[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Process more NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 0030e1d8 by Salvatore Bonaccorso at 2018-01-04T23:18:05+01:00 Process more NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -11,11 +11,11 @@ CVE-2018-5216 (Radiant CMS 1.1.4 has XSS via crafted Markdown input in the ...) CVE-2018-5215 (Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title ...) NOT-FOR-US: Fork CMS CVE-2018-5214 (The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via ...) - TODO: check + NOT-FOR-US: "Add Link to Facebook" plugin for WordPress CVE-2018-5213 (The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS ...) - TODO: check + NOT-FOR-US: Simple Download Monitor plugin for WordPress CVE-2018-5212 (The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS ...) - TODO: check + NOT-FOR-US: Simple Download Monitor plugin for WordPress CVE-2018-5211 RESERVED CVE-2018-5210 (On Samsung mobile devices with N(7.x) software and Exynos chipsets, ...) @@ -726,7 +726,7 @@ CVE-2017-1000497 (Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in CVE-2017-1000496 (Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration ...) TODO: check CVE-2017-1000495 (QuickApps CMS version 2.0.0 is vulnerable to Stored Cross-site ...) - TODO: check + NOT-FOR-US: QuickApps CMS CVE-2017-1000494 (Uninitialized stack variable vulnerability in NameValueParserEndElt ...) TODO: check CVE-2017-1000490 (Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any ...) @@ -752,7 +752,7 @@ CVE-2017-1000481 (When you visit a page where you need to login, Plone 2.5-5.1rc CVE-2017-1000480 (Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when ...) TODO: check CVE-2017-1000479 (pfSense versions 2.4.1 and lower are vulnerable to clickjacking ...) - TODO: check + NOT-FOR-US: pfSense CVE-2017-1000478 (ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in ...) TODO: check CVE-2017-1000477 (XMLBundle version 0.1.7 is vulnerable to XXE attacks which can result ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/0030e1d86fa5e2d55065cf9af9b6c539f58802df --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/0030e1d86fa5e2d55065cf9af9b6c539f58802df You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Process NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c46c2ab7 by Salvatore Bonaccorso at 2018-01-04T23:00:53+01:00 Process NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -1,15 +1,15 @@ CVE-2018-5220 (In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 Antivirus CVE-2018-5219 (In K7 Antivirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 Antivirus CVE-2018-5218 (In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 Antivirus CVE-2018-5217 (In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 Antivirus CVE-2018-5216 (Radiant CMS 1.1.4 has XSS via crafted Markdown input in the ...) - TODO: check + NOT-FOR-US: Radiant CMS CVE-2018-5215 (Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title ...) - TODO: check + NOT-FOR-US: Fork CMS CVE-2018-5214 (The "Add Link to Facebook" plugin through 2.3 for WordPress has XSS via ...) TODO: check CVE-2018-5213 (The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/c46c2ab7b976ab05dc3b85c4746e40ab89a7d5bb --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/c46c2ab7b976ab05dc3b85c4746e40ab89a7d5bb You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4e7e7293 by security tracker role at 2018-01-04T21:10:18+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -1,3 +1,23 @@
+CVE-2018-5220 (In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys)
allows local ...)
+ TODO: check
+CVE-2018-5219 (In K7 Antivirus 15.1.0306, the driver file (K7FWHlpr.sys)
allows local ...)
+ TODO: check
+CVE-2018-5218 (In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys)
allows local ...)
+ TODO: check
+CVE-2018-5217 (In K7 Antivirus 15.1.0306, the driver file (K7Sentry.sys)
allows local ...)
+ TODO: check
+CVE-2018-5216 (Radiant CMS 1.1.4 has XSS via crafted Markdown input in the ...)
+ TODO: check
+CVE-2018-5215 (Fork CMS 5.0.7 has XSS in /private/en/pages/edit via the title
...)
+ TODO: check
+CVE-2018-5214 (The "Add Link to Facebook" plugin through 2.3 for
WordPress has XSS via ...)
+ TODO: check
+CVE-2018-5213 (The Simple Download Monitor plugin before 3.5.4 for WordPress
has XSS ...)
+ TODO: check
+CVE-2018-5212 (The Simple Download Monitor plugin before 3.5.4 for WordPress
has XSS ...)
+ TODO: check
+CVE-2018-5211
+ RESERVED
CVE-2018-5210 (On Samsung mobile devices with N(7.x) software and Exynos
chipsets, ...)
NOT-FOR-US: Samsung mobile devices
CVE-2018-5209
@@ -37,7 +57,7 @@ CVE-2018-5193
CVE-2018-5192
RESERVED
CVE-2018-5191
- RESERVED
+ REJECTED
CVE-2018-5190
RESERVED
CVE-2018-5189
@@ -731,13 +751,14 @@ CVE-2017-1000481 (When you visit a page where you need to
login, Plone 2.5-5.1rc
TODO: check
CVE-2017-1000480 (Smarty 3 before 3.1.32 is vulnerable to a PHP code injection
when ...)
TODO: check
-CVE-2017-1000479 (pfSense versions 2.4.1 and lower are vulnerable to a
clickjacking ...)
+CVE-2017-1000479 (pfSense versions 2.4.1 and lower are vulnerable to
clickjacking ...)
TODO: check
CVE-2017-1000478 (ELabftw version 1.7.8 is vulnerable to stored cross-site
scripting in ...)
TODO: check
CVE-2017-1000477 (XMLBundle version 0.1.7 is vulnerable to XXE attacks which
can result ...)
TODO: check
CVE-2017-1000476 (ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was
found in ...)
+ {DLA-1229-1}
- imagemagick
[stretch] - imagemagick (Minor issue)
[jessie] - imagemagick (Minor issue)
@@ -2930,6 +2951,7 @@ CVE-2017-1000449
CVE-2017-1000448 (Structured Data Linter versions 2.4.1 and older are
vulnerable to a ...)
TODO: check
CVE-2017-1000445 (ImageMagick 7.0.7-1 and older version are vulnerable to null
pointer ...)
+ {DLA-1229-1}
- imagemagick (bug #886281)
[stretch] - imagemagick (Minor issue)
[jessie] - imagemagick (Minor issue)
@@ -2995,7 +3017,7 @@ CVE-2017-18012 (The Z-URL Preview plugin 1.6.1 for
WordPress has XSS via the ...
NOT-FOR-US: Z-URL Preview plugin for WordPress
CVE-2017-18011 (The MyCBGenie Affiliate Ads for Clickbank Products plugin
through 1.6 ...)
NOT-FOR-US: MyCBGenie Affiliate Ads for Clickbank Products plugin
WordPress
-CVE-2017-18010 (The E-goi Smart Marketing SMS and Newsletters Forms plugin
1.1.1 for ...)
+CVE-2017-18010 (The E-goi Smart Marketing SMS and Newsletters Forms plugin
before ...)
NOT-FOR-US: E-goi Smart Marketing SMS and Newsletters Forms plugin for
WordPress
CVE-2017-18009 (In OpenCV 3.3.1, a heap-based buffer over-read exists in the
function ...)
- opencv
@@ -3821,8 +3843,8 @@ CVE-2017-17869 (The mgl-instagram-gallery plugin for
WordPress has XSS via the .
NOT-FOR-US: mgl-instagram-gallery plugin for WordPress
CVE-2017-17868 (In Liferay Portal 6.1.0, the tags section has XSS via a Public
Render ...)
NOT-FOR-US: Liferay Portal
-CVE-2017-17867
- RESERVED
+CVE-2017-17867 (Inteno iopsys 2.0-3.14 and 4.0 devices allow remote
authenticated users ...)
+ TODO: check
CVE-2017-17866 (pdf/pdf-write.c in Artifex MuPDF before 1.12.0 mishandles
certain ...)
