://github.com/neutrinolabs/xrdp/pull/958
NOTE: https://groups.google.com/forum/#!topic/xrdp-devel/PmVfMuy_xBA
 CVE-2017-16926 (Ohcount 3.0.0 is prone to a command injection via specially 
crafted ...)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits