[Secure-testing-commits] r58351 - data
Author: jmm Date: 2017-12-08 06:44:41 + (Fri, 08 Dec 2017) New Revision: 58351 Modified: data/dsa-needed.txt Log: add openafs to dsa-needed Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-12-08 06:11:46 UTC (rev 58350) +++ data/dsa-needed.txt 2017-12-08 06:44:41 UTC (rev 58351) @@ -31,6 +31,8 @@ linux Wait until more issues have piled up -- +openafs (jmm) +-- openssl1.0/stable -- otrs2 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58347 - data/CVE
Author: jmm Date: 2017-12-07 21:43:17 + (Thu, 07 Dec 2017) New Revision: 58347 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-12-07 21:37:01 UTC (rev 58346) +++ data/CVE/list 2017-12-07 21:43:17 UTC (rev 58347) @@ -149,7 +149,7 @@ CVE-2017-17452 RESERVED CVE-2017-17451 (The WP Mailster plugin before 1.5.5 for WordPress has XSS in the ...) - TODO: check + NOT-FOR-US: Wordpress plugin CVE-2017-17450 (net/netfilter/xt_osf.c in the Linux kernel through 4.14.4 does not ...) - linux NOTE: https://lkml.org/lkml/2017/12/5/982 @@ -396,9 +396,9 @@ CVE-2017-17437 RESERVED CVE-2017-17436 (An issue was discovered in the software on Vaultek Gun Safe VT20i ...) - TODO: check + NOT-FOR-US: Vaultek Gun Safe CVE-2017-17435 (An issue was discovered in the software on Vaultek Gun Safe VT20i ...) - TODO: check + NOT-FOR-US: Vaultek Gun Safe CVE-2017-17434 (The daemon in rsync 3.1.2, and 3.1.3-development before 2017-12-03, ...) - rsync (bug #883665) NOTE: https://git.samba.org/?p=rsync.git;a=commit;h=5509597decdbd7b91994210f700329d8a35e70a1 @@ -409,7 +409,7 @@ CVE-2017-17431 (GeniXCMS 1.1.5 has XSS via the from, id, lang, menuid, mod, q, status, ...) NOT-FOR-US: GeniXCMS CVE-2017-17430 (Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows ...) - TODO: check + NOT-FOR-US: Sangoma NetBorder / Vega Session Controller CVE-2017-17429 RESERVED CVE-2017-17428 @@ -595,7 +595,7 @@ CVE-2017-17385 RESERVED CVE-2017-17384 (ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain ...) - TODO: check + NOT-FOR-US: ISPConfig CVE-2017-17383 (Jenkins through 2.93 allows remote authenticated administrators to ...) - jenkins CVE-2017-17382 @@ -2151,7 +2151,7 @@ CVE-2017-17056 (The ZKTime Web Software 2.0.1.12280 allows the Administrator to ...) NOT-FOR-US: ZKTeco ZKTime Web Software CVE-2017-17055 (Artica Web Proxy before 3.06.112911 allows remote attackers to execute ...) - TODO: check + NOT-FOR-US: Artica Web Proxy CVE-2017-17054 (In aubio 0.4.6, a divide-by-zero error exists in the function ...) - aubio (bug #883355) [stretch] - aubio (Minor issue) @@ -3956,7 +3956,7 @@ RESERVED NOT-FOR-US: Jenkins plugin CVE-2017-16884 (Cross-site scripting (XSS) vulnerability in MistServer before 2.13 ...) - TODO: check + NOT-FOR-US: MistServer CVE-2017-16883 (The outputSWF_TEXT_RECORD function in util/outputscript.c in libming = ...) - ming NOTE: https://github.com/libming/libming/issues/77 @@ -4396,7 +4396,7 @@ CVE-2017-16858 RESERVED CVE-2017-16857 (It is possible to bypass the bitbucket auto-unapprove plugin via ...) - TODO: check + NOT-FOR-US: Atlassian CVE-2017-16856 (The RSS Feed macro in Atlassian Confluence before version 6.5.2 allows ...) NOT-FOR-US: Atlassian Confluence CVE-2017-16855 (Ipsilon before 2.1.0 has a SAML2 multi-session vulnerability. ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58345 - data
Author: jmm Date: 2017-12-07 21:36:37 + (Thu, 07 Dec 2017) New Revision: 58345 Modified: data/dsa-needed.txt Log: add ruby2.1 to dsa-needed Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-12-07 21:35:53 UTC (rev 58344) +++ data/dsa-needed.txt 2017-12-07 21:36:37 UTC (rev 58345) @@ -49,6 +49,8 @@ -- qemu/oldstable -- +ruby2.1/oldstable +-- salt -- simplesamlphp ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58344 - data/CVE
Author: jmm Date: 2017-12-07 21:35:53 + (Thu, 07 Dec 2017) New Revision: 58344 Modified: data/CVE/list Log: qemu triage Modified: data/CVE/list === --- data/CVE/list 2017-12-07 21:23:37 UTC (rev 58343) +++ data/CVE/list 2017-12-07 21:35:53 UTC (rev 58344) @@ -602,6 +602,8 @@ RESERVED CVE-2017-17381 (The Virtio Vring implementation in QEMU allows local OS guest users to ...) - qemu (bug #883625) + [stretch] - qemu (Can be fixed along in later update) + [jessie] - qemu (Vulnerable code not present) - qemu-kvm NOTE: https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg00166.html CVE-2018-1140 @@ -9186,6 +9188,8 @@ CVE-2017-15119 [DoS via large option request] RESERVED - qemu (bug #883399) + [stretch] - qemu (Can be fixed along in later update) + [jessie] - qemu (Vulnerable code not present) - qemu-kvm [wheezy] - qemu-kvm (Vulnerable code introduced later) NOTE: https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05044.html ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58346 - data
Author: jmm Date: 2017-12-07 21:37:01 + (Thu, 07 Dec 2017) New Revision: 58346 Modified: data/dsa-needed.txt Log: add xen to dsa-needed Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-12-07 21:36:37 UTC (rev 58345) +++ data/dsa-needed.txt 2017-12-07 21:37:01 UTC (rev 58346) @@ -66,5 +66,7 @@ -- wordpress -- +xen/oldstable +-- zendframework/oldstable -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58343 - data/CVE
Author: jmm Date: 2017-12-07 21:23:37 + (Thu, 07 Dec 2017) New Revision: 58343 Modified: data/CVE/list Log: openssl triage Modified: data/CVE/list === --- data/CVE/list 2017-12-07 21:19:45 UTC (rev 58342) +++ data/CVE/list 2017-12-07 21:23:37 UTC (rev 58343) @@ -43621,8 +43621,11 @@ CVE-2017-3739 RESERVED CVE-2017-3738 (There is an overflow bug in the AVX2 Montgomery multiplication ...) - - openssl - - openssl1.0 + - openssl (low) + [stretch] - openssl (Can be fixed with next OpenSSL advisory round) + [jessie] - openssl (Vulnerable code not present) + [wheezy] - openssl (Vulnerable code not present) + - openssl1.0 (low) NOTE: https://www.openssl.org/news/secadv/20171207.txt NOTE: OpenSSL_1_1_0-stable: https://git.openssl.org/?p=openssl.git;a=commit;h=e502cc86df9dafded1694fceb3228ee34d11c11a NOTE: OpenSSL_1_0_2-stable: https://git.openssl.org/?p=openssl.git;a=commit;h=ca51bafc1a88d8b8348f5fd97adc5d6ca93f8e76 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58339 - in data: . CVE
Author: jmm Date: 2017-12-07 20:59:36 + (Thu, 07 Dec 2017) New Revision: 58339 Modified: data/CVE/list data/dsa-needed.txt Log: various no-dsa add two openssl and sqlite to dsa-needed Modified: data/CVE/list === --- data/CVE/list 2017-12-07 19:29:48 UTC (rev 58338) +++ data/CVE/list 2017-12-07 20:59:36 UTC (rev 58339) @@ -1,8 +1,12 @@ CVE-2017-17457 (The function d2ulaw_array() in ulaw.c of libsndfile 1.0.29pre1 may lead ...) - - libsndfile + - libsndfile (low) + [stretch] - libsndfile (Minor issue) + [jessie] - libsndfile (Minor issue) NOTE: https://github.com/erikd/libsndfile/issues/344 CVE-2017-17456 (The function d2alaw_array() in alaw.c of libsndfile 1.0.29pre1 may lead ...) - - libsndfile + - libsndfile (low) + [stretch] - libsndfile (Minor issue) + [jessie] - libsndfile (Minor issue) NOTE: https://github.com/erikd/libsndfile/issues/344 CVE-2017-17455 RESERVED @@ -3605,7 +3609,9 @@ CVE-2017-16934 (The web server on DBL DBLTek devices allows remote attackers to execute ...) NOT-FOR-US: DBL DBLTek devices CVE-2017-16933 (etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.0 has a chown ...) - - icinga2 (bug #883247) + - icinga2 (low; bug #883247) + [stretch] - icinga2 (Minor issue) + [jessie] - icinga2 (Minor issue) NOTE: https://github.com/Icinga/icinga2/issues/5793 CVE-2016-10700 (auth_login.php in Cacti before 1.0.0 allows remote authenticated users ...) - cacti 0.8.8h+ds1-5 (bug #833420) @@ -3936,8 +3942,9 @@ NOTE: https://github.com/upx/upx/issues/146 NOTE: crash in CLI tool, no security impact CVE-2017-16868 (In SWFTools 0.9.2, the wav_convert2mono function in lib/wav.c does not ...) - - swftools + - swftools (unimportant) NOTE: https://github.com/matthiaskramm/swftools/issues/52 + NOTE: Crash in CLI tool, no security impact CVE-2017-16867 (Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 ...) NOT-FOR-US: Amazon Key CVE-2017-1000248 (Redis-store =v1.3.0 allows unsafe objects to be loaded from redis ...) @@ -4020,23 +4027,31 @@ CVE-2017-1000188 (nodejs ejs version older than 2.5.5 is vulnerable to a ...) NOT-FOR-US: nodejs ejs CVE-2017-1000187 (In SWFTools, an address access exception was found in pdf2swf. ...) - - swftools + - swftools (unimportant) NOTE: https://github.com/matthiaskramm/swftools/issues/36 + NOTE: Crash in CLI tool, no security implications CVE-2017-1000186 (In SWFTools, a stack overflow was found in pdf2swf. ...) - - swftools + - swftools (unimportant) NOTE: https://github.com/matthiaskramm/swftools/issues/34 + NOTE: Crash in CLI tool, no security implications CVE-2017-1000185 (In SWFTools, a memcpy buffer overflow was found in gif2swf. ...) - swftools + [stretch] - swftools (Minor issue) + [jessie] - swftools (Minor issue) NOTE: https://github.com/matthiaskramm/swftools/issues/33 CVE-2017-1000182 (In SWFTools, a memory leak was found in wav2swf. ...) - - swftools + - swftools (unimportant) NOTE: https://github.com/matthiaskramm/swftools/issues/30 + NOTE: Crash in CLI tool, no security implications CVE-2017-1000176 (In SWFTools, a memcpy buffer overflow was found in swfc. ...) - swftools + [stretch] - swftools (Minor issue) + [jessie] - swftools (Minor issue) NOTE: https://github.com/matthiaskramm/swftools/issues/23 CVE-2017-1000174 (In SWFTools, an address access exception was found in swfdump ...) - - swftools + - swftools (unimportant) NOTE: https://github.com/matthiaskramm/swftools/issues/21 + NOTE: Crash in CLI tool, no security implications CVE-2017-1000173 (Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. ...) NOT-FOR-US: Creolabs Gravity CVE-2017-1000172 (Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. ...) @@ -4449,17 +4464,23 @@ NOT-FOR-US: CMS Made Simple CVE-2017-16797 (In SWFTools 0.9.2, the png_load function in lib/png.c does not properly ...) - swftools + [stretch] - swftools (Minor issue) + [jessie] - swftools (Minor issue) NOTE: https://github.com/matthiaskramm/swftools/issues/51 CVE-2017-16796 (In SWFTools 0.9.2, the png_load function in lib/png.c does not check ...) - - swftools + - swftools (unimportant) NOTE: https://github.com/matthiaskramm/swftools/issues/51 + NOTE: Crash in CLI tool, no security implications CVE-2017-16795 RESERVED CVE-2017-16794 (The png_load function in lib/png.c in SWFTools 0.9.2 does not properly ...) - - swftools + - swftools (unimportant) NOTE:
[Secure-testing-commits] r58322 - in data: . CVE
Author: jmm Date: 2017-12-07 12:53:29 + (Thu, 07 Dec 2017) New Revision: 58322 Modified: data/CVE/list data/dsa-needed.txt Log: new chromium issues (also libxml/icu) Modified: data/CVE/list === --- data/CVE/list 2017-12-07 10:12:09 UTC (rev 58321) +++ data/CVE/list 2017-12-07 12:53:29 UTC (rev 58322) @@ -8073,46 +8073,99 @@ RESERVED CVE-2017-15427 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15426 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15425 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15424 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15423 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15422 RESERVED + - icu CVE-2017-15421 RESERVED CVE-2017-15420 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15419 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15418 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15417 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15416 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15415 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15414 RESERVED CVE-2017-15413 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15412 RESERVED + - libxml2 CVE-2017-15411 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15410 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15409 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15408 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15407 RESERVED + - chromium-browser + [jessie] - chromium-browser (End of life, see DSA 4020) + [wheezy] - chromium-browser (Not supported in Wheezy) CVE-2017-15406 RESERVED CVE-2017-15405 Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-12-07 10:12:09 UTC (rev 58321) +++ data/dsa-needed.txt 2017-12-07 12:53:29 UTC (rev 58322) @@ -14,6 +14,8 @@ -- 389-ds-base (fw) -- +chromium-browser +-- erlang (jmm) -- graphicsmagick ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58321 - data
Author: jmm Date: 2017-12-07 10:12:09 + (Thu, 07 Dec 2017) New Revision: 58321 Modified: data/dsa-needed.txt Log: take erlang Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-12-07 10:02:24 UTC (rev 58320) +++ data/dsa-needed.txt 2017-12-07 10:12:09 UTC (rev 58321) @@ -14,7 +14,7 @@ -- 389-ds-base (fw) -- -erlang +erlang (jmm) -- graphicsmagick -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58312 - data/CVE
Author: jmm
Date: 2017-12-06 22:41:15 + (Wed, 06 Dec 2017)
New Revision: 58312
Modified:
data/CVE/list
Log:
libextractor no-dsa
Modified: data/CVE/list
===
--- data/CVE/list 2017-12-06 21:55:57 UTC (rev 58311)
+++ data/CVE/list 2017-12-06 22:41:15 UTC (rev 58312)
@@ -217,6 +217,8 @@
NOTE:
https://bitbucket.org/mpyne/game-music-emu/issues/14/addresssanitizer-negative-size-param-size
CVE-2017-17440 (GNU Libextractor 1.6 allows remote attackers to cause a denial
of ...)
- libextractor (bug #883528)
+ [stretch] - libextractor (Minor issue)
+ [jessie] - libextractor (Minor issue)
NOTE: Fixed by:
https://gnunet.org/git/libextractor.git/commit/?id=7cc63b001ceaf81143795321379c835486d0c92e
CVE-2017-17439 (In Heimdal through 7.4, remote unauthenticated attackers are
able to ...)
- heimdal (bug #878144)
@@ -6887,6 +6889,8 @@
CVE-2017-15922 (In GNU Libextractor 1.4, there is an out-of-bounds read in the
...)
{DLA-1198-1}
- libextractor (low; bug #880016)
+ [stretch] - libextractor (Minor issue)
+ [jessie] - libextractor (Minor issue)
NOTE:
http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg8.html
NOTE: Fixed by:
https://gnunet.org/git/libextractor.git/commit/?id=d4d488b0e5ab13dda241d688d87a07816368f117
CVE-2017-15921 (In Watchdog Anti-Malware 2.74.186.150 and Online Security Pro
...)
@@ -7629,17 +7633,23 @@
RESERVED
CVE-2017-15602 (In GNU Libextractor 1.4, there is an integer signedness error
for the ...)
{DLA-1198-1}
- - libextractor 1:1.6-1
+ - libextractor 1:1.6-1 (low)
+ [stretch] - libextractor (Minor issue)
+ [jessie] - libextractor (Minor issue)
NOTE:
http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg5.html
NOTE: Fixed by
https://gnunet.org/git/libextractor.git/commit/?id=ffab889c1710c7646af9ed360c796a2a0a619efc
CVE-2017-15601 (In GNU Libextractor 1.4, there is a heap-based buffer overflow
in the ...)
{DLA-1198-1}
- - libextractor 1:1.6-1
+ - libextractor 1:1.6-1 (low)
+ [stretch] - libextractor (Minor issue)
+ [jessie] - libextractor (Minor issue)
NOTE:
http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg6.html
NOTE: Fixed by
https://gnunet.org/git/libextractor.git/commit/?id=f813535dad4ad860b989952a46266a1469801091
CVE-2017-15600 (In GNU Libextractor 1.4, there is a NULL Pointer Dereference
in the ...)