- mupdf (bug #885120)
NOTE: Fixed by:
http://git.ghostscript.com/?p=mupdf.git;h=520cc26d18c9ee245b56e9e91f9d4fcae02be5f0
@@ -3922,8 +3944,8 @@ CVE-2017-17839
RESERVED
CVE-2017-17838
RESERVED
-CVE-2017-17837
- RESERVED
+CVE-2017-17837 (The Apache DeltaSpike-JSF 1.8.0 module has a XSS injection
leak in the ...)
+ TODO: check
CVE-2017-17836
RESERVED
CVE-2017-17835
@@ -9137,15 +9159,19 @@ CVE-2017-17560 (An issue was discovered on Western
Digital MyCloud PR4100 2.30.1
CVE-2017-17559
RESERVED
CVE-2017-17565 (An issue was discovered in Xen through 4.9.x allowing PV guest
OS users ...)
+ {DLA-1230-1}
- xen
NOTE: https://xenbits.xen.org/
[Secure-testing-commits] subject lines (like [Git][security-tracker-team/security-tracker][master] allocate DSA for Linux
Hi, all the commits cause mails with subject lines like [Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] allocate DSA for Linux could this maybe be shortened to [security-tracker.git] allocate DSA for Linux or some such? :-) -- cheers, Holger signature.asc Description: PGP signature ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] allocate DSA for Linux
Yves-Alexis Perez pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
66cb5eed by Yves-Alexis Perez at 2018-01-04T21:01:47+01:00
allocate DSA for Linux
- - - - -
1 changed file:
- data/DSA/list
Changes:
=
data/DSA/list
=
--- a/data/DSA/list
+++ b/data/DSA/list
@@ -1,3 +1,6 @@
+[04 Jan 2018] DSA-4078-1 linux - security update
+ {CVE-2017-5754}
+ [stretch] - linux 4.9.65-3+deb9u2
[30 Dec 2017] DSA-4077-1 gimp - security update
{CVE-2017-17784 CVE-2017-17785 CVE-2017-17786 CVE-2017-17787
CVE-2017-17788 CVE-2017-17789}
[jessie] - gimp 2.8.14-1+deb8u2
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/66cb5eedc5ddf880a2615c645fb8fd755492f5b7
---
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/66cb5eedc5ddf880a2615c645fb8fd755492f5b7
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Remove information for CVE-2018-5191
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 3674eb7d by Salvatore Bonaccorso at 2018-01-04T20:14:07+01:00 Remove information for CVE-2018-5191 The CVE was a reservation duplicate of the DWF assigned CVE-2017-1000479. MITRE will reject CVE-2018-5191 in favour of CVE-2017-1000479. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -36,8 +36,8 @@ CVE-2018-5193 RESERVED CVE-2018-5192 RESERVED -CVE-2018-5191 (/usr/local/www/csrf/csrf-magic.php in the WebGUI in pfSense before ...) - NOT-FOR-US: pfSense +CVE-2018-5191 + RESERVED CVE-2018-5190 RESERVED CVE-2018-5189 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/3674eb7d1ea01d04d83cbd286bef0211c351574b --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/3674eb7d1ea01d04d83cbd286bef0211c351574b You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Add CVE-2017-1000472/poco
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 4605417e by Salvatore Bonaccorso at 2018-01-04T19:13:02+01:00 Add CVE-2017-1000472/poco Add fixing version for the first one containing the fix and entering unstable. Upstream fix landed in 1.7.9p1. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -746,7 +746,8 @@ CVE-2017-1000476 (ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was f CVE-2017-1000473 (Linux Dash up to version v2 is vulnerable to multiple command ...) TODO: check CVE-2017-1000472 (The ZipCommon::isValidPath() function in Zip/src/ZipCommon.cpp in POCO ...) - TODO: check + - poco 1.8.0-2 + NOTE: https://github.com/pocoproject/poco/issues/1968 CVE-2017-1000471 (EmbedThis GoAhead Webserver version 4.0.0 is vulnerable to a NULL ...) TODO: check CVE-2017-1000470 (EmbedThis GoAhead Webserver versions 4.0.0 and earlier is vulnerable ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/4605417e347adac09fa69204dedf58ee524d1a09 --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/4605417e347adac09fa69204dedf58ee524d1a09 You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Add CVE-2017-18018/coreutils
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c344c58b by Salvatore Bonaccorso at 2018-01-04T18:08:15+01:00 Add CVE-2017-18018/coreutils This item should probably be marked as unimportant. https://lists.gnu.org/archive/html/coreutils/2017-12/msg00071.html > On 12/28/2017 04:36 PM, Michael Orlitzky wrote: > > Does anyone mind if I reserve a CVE for this? > > > Of course not - but I doubt that we can do much about it: > the chown(1) binary is just a wrapper around chown(2)/lchown(2), > so whatever (other) utility uses these system calls in a recursive > way will be prone to that trap. > > I think the best way to handle this is to keep teaching sysadmins > to avoid the --dereference option together with -R; usually > "chown -R" with the default -P is probably good enough. > > It would probably be good to add a clarifying sentence to the Texinfo > documentation. Would you like to propose a sentence? Will just be fixed by clarifying documentation about security risk. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -267,7 +267,12 @@ CVE-2017-18020 (On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) softwa CVE-2017-18019 (In K7 Total Security before 15.1.0.305, user-controlled input to the ...) NOT-FOR-US: K7 Total Security CVE-2017-18018 (In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not ...) - TODO: check + - coreutils + NOTE: http://lists.gnu.org/archive/html/coreutils/2017-12/msg00045.html + NOTE: http://www.openwall.com/lists/oss-security/2018/01/04/3 + NOTE: Documentation patches proposed: + NOTE: https://lists.gnu.org/archive/html/coreutils/2017-12/msg00072.html + NOTE: https://lists.gnu.org/archive/html/coreutils/2017-12/msg00073.html CVE-2018-5078 (Online Ticket Booking has XSS via the admin/eventlist.php cast ...) NOT-FOR-US: Online Ticket Booking CVE-2018-5077 (Online Ticket Booking has XSS via the admin/movieedit.php moviename ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/c344c58b5b43178b0c3bb6d5fd4011cef2a5e329 --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/c344c58b5b43178b0c3bb6d5fd4011cef2a5e329 You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] 2 commits: Move TODO item
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d06eeff6 by Salvatore Bonaccorso at 2018-01-04T15:43:16+01:00
Move TODO item
- - - - -
6f0c56e0 by Salvatore Bonaccorso at 2018-01-04T16:37:15+01:00
Add two references for intel advisory for CVE-2017-575{3,4}
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -47608,6 +47608,7 @@ CVE-2017-5754
NOTE:
https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html
NOTE: http://blog.cyberus-technology.de/posts/2018-01-03-meltdown.html
NOTE: Paper: https://meltdownattack.com/meltdown.pdf
+ NOTE: https://01.org/security/advisories/intel-oss-10003
CVE-2017-5753
RESERVED
- linux
@@ -47615,6 +47616,7 @@ CVE-2017-5753
NOTE: https://xenbits.xen.org/xsa/advisory-254.html
NOTE:
https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html
NOTE: Paper: https://spectreattack.com/spectre.pdf
+ NOTE: https://01.org/security/advisories/intel-oss-10002
CVE-2017-5752
RESERVED
CVE-2017-5751
@@ -47696,9 +47698,9 @@ CVE-2017-5715
NOTE: https://xenbits.xen.org/xsa/advisory-254.html
NOTE:
https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html
NOTE: Paper: https://spectreattack.com/spectre.pdf
- TODO: check, qemu/qemu-kvm and intel-microcode and amd64-microcode need
as well to be tracked
NOTE: https://www.suse.com/de-de/support/kb/doc/?id=7022512
NOTE:
https://www.suse.com/support/update/announcement/2018/suse-su-20180009-1/
+ TODO: check, qemu/qemu-kvm and intel-microcode and amd64-microcode need