{DLA-1198-1}
- - libextractor 1:1.6-1
+ - libextractor 1:1.6-1 (low)
+ [stretch] - libextractor (Minor issue)
+ [jessie] - libextractor (Minor issue)
NOTE:
http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg4.html
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1501695
NOTE: Fixed by
https://gnunet.org/git/libextractor.git/commit/?id=38e8933539ee9d044057b18a971c2eae3c21aba7
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58303 - data
Author: jmm Date: 2017-12-06 17:02:56 + (Wed, 06 Dec 2017) New Revision: 58303 Modified: data/dsa-needed.txt Log: take wireshark Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-12-06 16:32:33 UTC (rev 58302) +++ data/dsa-needed.txt 2017-12-06 17:02:56 UTC (rev 58303) @@ -57,9 +57,7 @@ -- thunderbird -- -wireshark - 2017-05-13: asked balint@ if he wants to prepare an update now - 2017-07-28: re-ping balint@ +wireshark (jmm) -- wordpress -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58281 - data/CVE
Author: jmm
Date: 2017-12-05 22:48:11 + (Tue, 05 Dec 2017)
New Revision: 58281
Modified:
data/CVE/list
Log:
thunderbird fixed
Modified: data/CVE/list
===
--- data/CVE/list 2017-12-05 22:31:15 UTC (rev 58280)
+++ data/CVE/list 2017-12-05 22:48:11 UTC (rev 58281)
@@ -30304,7 +30304,7 @@
{DSA-4035-1 DLA-1172-1}
- firefox 57.0-1
- firefox-esr 52.5.0esr-1
- - thunderbird
+ - thunderbird 1:52.5.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7830
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/#CVE-2017-7830
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/#CVE-2017-7830
@@ -30315,7 +30315,7 @@
{DSA-4035-1 DLA-1172-1}
- firefox 57.0-1
- firefox-esr 52.5.0esr-1
- - thunderbird
+ - thunderbird 1:52.5.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7828
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/#CVE-2017-7828
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/#CVE-2017-7828
@@ -30328,7 +30328,7 @@
{DSA-4035-1 DLA-1172-1}
- firefox 57.0-1
- firefox-esr 52.5.0esr-1
- - thunderbird
+ - thunderbird 1:52.5.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7826
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/#CVE-2017-7826
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-26/#CVE-2017-7826
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58280 - data/CVE
Author: jmm Date: 2017-12-05 22:31:15 + (Tue, 05 Dec 2017) New Revision: 58280 Modified: data/CVE/list Log: new condor issue Modified: data/CVE/list === --- data/CVE/list 2017-12-05 21:29:44 UTC (rev 58279) +++ data/CVE/list 2017-12-05 22:31:15 UTC (rev 58280) @@ -4097,6 +4097,7 @@ RESERVED CVE-2017-16816 RESERVED + - condor 8.6.8~dfsg.1-1 CVE-2017-16815 (installer.php in the Snap Creek Duplicator (WordPress Site Migration ...) NOT-FOR-US: Snap Creek Duplicator (WordPress Site Migration & Backup) plugin for WordPress CVE-2017-16820 (The csnmp_read_table function in snmp.c in the SNMP plugin in collectd ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58270 - data/CVE
Author: jmm Date: 2017-12-05 16:06:09 + (Tue, 05 Dec 2017) New Revision: 58270 Modified: data/CVE/list Log: new kfreebsd issues Modified: data/CVE/list === --- data/CVE/list 2017-12-05 16:04:10 UTC (rev 58269) +++ data/CVE/list 2017-12-05 16:06:09 UTC (rev 58270) @@ -50084,11 +50084,14 @@ CVE-2017-1089 RESERVED CVE-2017-1088 (In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, ...) - TODO: check + - kfreebsd-10 (unimportant) + NOTE: kfreebsd not covered by security support CVE-2017-1087 (In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and ...) - TODO: check + - kfreebsd-10 (unimportant) + NOTE: kfreebsd not covered by security support CVE-2017-1086 (In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, ...) - TODO: check + - kfreebsd-10 (unimportant) + NOTE: kfreebsd not covered by security support CVE-2017-1085 RESERVED CVE-2017-1084 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58269 - data/CVE
Author: jmm Date: 2017-12-05 16:04:10 + (Tue, 05 Dec 2017) New Revision: 58269 Modified: data/CVE/list Log: mark as NFU, limited to builds on Android Modified: data/CVE/list === --- data/CVE/list 2017-12-05 15:41:50 UTC (rev 58268) +++ data/CVE/list 2017-12-05 16:04:10 UTC (rev 58269) @@ -51125,11 +51125,7 @@ CVE-2017-0673 (A remote code execution vulnerability in the Android media framework. ...) NOT-FOR-US: Android media framework CVE-2017-0672 (A denial of service vulnerability in the Android libraries. Product: ...) - - firefox-esr - - firefox 54.0-1 - - qtwebengine-opensource-src - - icedove - - thunderbird + NOT-FOR-US: Android CVE-2017-0671 (A remote code execution vulnerability in the Android libraries. ...) NOT-FOR-US: Android NOTE: Not publicly available ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58268 - data/CVE
Author: jmm Date: 2017-12-05 15:41:50 + (Tue, 05 Dec 2017) New Revision: 58268 Modified: data/CVE/list Log: no need to track android bugs for firefox, those only affect Firefox builds for Android Modified: data/CVE/list === --- data/CVE/list 2017-12-05 15:37:29 UTC (rev 58267) +++ data/CVE/list 2017-12-05 15:41:50 UTC (rev 58268) @@ -50773,11 +50773,6 @@ NOT-FOR-US: Fluoride Bluetooth stack in Android CVE-2017-0841 (A remote code execution vulnerability in the Android system ...) - android-platform-system-core (unimportant) - - firefox - - firefox-esr - - icedove - - thunderbird - TODO: Vulnerable code exists in firefox/firefox-esr and thunderbird/icedove but not sure if affected NOTE: Fixed by https://android.googlesource.com/platform/system/core/+/47efc676c849e3abf32001d66e2d6eb887e83c48%5E!/ CVE-2017-0840 (An information disclosure vulnerability in the Android media framework ...) NOT-FOR-US: Android media framework ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58267 - data/CVE
Author: jmm Date: 2017-12-05 15:37:29 + (Tue, 05 Dec 2017) New Revision: 58267 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-12-05 15:10:29 UTC (rev 58266) +++ data/CVE/list 2017-12-05 15:37:29 UTC (rev 58267) @@ -20925,15 +20925,15 @@ CVE-2017-11018 (In android for MSM, Firefox OS for MSM, QRD Android, with all Android ...) NOT-FOR-US: Qualcomm components for Android CVE-2017-11017 (In android for MSM, Firefox OS for MSM, QRD Android, with all Android ...) - TODO: check + NOT-FOR-US: Qualcomm components for Android CVE-2017-11016 RESERVED CVE-2017-11015 (In android for MSM, Firefox OS for MSM, QRD Android, with all Android ...) - TODO: check + NOT-FOR-US: Qualcomm components for Android CVE-2017-11014 (In android for MSM, Firefox OS for MSM, QRD Android, with all Android ...) - TODO: check + NOT-FOR-US: Qualcomm components for Android CVE-2017-11013 (In android for MSM, Firefox OS for MSM, QRD Android, with all Android ...) - TODO: check + NOT-FOR-US: Qualcomm components for Android CVE-2017-11012 (In android for MSM, Firefox OS for MSM, QRD Android, with all Android ...) NOT-FOR-US: Qualcomm components for Android CVE-2017-11011 @@ -21304,9 +21304,9 @@ CVE-2017-10900 (PTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass ...) NOT-FOR-US: PTW-WMS1 firmware CVE-2017-10899 (SQL injection vulnerability in the A-Reserve and A-Reserve for MT ...) - TODO: check + NOT-FOR-US: A-Reserve CVE-2017-10898 (SQL injection vulnerability in the A-Member and A-Member for MT cloud ...) - TODO: check + NOT-FOR-US: A-Member CVE-2017-10897 RESERVED CVE-2017-10896 @@ -29525,7 +29525,7 @@ CVE-2017-8045 (In Pivotal Spring AMQP versions prior to 1.7.4, 1.6.11, and 1.5.7, an ...) NOT-FOR-US: Spring AMQP CVE-2017-8044 (In Pivotal Single Sign-On for PCF (1.3.x versions prior to 1.3.4 and ...) - TODO: check + NOT-FOR-US: Pivotal SSO CVE-2017-8043 RESERVED CVE-2017-8042 @@ -50724,17 +50724,17 @@ CVE-2017-0866 (An elevation of privilege vulnerability in the Direct rendering ...) NOT-FOR-US: NVIDIA components for Android CVE-2017-0865 (An elevation of privilege vulnerability in the MediaTek soc driver. ...) - TODO: check + NOT-FOR-US: MediaTek driver for Android CVE-2017-0864 (An elevation of privilege vulnerability in the MediaTek ioctl ...) - TODO: check + NOT-FOR-US: MediaTek driver for Android CVE-2017-0863 (An elevation of privilege vulnerability in the Upstream kernel video ...) - TODO: check + NOT-FOR-US: Android driver (proprietary, not part of upstream kernel) CVE-2017-0862 (An elevation of privilege vulnerability in the Upstream kernel kernel. ...) - TODO: check + NOT-FOR-US: Android driver (proprietary, not part of upstream kernel) CVE-2017-0861 (An elevation of privilege vulnerability in the Upstream kernel audio ...) - TODO: check + NOT-FOR-US: Android driver (proprietary, not part of upstream kernel) CVE-2017-0860 (An elevation of privilege vulnerability in the Android system ...) - TODO: check + NOT-FOR-US: Android CVE-2017-0859 (Another vulnerability in the Android media framework (n/a). Product: ...) NOT-FOR-US: Android media framework CVE-2017-0858 (Another vulnerability in the Android media framework (n/a). Product: ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58265 - data/CVE
Author: jmm
Date: 2017-12-05 09:18:13 + (Tue, 05 Dec 2017)
New Revision: 58265
Modified:
data/CVE/list
Log:
nasm fixed
further wireshark triage
Modified: data/CVE/list
===
--- data/CVE/list 2017-12-05 09:10:17 UTC (rev 58264)
+++ data/CVE/list 2017-12-05 09:18:13 UTC (rev 58265)
@@ -11398,7 +11398,7 @@
NOTE: https://github.com/mdadams/jasper/issues/146
NOTE: Possible false-positive, cf.
https://github.com/mdadams/jasper/issues/146#issuecomment-330674648
CVE-2017-14228 (In Netwide Assembler (NASM) 2.14rc0, there is an illegal
address access ...)
- - nasm (unimportant; bug #874731)
+ - nasm 2.13.02-0.1 (unimportant; bug #874731)
NOTE: https://bugzilla.nasm.us/show_bug.cgi?id=3392423
NOTE: Crash in CLI tool, no securiy impact
CVE-2017-14227 (In MongoDB libbson 1.7.0, the bson_iter_codewscope function in
...)
@@ -12658,6 +12658,8 @@
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-38.html
CVE-2017-13766 (In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O
dissector could ...)
- wireshark 2.4.1-1
+ [jessie] - wireshark (Vulnerable code not present)
+ [wheezy] - wireshark (Vulnerable code not present)
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13847
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=2096bc1e5078732543e0a3ee115a2ce520a72bbc
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=af7b093ca528516c14247acb545046199d30843e
@@ -19643,7 +19645,8 @@
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3c7168cc5f044b4da8747d35da0b2b204dabf398
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-13.html
CVE-2017-11409 (In Wireshark 2.0.0 to 2.0.13, the GPRS LLC dissector could go
into a ...)
- - wireshark 2.2.0~rc1+g438c022-1
+ - wireshark 2.2.0~rc1+g438c022-1 (low)
+ [jessie] - wireshark (Minor issue)
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13603
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=57b83bbbd76f543eb8d108919f13b662910bff9a
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-37.html
@@ -20690,7 +20693,7 @@
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1464686
CVE-2017-1 (In Netwide Assembler (NASM) 2.14rc0, preproc.c allows remote
attackers ...)
{DLA-1041-1}
- - nasm (bug #867988)
+ - nasm 2.13.02-0.1 (bug #867988)
[stretch] - nasm (Minor issue)
[jessie] - nasm (Minor issue)
NOTE: https://bugzilla.nasm.us/show_bug.cgi?id=3392415
@@ -21798,7 +21801,7 @@
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1466411
CVE-2017-10686 (In Netwide Assembler (NASM) 2.14rc0, there are multiple heap
use after ...)
{DLA-1041-1}
- - nasm (bug #867988)
+ - nasm 2.13.02-0.1 (bug #867988)
[stretch] - nasm (Minor issue)
[jessie] - nasm (Minor issue)
NOTE: https://bugzilla.nasm.us/show_bug.cgi?id=3392414
@@ -30777,6 +30780,7 @@
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13581
CVE-2017-7747 (In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the PacketBB
dissector ...)
- wireshark 2.2.6+g32dac6a-1
+ [jessie] - wireshark (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-18.html
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=5cfd52d6629cf8a7ab67c6bacd3431a964f43584
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13559
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58257 - data/CVE
Author: jmm
Date: 2017-12-04 22:34:40 + (Mon, 04 Dec 2017)
New Revision: 58257
Modified:
data/CVE/list
Log:
further wireshark triage
Modified: data/CVE/list
===
--- data/CVE/list 2017-12-04 21:29:34 UTC (rev 58256)
+++ data/CVE/list 2017-12-04 22:34:40 UTC (rev 58257)
@@ -30600,7 +30600,8 @@
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/#CVE-2017-7749
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-17/#CVE-2017-7749
CVE-2017-7748 (In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WSP
dissector ...)
- - wireshark 2.2.6+g32dac6a-1
+ - wireshark 2.2.6+g32dac6a-1 (low)
+ [jessie] - wireshark (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-21.html
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f55cbcde2c8f74b652add4450b0592082eb6acff
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13581
@@ -30610,7 +30611,8 @@
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=5cfd52d6629cf8a7ab67c6bacd3431a964f43584
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13559
CVE-2017-7746 (In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the SLSK
dissector ...)
- - wireshark 2.2.6+g32dac6a-1
+ - wireshark 2.2.6+g32dac6a-1 (low)
+ [jessie] - wireshark (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-19.html
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=58e69cc769dea24b721abd8a29f9eedc11024b7e
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13576
@@ -30731,12 +30733,14 @@
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=6032b0fe5fc1176ab77e03e20765f95fbd21b19e
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=da53a90b6895e47e03c5de05edf84bd99d535fd8
CVE-2017-7703 (In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the IMAP
dissector ...)
- - wireshark 2.2.6+g32dac6a-1
+ - wireshark 2.2.6+g32dac6a-1 (low)
+ [jessie] - wireshark (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-12.html
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13466
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=671e32820ab29d41d712cc8a472eab9b672684d9
CVE-2017-7702 (In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the WBXML
dissector ...)
- - wireshark 2.2.6+g32dac6a-1
+ - wireshark 2.2.6+g32dac6a-1 (low)
+ [jessie] - wireshark (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-13.html
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13477
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=2f322f66cbcca2fefdaa630494f9d6c97eb659b7
@@ -30752,7 +30756,8 @@
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=fa31f69b407436d0946f84baa0acdcc50962bf7a
CVE-2017-7700 (In Wireshark 2.2.0 to 2.2.5 and 2.0.0 to 2.0.11, the NetScaler
file ...)
{DLA-858-1}
- - wireshark 2.2.6+g32dac6a-1
+ - wireshark 2.2.6+g32dac6a-1 (low)
+ [jessie] - wireshark (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2017-14.html
NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13478
NOTE:
https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8fc0af859de4993951a915ad735be350221f3f53
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58248 - data/CVE
Author: jmm Date: 2017-12-04 17:21:24 + (Mon, 04 Dec 2017) New Revision: 58248 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-12-04 17:17:12 UTC (rev 58247) +++ data/CVE/list 2017-12-04 17:21:24 UTC (rev 58248) @@ -762,11 +762,11 @@ CVE-2017-17115 RESERVED CVE-2017-17114 (ntguard.sys and ntguard_x64.sys 0.18780.0.0 in IKARUS anti.virus ...) - TODO: check + NOT-FOR-US: IKARUS CVE-2017-17113 (ntguard_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 has a NULL ...) - TODO: check + NOT-FOR-US: IKARUS CVE-2017-17112 (ntguard_x64.sys 0.18780.0.0 in IKARUS anti.virus 2.16.15 has a Pool ...) - TODO: check + NOT-FOR-US: IKARUS CVE-2017-17111 RESERVED CVE-2017-17110 @@ -782,23 +782,23 @@ CVE-2017-17105 RESERVED CVE-2017-17104 (Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-17103 (Fiyo CMS 2.0.7 has SQL injection in /apps/app_user/sys_user.php via ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-17102 (Fiyo CMS 2.0.7 has SQL injection in /system/site.php via ...) - TODO: check + NOT-FOR-US: Fiyo CMS CVE-2017-17101 RESERVED CVE-2017-17100 RESERVED CVE-2017-17099 (There exists an unauthenticated SEH based Buffer Overflow vulnerability ...) - TODO: check + NOT-FOR-US: Flexense SyncBreeze Enterprise CVE-2017-17098 RESERVED CVE-2017-17097 RESERVED CVE-2017-17096 (Cross-site scripting (XSS) vulnerability in the Content Cards plugin ...) - TODO: check + NOT-FOR-US: Wordpress plugin CVE-2017-17090 (An issue was discovered in chan_skinny.c in Asterisk Open Source ...) - asterisk (bug #883342) NOTE: http://downloads.digium.com/pub/security/AST-2017-013.html ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58247 - data/CVE
Author: jmm Date: 2017-12-04 17:17:12 + (Mon, 04 Dec 2017) New Revision: 58247 Modified: data/CVE/list Log: new libav issue Modified: data/CVE/list === --- data/CVE/list 2017-12-04 17:13:11 UTC (rev 58246) +++ data/CVE/list 2017-12-04 17:17:12 UTC (rev 58247) @@ -703,7 +703,7 @@ CVE-2017-17129 (The ff_vc1_mc_4mv_chroma4 function in libavcodec/vc1_mc.c in Libav 12.2 ...) - libav (Vulnerable code introduced in 12.x) CVE-2017-17128 (The h264_slice_init function in libavcodec/h264_slice.c in Libav 12.2 ...) - TODO: check + - libav CVE-2017-17127 (The vc1_decode_frame function in libavcodec/vc1dec.c in Libav 12.2 ...) - libav [jessie] - libav (Minor issue) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58246 - data/CVE
Author: jmm Date: 2017-12-04 17:13:11 + (Mon, 04 Dec 2017) New Revision: 58246 Modified: data/CVE/list Log: new ffmpeg issue Modified: data/CVE/list === --- data/CVE/list 2017-12-04 17:06:43 UTC (rev 58245) +++ data/CVE/list 2017-12-04 17:13:11 UTC (rev 58246) @@ -699,7 +699,7 @@ CVE-2017-17131 RESERVED CVE-2017-17130 (The ff_free_picture_tables function in libavcodec/mpegpicture.c in ...) - TODO: check + - libav CVE-2017-17129 (The ff_vc1_mc_4mv_chroma4 function in libavcodec/vc1_mc.c in Libav 12.2 ...) - libav (Vulnerable code introduced in 12.x) CVE-2017-17128 (The h264_slice_init function in libavcodec/h264_slice.c in Libav 12.2 ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58245 - data/CVE