as well to be tracked
CVE-2017-5714
RESERVED
CVE-2017-5713
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/compare/cb3a89182d9fce006bf7db9ee4125d25b9870e59...6f0c56e08f6c2a0428a1512ac7c6c483ba474a75
---
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/compare/cb3a89182d9fce006bf7db9ee4125d25b9870e59...6f0c56e08f6c2a0428a1512ac7c6c483ba474a75
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1230-1 for xen
Felix Geyer pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
cb3a8918 by Felix Geyer at 2018-01-04T15:32:10+01:00
Reserve DLA-1230-1 for xen
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[04 Jan 2018] DLA-1230-1 xen - security update
+ {CVE-2017-17044 CVE-2017-17045 CVE-2017-17563 CVE-2017-17564
CVE-2017-17565 CVE-2017-17566}
+ [wheezy] - xen 4.1.6.lts1-11
[04 Jan 2018] DLA-1229-1 imagemagick - security update
{CVE-2017-1000445 CVE-2017-1000476}
[wheezy] - imagemagick 8:6.7.7.10-5+deb7u20
=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -68,5 +68,3 @@ tiff3 (Roberto C. Sánchez)
wordpress
NOTE: 2017-12-25: Fix requires migrating users from MD5 -> bcrypt. (lamby)
--
-xen
---
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/cb3a89182d9fce006bf7db9ee4125d25b9870e59
---
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/cb3a89182d9fce006bf7db9ee4125d25b9870e59
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] add info from Suse on microcode update
Yves-Alexis Perez pushed to branch master at Debian Security Tracker / security-tracker Commits: eab5848b by Yves-Alexis Perez at 2018-01-04T14:30:01+01:00 add info from Suse on microcode update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -47697,6 +47697,8 @@ CVE-2017-5715 NOTE: https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html NOTE: Paper: https://spectreattack.com/spectre.pdf TODO: check, qemu/qemu-kvm and intel-microcode and amd64-microcode need as well to be tracked + NOTE: https://www.suse.com/de-de/support/kb/doc/?id=7022512 + NOTE: https://www.suse.com/support/update/announcement/2018/suse-su-20180009-1/ CVE-2017-5714 RESERVED CVE-2017-5713 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/eab5848b2d8e6a596f1af580b13383c359ebc881 --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/eab5848b2d8e6a596f1af580b13383c359ebc881 You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Add TODO/NOTE for CVE-2017-5715
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 2695200c by Salvatore Bonaccorso at 2018-01-04T14:27:47+01:00 Add TODO/NOTE for CVE-2017-5715 - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -47696,6 +47696,7 @@ CVE-2017-5715 NOTE: https://xenbits.xen.org/xsa/advisory-254.html NOTE: https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged-memory-with-side.html NOTE: Paper: https://spectreattack.com/spectre.pdf + TODO: check, qemu/qemu-kvm and intel-microcode and amd64-microcode need as well to be tracked CVE-2017-5714 RESERVED CVE-2017-5713 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/2695200ca67861e11fd41d9703623e2fb09c0679 --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/2695200ca67861e11fd41d9703623e2fb09c0679 You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Process NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 7416b0cc by Salvatore Bonaccorso at 2018-01-04T12:31:41+01:00 Process NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -1,5 +1,5 @@ CVE-2018-5210 (On Samsung mobile devices with N(7.x) software and Exynos chipsets, ...) - TODO: check + NOT-FOR-US: Samsung mobile devices CVE-2018-5209 RESERVED CVE-2018-5208 @@ -243,29 +243,29 @@ CVE-2018-5090 CVE-2018-5089 RESERVED CVE-2018-5088 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5087 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5086 