Author: jmm Date: 2017-12-04 17:06:43 + (Mon, 04 Dec 2017) New Revision: 58245 Modified: data/CVE/list Log: one new libav issue n/a Modified: data/CVE/list === --- data/CVE/list 2017-12-04 11:24:11 UTC (rev 58244) +++ data/CVE/list 2017-12-04 17:06:43 UTC (rev 58245) @@ -701,7 +701,7 @@ CVE-2017-17130 (The ff_free_picture_tables function in libavcodec/mpegpicture.c in ...) TODO: check CVE-2017-17129 (The ff_vc1_mc_4mv_chroma4 function in libavcodec/vc1_mc.c in Libav 12.2 ...) - TODO: check + - libav (Vulnerable code introduced in 12.x) CVE-2017-17128 (The h264_slice_init function in libavcodec/h264_slice.c in Libav 12.2 ...) TODO: check CVE-2017-17127 (The vc1_decode_frame function in libavcodec/vc1dec.c in Libav 12.2 ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58243 - data/CVE
Author: jmm Date: 2017-12-04 09:55:35 + (Mon, 04 Dec 2017) New Revision: 58243 Modified: data/CVE/list Log: new libav issue (ffmpeg not affected or fixed before reupload to archive, not really worth investigating) Modified: data/CVE/list === --- data/CVE/list 2017-12-04 09:54:26 UTC (rev 58242) +++ data/CVE/list 2017-12-04 09:55:35 UTC (rev 58243) @@ -705,7 +705,8 @@ CVE-2017-17128 (The h264_slice_init function in libavcodec/h264_slice.c in Libav 12.2 ...) TODO: check CVE-2017-17127 (The vc1_decode_frame function in libavcodec/vc1dec.c in Libav 12.2 ...) - TODO: check + - libav + [jessie] - libav (Minor issue) CVE-2017-17126 (The load_debug_section function in readelf.c in GNU Binutils 2.29.1 ...) - binutils [stretch] - binutils (Minor issue) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58232 - in data: . DSA
Author: jmm
Date: 2017-12-03 18:52:55 + (Sun, 03 Dec 2017)
New Revision: 58232
Modified:
data/DSA/list
data/dsa-needed.txt
Log:
tor DSA
Modified: data/DSA/list
===
--- data/DSA/list 2017-12-03 16:40:49 UTC (rev 58231)
+++ data/DSA/list 2017-12-03 18:52:55 UTC (rev 58232)
@@ -1,3 +1,7 @@
+[03 Dec 2017] DSA-4054-1 tor - security update
+ {CVE-2017-8819 CVE-2017-8820 CVE-2017-8821 CVE-2017-8822 CVE-2017-8823}
+ [jessie] - tor 0.2.5.16-1
+ [stretch] - tor 0.2.9.14-1
[30 Nov 2017] DSA-4053-1 exim4 - security update
{CVE-2017-16943 CVE-2017-16944}
[stretch] - exim4 4.89-2+deb9u2
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-12-03 16:40:49 UTC (rev 58231)
+++ data/dsa-needed.txt 2017-12-03 18:52:55 UTC (rev 58232)
@@ -52,8 +52,6 @@
--
thunderbird
--
-tor
---
wireshark
2017-05-13: asked balint@ if he wants to prepare an update now
2017-07-28: re-ping balint@
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58197 - data/CVE
Author: jmm Date: 2017-12-01 21:41:40 + (Fri, 01 Dec 2017) New Revision: 58197 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-12-01 21:36:43 UTC (rev 58196) +++ data/CVE/list 2017-12-01 21:41:40 UTC (rev 58197) @@ -2256,11 +2256,11 @@ CVE-2017-16954 RESERVED CVE-2017-16953 (connoppp.cgi on ZTE ZXDSL 831CII devices does not require HTTP Basic ...) - TODO: check + NOT-FOR-US: ZTE CVE-2017-16952 (KMPlayer 4.2.2.4 allows remote attackers to cause a denial of service ...) TODO: check CVE-2017-16951 (Winamp Pro 5.66 Build 3512 allows remote attackers to cause a denial ...) - TODO: check + NOT-FOR-US: Winamp CVE-2017-16950 RESERVED CVE-2017-16949 @@ -2429,11 +2429,11 @@ NOTE: https://discourse.tt-rss.org/t/sql-injection-in-forgotpass-fixed/669 NOTE: https://git.tt-rss.org/git/tt-rss/commit/2352c320c2ed34ec7df1ad22f0c55a1b26489815 CVE-2017-16895 (The (1) arq_updater, (2) arqcommitter, (3) standardrestorer, (4) ...) - TODO: check + NOT-FOR-US: Arq CVE-2017-16894 (In Laravel framework through 5.5.21, remote attackers can obtain ...) NOT-FOR-US: Laravel framework CVE-2017-16893 (The application Piwigo is affected by an SQL injection vulnerability ...) - TODO: check + - piwigo CVE-2017-16892 (In Bftpd before 4.7, there is a memory leak in the file rename ...) - bftpd (bug #640469) NOTE: http://bftpd.sourceforge.net/news.html#032390 @@ -6102,7 +6102,7 @@ CVE-2017-15708 RESERVED CVE-2017-15707 (In Apache Struts 2.5 to 2.5.14, the REST Plugin is using an outdated ...) - TODO: check + - libstruts1.2-java (Specific to 2.x) CVE-2017-15706 RESERVED CVE-2017-15705 @@ -6978,7 +6978,7 @@ CVE-2017-15358 RESERVED CVE-2017-15357 (The setpermissions function in the auto-updater in Arq before 5.9.7 ...) - TODO: check + NOT-FOR-US: Arq CVE-2017-15356 RESERVED CVE-2017-15355 @@ -8298,7 +8298,7 @@ - linux (Vulnerable code introduced in v4.13-rc1) NOTE: Fixed by: https://git.kernel.org/linus/6c85501f2fabcfc4fc6ed976543d252c4eaf4be9 CVE-2017-14953 (HikVision Wi-Fi IP cameras, when used in a wired configuration, allow ...) - TODO: check + NOT-FOR-US: HikVision CVE-2017-14952 (Double free in i18n/zonemeta.cpp in International Components for ...) - icu 57.1-7 (bug #878840) [stretch] - icu (Should be fixed along in future update) @@ -9375,7 +9375,7 @@ CVE-2017-14592 RESERVED CVE-2017-14591 (Atlassian Fisheye and Crucible versions less than 4.4.3 and version ...) - TODO: check + NOT-FOR-US: Atlassian CVE-2017-14590 RESERVED CVE-2017-14589 @@ -9385,9 +9385,9 @@ CVE-2017-14587 (The administration user deletion resource in Atlassian FishEye and ...) NOT-FOR-US: Atlassian CVE-2017-14586 (The Hipchat for Mac desktop client is vulnerable to client-side remote ...) - TODO: check + NOT-FOR-US: Atlassian CVE-2017-14585 (A Server Side Request Forgery (SSRF) vulnerability could lead to ...) - TODO: check + NOT-FOR-US: Atlassian CVE-2017-14584 RESERVED CVE-2017-14583 @@ -9690,9 +9690,9 @@ CVE-2017-14488 RESERVED CVE-2017-14487 (The OhMiBod Remote app for Android and iOS allows remote attackers to ...) - TODO: check + NOT-FOR-US: OhMiBod Remote app CVE-2017-14486 (The Vibease Wireless Remote Vibrator app for Android and the Vibease ...) - TODO: check + NOT-FOR-US: Vibease Wireless Remote Vibrator app CVE-2017-14485 RESERVED CVE-2017-14484 (The Gentoo sci-mathematics/gimps package before 28.10-r1 for Great ...) @@ -10487,11 +10487,11 @@ CVE-2017-14199 RESERVED CVE-2017-14198 (An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before ...) - TODO: check + NOT-FOR-US: Squiz Matrix CVE-2017-14197 (An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before ...) - TODO: check + NOT-FOR-US: Squiz Matrix CVE-2017-14196 (An issue was discovered in Squiz Matrix from 5.3 through to 5.3.6.1 and ...) - TODO: check + NOT-FOR-US: Squiz Matrix CVE-2017-14195 (The call_msg function in controllers/Form.php in dayrui FineCms 5.0.11 ...) NOT-FOR-US: dayrui FineCms CVE-2017-14194 (The out function in controllers/member/Login.php in dayrui FineCms ...) @@ -12124,9 +12124,9 @@ CVE-2017-13665 RESERVED CVE-2017-13664 (Password file exposure in firmware in iSmartAlarm CubeOne version ...) - TODO: check + NOT-FOR-US: iSmartAlarm CubeOne CVE-2017-13663 (Encryption key exposure in firmware in iSmartAlarm CubeOne version ...) - TODO: check + NOT-FOR-US: iSmartAlarm CubeOne CVE-2017-13662 RESERVED CVE-2017-13661
[Secure-testing-commits] r58196 - data/CVE
Author: jmm Date: 2017-12-01 21:36:43 + (Fri, 01 Dec 2017) New Revision: 58196 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-12-01 21:10:21 UTC (rev 58195) +++ data/CVE/list 2017-12-01 21:36:43 UTC (rev 58196) @@ -1356,19 +1356,19 @@ CVE-2017-16995 RESERVED CVE-2016-10702 (Pebble Smartwatch devices through 4.3 mishandle UUID storage, which ...) - TODO: check + NOT-FOR-US: Pebble CVE-2016-10701 (In Hitachi Vantara Pentaho BA Platform through 8.0, a CSRF issue exists ...) NOT-FOR-US: Hitachi Vantara Pentaho BA Platform CVE-2017-1001004 (typed-function before 0.10.6 had an arbitrary code execution in the ...) - TODO: check + NOT-FOR-US: typed-function CVE-2017-1001003 (math.js before 3.17.0 had an issue where private properties such as a ...) - TODO: check + NOT-FOR-US: math.js CVE-2017-1001002 (math.js before 3.17.0 had an arbitrary code execution in the ...) - TODO: check + NOT-FOR-US: math.js CVE-2017-1000214 (GitPHP by xiphux is vulnerable to OS Command Injections ...) - TODO: check + NOT-FOR-US: GitPHP CVE-2017-1000207 (A vulnerability in Swagger-Parser's version = 1.0.30 and Swagger ...) - TODO: check + NOT-FOR-US: Swagger-Parser CVE-2017-1000159 (Command injection in evince 3.24.8 via filename when printing to PDF ...) - evince 3.25.92-1 NOTE: https://bugzilla.gnome.org/show_bug.cgi?id=784947 @@ -2238,7 +2238,7 @@ CVE-2017-16963 RESERVED CVE-2017-16962 (The WebMail components (Crystal, pronto, and pronto4) in CommuniGate ...) - TODO: check + NOT-FOR-US: CommuniGate Pro CVE-2017-16961 (A SQL injection vulnerability in core/inc/auto-modules.php in BigTree ...) NOT-FOR-US: BigTree CMS CVE-2017-16960 (TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58194 - data/CVE
Author: jmm Date: 2017-12-01 19:56:17 + (Fri, 01 Dec 2017) New Revision: 58194 Modified: data/CVE/list Log: more wireshark triage Modified: data/CVE/list === --- data/CVE/list 2017-12-01 19:51:51 UTC (rev 58193) +++ data/CVE/list 2017-12-01 19:56:17 UTC (rev 58194) @@ -11062,6 +11062,8 @@ NOTE: https://www.wireshark.org/security/wnpa-sec-2017-39.html CVE-2017-13765 (In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the IrCOMM ...) - wireshark 2.4.1-1 + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13929 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=94666d4357096fc45e3bcad3d9414a14f0831bc8 NOTE: https://www.wireshark.org/security/wnpa-sec-2017-41.html @@ -18053,7 +18055,9 @@ NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e57c86ef8e3b57b7f90c224f6053d1eacf20e1ba NOTE: https://www.wireshark.org/security/wnpa-sec-2017-34.html CVE-2017-11407 (In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the MQ dissector could ...) - - wireshark 2.4.0-1 (bug #870172) + - wireshark 2.4.0-1 (low; bug #870172) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13792 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=4e54dae7f0d7840836ee6d5ce1e688f152ab2978 NOTE: https://www.wireshark.org/security/wnpa-sec-2017-35.html ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58192 - data/CVE
Author: jmm Date: 2017-12-01 18:36:19 + (Fri, 01 Dec 2017) New Revision: 58192 Modified: data/CVE/list Log: further wireshark triage Modified: data/CVE/list === --- data/CVE/list 2017-12-01 18:21:43 UTC (rev 58191) +++ data/CVE/list 2017-12-01 18:36:19 UTC (rev 58192) @@ -6842,24 +6842,33 @@ - kanboard (bug #790814) CVE-2017-15193 (In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the MBIM dissector ...) - wireshark 2.4.2-1 (low) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14056 NOTE: https://code.wireshark.org/review/23537 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=afb9ff7982971aba6e42472de0db4c1bedfc641b NOTE: https://www.wireshark.org/security/wnpa-sec-2017-43.html CVE-2017-15192 (In Wireshark 2.4.0 to 2.4.1 and 2.2.0 to 2.2.9, the BT ATT dissector ...) - wireshark 2.4.2-1 (low) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14049 NOTE: https://code.wireshark.org/review/23470 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=3689dc1db36037436b1616715f9a3f888fc9a0f6 NOTE: https://www.wireshark.org/security/wnpa-sec-2017-42.html CVE-2017-15191 (In Wireshark 2.4.0 to 2.4.1, 2.2.0 to 2.2.9, and 2.0.0 to 2.0.15, the ...) - wireshark 2.4.2-1 (low) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14068 NOTE: https://code.wireshark.org/review/23591 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=8dbb21dfde14221dab09b6b9c7719b9067c1f06e NOTE: https://www.wireshark.org/security/wnpa-sec-2017-44.html CVE-2017-15190 (In Wireshark 2.4.0 to 2.4.1, the RTSP dissector could crash. This was ...) - wireshark 2.4.2-1 (low) + [stretch] - wireshark (Only affects 2.4) + [jessie] - wireshark (Only affects 2.4) + [wheezy] - wireshark (Only affects 2.4) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14077 NOTE: https://code.wireshark.org/review/23635 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=e27870eaa6efa1c2dac08aa41a67fe9f0839e6e0 @@ -23982,6 +23991,8 @@ NOT-FOR-US: Subsonic CVE-2017-9354 (In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector ...) - wireshark 2.2.7-1 (bug #864058) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://www.wireshark.org/security/wnpa-sec-2017-32.html NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13646 CVE-2017-9353 (In Wireshark 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was ...) @@ -23998,12 +24009,16 @@ NOTE: https://www.wireshark.org/security/wnpa-sec-2017-22.html NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13599 CVE-2017-9351 (In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector ...) - - wireshark 2.2.7-1 (bug #864058) + - wireshark 2.2.7-1 (low; bug #864058) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://www.wireshark.org/security/wnpa-sec-2017-24.html NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13628 NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13609 CVE-2017-9350 (In Wireshark 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the openSAFETY ...) - - wireshark 2.2.7-1 (bug #864058) + - wireshark 2.2.7-1 (low; bug #864058) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://www.wireshark.org/security/wnpa-sec-2017-28.html NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13649 NOTE: When fixing this entry make sure to apply the complete fix and adding @@ -24017,6 +24032,7 @@ NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13685 CVE-2017-9348 (In Wireshark 2.2.0 to 2.2.6, the DOF dissector could read past the end ...) - wireshark 2.2.7-1 (bug #864058) + [stretch] - wireshark (Minor issue) [jessie] - wireshark (Only affects 2.2.x) [wheezy] - wireshark (Only affects 2.2.x) NOTE: https://www.wireshark.org/security/wnpa-sec-2017-23.html ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58185 - data/CVE
Author: jmm Date: 2017-12-01 15:44:29 + (Fri, 01 Dec 2017) New Revision: 58185 Modified: data/CVE/list Log: wireshark triage Modified: data/CVE/list === --- data/CVE/list 2017-12-01 15:38:34 UTC (rev 58184) +++ data/CVE/list 2017-12-01 15:44:29 UTC (rev 58185) @@ -45,8 +45,8 @@ RESERVED CVE-2017-17081 (The gmc_mmx function in libavcodec/x86/mpegvideodsp.c in FFmpeg 3.4 ...) - ffmpeg + [stretch] - ffmpeg (Can wait for the next 3.2.x release) NOTE: https://github.com/FFmpeg/FFmpeg/commit/58cf31cee7a456057f337b3102a03206d833d5e8 - TODO: check CVE-2017-17080 (elf.c in the Binary File Descriptor (BFD) library (aka libbfd), as ...) - binutils [stretch] - binutils (Minor issue) @@ -6865,6 +6865,8 @@ NOTE: https://www.wireshark.org/security/wnpa-sec-2017-45.html CVE-2017-15189 (In Wireshark 2.4.0 to 2.4.1, the DOCSIS dissector could go into an ...) - wireshark 2.4.2-1 (low) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14080 NOTE: https://code.wireshark.org/review/23663 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=625bab309d9dd21db2d8ae2aa3511810d32842a8 @@ -11036,6 +11038,8 @@ NOTE: ImageMagick-6: https://github.com/ImageMagick/ImageMagick/commit/2c1b360d80e5f8f7c7108c0afedde64ab79318ff CVE-2017-13767 (In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSDP ...) - wireshark 2.4.1-1 + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13933 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=6f18ace2a2683418a9368a8dfd92da6bd8213e15 NOTE: https://www.wireshark.org/security/wnpa-sec-2017-38.html @@ -11052,6 +11056,8 @@ NOTE: https://www.wireshark.org/security/wnpa-sec-2017-41.html CVE-2017-13764 (In Wireshark 2.4.0, the Modbus dissector could crash with a NULL ...) - wireshark 2.4.1-1 + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13925 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b87ffbd12bddf64582c0a6e082b462744474de94 NOTE: https://www.wireshark.org/security/wnpa-sec-2017-40.html @@ -18015,6 +18021,7 @@ NOTE: https://www.wireshark.org/security/wnpa-sec-2017-28.html CVE-2017-11410 (In Wireshark through 2.0.13 and 2.2.x through 2.2.7, the WBXML ...) - wireshark 2.4.0-1 (bug #870180) + [stretch] - wireshark (Minor issue) [jessie] - wireshark (Incomplete fix for CVE-2017-7702 not applied) [wheezy] - wireshark (Incomplete fix for CVE-2017-7702 not applied) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13796 @@ -18041,6 +18048,8 @@ NOTE: https://www.wireshark.org/security/wnpa-sec-2017-35.html CVE-2017-11406 (In Wireshark 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector ...) - wireshark 2.4.0-1 (bug #870172) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13797 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=250216263c3a3f2c651e80d9c6b3dc0adc53dc2c NOTE: https://www.wireshark.org/security/wnpa-sec-2017-36.html @@ -22597,7 +22606,9 @@ CVE-2017-9767 (Multiple cross-site scripting (XSS) vulnerabilities in Quali ...) NOT-FOR-US: Quali CloudShell CVE-2017-9766 (In Wireshark 2.2.7, PROFINET IO data with a high recursion depth allows ...) - - wireshark 2.4.0-1 (bug #870175) + - wireshark 2.4.0-1 (low; bug #870175) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13811 NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=d6e888400ba64de3147da4c23edf389b CVE-2017-9765 (Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and ...) @@ -23179,9 +23190,13 @@ NOTE: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=3c2aebbedd37fab054e80f2e315de07d7e9b5bdb CVE-2017-9617 (In Wireshark 2.2.7, deeply nested DAAP data may cause stack exhaustion ...) - wireshark 2.4.0-1 (low; bug #870174) + [stretch] - wireshark (Minor issue) + [jessie] - wireshark (Minor issue) NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13799 CVE-2017-9616 (In Wireshark 2.2.7, overly deep mp4 chunks may cause stack exhaustion ...) - wireshark 2.4.0-1 (low; bug #870173) + [stretch] - wireshark (Minor issue) + [jessie] -
[Secure-testing-commits] r58103 - data/CVE
Author: jmm Date: 2017-11-29 08:09:13 + (Wed, 29 Nov 2017) New Revision: 58103 Modified: data/CVE/list Log: NFU Modified: data/CVE/list === --- data/CVE/list 2017-11-29 06:46:17 UTC (rev 58102) +++ data/CVE/list 2017-11-29 08:09:13 UTC (rev 58103) @@ -15535,6 +15535,7 @@ RESERVED CVE-2017-12195 RESERVED + NOT-FOR-US: OpenShift CVE-2017-12194 RESERVED CVE-2017-12193 (The assoc_array_insert_into_terminal_node function in lib/assoc_array.c ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58088 - data/CVE