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5085 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5084 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5083 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5082 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5081 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5080 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2018-5079 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) - TODO: check + NOT-FOR-US: K7 AntiVirus CVE-2017-18020 (On Samsung mobile devices with L(5.x), M(6.x), and N(7.x) software and ...) - TODO: check + NOT-FOR-US: Samsung mobile devices CVE-2017-18019 (In K7 Total Security before 15.1.0.305, user-controlled input to the ...) - TODO: check + NOT-FOR-US: K7 Total Security CVE-2017-18018 (In GNU Coreutils through 8.29, chown-core.c in chown and chgrp does not ...) TODO: check CVE-2018-5078 (Online Ticket Booking has XSS via the admin/eventlist.php cast ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/7416b0cc54c872977a85d63394ad1037848fc471 --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/7416b0cc54c872977a85d63394ad1037848fc471 You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1229-1 for imagemagick
Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker
Commits:
1bbfeacc by Chris Lamb at 2018-01-04T10:15:33+00:00
Reserve DLA-1229-1 for imagemagick
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[04 Jan 2018] DLA-1229-1 imagemagick - security update
+ {CVE-2017-1000445 CVE-2017-1000476}
+ [wheezy] - imagemagick 8:6.7.7.10-5+deb7u20
[03 Jan 2018] DLA-1228-1 poppler - security update
{CVE-2017-1000456}
[wheezy] - poppler 0.18.4-6+deb7u5
=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -27,8 +27,6 @@ graphicsmagick (Markus Koschany)
icu
NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in
Chromium project; report is not visible to the public
--
-imagemagick (Chris Lamb)
---
lame (Hugo Lefeuvre)
NOTE: Couldn't reproduce CVE-2017-{69-72}, but successfully reproduced
CVE-2017-150{18,45,46}
NOTE: 20171120: Backporting 3.100 is not conceivable, diff >40k lines.
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1bbfeacc038a92cb45e6007357f4bd597edd264a
---
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1bbfeacc038a92cb45e6007357f4bd597edd264a
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] NFU
Henri Salo pushed to branch master at Debian Security Tracker / security-tracker Commits: 682e7868 by Henri Salo at 2018-01-04T11:48:22+02:00 NFU - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -37,7 +37,7 @@ CVE-2018-5193 CVE-2018-5192 RESERVED CVE-2018-5191 (/usr/local/www/csrf/csrf-magic.php in the WebGUI in pfSense before ...) - TODO: check + NOT-FOR-US: pfSense CVE-2018-5190 RESERVED CVE-2018-5189 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/682e78682b1c28f47ade0c90d2de7b3bf26d1aed --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/682e78682b1c28f47ade0c90d2de7b3bf26d1aed You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: d812f405 by security tracker role at 2018-01-04T09:10:15+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -1,3 +1,273 @@ +CVE-2018-5210 (On Samsung mobile devices with N(7.x) software and Exynos chipsets, ...) + TODO: check +CVE-2018-5209 + RESERVED +CVE-2018-5208 + RESERVED +CVE-2018-5207 + RESERVED +CVE-2018-5206 + RESERVED +CVE-2018-5205 + RESERVED +CVE-2018-5204 + RESERVED +CVE-2018-5203 + RESERVED +CVE-2018-5202 + RESERVED +CVE-2018-5201 + RESERVED +CVE-2018-5200 + RESERVED +CVE-2018-5199 + RESERVED +CVE-2018-5198 + RESERVED +CVE-2018-5197 + RESERVED +CVE-2018-5196 + RESERVED +CVE-2018-5195 + RESERVED +CVE-2018-5194 + RESERVED +CVE-2018-5193 + RESERVED +CVE-2018-5192 + RESERVED +CVE-2018-5191 (/usr/local/www/csrf/csrf-magic.php in the WebGUI in pfSense before ...) + TODO: check +CVE-2018-5190 + RESERVED +CVE-2018-5189 + RESERVED +CVE-2018-5188 + RESERVED +CVE-2018-5187 + RESERVED +CVE-2018-5186 + RESERVED +CVE-2018-5185 + RESERVED +CVE-2018-5184 + RESERVED +CVE-2018-5183 + RESERVED +CVE-2018-5182 + RESERVED +CVE-2018-5181 + RESERVED +CVE-2018-5180 + RESERVED +CVE-2018-5179 + RESERVED +CVE-2018-5178 + RESERVED +CVE-2018-5177 + RESERVED +CVE-2018-5176 + RESERVED +CVE-2018-5175 + RESERVED +CVE-2018-5174 + RESERVED +CVE-2018-5173 + RESERVED +CVE-2018-5172 + RESERVED +CVE-2018-5171 + RESERVED +CVE-2018-5170 + RESERVED +CVE-2018-5169 + RESERVED +CVE-2018-5168 + RESERVED +CVE-2018-5167 + RESERVED +CVE-2018-5166 + RESERVED +CVE-2018-5165 + RESERVED +CVE-2018-5164 + RESERVED +CVE-2018-5163 + RESERVED +CVE-2018-5162 + RESERVED +CVE-2018-5161 + RESERVED +CVE-2018-5160 + RESERVED +CVE-2018-5159 + RESERVED +CVE-2018-5158 + RESERVED +CVE-2018-5157 + RESERVED +CVE-2018-5156 + RESERVED +CVE-2018-5155 + RESERVED +CVE-2018-5154 + RESERVED +CVE-2018-5153 + RESERVED +CVE-2018-5152 + RESERVED +CVE-2018-5151 + RESERVED +CVE-2018-5150 + RESERVED +CVE-2018-5149 + RESERVED +CVE-2018-5148 + RESERVED +CVE-2018-5147 + RESERVED +CVE-2018-5146 + RESERVED +CVE-2018-5145 + RESERVED +CVE-2018-5144 + RESERVED +CVE-2018-5143 + RESERVED +CVE-2018-5142 + RESERVED +CVE-2018-5141 + RESERVED +CVE-2018-5140 + RESERVED +CVE-2018-5139 + RESERVED +CVE-2018-5138 + RESERVED +CVE-2018-5137 + RESERVED +CVE-2018-5136 + RESERVED +CVE-2018-5135 + RESERVED +CVE-2018-5134 + RESERVED +CVE-2018-5133 + RESERVED +CVE-2018-5132 + RESERVED +CVE-2018-5131 + RESERVED +CVE-2018-5130 + RESERVED +CVE-2018-5129 + RESERVED +CVE-2018-5128 + RESERVED +CVE-2018-5127 + RESERVED +CVE-2018-5126 + RESERVED +CVE-2018-5125 + RESERVED +CVE-2018-5124 + RESERVED +CVE-2018-5123 + RESERVED +CVE-2018-5122 + RESERVED +CVE-2018-5121 + RESERVED +CVE-2018-5120 + RESERVED +CVE-2018-5119 + RESERVED +CVE-2018-5118 + RESERVED +CVE-2018-5117 + RESERVED +CVE-2018-5116 + RESERVED +CVE-2018-5115 + RESERVED +CVE-2018-5114 + RESERVED +CVE-2018-5113 + RESERVED +CVE-2018-5112 + RESERVED +CVE-2018-5111 + RESERVED +CVE-2018-5110 + RESERVED +CVE-2018-5109 + RESERVED +CVE-2018-5108 + RESERVED +CVE-2018-5107 + RESERVED +CVE-2018-5106 + RESERVED +CVE-2018-5105 + RESERVED +CVE-2018-5104 + RESERVED +CVE-2018-5103 + RESERVED +CVE-2018-5102 + RESERVED +CVE-2018-5101 + RESERVED +CVE-2018-5100 + RESERVED +CVE-2018-5099 + RESERVED +CVE-2018-5098 + RESERVED +CVE-2018-5097 + RESERVED +CVE-2018-5096 + RESERVED +CVE-2018-5095 + RESERVED +CVE-2018-5094 + RESERVED +CVE-2018-5093 + RESERVED +CVE-2018-5092 + RESERVED +CVE-2018-5091 + RESERVED +CVE-2018-5090 + RESERVED +CVE-2018-5089 + RESERVED +CVE-2018-5088 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) + TODO: check +CVE-2018-5087 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) + TODO: check +CVE-2018-5086 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) + TODO: check +CVE-2018-5085 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) + TODO: check +CVE-2018-5084 (In K7 AntiVirus 15.1.0306, the driver file (K7FWHlpr.sys) allows local ...) +
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Add upstream reference for CVE-2017-7559
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5bea03a6 by Salvatore Bonaccorso at 2018-01-04T09:47:33+01:00
Add upstream reference for CVE-2017-7559
Cf. https://bugzilla.redhat.com/show_bug.cgi?id=1481665#c15
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -41624,6 +41624,7 @@ CVE-2017-7559 [HTTP Request smuggling vulnerability
(incomplete fix of CVE-2017-
- undertow (bug #885576)
NOTE: CVE is for an incomplete fix of CVE-2017-2666
NOTE: Invalid characters were still allowed in the query string and
path parameters.