Author: jmm Date: 2017-11-28 19:56:41 + (Tue, 28 Nov 2017) New Revision: 58088 Modified: data/CVE/list Log: libxfont no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-11-28 19:50:50 UTC (rev 58087) +++ data/CVE/list 2017-11-28 19:56:41 UTC (rev 58088) @@ -2739,7 +2739,9 @@ NOTE: https://marc.info/?l=freedesktop-xorg-announce=151188036018262=2 CVE-2017-16611 [Open files with O_NOFOLLOW] RESERVED - - libxfont + - libxfont (low) + [stretch] - libxfont (Minor issue) + [jessie] - libxfont (Minor issue) - libxfont1 (unimportant) NOTE: http://www.openwall.com/lists/oss-security/2017/11/28/7 NOTE: https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?id=7b377456f95d2ec3ead40f4fb74ea620191f88c8 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58087 - data/CVE
Author: jmm Date: 2017-11-28 19:50:50 + (Tue, 28 Nov 2017) New Revision: 58087 Modified: data/CVE/list Log: two more xen temp stubs Modified: data/CVE/list === --- data/CVE/list 2017-11-28 19:47:38 UTC (rev 58086) +++ data/CVE/list 2017-11-28 19:50:50 UTC (rev 58087) @@ -1,3 +1,8 @@ +CVE-2017- [XSA-238: DMOP map/unmap missing argument checks] + - xen + [stretch] - xen 4.8.2+xsa245-0+deb9u1 + NOTE: https://xenbits.xen.org/xsa/advisory-238.html + NOTE: Workaround for DSA 4050 CVE-2017- [XSA-247: Missing p2m error checking in PoD code] - xen [stretch] - xen 4.8.2+xsa245-0+deb9u1 @@ -8,6 +13,11 @@ [stretch] - xen 4.8.2+xsa245-0+deb9u1 NOTE: https://xenbits.xen.org/xsa/advisory-246.html NOTE: Workaround for DSA 4050 +CVE-2017- [XSA-245: ARM: Some memory not scrubbed at boot] + - xen + [stretch] - xen 4.8.2+xsa245-0+deb9u1 + NOTE: https://xenbits.xen.org/xsa/advisory-245.html + NOTE: Workaround for DSA 4050 CVE-2018-0705 RESERVED CVE-2018-0704 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58085 - in data: . CVE DSA
Author: jmm
Date: 2017-11-28 19:46:03 + (Tue, 28 Nov 2017)
New Revision: 58085
Modified:
data/CVE/list
data/DSA/list
data/dsa-needed.txt
Log:
xen DSA
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-28 19:30:41 UTC (rev 58084)
+++ data/CVE/list 2017-11-28 19:46:03 UTC (rev 58085)
@@ -1,9 +1,13 @@
CVE-2017- [XSA-247: Missing p2m error checking in PoD code]
- xen
+ [stretch] - xen 4.8.2+xsa245-0+deb9u1
NOTE: https://xenbits.xen.org/xsa/advisory-247.html
+ NOTE: Workaround for DSA 4050
CVE-2017- [XSA-246: x86: infinite loop due to missing PoD error checking]
- xen
+ [stretch] - xen 4.8.2+xsa245-0+deb9u1
NOTE: https://xenbits.xen.org/xsa/advisory-246.html
+ NOTE: Workaround for DSA 4050
CVE-2018-0705
RESERVED
CVE-2018-0704
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-28 19:30:41 UTC (rev 58084)
+++ data/DSA/list 2017-11-28 19:46:03 UTC (rev 58085)
@@ -1,3 +1,6 @@
+[28 Nov 2017] DSA-4050-1 xen - security update
+ {CVE-2017-14316 CVE-2017-14317 CVE-2017-14318 CVE-2017-14319
CVE-2017-15588 CVE-2017-15589 CVE-2017-15590 CVE-2017-15592 CVE-2017-15593
CVE-2017-15594 CVE-2017-15595 CVE-2017-15597}
+ [stretch] - xen 4.8.2+xsa245-0+deb9u1
[27 Nov 2017] DSA-4049-1 ffmpeg - security update
{CVE-2017-15186 CVE-2017-15672 CVE-2017-16840}
[stretch] - ffmpeg 7:3.2.9-1~deb9u1
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-28 19:30:41 UTC (rev 58084)
+++ data/dsa-needed.txt 2017-11-28 19:46:03 UTC (rev 58085)
@@ -59,7 +59,5 @@
--
wordpress
--
-xen
---
zendframework/oldstable
--
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58066 - data/DSA
Author: jmm
Date: 2017-11-27 21:45:25 + (Mon, 27 Nov 2017)
New Revision: 58066
Modified:
data/DSA/list
Log:
ffmpeg DSA
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-27 21:30:53 UTC (rev 58065)
+++ data/DSA/list 2017-11-27 21:45:25 UTC (rev 58066)
@@ -1,3 +1,6 @@
+[27 Nov 2017] DSA-4049-1 ffmpeg - security update
+ {CVE-2017-15186 CVE-2017-15672 CVE-2017-16840}
+ [stretch] - ffmpeg 7:3.2.9-1~deb9u1
[23 Nov 2017] DSA-4048-1 openjdk-7 - security update
{CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295
CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349
CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388}
[jessie] - openjdk-7 7u151-2.6.11-2~deb8u1
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58049 - data/CVE
Author: jmm Date: 2017-11-27 17:34:28 + (Mon, 27 Nov 2017) New Revision: 58049 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-27 17:31:35 UTC (rev 58048) +++ data/CVE/list 2017-11-27 17:34:28 UTC (rev 58049) @@ -889,7 +889,7 @@ CVE-2017-16949 RESERVED CVE-2017-16948 (TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a ...) - TODO: check + NOT-FOR-US: TG Soft Vir.IT eXplorer Lite CVE-2017-16947 RESERVED CVE-2017-16946 (The admin_edit function in app/Controller/UsersController.php in MISP ...) @@ -13249,7 +13249,7 @@ CVE-2017-12801 (The UpdateDataSize function in ebmlmaster.c in libebml2 through ...) NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12800 (The EBML_FindNextElement function in ebmlmain.c in libebml2 through ...) - TODO: check + NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2016-10405 (Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) ...) NOT-FOR-US: D-Link CVE-2017-12836 (CVS 1.12.x, when configured to use SSH for remote repositories, might ...) @@ -13308,15 +13308,15 @@ CVE-2017-12784 (In Youngzsoft CCFile (aka CC File Transfer) 3.6, by sending a crafted ...) NOT-FOR-US: Youngzsoft CCFile CVE-2017-12783 (The ReadDataFloat function in ebmlnumber.c in libebml2 through ...) - TODO: check + NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12782 (The ReadData function in ebmlmaster.c in libebml2 through 2012-08-26 ...) - TODO: check + NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12781 (The EBML_BufferToID function in ebmlelement.c in libebml2 through ...) - TODO: check + NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12780 (The ReadData function in ebmlstring.c in libebml2 through 2012-08-26 ...) - TODO: check + NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12779 (The Node_GetData function in corec/corec/node/node.c in mkvalidator ...) - TODO: check + NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12778 RESERVED CVE-2017-1000112 (Linux kernel: Exploitable memory corruption due to UFO to non-UFO path ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58048 - data/CVE
Author: jmm Date: 2017-11-27 17:31:35 + (Mon, 27 Nov 2017) New Revision: 58048 Modified: data/CVE/list Log: remove postponed entries for ffmpeg, next DSA will fix those Modified: data/CVE/list === --- data/CVE/list 2017-11-27 09:10:15 UTC (rev 58047) +++ data/CVE/list 2017-11-27 17:31:35 UTC (rev 58048) @@ -1575,7 +1575,6 @@ NOT-FOR-US: LanSweeper CVE-2017-16840 (The VC-2 Video Compression encoder in FFmpeg 3.4 allows remote ...) - ffmpeg - [stretch] - ffmpeg (Can be fixed with next 3.2.x release) NOTE: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=a94cb36ab2ad99d3a1331c9f91831ef593d94f74 CVE-2017-16839 RESERVED @@ -4759,7 +4758,6 @@ RESERVED CVE-2017-15672 (The read_header function in libavcodec/ffv1dec.c in FFmpeg 3.3.4 and ...) - ffmpeg 7:3.4-1 - [stretch] - ffmpeg (Wait until next round of security releases) - libav NOTE: Fixed by: http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c20f4fcb74da2d0432c7b54499bb98f48236b904 CVE-2017-15671 (The glob function in glob.c in the GNU C Library (aka glibc or libc6) ...) @@ -6054,7 +6052,6 @@ NOTE: https://github.com/Cacti/cacti/commit/4f87256e63859117f81d2a2bd40c9c730e39b65d CVE-2017-15186 (Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote ...) - ffmpeg 7:3.4-1 - [stretch] - ffmpeg (Wait until next round of security releases) - libav NOTE: http://www.openwall.com/lists/oss-security/2017/10/20/4 NOTE: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/df62b70de8aaa285168e72fe8f6e740843ca91fa ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58023 - data/CVE
Author: jmm Date: 2017-11-25 16:18:28 + (Sat, 25 Nov 2017) New Revision: 58023 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-25 14:16:53 UTC (rev 58022) +++ data/CVE/list 2017-11-25 16:18:28 UTC (rev 58023) @@ -2190,7 +2190,6 @@ [wheezy] - nova (Vulnerble code introduced later) NOTE: https://launchpad.net/bugs/1664931 NOTE: https://security.openstack.org/ossa/OSSA-2017-005.html - TODO: check / verify affected versions CVE-2017-16238 RESERVED CVE-2017-16237 (In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file ...) @@ -9607,7 +9606,7 @@ CVE-2017-13702 (An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. ...) NOT-FOR-US: Moxa CVE-2017-13701 (An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. ...) - TODO: check + NOT-FOR-US: Moxa CVE-2017-13700 (An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. ...) NOT-FOR-US: Moxa CVE-2017-13699 (An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices. ...) @@ -10775,7 +10774,7 @@ CVE-2017-13137 (The FormCraft Basic plugin 1.0.5 for WordPress has SQL injection in the ...) NOT-FOR-US: Wordpress plugin CVE-2017-13136 (The image_alloc function in bpgenc.c in libbpg 0.9.7 has an integer ...) - TODO: check + NOT-FOR-US: libbpg CVE-2017-13135 (A NULL Pointer Dereference exists in VideoLAN x265, as used in libbpg ...) TODO: check CVE-2017-13134 (In ImageMagick 7.0.6-6 and GraphicsMagick 1.3.26, a heap-based buffer ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58016 - data/CVE
Author: jmm Date: 2017-11-25 11:44:02 + (Sat, 25 Nov 2017) New Revision: 58016 Modified: data/CVE/list Log: add note for exim Modified: data/CVE/list === --- data/CVE/list 2017-11-25 10:42:39 UTC (rev 58015) +++ data/CVE/list 2017-11-25 11:44:02 UTC (rev 58016) @@ -3,7 +3,8 @@ [jessie] - exim4 (ESMTP CHUNKING extension introduced in 4.88) [wheezy] - exim4 (ESMTP CHUNKING extension introduced in 4.88) NOTE: https://bugs.exim.org/show_bug.cgi?id=2201 - NOTE: https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.htm + NOTE: https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html + NOTE: 4.89-10 adds a workaround which disables the affected code by default CVE-2017- [Exim use-after-free vulnerability while reading mail header] - exim4 (bug #882648) [jessie] - exim4 (ESMTP CHUNKING extension introduced in 4.88) @@ -11,6 +12,7 @@ NOTE: https://bugs.exim.org/show_bug.cgi?id=2199 NOTE: https://lists.exim.org/lurker/message/20171125.034842.d1d75cac.en.html NOTE: https://twitter.com/philpennock/status/934270613811875840 + NOTE: 4.89-10 adds a workaround which disables the affected code by default CVE-2017-16941 (** DISPUTED ** October CMS through 1.0.428 does not prevent use of ...) TODO: check CVE-2017-16940 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r58007 - data
Author: jmm Date: 2017-11-24 22:19:05 + (Fri, 24 Nov 2017) New Revision: 58007 Modified: data/next-point-update.txt Log: python2.7 spu Modified: data/next-point-update.txt === --- data/next-point-update.txt 2017-11-24 22:13:48 UTC (rev 58006) +++ data/next-point-update.txt 2017-11-24 22:19:05 UTC (rev 58007) @@ -39,3 +39,5 @@ [stretch] - libofx 1:0.9.10-2+deb9u1 CVE-2017-14731 [stretch] - libofx 1:0.9.10-2+deb9u1 +CVE-2017-1000158 + [stretch] - python2.7 2.7.13-2+deb9u2 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57998 - data/CVE
Author: jmm
Date: 2017-11-24 17:37:26 + (Fri, 24 Nov 2017)
New Revision: 57998
Modified:
data/CVE/list
Log:
scala non-issue
convert otrs issue to NOTE, apparently bogus
fix pnp4nagios entry, all suites are n/a
libraw, lame, libcatalyst-plugin-static-simple-perl, lynx, ohcount no-dsa
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-24 15:40:28 UTC (rev 57997)
+++ data/CVE/list 2017-11-24 17:37:26 UTC (rev 57998)
@@ -44,6 +44,8 @@
NOTE: https://groups.google.com/forum/#!topic/xrdp-devel/PmVfMuy_xBA
CVE-2017-16926 (Ohcount 3.0.0 is prone to a command injection via specially
crafted ...)
- ohcount (bug #882372)
+ [stretch] - ohcount (Minor issue)
+ [jessie] - ohcount (Minor issue)
CVE-2017-16925
RESERVED
CVE-2017-16924
@@ -249,7 +251,9 @@
CVE-2017-1000211 (Lynx before 2.8.9dev.16 is vulnerable to a use after free in
the HTML ...)
{DLA-1175-1}
- lynx 2.8.9dev16-1
+ [stretch] - lynx (Minor issue)
- lynx-cur
+ [jessie] - lynx-cur (Minor issue)
NOTE:
https://github.com/ThomasDickey/lynx-snapshots/commit/280a61b300a1614f6037efc0902ff7ecf17146e9
CVE-2017-1000206 (samtools htslib library version 1.4.0 and earlier is
vulnerable to ...)
- htslib 1.4.1-1
@@ -648,8 +652,7 @@
CVE-2017-16835
RESERVED
CVE-2017-16834 (PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned
by an ...)
- - pnp4nagios
- [wheezy] - pnp4nagios (/etc/pnp4nagios and its content
is installed as root by the Debian package)
+ - pnp4nagios (/etc/pnp4nagios and its content is
installed as root by the Debian package)
NOTE: https://github.com/lingej/pnp4nagios/issues/140
CVE-2017-16833 (Stored cross-site scripting (XSS) vulnerability in Gemirro
before ...)
NOT-FOR-US: Gemirro
@@ -2148,6 +2151,8 @@
NOTE:
https://github.com/vim/vim/commit/5a73e0ca54c77e067c3b12ea6f35e3e8681e8cf8
CVE-2017-16248 (The Catalyst-Plugin-Static-Simple module before 0.34 for Perl
allows ...)
- libcatalyst-plugin-static-simple-perl 0.34-1 (bug #880458)
+ [stretch] - libcatalyst-plugin-static-simple-perl (Minor issue)
+ [jessie] - libcatalyst-plugin-static-simple-perl (Minor issue)
NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=120558
CVE-2017-16241
RESERVED
@@ -4795,12 +4800,12 @@
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg02557.html
NOTE: Fixed by:
https://git.qemu.org/gitweb.cgi?p=qemu.git;a=commit;h=eb38e1bc3740725ca29a535351de94107ec58d51
CVE-2017-15288 (The compilation daemon in Scala before 2.10.7, 2.11.x before
2.11.12, ...)
- - scala
+ - scala (unimportant)
NOTE: http://scala-lang.org/news/security-update-nov17.html
NOTE: For 2.11.x: https://github.com/scala/scala/pull/6108
NOTE: For 2.12.x: https://github.com/scala/scala/pull/6120
NOTE: For 2.10.x: https://github.com/scala/scala/pull/6128
- TODO: check
+ NOTE: Neutralised by kernel hardening
CVE-2017-15287 (There is XSS in the BouquetEditor WebPlugin for Dream
Multimedia ...)
NOT-FOR-US: BouquetEditor WebPlugin
CVE-2017-15286 (SQLite 3.20.1 has a NULL pointer dereference in
tableColumnList in ...)
@@ -5622,6 +5627,8 @@
NOTE:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=1da5c9a485f3dcac4c45e96ef4b7dae5948314b5
CVE-2017-15019 (LAME 3.99.5 has a NULL Pointer Dereference in the
hip_decode_init ...)
- lame
+ [stretch] - lame (Minor issue)
+ [jessie] - lame (Minor issue)
NOTE: https://sourceforge.net/p/lame/bugs/477/
CVE-2017-15018 (LAME 3.99.5 has a heap-based buffer over-read when handling a
malformed ...)
- lame 3.99.5+repack1-8
@@ -9386,6 +9393,8 @@
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1484192
CVE-2017-13735 (There is a floating point exception in the kodak_radc_load_raw
function ...)
- libraw 0.18.5-1 (low; bug #874729)
+ [stretch] - libraw (Minor issue)
+ [jessie] - libraw (Minor issue)
[wheezy] - libraw (Minor issue)
NOTE: https://github.com/LibRaw/LibRaw/issues/96
NOTE: Isolated patch:
https://github.com/LibRaw/LibRaw/files/1276421/radc_divbyzero.txt
@@ -22463,11 +22472,7 @@
[wheezy] - vlc (Not supported in wheezy LTS)
NOTE:
https://git.videolan.org/?p=vlc/vlc-2.2.git;a=commit;h=55a82442cfea9dab8b853f3a4610f2880c5fadf3
CVE-2017-9299 (Open Ticket Request System (OTRS) 3.3.9 has XSS in ...)
- - otrs2 (unimportant)
- NOTE: The issue is most likely fixed in the 3.x series already before
3.3.17.
- NOTE: The exact issue, fixing commits and upstream version was not yet
tracked
- NOTE: down.
- NOTE: Furthermore the original report is quite vague/unclear and
upstream can
+ NOTE: This report for OTRS is quite vague/unclear and
[Secure-testing-commits] r57982 - in data: . CVE DSA
Author: jmm
Date: 2017-11-23 22:05:10 + (Thu, 23 Nov 2017)
New Revision: 57982
Modified:
data/CVE/list
data/DSA/list
data/dsa-needed.txt
Log:
otrs, openjdk-7 DSA
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-23 21:47:29 UTC (rev 57981)
+++ data/CVE/list 2017-11-23 22:05:10 UTC (rev 57982)
@@ -3353,6 +3353,7 @@
- frr (bug #863249)
CVE-2017-15864 (In the Agent Frontend in Open Ticket Request System (OTRS)
3.3.x ...)
- otrs2 4.0.7-2
+ [jessie] - otrs2 3.3.18-1+deb8u2
NOTE:
https://www.otrs.com/security-advisory-2017-06-security-update-otrs-3-3/
NOTE:
https://github.com/OTRS/otrs/compare/3bc58ebeb9bdbe8107251a03cf7b9b8cfc515f53...80a0a9a138278d63a2621d146eb3c29e982aa2d5
NOTE: Root cause for the issue is the recursive parsing handling in the
old
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-23 21:47:29 UTC (rev 57981)
+++ data/DSA/list 2017-11-23 22:05:10 UTC (rev 57982)
@@ -1,3 +1,10 @@
+[23 Nov 2017] DSA-4048-1 openjdk-7 - security update
+ {CVE-2017-10274 CVE-2017-10281 CVE-2017-10285 CVE-2017-10295
CVE-2017-10345 CVE-2017-10346 CVE-2017-10347 CVE-2017-10348 CVE-2017-10349
CVE-2017-10350 CVE-2017-10355 CVE-2017-10356 CVE-2017-10357 CVE-2017-10388}
+ [jessie] - openjdk-7 7u151-2.6.11-2~deb8u1
+[23 Nov 2017] DSA-4047-1 otrs2 - security update
+ {CVE-2017-16664}
+ [jessie] - otrs2 3.3.18-1+deb8u2
+ [stretch] - otrs2 5.0.16-1+deb9u3
[22 Nov 2017] DSA-4046-1 libspring-ldap-java - security update
{CVE-2017-8028}
[jessie] - libspring-ldap-java 1.3.1.RELEASE-5+deb8u1
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-23 21:47:29 UTC (rev 57981)
+++ data/dsa-needed.txt 2017-11-23 22:05:10 UTC (rev 57982)
@@ -29,10 +29,6 @@
due to new dependency being introduced
Important: original fix would introduce a regression (needs fix upstream)
--
-openjdk-7/oldstable (jmm)
---
-otrs2 (jmm)
---
php-horde-image
--
php5
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57955 - data/CVE
Author: jmm
Date: 2017-11-23 12:26:23 + (Thu, 23 Nov 2017)
New Revision: 57955
Modified:
data/CVE/list
Log:
shairpoint non-issue
a few no-dsa
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-23 11:50:22 UTC (rev 57954)
+++ data/CVE/list 2017-11-23 12:26:23 UTC (rev 57955)
@@ -218,6 +218,7 @@
REJECTED
CVE-2017-1000203 (ROOT version 6.9.03 and below is vulnerable to an
authenticated shell ...)
- root-system
+ [jessie] - root-system (Minor issue)
[wheezy] - root-system (Minor issue as it's restricted to
authenticated users)
NOTE:
https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145#diff-6cd6f6c31bac70116b7ca7abdc8e517e
CVE-2017-1000192 (Cygnux sysPass version 2.1.7 and older is vulnerable to a
Local File ...)
@@ -356,6 +357,8 @@
NOT-FOR-US: EllisLab ExpressionEngine
CVE-2017-1000158 (CPython (aka Python) up to 2.7.13 is vulnerable to an
integer overflow ...)
- python2.7 2.7.13-4
+ [stretch] - python2.7 (Minor issue)
+ [jessie] - python2.7 (Minor issue)
- python2.6
NOTE: https://bugs.python.org/issue30657
NOTE:
https://github.com/python/cpython/commit/c3c9db89273fabc62ea1b48389d9a3000c1c03ae
@@ -3356,6 +3359,8 @@
CVE-2016-10517 (networking.c in Redis before 3.2.7 allows Cross Protocol
Scripting ...)
{DLA-1161-1}
- redis 3:3.2.7-1
+ [stretch] - redis (Minor issue)
+ [jessie] - redis (Minor issue)
NOTE:
https://github.com/antirez/redis/commit/874804da0c014a7d704b3d285aa500098a931f50
CVE-2017-15863 (Cross Site Scripting (XSS) exists in the wp-noexternallinks
plugin ...)
NOT-FOR-US: WordPress plugin wp-noexternallinks
@@ -14231,6 +14236,9 @@
RESERVED
CVE-2017-12087
RESERVED
+ - shairport-sync (unimportant)
+ NOTE: Debian build uses Avahi instead
+ NOTE:
https://bugs.launchpad.net/ubuntu/+source/shairport-sync/+bug/1729668
CVE-2017-12086
RESERVED
CVE-2017-12085 (An exploitable routing vulnerability exists in the Circle with
Disney ...)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57928 - data
Author: jmm Date: 2017-11-22 17:01:01 + (Wed, 22 Nov 2017) New Revision: 57928 Modified: data/dsa-needed.txt Log: take otrs Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-11-22 16:08:44 UTC (rev 57927) +++ data/dsa-needed.txt 2017-11-22 17:01:01 UTC (rev 57928) @@ -34,7 +34,7 @@ -- openjdk-7/oldstable (jmm) -- -otrs2 +otrs2 (jmm) -- php-horde-image -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57922 - data/CVE
Author: jmm Date: 2017-11-22 08:33:10 + (Wed, 22 Nov 2017) New Revision: 57922 Modified: data/CVE/list Log: new ceph issue, NFU concludes external check Modified: data/CVE/list === --- data/CVE/list 2017-11-22 06:10:27 UTC (rev 57921) +++ data/CVE/list 2017-11-22 08:33:10 UTC (rev 57922) @@ -116,6 +116,8 @@ NOT-FOR-US: Jenkins CVE-2017-1000395 NOT-FOR-US: Jenkins +CVE-2017-1000394 + NOT-FOR-US: Jenkins CVE-2017-1000393 NOT-FOR-US: Jenkins CVE-2017-1000392 @@ -674,6 +676,8 @@ TODO: check CVE-2017-16818 RESERVED + - ceph + NOTE: https://github.com/ceph/ceph/commit/b3118cabb8060a8cc6a01c4e8264cb18e7b1745a CVE-2017-16817 RESERVED CVE-2017-16816 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57915 - data/CVE
Author: jmm Date: 2017-11-21 22:33:44 + (Tue, 21 Nov 2017) New Revision: 57915 Modified: data/CVE/list Log: new ffmpeg issue NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-21 22:29:23 UTC (rev 57914) +++ data/CVE/list 2017-11-21 22:33:44 UTC (rev 57915) @@ -3,13 +3,13 @@ CVE-2017-16924 RESERVED CVE-2017-16923 (Command Injection vulnerability in app_data_center on Shenzhen Tenda ...) - TODO: check + NOT-FOR-US: Shenzhen Tenda CVE-2017-16922 RESERVED CVE-2017-16921 RESERVED CVE-2017-16920 (v5/config/system.php in dayrui FineCms 5.2.0 has a default SYS_KEY ...) - TODO: check + NOT-FOR-US: dayrui FineCms CVE-2017-16919 (MapOS 3.1.11 and earlier has a Stored Cross-site Scripting (XSS) ...) NOT-FOR-US: MapOS CVE-2017-16918 @@ -213,11 +213,11 @@ CVE-2017-1000191 (Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting ...) NOT-FOR-US: Jool CVE-2017-1000170 (jqueryFileTree 2.1.5 and older Directory Traversal ...) - TODO: check + NOT-FOR-US: jqueryFileTree CVE-2017-1000169 (QuickerBB version = 0.7.2 is vulnerable to arbitrary file writes ...) NOT-FOR-US: QuickerBB CVE-2017-1000168 (sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate ...) - TODO: check + NOT-FOR-US: sodiumoxide CVE-2017-1000161 REJECTED CVE-2017-16872 (An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in ...) @@ -281,7 +281,7 @@ CVE-2017-1000228 (nodejs ejs versions older than 2.5.3 is vulnerable to remote code ...) NOT-FOR-US: nodejs ejs CVE-2017-1000226 (Stop User Enumeration 1.3.8 allows user enumeration via the REST API ...) - TODO: check + NOT-FOR-US: Wordpress plugin CVE-2017-1000225 (Reflected XSS in Relevanssi Premium version 1.14.8 when using ...) NOT-FOR-US: Relevanssi CVE-2017-1000224 (CSRF in YouTube (WordPress plugin) could allow unauthenticated ...) @@ -578,7 +578,9 @@ CVE-2017-16841 (LanSweeper 6.0.100.75 has XSS via the description parameter to ...) NOT-FOR-US: LanSweeper CVE-2017-16840 (The VC-2 Video Compression encoder in FFmpeg 3.4 allows remote ...) - TODO: check + - ffmpeg + [stretch] - ffmpeg (Can be fixed with next 3.2.x release) + NOTE: http://git.videolan.org/?p=ffmpeg.git;a=commit;h=a94cb36ab2ad99d3a1331c9f91831ef593d94f74 CVE-2017-16839 RESERVED CVE-2017-16838 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57914 - data/CVE
Author: jmm Date: 2017-11-21 22:29:23 + (Tue, 21 Nov 2017) New Revision: 57914 Modified: data/CVE/list Log: simple-xml no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-11-21 22:25:20 UTC (rev 57913) +++ data/CVE/list 2017-11-21 22:29:23 UTC (rev 57914) @@ -155,6 +155,8 @@ NOT-FOR-US: Opencast CVE-2017-1000190 (SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability ...) - simple-xml + [stretch] - simple-xml (Minor issue) + [jessie] - simple-xml (Minor issue) NOTE: https://github.com/ngallagher/simplexml/issues/18 CVE-2017-1000163 (The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through ...) NOT-FOR-US: Phoenix Framework ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57913 - in data: . DSA
Author: jmm
Date: 2017-11-21 22:25:20 + (Tue, 21 Nov 2017)
New Revision: 57913
Modified:
data/DSA/list
data/dsa-needed.txt
Log:
vlc DSA
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-21 21:58:54 UTC (rev 57912)
+++ data/DSA/list 2017-11-21 22:25:20 UTC (rev 57913)
@@ -1,3 +1,7 @@
+[21 Nov 2017] DSA-4045-1 vlc - security update
+ {CVE-2017-9300 CVE-2017-10699}
+ [jessie] - vlc 2.2.7-1~deb8u1
+ [stretch] - vlc 2.2.7-1~deb9u1
[21 Nov 2017] DSA-4044-1 swauth - security update
{CVE-2017-16613}
[stretch] - swauth 1.2.0-2+deb9u1
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-21 21:58:54 UTC (rev 57912)
+++ data/dsa-needed.txt 2017-11-21 22:25:20 UTC (rev 57913)
@@ -53,8 +53,6 @@
tiff
wait until more issues are around
--
-vlc (jmm)
---
wireshark (seb)
2017-05-13: asked balint@ if he wants to prepare an update now
2017-07-28: re-ping balint@
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57888 - data
Author: jmm Date: 2017-11-21 11:18:28 + (Tue, 21 Nov 2017) New Revision: 57888 Modified: data/next-oldstable-point-update.txt Log: libofx ospu Modified: data/next-oldstable-point-update.txt === --- data/next-oldstable-point-update.txt2017-11-21 09:25:57 UTC (rev 57887) +++ data/next-oldstable-point-update.txt2017-11-21 11:18:28 UTC (rev 57888) @@ -104,3 +104,7 @@ [jessie] - icu 52.1-8+deb8u6 CVE-2017-2810 [jessie] - python-tablib 0.9.11-2+deb8u1 +CVE-2017-2816 + [stretch] - libofx 1:0.9.10-1+deb8u1 +CVE-2017-14731 + [stretch] - libofx 1:0.9.10-1+deb8u1 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57860 - in data: CVE DLA
Author: jmm
Date: 2017-11-20 18:17:54 + (Mon, 20 Nov 2017)
New Revision: 57860
Modified:
data/CVE/list
data/DLA/list
Log:
fix opencv entry
htslib no-dsa
ffmpeg postponed
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-20 16:14:36 UTC (rev 57859)
+++ data/CVE/list 2017-11-20 18:17:54 UTC (rev 57860)
@@ -123,6 +123,8 @@
NOTE:
https://github.com/ThomasDickey/lynx-snapshots/commit/280a61b300a1614f6037efc0902ff7ecf17146e9
CVE-2017-1000206 (samtools htslib library version 1.4.0 and earlier is
vulnerable to ...)
- htslib 1.4.1-1
+ [stretch] - htslib (Minor issue)
+ [jessie] - htslib (Minor issue)
CVE-2017-1000204
REJECTED
CVE-2017-1000203 (ROOT version 6.9.03 and below is vulnerable to an
authenticated shell ...)
@@ -625,8 +627,9 @@
NOTE:
https://github.com/radare/radare2/commit/2ca9ab45891b6ae8e32b6c28c81eebca059cbe5d
NOTE: https://github.com/radare/radare2/issues/8813
CVE-2017-16803 (In Libav through 11.11 and 12.x through 12.1, the
smacker_decode_tree ...)
- - libav
- - ffmpeg
+ - libav (low)
+ - ffmpeg (low)
+ [stretch] - ffmpeg (Can be fixed with next 3.2.x release)
NOTE: https://bugzilla.libav.org/show_bug.cgi?id=1098
NOTE:
https://github.com/libav/libav/commit/cd4663dc80323ba64989d0c103d51ad3ee0e9c2f
NOTE:
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/cd4663dc80323ba64989d0c103d51ad3ee0e9c2f
@@ -8104,8 +8107,7 @@
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/cfc2bd4c87481d4cf60308cc6ffd3c61288ff004
NOTE: ImageMagick in Debian not compiled with webp support
(--with-webp=yes)
CVE-2017-14136 (OpenCV (Open Source Computer Vision Library) 3.3 has an
out-of-bounds ...)
- {DLA-1117-1}
- - opencv
+ - opencv (Incomplete patch never shipped)
NOTE: https://github.com/opencv/opencv/issues/9443
NOTE: https://github.com/opencv/opencv/pull/9448
CVE-2017-14135 (enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py
in the ...)
Modified: data/DLA/list
===
--- data/DLA/list 2017-11-20 16:14:36 UTC (rev 57859)
+++ data/DLA/list 2017-11-20 18:17:54 UTC (rev 57860)
@@ -193,7 +193,7 @@
{CVE-2017-7793 CVE-2017-7805 CVE-2017-7810 CVE-2017-7814 CVE-2017-7818
CVE-2017-7819 CVE-2017-7823 CVE-2017-7824}
[wheezy] - firefox-esr 52.4.0esr-2~deb7u1
[29 Sep 2017] DLA-1117-1 opencv - security update
- {CVE-2016-1516 CVE-2017-12597 CVE-2017-12598 CVE-2017-12599
CVE-2017-12601 CVE-2017-12603 CVE-2017-12604 CVE-2017-12605 CVE-2017-12606
CVE-2017-12862 CVE-2017-12863 CVE-2017-12864 CVE-2017-14136}
+ {CVE-2016-1516 CVE-2017-12597 CVE-2017-12598 CVE-2017-12599
CVE-2017-12601 CVE-2017-12603 CVE-2017-12604 CVE-2017-12605 CVE-2017-12606
CVE-2017-12862 CVE-2017-12863 CVE-2017-12864}
[wheezy] - opencv 2.3.1-11+deb7u2
[27 Sep 2017] DLA-1116-1 poppler - security update
{CVE-2017-14517 CVE-2017-14519 CVE-2017-14617}
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57841 - data/CVE
Author: jmm Date: 2017-11-19 21:45:54 + (Sun, 19 Nov 2017) New Revision: 57841 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-19 21:10:15 UTC (rev 57840) +++ data/CVE/list 2017-11-19 21:45:54 UTC (rev 57841) @@ -70,16 +70,16 @@ CVE-2017-1000230 (The Snap7 Server version 1.4.1 can be crashed when the ItemCount field ...) NOT-FOR-US: Snap7 Server CVE-2017-1000227 (Stored XSS in Salutation Responsive WordPress + BuddyPress Theme ...) - TODO: check + NOT-FOR-US: Wordpress plugin CVE-2017-1000221 (In Opencast 2.2.3 and older if user names overlap, the Opencast search ...) - TODO: check + NOT-FOR-US: Opencast CVE-2017-1000217 (Opencast 2.3.2 and older versions are vulnerable to script injections ...) - TODO: check + NOT-FOR-US: Opencast CVE-2017-1000190 (SimpleXML (latest version 2.7.1) is vulnerable to an XXE vulnerability ...) - simple-xml NOTE: https://github.com/ngallagher/simplexml/issues/18 CVE-2017-1000163 (The Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through ...) - TODO: check + NOT-FOR-US: Phoenix Framework CVE-2017-1000128 (Exiv2 0.26 contains a stack out of bounds read in JPEG2000 parser ...) - exiv2 NOTE: http://www.openwall.com/lists/oss-security/2017/06/30/1 @@ -95,7 +95,7 @@ CVE-2017-16878 RESERVED CVE-2017-16877 (ZEIT Next.js before 2.4.1 has directory traversal under the /_next and ...) - TODO: check + NOT-FOR-US: ZEIT Next.js CVE-2017-16876 RESERVED CVE-2017-16875 (An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in ...) @@ -127,13 +127,13 @@ - root-system NOTE: https://github.com/root-project/root/commit/88ccff152604e0f1012653a596d802ff7ede3145#diff-6cd6f6c31bac70116b7ca7abdc8e517e CVE-2017-1000192 (Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File ...) - TODO: check + NOT-FOR-US: Cygnux sysPass CVE-2017-1000191 (Jool 3.5.0-3.5.1 is vulnerable to a kernel crashing packet resulting ...) - TODO: check + NOT-FOR-US: Jool CVE-2017-1000170 (jqueryFileTree 2.1.5 and older Directory Traversal ...) TODO: check CVE-2017-1000169 (QuickerBB version = 0.7.2 is vulnerable to arbitrary file writes ...) - TODO: check + NOT-FOR-US: QuickerBB CVE-2017-1000168 (sodiumoxide 0.0.13 and older scalarmult() vulnerable to degenerate ...) TODO: check CVE-2017-1000161 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57818 - data/CVE
Author: jmm Date: 2017-11-19 12:04:11 + (Sun, 19 Nov 2017) New Revision: 57818 Modified: data/CVE/list Log: jenkins NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-19 10:17:07 UTC (rev 57817) +++ data/CVE/list 2017-11-19 12:04:11 UTC (rev 57818) @@ -1,3 +1,39 @@ +CVE-2017-1000404 + NOT-FOR-US: Jenkins plugin +CVE-2017-1000403 + NOT-FOR-US: Jenkins plugin +CVE-2017-1000402 + NOT-FOR-US: Jenkins plugin +CVE-2017-1000401 + NOT-FOR-US: Jenkins +CVE-2017-1000400 + NOT-FOR-US: Jenkins +CVE-2017-1000399 + NOT-FOR-US: Jenkins +CVE-2017-1000398 + NOT-FOR-US: Jenkins +CVE-2017-1000397 + NOT-FOR-US: Jenkins plugin +CVE-2017-1000396 + NOT-FOR-US: Jenkins +CVE-2017-1000395 + NOT-FOR-US: Jenkins +CVE-2017-1000393 + NOT-FOR-US: Jenkins +CVE-2017-1000392 + NOT-FOR-US: Jenkins +CVE-2017-1000391 + NOT-FOR-US: Jenkins +CVE-2017-1000390 + NOT-FOR-US: Jenkins plugin +CVE-2017-1000389 + NOT-FOR-US: Jenkins plugin +CVE-2017-1000388 + NOT-FOR-US: Jenkins plugin +CVE-2017-1000387 + NOT-FOR-US: Jenkins plugin +CVE-2017-1000386 + NOT-FOR-US: Jenkins plugin CVE-2017-16884 RESERVED CVE-2017-16883 (The outputSWF_TEXT_RECORD function in util/outputscript.c in libming = ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57754 - in data: . DSA
Author: jmm
Date: 2017-11-17 22:47:35 + (Fri, 17 Nov 2017)
New Revision: 57754
Modified:
data/DSA/list
data/dsa-needed.txt
Log:
imagemagick DSA
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-17 22:41:54 UTC (rev 57753)
+++ data/DSA/list 2017-11-17 22:47:35 UTC (rev 57754)
@@ -1,3 +1,6 @@
+[17 Nov 2017] DSA-4040-1 imagemagick - security update
+ {CVE-2017-11352 CVE-2017-11640 CVE-2017-12431 CVE-2017-12640
CVE-2017-12877 CVE-2017-12983 CVE-2017-13134 CVE-2017-13139 CVE-2017-13144
CVE-2017-13758 CVE-2017-13769 CVE-2017-14224 CVE-2017-14607 CVE-2017-14682
CVE-2017-14989 CVE-2017-15277 CVE-2017-16546}
+ [jessie] - imagemagick 8:6.8.9.9-5+deb8u11
[16 Nov 2017] DSA-4039-1 opensaml2 - security update
{CVE-2017-16853}
[jessie] - opensaml2 2.5.3-2+deb8u2
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-17 22:41:54 UTC (rev 57753)
+++ data/dsa-needed.txt 2017-11-17 22:47:35 UTC (rev 57754)
@@ -16,8 +16,6 @@
--
graphicsmagick
--
-imagemagick/oldstable (jmm)
---
libav/oldstable
We can ship the next libav 11.x point release when available
--
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57725 - data/CVE
Author: jmm Date: 2017-11-17 18:35:57 + (Fri, 17 Nov 2017) New Revision: 57725 Modified: data/CVE/list Log: procmail fixed Modified: data/CVE/list === --- data/CVE/list 2017-11-17 18:35:26 UTC (rev 57724) +++ data/CVE/list 2017-11-17 18:35:57 UTC (rev 57725) @@ -333,7 +333,7 @@ - qemu-kvm NOTE: https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg02982.html CVE-2017-16844 (Heap-based buffer overflow in the loadbuf function in formisc.c in ...) - - procmail (bug #876511) + - procmail 3.22-26 (bug #876511) CVE-2017-16843 (Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the ...) NOT-FOR-US: Vonage VDV-23 CVE-2017-16842 (Cross-site scripting (XSS) vulnerability in ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57724 - data/CVE
Author: jmm Date: 2017-11-17 18:35:26 + (Fri, 17 Nov 2017) New Revision: 57724 Modified: data/CVE/list Log: nova fixed Modified: data/CVE/list === --- data/CVE/list 2017-11-17 18:34:54 UTC (rev 57723) +++ data/CVE/list 2017-11-17 18:35:26 UTC (rev 57724) @@ -1821,7 +1821,7 @@ CVE-2017-16240 RESERVED CVE-2017-16239 (In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through ...) - - nova (bug #882009) + - nova 2:16.0.3-1 (bug #882009) NOTE: https://launchpad.net/bugs/1664931 NOTE: https://security.openstack.org/ossa/OSSA-2017-005.html TODO: check / verify affected versions ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57721 - data/CVE
Author: jmm
Date: 2017-11-17 18:33:55 + (Fri, 17 Nov 2017)
New Revision: 57721
Modified:
data/CVE/list
Log:
chicken uploaded to sid, keeping the version that initially hit experimental
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-17 18:32:50 UTC (rev 57720)
+++ data/CVE/list 2017-11-17 18:33:55 UTC (rev 57721)
@@ -15971,8 +15971,7 @@
[stretch] - yadm 1.06-1+deb9u1
NOTE: https://github.com/TheLocehiliosan/yadm/issues/74
CVE-2017-11343 (Due to an incomplete fix for CVE-2012-6125, all versions of
CHICKEN ...)