+ NOTE: https://issues.jboss.org/browse/UNDERTOW-1251
TODO: check, asked for clarification to Red Hat:
https://bugzilla.redhat.com/show_bug.cgi?id=1481665#c7
CVE-2017-7558 [sctp: out-of-bounds read in inet_diag_msg_sctp{,l}addr_fill()
and sctp_get_sctp_info()]
RESERVED
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/5bea03a6f049e4e5e4d6d78f6d9638a6145da846
---
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/5bea03a6f049e4e5e4d6d78f6d9638a6145da846
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] 2 commits: Triage imagemagick for LTS
Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker
Commits:
1a80eb18 by Chris Lamb at 2018-01-04T08:38:31+00:00
Triage imagemagick for LTS
- - - - -
47aa7d30 by Chris Lamb at 2018-01-04T08:38:35+00:00
Claim imagemagick in data/dla-needed.txt
- - - - -
1 changed file:
- data/dla-needed.txt
Changes:
=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -27,6 +27,8 @@ graphicsmagick (Markus Koschany)
icu
NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in
Chromium project; report is not visible to the public
--
+imagemagick (Chris Lamb)
+--
lame (Hugo Lefeuvre)
NOTE: Couldn't reproduce CVE-2017-{69-72}, but successfully reproduced
CVE-2017-150{18,45,46}
NOTE: 20171120: Backporting 3.100 is not conceivable, diff >40k lines.
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/compare/285364e3f9b86fcc71097ad37994fab898dbee74...47aa7d302160cd3163617aa399d1bb9e4af5236d
---
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/compare/285364e3f9b86fcc71097ad37994fab898dbee74...47aa7d302160cd3163617aa399d1bb9e4af5236d
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Two imagemagick issues ignored
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 285364e3 by Moritz Muehlenhoff at 2018-01-04T09:01:13+01:00 Two imagemagick issues ignored - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = --- a/data/CVE/list +++ b/data/CVE/list @@ -464,6 +464,8 @@ CVE-2017-1000477 (XMLBundle version 0.1.7 is vulnerable to XXE attacks which can TODO: check CVE-2017-1000476 (ImageMagick 7.0.7-12 Q16, a CPU exhaustion vulnerability was found in ...) - imagemagick + [stretch] - imagemagick (Minor issue) + [jessie] - imagemagick (Minor issue) NOTE: https://github.com/ImageMagick/ImageMagick/issues/867 NOTE: ImageMagick-6: https://github.com/ImageMagick/ImageMagick/commit/e5dae180b9236bccd73ce93bfce81e99232a8533 CVE-2017-1000473 (Linux Dash up to version v2 is vulnerable to multiple command ...) @@ -2653,6 +2655,8 @@ CVE-2017-1000448 (Structured Data Linter versions 2.4.1 and older are vulnerable TODO: check CVE-2017-1000445 (ImageMagick 7.0.7-1 and older version are vulnerable to null pointer ...) - imagemagick (bug #886281) + [stretch] - imagemagick (Minor issue) + [jessie] - imagemagick (Minor issue) NOTE: https://github.com/ImageMagick/ImageMagick/issues/775 NOTE: https://github.com/ImageMagick/ImageMagick/commit/441fde32557eb3cec573b0f877ac324173feed7f NOTE: ImageMagick-6: https://github.com/ImageMagick/ImageMagick/commit/839a14e43d0c88db7b3fffe8aa4ec57d80c93623 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/285364e3f9b86fcc71097ad37994fab898dbee74 --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/285364e3f9b86fcc71097ad37994fab898dbee74 You're receiving this email because of your account on salsa.debian.org. ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