- [experimental] - chicken 4.12.0-0.2
- - chicken (bug #870266)
+ - chicken 4.12.0-0.2 (bug #870266)
[stretch] - chicken (Minor issue)
[jessie] - chicken (Minor issue)
[wheezy] - chicken (Minor issue)
@@ -21803,8 +21802,7 @@
CVE-2017-9325
RESERVED
CVE-2017-9334 (An incorrect pair? check in the Scheme
length procedure results in ...)
- [experimental] - chicken 4.12.0-0.2
- - chicken (low; bug #863884)
+ - chicken 4.12.0-0.2 (low; bug #863884)
[stretch] - chicken (Minor issue)
[jessie] - chicken (Minor issue)
[wheezy] - chicken (Minor issue)
@@ -29666,8 +29664,7 @@
NOT-FOR-US: SAP
CVE-2017-6949 (An issue was discovered in CHICKEN Scheme through 4.12.0. When
using a ...)
{DLA-908-1}
- [experimental] - chicken 4.12.0-0.2
- - chicken (bug #858057)
+ - chicken 4.12.0-0.2 (bug #858057)
[stretch] - chicken (Minor issue)
[jessie] - chicken (Minor issue)
NOTE:
http://lists.gnu.org/archive/html/chicken-announce/2017-03/msg0.html
@@ -39249,8 +39246,7 @@
NOTE: https://github.com/docker/docker/compare/v1.12.5...v1.12.6
NOTE:
https://github.com/opencontainers/runc/commit/50a19c6ff828c58e5dab13830bd3dacde268afe5
CVE-2016-9954 (The backtrack compilation code in the Irregex package (aka
IrRegular ...)
- [experimental] - chicken 4.12.0-0.2
- - chicken (low; bug #851278)
+ - chicken 4.12.0-0.2 (low; bug #851278)
[stretch] - chicken (Minor issue)
[jessie] - chicken (Minor issue)
[wheezy] - chicken (Minor issue)
@@ -57448,15 +57444,13 @@
NOTE: Claimed to not affect ffmpeg
CVE-2016-6831 (The process-execute and process-spawn
procedures did not free ...)
{DLA-643-1}
- [experimental] - chicken 4.12.0-0.2
- - chicken (bug #834845)
+ - chicken 4.12.0-0.2 (bug #834845)
[stretch] - chicken (Minor issue)
[jessie] - chicken (Minor issue)
NOTE: Fixed in the same upstream patch which is provided for
CVE-2016-6830
CVE-2016-6830 (The process-execute and process-spawn
procedures in CHICKEN Scheme ...)
{DLA-643-1}
- [experimental] - chicken 4.12.0-0.2
- - chicken (bug #834845)
+ - chicken 4.12.0-0.2 (bug #834845)
[stretch] - chicken (Minor issue)
[jessie] - chicken (Minor issue)
NOTE:
http://lists.nongnu.org/archive/html/chicken-announce/2016-08/msg1.html
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57707 - data/CVE
Author: jmm Date: 2017-11-17 09:33:04 + (Fri, 17 Nov 2017) New Revision: 57707 Modified: data/CVE/list Log: NFUs, some need further investigation with Mono maintainers Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:29:52 UTC (rev 57706) +++ data/CVE/list 2017-11-17 09:33:04 UTC (rev 57707) @@ -14297,7 +14297,7 @@ CVE-2017-11884 (Microsoft Excel 2016 Click-to-Run (C2R) allows an attacker to run ...) NOT-FOR-US: Microsoft CVE-2017-11883 (.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to ...) - TODO: check + TODO: check with Debian mono maintainers CVE-2017-11882 (Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service ...) NOT-FOR-US: Microsoft CVE-2017-11881 @@ -14305,7 +14305,7 @@ CVE-2017-11880 (Windows kernel in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, ...) NOT-FOR-US: Microsoft CVE-2017-11879 (ASP.NET Core 2.0 allows an attacker to steal log-in session ...) - TODO: check + NOT-FOR-US: Microsoft CVE-2017-11878 (Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack ...) NOT-FOR-US: Microsoft CVE-2017-11877 (Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack ...) @@ -14523,7 +14523,7 @@ CVE-2017-11771 (The Microsoft Windows Search component on Microsoft Windows Server ...) NOT-FOR-US: Microsoft CVE-2017-11770 (.NET Core 1.0, 1.1, and 2.0 allow an unauthenticated attacker to ...) - TODO: check + TODO: check with Debian mono maintainers CVE-2017-11769 (The Microsoft Windows TRIE component on Microsoft Windows 10 Gold, ...) NOT-FOR-US: Microsoft CVE-2017-11768 (Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 ...) @@ -23880,7 +23880,7 @@ CVE-2017-8701 RESERVED CVE-2017-8700 (ASP.NET Core 1.0, 1.1, and 2.0 allow an attacker to bypass ...) - TODO: check + NOT-FOR-US: Microsoft CVE-2017-8699 (Windows Shell in Microsoft Windows 7 SP1, Windows Server 2008 and R2 ...) NOT-FOR-US: Microsoft CVE-2017-8698 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57706 - data/CVE
Author: jmm
Date: 2017-11-17 09:29:52 + (Fri, 17 Nov 2017)
New Revision: 57706
Modified:
data/CVE/list
Log:
NFU
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-17 09:26:56 UTC (rev 57705)
+++ data/CVE/list 2017-11-17 09:29:52 UTC (rev 57706)
@@ -78119,6 +78119,7 @@
[wheezy] - ruby-actionpack-2.3
CVE-2016-0750
RESERVED
+ NOT-FOR-US: Infinispan
CVE-2016-0749 (The smartcard interaction in SPICE allows remote attackers to
cause a ...)
{DSA-3596-1}
- spice 0.12.6-4.1 (bug #826585)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57705 - data/CVE
Author: jmm Date: 2017-11-17 09:26:56 + (Fri, 17 Nov 2017) New Revision: 57705 Modified: data/CVE/list Log: new python issue Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:26:09 UTC (rev 57704) +++ data/CVE/list 2017-11-17 09:26:56 UTC (rev 57705) @@ -108,7 +108,9 @@ CVE-2017-1000160 (EllisLab ExpressionEngine 3.4.2 is vulnerable to cross-site scripting ...) NOT-FOR-US: EllisLab ExpressionEngine CVE-2017-1000158 (CPython (aka Python) up to 2.7.13 is vulnerable to an integer overflow ...) - TODO: check + - python2.7 + TODO: check other versions + NOTE: https://bugs.python.org/issue30657 CVE-2017-1000129 (Serendipity 2.0.3 is vulnerable to a SQL injection in the blog ...) - serendipity CVE-2017-1000125 (Codiad(full version) is vulnerable to write anything to configure file ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57704 - data/CVE
Author: jmm Date: 2017-11-17 09:26:09 + (Fri, 17 Nov 2017) New Revision: 57704 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:24:07 UTC (rev 57703) +++ data/CVE/list 2017-11-17 09:26:09 UTC (rev 57704) @@ -58,9 +58,9 @@ CVE-2017-1000219 (npm/KyleRoss windows-cpu all versions vulnerable to command injection ...) NOT-FOR-US: npm/KyleRoss windows-cpu CVE-2017-1000218 (LightFTP version 1.1 is vulnerable to a buffer overflow in the ...) - TODO: check + NOT-FOR-US: LightFTP CVE-2017-1000213 (WBCE v1.1.11 is vulnerable to reflected XSS via the begriff POST ...) - TODO: check + NOT-FOR-US: WBCE CVE-2017-1000210 (picoTCP (versions 1.7.0 - 1.5.0) is vulnerable to stack buffer ...) NOT-FOR-US: picoTCP CVE-2017-1000209 (The Java WebSocket client nv-websocket-client does not verify that the ...) @@ -284,7 +284,7 @@ CVE-2018-0001 RESERVED CVE-2017-16866 (dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) ...) - TODO: check + NOT-FOR-US: dayrui FineCms CVE-2017-16865 RESERVED CVE-2017-16864 @@ -329,7 +329,7 @@ CVE-2017-16844 (Heap-based buffer overflow in the loadbuf function in formisc.c in ...) - procmail (bug #876511) CVE-2017-16843 (Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the ...) - TODO: check + NOT-FOR-US: Vonage VDV-23 CVE-2017-16842 (Cross-site scripting (XSS) vulnerability in ...) NOT-FOR-US: Yoast SEO plugin for WordPress CVE-2017-16841 (LanSweeper 6.0.100.75 has XSS via the description parameter to ...) @@ -524,7 +524,7 @@ CVE-2017-16778 RESERVED CVE-2017-16777 (If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) ...) - TODO: check + NOT-FOR-US: HashiCorp Vagrant VMware Fusion plugin CVE-2017-16776 RESERVED CVE-2017-16775 @@ -640,7 +640,7 @@ CVE-2017-16720 RESERVED CVE-2017-16719 (An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort ...) - TODO: check + NOT-FOR-US: Moxa CVE-2017-16718 RESERVED CVE-2017-16717 @@ -648,7 +648,7 @@ CVE-2017-16716 RESERVED CVE-2017-16715 (An Information Exposure issue was discovered in Moxa NPort 5110 Version ...) - TODO: check + NOT-FOR-US: Moxa CVE-2017-16714 RESERVED CVE-2017-16713 @@ -3158,7 +3158,7 @@ CVE-2017-15807 RESERVED CVE-2017-15806 (The send function in the ezcMailMtaTransport class in Zeta Components ...) - TODO: check + NOT-FOR-US: Zeta Components Mail CVE-2016-10516 (Cross-site scripting (XSS) vulnerability in the render_full function in ...) - python-werkzeug 0.11.11+dfsg1-1 NOTE: http://blog.neargle.com/2016/09/21/flask-src-review-get-a-xss-from-debuger/ @@ -3771,9 +3771,9 @@ CVE-2017-15518 RESERVED CVE-2017-15517 (AltaVault OST Plug-in versions prior to 1.2.2 may allow attackers to ...) - TODO: check + NOT-FOR-US: AltaVault OST Plug-in CVE-2017-15516 (NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a ...) - TODO: check + NOT-FOR-US: NetApp CVE-2017-15515 RESERVED CVE-2017-15514 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57703 - data/CVE
Author: jmm Date: 2017-11-17 09:24:07 + (Fri, 17 Nov 2017) New Revision: 57703 Modified: data/CVE/list Log: new ruby-redis-store issue Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:22:50 UTC (rev 57702) +++ data/CVE/list 2017-11-17 09:24:07 UTC (rev 57703) @@ -11,7 +11,8 @@ CVE-2017-16867 (Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 ...) NOT-FOR-US: Amazon Key CVE-2017-1000248 (Redis-store =v1.3.0 allows unsafe objects to be loaded from redis ...) - TODO: check + - ruby-redis-store + NOTE: https://github.com/redis-store/redis-store/commit/e0c1398d54a9661c8c70267c3a925ba6b192142e CVE-2017-1000247 (British Columbia Institute of Technology CodeIgniter 3.1.3 is ...) NOT-FOR-US: CodeIgniter CVE-2017-1000246 (Python package pysaml2 version 4.4.0 and earlier reuses the ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57702 - data/CVE
Author: jmm Date: 2017-11-17 09:22:50 + (Fri, 17 Nov 2017) New Revision: 57702 Modified: data/CVE/list Log: new swftools issues Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:21:32 UTC (rev 57701) +++ data/CVE/list 2017-11-17 09:22:50 UTC (rev 57702) @@ -81,17 +81,23 @@ CVE-2017-1000188 (nodejs ejs version older than 2.5.5 is vulnerable to a ...) NOT-FOR-US: nodejs ejs CVE-2017-1000187 (In SWFTools, an address access exception was found in pdf2swf. ...) - TODO: check + - swftools + NOTE: https://github.com/matthiaskramm/swftools/issues/36 CVE-2017-1000186 (In SWFTools, a stack overflow was found in pdf2swf. ...) - TODO: check + - swftools + NOTE: https://github.com/matthiaskramm/swftools/issues/34 CVE-2017-1000185 (In SWFTools, a memcpy buffer overflow was found in gif2swf. ...) - TODO: check + - swftools + NOTE: https://github.com/matthiaskramm/swftools/issues/33 CVE-2017-1000182 (In SWFTools, a memory leak was found in wav2swf. ...) - TODO: check + - swftools + NOTE: https://github.com/matthiaskramm/swftools/issues/32 CVE-2017-1000176 (In SWFTools, a memcpy buffer overflow was found in swfc. ...) - TODO: check + - swftools + NOTE: https://github.com/matthiaskramm/swftools/issues/23 CVE-2017-1000174 (In SWFTools, an address access exception was found in swfdump ...) - TODO: check + - swftools + NOTE: https://github.com/matthiaskramm/swftools/issues/21 CVE-2017-1000173 (Creolabs Gravity Version: 1.0 Heap Overflow Potential Code Execution. ...) NOT-FOR-US: Creolabs Gravity CVE-2017-1000172 (Creolabs Gravity Version: 1.0 Use-After-Free Possible code execution. ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57701 - data/CVE
Author: jmm Date: 2017-11-17 09:21:32 + (Fri, 17 Nov 2017) New Revision: 57701 Modified: data/CVE/list Log: new optipng issue Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:20:46 UTC (rev 57700) +++ data/CVE/list 2017-11-17 09:21:32 UTC (rev 57701) @@ -40,7 +40,8 @@ - ldns NOTE: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1256 CVE-2017-1000229 (Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 ...) - TODO: check + - optipng + NOTE: https://sourceforge.net/p/optipng/bugs/65/ CVE-2017-1000228 (nodejs ejs versions older than 2.5.3 is vulnerable to remote code ...) NOT-FOR-US: nodejs ejs CVE-2017-1000226 (Stop User Enumeration 1.3.8 allows user enumeration via the REST API ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57700 - data/CVE
Author: jmm Date: 2017-11-17 09:20:46 + (Fri, 17 Nov 2017) New Revision: 57700 Modified: data/CVE/list Log: new ldns issues Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:19:38 UTC (rev 57699) +++ data/CVE/list 2017-11-17 09:20:46 UTC (rev 57700) @@ -34,9 +34,11 @@ CVE-2017-1000234 (I, Librarian version =4.6 4.7 is vulnerable to Directory ...) NOT-FOR-US: I, Librarian CVE-2017-1000232 (A double-free vulnerability in str2host.c in ldns 1.7.0 have ...) - TODO: check + - ldns + NOTE: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1257 CVE-2017-1000231 (A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified ...) - TODO: check + - ldns + NOTE: https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=1256 CVE-2017-1000229 (Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 ...) TODO: check CVE-2017-1000228 (nodejs ejs versions older than 2.5.3 is vulnerable to remote code ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57699 - data/CVE
Author: jmm Date: 2017-11-17 09:19:38 + (Fri, 17 Nov 2017) New Revision: 57699 Modified: data/CVE/list Log: new pysaml issue Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:18:16 UTC (rev 57698) +++ data/CVE/list 2017-11-17 09:19:38 UTC (rev 57699) @@ -15,7 +15,8 @@ CVE-2017-1000247 (British Columbia Institute of Technology CodeIgniter 3.1.3 is ...) NOT-FOR-US: CodeIgniter CVE-2017-1000246 (Python package pysaml2 version 4.4.0 and earlier reuses the ...) - TODO: check + - python-pysaml2 + NOTE: https://github.com/rohe/pysaml2/issues/417 CVE-2017-1000241 (The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected ...) NOT-FOR-US: OpenEMR CVE-2017-1000240 (The application OpenEMR is affected by multiple reflected stored ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57698 - data/CVE
Author: jmm Date: 2017-11-17 09:18:16 + (Fri, 17 Nov 2017) New Revision: 57698 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-17 09:10:18 UTC (rev 57697) +++ data/CVE/list 2017-11-17 09:18:16 UTC (rev 57698) @@ -9,29 +9,29 @@ CVE-2017-16868 RESERVED CVE-2017-16867 (Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 ...) - TODO: check + NOT-FOR-US: Amazon Key CVE-2017-1000248 (Redis-store =v1.3.0 allows unsafe objects to be loaded from redis ...) TODO: check CVE-2017-1000247 (British Columbia Institute of Technology CodeIgniter 3.1.3 is ...) - TODO: check + NOT-FOR-US: CodeIgniter CVE-2017-1000246 (Python package pysaml2 version 4.4.0 and earlier reuses the ...) TODO: check CVE-2017-1000241 (The application OpenEMR version 5.0.0, 5.0.1-dev and prior is affected ...) - TODO: check + NOT-FOR-US: OpenEMR CVE-2017-1000240 (The application OpenEMR is affected by multiple reflected stored ...) - TODO: check + NOT-FOR-US: OpenEMR CVE-2017-1000239 (InvoicePlane version 1.4.10 is vulnerable to a Stored Cross Site ...) - TODO: check + NOT-FOR-US: InvoicePlane CVE-2017-1000238 (InvoicePlane version 1.4.10 is vulnerable to a Arbitrary File Upload ...) - TODO: check + NOT-FOR-US: InvoicePlane CVE-2017-1000237 (I, Librarian version =4.6 4.7 is vulnerable to Server-Side Request ...) - TODO: check + NOT-FOR-US: I, Librarian CVE-2017-1000236 (I, Librarian version =4.6 4.7 is vulnerable to Reflected Cross-Site ...) - TODO: check + NOT-FOR-US: I, Librarian CVE-2017-1000235 (I, Librarian version =4.6 4.7 is vulnerable to OS Command Injection ...) - TODO: check + NOT-FOR-US: I, Librarian CVE-2017-1000234 (I, Librarian version =4.6 4.7 is vulnerable to Directory ...) - TODO: check + NOT-FOR-US: I, Librarian CVE-2017-1000232 (A double-free vulnerability in str2host.c in ldns 1.7.0 have ...) TODO: check CVE-2017-1000231 (A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified ...) @@ -39,43 +39,43 @@ CVE-2017-1000229 (Integer overflow bug in function minitiff_read_info() of optipng 0.7.6 ...) TODO: check CVE-2017-1000228 (nodejs ejs versions older than 2.5.3 is vulnerable to remote code ...) - TODO: check + NOT-FOR-US: nodejs ejs CVE-2017-1000226 (Stop User Enumeration 1.3.8 allows user enumeration via the REST API ...) TODO: check CVE-2017-1000225 (Reflected XSS in Relevanssi Premium version 1.14.8 when using ...) - TODO: check + NOT-FOR-US: Relevanssi CVE-2017-1000224 (CSRF in YouTube (WordPress plugin) could allow unauthenticated ...) - TODO: check + NOT-FOR-US: Wordpress plugin CVE-2017-1000223 (A stored web content injection vulnerability (WCI, a.k.a XSS) is ...) - TODO: check + NOT-FOR-US: MODX Revolution CVE-2017-1000220 (soyuka/pidusage =1.1.4 is vulnerable to command injection in the ...) - TODO: check + NOT-FOR-US: soyuka/pidusage CVE-2017-1000219 (npm/KyleRoss windows-cpu all versions vulnerable to command injection ...) - TODO: check + NOT-FOR-US: npm/KyleRoss windows-cpu CVE-2017-1000218 (LightFTP version 1.1 is vulnerable to a buffer overflow in the ...) TODO: check CVE-2017-1000213 (WBCE v1.1.11 is vulnerable to reflected XSS via the begriff POST ...) TODO: check CVE-2017-1000210 (picoTCP (versions 1.7.0 - 1.5.0) is vulnerable to stack buffer ...) - TODO: check + NOT-FOR-US: picoTCP CVE-2017-1000209 (The Java WebSocket client nv-websocket-client does not verify that the ...) - TODO: check + NOT-FOR-US: Java WebSocket client nv-websocket-client CVE-2017-1000208 (A vulnerability in Swagger-Parser's (version = 1.0.30) yaml parsing ...) - TODO: check + NOT-FOR-US: Swagger-Parser CVE-2017-1000197 (October CMS build 412 is vulnerable to file path modification in asset ...) - TODO: check + NOT-FOR-US: October CMS CVE-2017-1000196 (October CMS build 412 is vulnerable to PHP code execution in the asset ...) - TODO: check + NOT-FOR-US: October CMS CVE-2017-1000195 (October CMS build 412 is vulnerable to PHP object injection in asset ...) - TODO: check + NOT-FOR-US: October CMS CVE-2017-1000194 (October CMS build 412 is vulnerable to Apache configuration ...) - TODO: check + NOT-FOR-US: October CMS CVE-2017-1000193 (October CMS build 412 is vulnerable to stored WCI (a.k.a XSS) in brand ...) - TODO: check + NOT-FOR-US: October CMS CVE-2017-1000189 (nodejs ejs version older than 2.5.5 is vulnerable to a ...) - TODO: check + NOT-FOR-US: nodejs ejs CVE-2017-1000188 (nodejs ejs version older than 2.5.5 is vulnerable to a ...) - TODO: check +
[Secure-testing-commits] r57681 - data/CVE
Author: jmm Date: 2017-11-16 13:34:51 + (Thu, 16 Nov 2017) New Revision: 57681 Modified: data/CVE/list Log: tboot rfp/itp Modified: data/CVE/list === --- data/CVE/list 2017-11-16 13:27:06 UTC (rev 57680) +++ data/CVE/list 2017-11-16 13:34:51 UTC (rev 57681) @@ -11,7 +11,7 @@ CVE-2017-16838 RESERVED CVE-2017-16837 (Certain function pointers in Trusted Boot (tboot) through 1.9.6 are not ...) - TODO: check + - tboot (bug #803180) CVE-2017-16836 (Arris TG1682G devices with Comcast TG1682_2.0s7_PRODse ...) NOT-FOR-US: Arris TG1682G devices CVE-2017-16835 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57676 - data/CVE
Author: jmm Date: 2017-11-16 09:50:06 + (Thu, 16 Nov 2017) New Revision: 57676 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-16 09:10:18 UTC (rev 57675) +++ data/CVE/list 2017-11-16 09:50:06 UTC (rev 57676) @@ -12869,7 +12869,7 @@ CVE-2017-12338 RESERVED CVE-2017-12337 (A vulnerability in the upgrade mechanism of Cisco collaboration ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12336 RESERVED CVE-2017-12335 @@ -12897,55 +12897,55 @@ CVE-2017-12324 RESERVED CVE-2017-12323 (Multiple vulnerabilities in the web interface of the Cisco Registered ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12322 (Multiple vulnerabilities in the web interface of the Cisco Registered ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12321 (Multiple vulnerabilities in the web interface of the Cisco Registered ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12320 (Multiple vulnerabilities in the web interface of the Cisco Registered ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12319 RESERVED CVE-2017-12318 (A vulnerability in the TCP state machine of Cisco RF Gateway 1 devices ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12317 (The Cisco AMP For Endpoints application allows an authenticated, local ...) NOT-FOR-US: Cisco CVE-2017-12316 (A vulnerability in the Guest Portal login page of Cisco Identity ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12315 (A vulnerability in system logging when replication is being configured ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12314 (A vulnerability in the Cisco FindIT Network Discovery Utility could ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12313 (An untrusted search path (aka DLL Preload) vulnerability in the Cisco ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12312 (An untrusted search path (aka DLL Preloading) vulnerability in the ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12311 (A vulnerability in the H.264 decoder function of Cisco Meeting Server ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12310 RESERVED CVE-2017-12309 (A vulnerability in the Cisco Email Security Appliance (ESA) could allow ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12308 RESERVED CVE-2017-12307 RESERVED CVE-2017-12306 (A vulnerability in the upgrade process of Cisco Spark Board could allow ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12305 (A vulnerability in the debug interface of Cisco IP Phone 8800 series ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12304 (A vulnerability in the IOS daemon (IOSd) web-based management interface ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12303 (A vulnerability in the Advanced Malware Protection (AMP) file filtering ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12302 (A vulnerability in the Cisco Unified Communications Manager SQL ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12301 (A vulnerability in the Python scripting subsystem of Cisco NX-OS ...) NOT-FOR-US: Cisco CVE-2017-12300 (A vulnerability in the SNORT detection engine of Cisco Firepower System ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12299 (A vulnerability exists in the process of creating default IP blocks ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12298 (A vulnerability in Cisco WebEx Meeting Center could allow an ...) NOT-FOR-US: Cisco CVE-2017-12297 @@ -12959,11 +12959,11 @@ CVE-2017-12293 (A vulnerability in Cisco WebEx Meetings Server could allow an ...) NOT-FOR-US: Cisco CVE-2017-12292 (Multiple vulnerabilities in the web interface of the Cisco Registered ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12291 (Multiple vulnerabilities in the web interface of the Cisco Registered ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12290 (Multiple vulnerabilities in the web interface of the Cisco Registered ...) - TODO: check + NOT-FOR-US: Cisco CVE-2017-12289 (A vulnerability in conditional, verbose debug logging for the IPsec ...) NOT-FOR-US: Cisco CVE-2017-12288 (A vulnerability in the web-based management interface of Cisco Unified ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57668 - in data: . DSA
Author: jmm
Date: 2017-11-15 21:49:45 + (Wed, 15 Nov 2017)
New Revision: 57668
Modified:
data/DSA/list
data/dsa-needed.txt
Log:
mediawiki, firefox DSAs
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-15 21:18:11 UTC (rev 57667)
+++ data/DSA/list 2017-11-15 21:49:45 UTC (rev 57668)
@@ -1,3 +1,10 @@
+[15 Nov 2017] DSA-4036-1 mediawiki - security update
+ {CVE-2017-8808 CVE-2017-8809 CVE-2017-8810 CVE-2017-8811 CVE-2017-8812
CVE-2017-8814 CVE-2017-8815}
+ [stretch] - mediawiki 1:1.27.4-1~deb9u1
+[15 Nov 2017] DSA-4035-1 firefox-esr - security update
+ {CVE-2017-7826 CVE-2017-7828 CVE-2017-7830}
+ [jessie] - firefox-esr 52.5.0esr-1~deb8u1
+ [stretch] - firefox-esr 52.5.0esr-1~deb9u1
[15 Nov 2017] DSA-4034-1 varnish - security update
{CVE-2017-8807}
[stretch] - varnish 5.0.0-7+deb9u2
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-15 21:18:11 UTC (rev 57667)
+++ data/dsa-needed.txt 2017-11-15 21:49:45 UTC (rev 57668)
@@ -14,8 +14,6 @@
--
389-ds-base (fw)
--
-firefox-esr (jmm)
---
graphicsmagick
--
imagemagick/oldstable (jmm)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57661 - data/CVE
Author: jmm Date: 2017-11-15 12:44:48 + (Wed, 15 Nov 2017) New Revision: 57661 Modified: data/CVE/list Log: add upstream bugs for mediawiki issues Modified: data/CVE/list === --- data/CVE/list 2017-11-15 12:39:59 UTC (rev 57660) +++ data/CVE/list 2017-11-15 12:44:48 UTC (rev 57661) @@ -23181,26 +23181,33 @@ CVE-2017-8815 (The language converter in MediaWiki before 1.27.4, 1.28.x before ...) - mediawiki 1:1.27.4-1 NOTE: https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html + NOTE: https://phabricator.wikimedia.org/T119158 CVE-2017-8814 (The language converter in MediaWiki before 1.27.4, 1.28.x before ...) - mediawiki 1:1.27.4-1 NOTE: https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html + NOTE: https://phabricator.wikimedia.org/T124404 CVE-2017-8813 REJECTED CVE-2017-8812 (MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 ...) - mediawiki 1:1.27.4-1 NOTE: https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html + NOTE: https://phabricator.wikimedia.org/T125163 CVE-2017-8811 (The implementation of raw message parameter expansion in MediaWiki ...) - mediawiki 1:1.27.4-1 NOTE: https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html + NOTE: https://phabricator.wikimedia.org/T176247 CVE-2017-8810 (MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before ...) - mediawiki 1:1.27.4-1 NOTE: https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html + NOTE: https://phabricator.wikimedia.org/T134100 CVE-2017-8809 (api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x ...) - mediawiki 1:1.27.4-1 NOTE: https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html + NOTE: https://phabricator.wikimedia.org/T128209 CVE-2017-8808 (MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 ...) - mediawiki 1:1.27.4-1 NOTE: https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html + NOTE: https://phabricator.wikimedia.org/T178451 CVE-2017-8807 [Data leak - '-sfile' Stevedore transient objects] RESERVED - varnish (bug #881808) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57655 - in data: . CVE
Author: jmm
Date: 2017-11-15 11:34:49 + (Wed, 15 Nov 2017)
New Revision: 57655
Modified:
data/CVE/list
data/dsa-needed.txt
Log:
new varnish issue
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-15 09:58:25 UTC (rev 57654)
+++ data/CVE/list 2017-11-15 11:34:49 UTC (rev 57655)
@@ -23201,6 +23201,8 @@
NOTE:
https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html
CVE-2017-8807
RESERVED
+ - varnish
+ NOTE: http://varnish-cache.org/security/VSV2.html#vsv2
CVE-2017-8806 (The Debian pg_ctlcluster, pg_createcluster, and
pg_upgradecluster ...)
{DSA-4029-1 DLA-1169-1}
- postgresql-common 188
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-15 09:58:25 UTC (rev 57654)
+++ data/dsa-needed.txt 2017-11-15 11:34:49 UTC (rev 57655)
@@ -56,6 +56,8 @@
tiff
wait until more issues are around
--
+varnish (carnil)
+--
vlc
wait until 2.2.7 release
--
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57636 - data/CVE
Author: jmm Date: 2017-11-14 20:34:04 + (Tue, 14 Nov 2017) New Revision: 57636 Modified: data/CVE/list Log: libofx no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-11-14 20:29:22 UTC (rev 57635) +++ data/CVE/list 2017-11-14 20:34:04 UTC (rev 57636) @@ -5671,6 +5671,8 @@ RESERVED CVE-2017-14731 (ofx_proc_file in ofx_preproc.cpp in LibOFX 0.9.12 allows remote ...) - libofx 1:0.9.11-5 (bug #877442) + [stretch] - libofx (Minor issue) + [jessie] - libofx (Minor issue) NOTE: https://github.com/libofx/libofx/issues/10 NOTE: https://github.com/libofx/libofx/commit/fad8418f34094de42e1307113598e0e8bee0a2bd CVE-2017-14730 (The init script in the Gentoo app-admin/logstash-bin package before ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57635 - data/CVE
Author: jmm Date: 2017-11-14 20:29:22 + (Tue, 14 Nov 2017) New Revision: 57635 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-14 20:26:40 UTC (rev 57634) +++ data/CVE/list 2017-11-14 20:29:22 UTC (rev 57635) @@ -19,9 +19,9 @@ [jessie] - tcpdump (Can be fixed along in a future update) NOTE: https://github.com/the-tcpdump-group/tcpdump/issues/645 CVE-2017-16807 (A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, ...) - TODO: check + NOT-FOR-US: Kirby Panel CVE-2017-16806 (The Process function in RemoteTaskServer/WebServer/HttpServer.cs in ...) - TODO: check + NOT-FOR-US: Ulterius CVE-2017-16805 (In radare2 2.0.1, libr/bin/dwarf.c allows remote attackers to cause a ...) - radare2 NOTE: https://github.com/radare/radare2/commit/2ca9ab45891b6ae8e32b6c28c81eebca059cbe5d @@ -8270,7 +8270,7 @@ NOTE: https://webkitgtk.org/security/WSA-2017-0009.html NOTE: Not covered by security support CVE-2017-13797 (An issue was discovered in certain Apple products. iOS before 11.1 is ...) - TODO: check + NOT-FOR-US: Apple-specific Webkit change (since not mentioned in webkitgtk releases) CVE-2017-13796 (An issue was discovered in certain Apple products. iOS before 11.1 is ...) - webkit2gtk 2.18.1-1 (unimportant) NOTE: https://webkitgtk.org/security/WSA-2017-0009.html @@ -8296,9 +8296,9 @@ NOTE: https://webkitgtk.org/security/WSA-2017-0009.html NOTE: Not covered by security support CVE-2017-13790 (An issue was discovered in certain Apple products. Safari before ...) - TODO: check + NOT-FOR-US: Apple Safari CVE-2017-13789 (An issue was discovered in certain Apple products. Safari before ...) - TODO: check + NOT-FOR-US: Apple Safari CVE-2017-13788 (An issue was discovered in certain Apple products. iOS before 11.1 is ...) - webkit2gtk 2.18.3-1 (unimportant) NOTE: https://webkitgtk.org/security/WSA-2017-0009.html @@ -38589,7 +38589,7 @@ CVE-2017-3768 RESERVED CVE-2017-3767 (A local privilege escalation vulnerability was identified in the ...) - TODO: check + NOT-FOR-US: Lenovo CVE-2017-3766 RESERVED CVE-2017-3765 @@ -44865,7 +44865,7 @@ CVE-2017-1478 RESERVED CVE-2017-1477 (IBM Security Access Manager Appliance 9.0.3 is vulnerable to a XML ...) - TODO: check + NOT-FOR-US: IBM CVE-2017-1476 RESERVED CVE-2017-1475 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57631 - data
Author: jmm Date: 2017-11-14 20:04:34 + (Tue, 14 Nov 2017) New Revision: 57631 Modified: data/dsa-needed.txt Log: take firefox Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-11-14 19:38:14 UTC (rev 57630) +++ data/dsa-needed.txt 2017-11-14 20:04:34 UTC (rev 57631) @@ -14,7 +14,7 @@ -- 389-ds-base (fw) -- -firefox-esr (presumably jmm) +firefox-esr (jmm) -- graphicsmagick -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57627 - data/CVE
Author: jmm Date: 2017-11-14 18:31:55 + (Tue, 14 Nov 2017) New Revision: 57627 Modified: data/CVE/list Log: new couchdb issues Modified: data/CVE/list === --- data/CVE/list 2017-11-14 17:07:20 UTC (rev 57626) +++ data/CVE/list 2017-11-14 18:31:55 UTC (rev 57627) @@ -11935,8 +11935,10 @@ NOT-FOR-US: SAP CVE-2017-12636 RESERVED + - couchdb CVE-2017-12635 RESERVED + - couchdb CVE-2017-12634 RESERVED CVE-2017-12633 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57620 - data/CVE
Author: jmm
Date: 2017-11-14 15:11:08 + (Tue, 14 Nov 2017)
New Revision: 57620
Modified:
data/CVE/list
Log:
new firefox issues
one im issue no-dsa
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-14 11:21:08 UTC (rev 57619)
+++ data/CVE/list 2017-11-14 15:11:08 UTC (rev 57620)
@@ -11238,6 +11238,7 @@
NOTE: https://github.com/ImageMagick/ImageMagick/issues/662
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/98dda239ec398dd56453460849b4c9057fc424e5
NOTE: ImageMagick-7:
https://github.com/ImageMagick/ImageMagick/commit/04178de2247e353fc095846784b9a10fefdbf890
+ NOTE: This doesn't affect the base releases, but got introduced via
security fixes, which got backported to older suites
CVE-2017-12876 (Heap-based buffer overflow in enhance.c in ImageMagick before
7.0.6-6 ...)
- imagemagick (Specific to Imagemagick 7, 6.x uses fixed
pixel cache morphology)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/663
@@ -14464,6 +14465,7 @@
CVE-2017-13145 (In ImageMagick before 6.9.8-8 and 7.x before 7.0.5-9, the
ReadJP2Image ...)
{DSA-4019-1}
- imagemagick 8:6.9.7.4+dfsg-13 (bug #869830)
+ [jessie] - imagemagick (Minor issue)
[wheezy] - imagemagick (Vulnerable code not present)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/501
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/acee073df34aa4d491bf5cb74d3a15fc80f0a3aa
@@ -25784,38 +25786,69 @@
RESERVED
CVE-2017-7842
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7842
CVE-2017-7841
RESERVED
CVE-2017-7840
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7840
CVE-2017-7839
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7839
CVE-2017-7838
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7838
CVE-2017-7837
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7837
CVE-2017-7836
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7836
CVE-2017-7835
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7835
CVE-2017-7834
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7834
CVE-2017-7833
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7833
CVE-2017-7832
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7832
CVE-2017-7831
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7831
CVE-2017-7830
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7830
CVE-2017-7829
RESERVED
CVE-2017-7828
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7828
CVE-2017-7827
RESERVED
+ - firefox
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7827
CVE-2017-7826
RESERVED
+ - firefox
+ - firefox-esr
+ NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-24/#CVE-2017-7826
CVE-2017-7825
RESERVED
- firefox (Only affects Firefox on OS X)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57619 - data/CVE
Author: jmm Date: 2017-11-14 11:21:08 + (Tue, 14 Nov 2017) New Revision: 57619 Modified: data/CVE/list Log: tcpdump no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-11-14 10:08:47 UTC (rev 57618) +++ data/CVE/list 2017-11-14 11:21:08 UTC (rev 57619) @@ -11,7 +11,9 @@ CVE-2017-16809 RESERVED CVE-2017-16808 (tcpdump 4.9.2 has a heap-based buffer over-read related to aoe_print in ...) - - tcpdump + - tcpdump (low) + [stretch] - tcpdump (Can be fixed along in a future update) + [jessie] - tcpdump (Can be fixed along in a future update) NOTE: https://github.com/the-tcpdump-group/tcpdump/issues/645 CVE-2017-16807 (A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, ...) TODO: check ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57613 - data/CVE
Author: jmm Date: 2017-11-14 08:26:59 + (Tue, 14 Nov 2017) New Revision: 57613 Modified: data/CVE/list Log: libav issue also affects ffmpeg Modified: data/CVE/list === --- data/CVE/list 2017-11-14 06:25:30 UTC (rev 57612) +++ data/CVE/list 2017-11-14 08:26:59 UTC (rev 57613) @@ -1,8 +1,9 @@ CVE-2017-16803 (In Libav through 11.11 and 12.x through 12.1, the smacker_decode_tree ...) - libav + - ffmpeg NOTE: https://bugzilla.libav.org/show_bug.cgi?id=1098 NOTE: https://github.com/libav/libav/commit/cd4663dc80323ba64989d0c103d51ad3ee0e9c2f - TODO: check, ffmpeg? + NOTE: https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/cd4663dc80323ba64989d0c103d51ad3ee0e9c2f CVE-2017-16802 (In the sharingGroupPopulateOrganisations function in ...) NOT-FOR-US: MISP CVE-2017-16804 (In Redmine before 3.2.7 and 3.3.x before 3.3.4, the reminders function ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57600 - data/CVE
Author: jmm
Date: 2017-11-13 13:44:27 + (Mon, 13 Nov 2017)
New Revision: 57600
Modified:
data/CVE/list
Log:
bogus apple CVE ID
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-13 13:34:51 UTC (rev 57599)
+++ data/CVE/list 2017-11-13 13:44:27 UTC (rev 57600)
@@ -3968,7 +3968,7 @@
{DSA-4032-1 DLA-1140-1 DLA-1139-1}
- imagemagick (bug #878578)
- graphicsmagick 1.3.26-14
- NOTE:
https://github.com/ImageMagick/ImageMagick/commit/9fd10cf630832b36a588c1545d8736539b2f1fb5
+ NOTE: IM6:
https://github.com/ImageMagick/ImageMagick/commit/10aae21bf9dac47e16d8fcde7eba7f7f9d1e52f8
NOTE: https://github.com/ImageMagick/ImageMagick/issues/592
NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/923c4a525c99
NOTE: https://github.com/neex/gifoeb
@@ -8146,7 +8146,7 @@
CVE-2017-13827
RESERVED
CVE-2017-13826 (An issue was discovered in certain Apple products. macOS
before ...)
- TODO: check
+ NOT-FOR-US: Postfix as used by Apple, but actually a dupe of
CVE-2017-10140. Requested reject at MITRE
CVE-2017-13825 (An issue was discovered in certain Apple products. macOS
before ...)
NOT-FOR-US: Apple
CVE-2017-13824 (An issue was discovered in certain Apple products. macOS
before ...)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57599 - data/CVE
Author: jmm Date: 2017-11-13 13:34:51 + (Mon, 13 Nov 2017) New Revision: 57599 Modified: data/CVE/list Log: apple NFUs, some potentially affecting floss components as usual... Modified: data/CVE/list === --- data/CVE/list 2017-11-13 10:04:10 UTC (rev 57598) +++ data/CVE/list 2017-11-13 13:34:51 UTC (rev 57599) @@ -8094,103 +8094,103 @@ CVE-2017-13853 RESERVED CVE-2017-13852 (An issue was discovered in certain Apple products. iOS before 11.1 is ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13851 RESERVED CVE-2017-13850 RESERVED CVE-2017-13849 (An issue was discovered in certain Apple products. iOS before 11.1 is ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13848 RESERVED CVE-2017-13847 RESERVED CVE-2017-13846 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + TODO: check, potentially PCRE CVE-2017-13845 RESERVED CVE-2017-13844 (An issue was discovered in certain Apple products. iOS before 11.1 is ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13843 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13842 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13841 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13840 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13839 RESERVED CVE-2017-13838 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13837 RESERVED CVE-2017-13836 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13835 RESERVED CVE-2017-13834 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13833 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13832 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13831 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13830 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13829 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13828 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13827 RESERVED CVE-2017-13826 (An issue was discovered in certain Apple products. macOS before ...) TODO: check CVE-2017-13825 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13824 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13823 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13822 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13821 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13820 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13819 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13818 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13817 (An out-of-bounds read issue was discovered in certain Apple products. ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13816 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + TODO: check, potentially libarchive CVE-2017-13815 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + TODO: check, potentially file CVE-2017-13814 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + NOT-FOR-US: Apple CVE-2017-13813 (An issue was discovered in certain Apple products. macOS before ...) - TODO: check + TODO: check, potentially libarchive CVE-2017-13812 (An issue was discovered in certain Apple
[Secure-testing-commits] r57592 - data/CVE
Author: jmm Date: 2017-11-13 07:27:15 + (Mon, 13 Nov 2017) New Revision: 57592 Modified: data/CVE/list Log: NFU Modified: data/CVE/list === --- data/CVE/list 2017-11-13 06:09:42 UTC (rev 57591) +++ data/CVE/list 2017-11-13 07:27:15 UTC (rev 57592) @@ -11409,7 +11409,7 @@ CVE-2017-12802 (The EBML_IntegerValue function in ebmlnumber.c in libebml2 through ...) NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12801 (The UpdateDataSize function in ebmlmaster.c in libebml2 through ...) - TODO: check + NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12800 (The EBML_FindNextElement function in ebmlmain.c in libebml2 through ...) TODO: check CVE-2016-10405 (Session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57590 - data/CVE
Author: jmm Date: 2017-11-12 22:13:40 + (Sun, 12 Nov 2017) New Revision: 57590 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-12 21:57:43 UTC (rev 57589) +++ data/CVE/list 2017-11-12 22:13:40 UTC (rev 57590) @@ -37,7 +37,7 @@ CVE-2017-16783 (In CMS Made Simple 2.1.6, there is Server-Side Template Injection via ...) NOT-FOR-US: CMS Made Simple CVE-2017-16782 (In Home Assistant before 0.57, it is possible to inject JavaScript code ...) - TODO: check + NOT-FOR-US: Home Assistant CVE-2017-16781 (The installer in MyBB before 1.8.13 has XSS. ...) NOT-FOR-US: MyBB CVE-2017-16780 (The installer in MyBB before 1.8.13 allows remote attackers to execute ...) @@ -1295,7 +1295,7 @@ CVE-2017-16250 RESERVED CVE-2017-16249 (The Debut embedded http server 1.20 contains a remotely exploitable ...) - TODO: check + NOT-FOR-US: Debut embedded http server CVE-2017-16247 RESERVED CVE-2017-16246 @@ -11404,9 +11404,9 @@ CVE-2017-12804 RESERVED CVE-2017-12803 (The Node_ValidatePtr function in corec/corec/node/node.c in mkclean ...) - TODO: check + NOT-FOR-US: mkclean CVE-2017-12802 (The EBML_IntegerValue function in ebmlnumber.c in libebml2 through ...) - TODO: check + NOT-FOR-US: libembl2 (different codebase than src:libebml) CVE-2017-12801 (The UpdateDataSize function in ebmlmaster.c in libebml2 through ...) TODO: check CVE-2017-12800 (The EBML_FindNextElement function in ebmlmain.c in libebml2 through ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57589 - doc
Author: jmm Date: 2017-11-12 21:57:43 + (Sun, 12 Nov 2017) New Revision: 57589 Modified: doc/DSA.template Log: remove testing/sid from DSA template - if a DSA is for more than one vulnerability, we end up writing unfixed, while that's partly untrue, security tracker is more precise - the DSA mail is a single point in time, if it gets fixed after DSA release time, it still reads unfixed in the advisory, security tracker is always up-to-date. - if we notice a fix for unstable was incorrect/incomplete, the advisory never gets updated, security tracker is always up-to-date => people should consult the Debian Security Tracker as the canonical source of information for the fix status in testing/unstable. Modified: doc/DSA.template === --- doc/DSA.template2017-11-12 21:40:13 UTC (rev 57588) +++ doc/DSA.template2017-11-12 21:57:43 UTC (rev 57589) @@ -20,12 +20,6 @@ For the stable distribution ($STABLE), this problem has been fixed in version $$STABLE_VERSION. -For the testing distribution ($TESTING), this problem has been fixed -in version $$TESTING_VERSION. - -For the unstable distribution (sid), this problem has been fixed in -version $UNSTABLE_VERSION. - We recommend that you upgrade your $PACKAGE packages. Further information about Debian Security Advisories, how to apply ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57573 - data
Author: jmm Date: 2017-11-12 10:44:08 + (Sun, 12 Nov 2017) New Revision: 57573 Modified: data/dsa-needed.txt Log: add imagemagick/jessie Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-11-12 10:42:22 UTC (rev 57572) +++ data/dsa-needed.txt 2017-11-12 10:44:08 UTC (rev 57573) @@ -16,6 +16,8 @@ -- graphicsmagick -- +imagemagick/oldstable (jmm) +-- jackson-databind (seb) For CVE-2017-15095 (see notes for missing commits) -- ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57572 - data/DSA
Author: jmm
Date: 2017-11-12 10:42:22 + (Sun, 12 Nov 2017)
New Revision: 57572
Modified:
data/DSA/list
Log:
imagemagick DSA
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-12 09:10:15 UTC (rev 57571)
+++ data/DSA/list 2017-11-12 10:42:22 UTC (rev 57572)
@@ -1,3 +1,6 @@
+[12 Nov 2017] DSA-4032-1 imagemagick - security update
+ {CVE-2017-12983 CVE-2017-13134 CVE-2017-13758 CVE-2017-13769
CVE-2017-14224 CVE-2017-14607 CVE-2017-14682 CVE-2017-14989 CVE-2017-15277}
+ [stretch] - imagemagick 8:6.9.7.4+dfsg-11+deb9u3
[11 Nov 2017] DSA-4031-1 ruby2.3 - security update
{CVE-2017-0898 CVE-2017-0903 CVE-2017-10784 CVE-2017-14033}
[stretch] - ruby2.3 2.3.3-1+deb9u2
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57530 - data/CVE
Author: jmm Date: 2017-11-10 17:14:37 + (Fri, 10 Nov 2017) New Revision: 57530 Modified: data/CVE/list Log: new webkit issues Modified: data/CVE/list === --- data/CVE/list 2017-11-10 15:46:41 UTC (rev 57529) +++ data/CVE/list 2017-11-10 17:14:37 UTC (rev 57530) @@ -8089,8 +8089,14 @@ RESERVED CVE-2017-13803 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13802 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13801 RESERVED CVE-2017-13800 @@ -8099,36 +8105,69 @@ RESERVED CVE-2017-13798 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13797 RESERVED CVE-2017-13796 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13795 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13794 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13793 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13792 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13791 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13790 RESERVED CVE-2017-13789 RESERVED CVE-2017-13788 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13787 RESERVED CVE-2017-13786 RESERVED CVE-2017-13785 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13784 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13783 RESERVED + - webkit2gtk 2.18.1-1 (unimportant) + NOTE: https://webkitgtk.org/security/WSA-2017-0009.html + NOTE: Not covered by security support CVE-2017-13782 RESERVED CVE-2017-13781 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57529 - data
Author: jmm Date: 2017-11-10 15:46:41 + (Fri, 10 Nov 2017) New Revision: 57529 Modified: data/next-oldstable-point-update.txt Log: tablib ospu Modified: data/next-oldstable-point-update.txt === --- data/next-oldstable-point-update.txt2017-11-10 11:25:11 UTC (rev 57528) +++ data/next-oldstable-point-update.txt2017-11-10 15:46:41 UTC (rev 57529) @@ -106,3 +106,5 @@ [jessie] - liblouis 2.5.3-3+deb8u1 CVE-2017-14952 [jessie] - icu 52.1-8+deb8u6 +CVE-2017-2810 + [jessie] - python-tablib 0.9.11-2+deb8u1 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57527 - data/CVE
Author: jmm Date: 2017-11-10 09:49:11 + (Fri, 10 Nov 2017) New Revision: 57527 Modified: data/CVE/list Log: remove exp entry, I got consuded, im7 isn't even in experimental yet Modified: data/CVE/list === --- data/CVE/list 2017-11-10 09:32:03 UTC (rev 57526) +++ data/CVE/list 2017-11-10 09:49:11 UTC (rev 57527) @@ -11062,7 +11062,6 @@ NOTE: ImageMagick-6: https://github.com/ImageMagick/ImageMagick/commit/98dda239ec398dd56453460849b4c9057fc424e5 NOTE: ImageMagick-7: https://github.com/ImageMagick/ImageMagick/commit/04178de2247e353fc095846784b9a10fefdbf890 CVE-2017-12876 (Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 ...) - [experimental] - imagemagick (bug #872374) - imagemagick (Specific to Imagemagick 7, 6.x uses fixed pixel cache morphology) NOTE: https://github.com/ImageMagick/ImageMagick/issues/663 NOTE: https://github.com/ImageMagick/ImageMagick/commit/1cc6f0ccc92c20c7cab6c4a7335daf29c91f0d8e ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57526 - data/CVE
Author: jmm Date: 2017-11-10 09:32:03 + (Fri, 10 Nov 2017) New Revision: 57526 Modified: data/CVE/list Log: imagemagick n/a NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-10 09:10:26 UTC (rev 57525) +++ data/CVE/list 2017-11-10 09:32:03 UTC (rev 57526) @@ -9,11 +9,11 @@ CVE-2017-16760 RESERVED CVE-2017-16759 (The installation process in LibreNMS before 2017-08-18 allows remote ...) - TODO: check + NOT-FOR-US: LibreNMS CVE-2017-16758 (Cross-site scripting (XSS) vulnerability in ...) - TODO: check + NOT-FOR-US: Wordpress plugin CVE-2017-16757 (Hola VPN 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, ...) - TODO: check + NOT-FOR-US: Hola VPN CVE-2017-16756 RESERVED CVE-2017-16755 @@ -11062,8 +11062,8 @@ NOTE: ImageMagick-6: https://github.com/ImageMagick/ImageMagick/commit/98dda239ec398dd56453460849b4c9057fc424e5 NOTE: ImageMagick-7: https://github.com/ImageMagick/ImageMagick/commit/04178de2247e353fc095846784b9a10fefdbf890 CVE-2017-12876 (Heap-based buffer overflow in enhance.c in ImageMagick before 7.0.6-6 ...) - - imagemagick (bug #872374) - [wheezy] - imagemagick (Vulnerable code not present) + [experimental] - imagemagick (bug #872374) + - imagemagick (Specific to Imagemagick 7, 6.x uses fixed pixel cache morphology) NOTE: https://github.com/ImageMagick/ImageMagick/issues/663 NOTE: https://github.com/ImageMagick/ImageMagick/commit/1cc6f0ccc92c20c7cab6c4a7335daf29c91f0d8e CVE-2017-12875 (The WritePixelCachePixels function in ImageMagick 7.0.6-6 allows ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57517 - data/CVE
Author: jmm Date: 2017-11-09 21:46:07 + (Thu, 09 Nov 2017) New Revision: 57517 Modified: data/CVE/list Log: ffmpeg fixed (version from experimental uploaded to sid) Modified: data/CVE/list === --- data/CVE/list 2017-11-09 21:21:34 UTC (rev 57516) +++ data/CVE/list 2017-11-09 21:46:07 UTC (rev 57517) @@ -2853,7 +2853,7 @@ CVE-2017-15673 RESERVED CVE-2017-15672 (The read_header function in libavcodec/ffv1dec.c in FFmpeg 3.3.4 and ...) - - ffmpeg + - ffmpeg 7:3.4-1 [stretch] - ffmpeg (Wait until next round of security releases) - libav NOTE: Fixed by: http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=c20f4fcb74da2d0432c7b54499bb98f48236b904 @@ -4124,7 +4124,7 @@ NOTE: https://github.com/Cacti/cacti/commit/93f661d8adcfa6618b11522cdab30e97bada33fd NOTE: https://github.com/Cacti/cacti/commit/4f87256e63859117f81d2a2bd40c9c730e39b65d CVE-2017-15186 (Double free vulnerability in FFmpeg 3.3.4 and earlier allows remote ...) - - ffmpeg + - ffmpeg 7:3.4-1 [stretch] - ffmpeg (Wait until next round of security releases) - libav NOTE: http://www.openwall.com/lists/oss-security/2017/10/20/4 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57508 - data/DSA
Author: jmm
Date: 2017-11-09 18:42:25 + (Thu, 09 Nov 2017)
New Revision: 57508
Modified:
data/DSA/list
Log:
reserve IDs for postgres DSA
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-09 18:35:25 UTC (rev 57507)
+++ data/DSA/list 2017-11-09 18:42:25 UTC (rev 57508)
@@ -1,3 +1,13 @@
+[09 Nov 2017] DSA-4029-1 postgresql-common - security update
+ {CVE-2017-8806}
+ [jessie] - postgresql-common 165+deb8u3
+ [stretch] - postgresql-common 181+deb9u1
+[09 Nov 2017] DSA-4028-1 postgresql-9.6 - security update
+ {CVE-2017-15098 CVE-2017-15099}
+ [stretch] - postgresql-9.6 9.6.6-0+deb9u1
+[09 Nov 2017] DSA-4027-1 postgresql-9.4 - security update
+ {CVE-2017-15098}
+ [jessie] - postgresql-9.4 9.4.15-0+deb8u1
[09 Nov 2017] DSA-4026-1 bchunk - security update
{CVE-2017-15953 CVE-2017-15954 CVE-2017-15955}
[jessie] - bchunk 1.2.0-12+deb8u1
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57507 - data/CVE
Author: jmm
Date: 2017-11-09 18:35:25 + (Thu, 09 Nov 2017)
New Revision: 57507
Modified:
data/CVE/list
Log:
further imagemagick triage
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-09 17:36:25 UTC (rev 57506)
+++ data/CVE/list 2017-11-09 18:35:25 UTC (rev 57507)
@@ -3676,6 +3676,8 @@
CVE-2017-15281 (ReadPSDImage in coders/psd.c in ImageMagick 7.0.7-6 allows
remote ...)
{DLA-1139-1}
- imagemagick (low; bug #878579)
+ [stretch] - imagemagick (Minor issue)
+ [jessie] - imagemagick (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/832
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/e9d1c2adae866861a291535997b2263f26becb1e
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/32cbfc57962321b2ead627129c9d9ffbfcdb
@@ -4476,7 +4478,9 @@
NOTE: severity:unimportant for stretch onwards, but we don't have
suite-specific severity annotations
CVE-2017-15017 (ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference
vulnerability in ...)
{DLA-1131-1}
- - imagemagick (bug #878554)
+ - imagemagick (low; bug #878554)
+ [stretch] - imagemagick (Minor issue)
+ [jessie] - imagemagick (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/723
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/5a1006a249516a875558c3d642e719b1eac8f820
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/0cff8bac0a47f8693cfe57f026fcd752689ff375
@@ -4488,7 +4492,9 @@
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/27f8ba82ddd665ab41cef6588128f680cbd69905
NOTE: emf.c not compiled under Debian
CVE-2017-15015 (ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference
vulnerability in ...)
- - imagemagick (bug #878555)
+ - imagemagick (low; bug #878555)
+ [stretch] - imagemagick (Minor issue)
+ [jessie] - imagemagick (Minor issue)
[wheezy] - imagemagick (Vulnerable code not present)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/724
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/0cbb3b3b02e7af493a9aafa8f7e7d23fc70644e4
@@ -5280,7 +5286,9 @@
RESERVED
CVE-2017-14741 (The ReadCAPTIONImage function in coders/caption.c in
ImageMagick ...)
{DLA-1131-1}
- - imagemagick (bug #878548)
+ - imagemagick (low; bug #878548)
+ [stretch] - imagemagick (Minor issue)
+ [jessie] - imagemagick (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/771
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/7d8e14899c562157c7760a77fc91625a27cb596f
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/bb11d07139efe0f5e4ce0e4afda32abdbe82fa9d
@@ -5288,7 +5296,9 @@
RESERVED
CVE-2017-14739 (The AcquireResampleFilterThreadSet function in ...)
{DLA-1131-1}
- - imagemagick (bug #878547)
+ - imagemagick (low; bug #878547)
+ [stretch] - imagemagick (Minor issue)
+ [jessie] - imagemagick (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/780
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/6017a80fe8327fefb77fa677d81154db2b857d1d
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/700fcf95b2c3f554dfbe75833b91f19dde208089
@@ -5640,19 +5650,25 @@
CVE-2017-14627 (Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow
remote ...)
NOT-FOR-US: CyberLink LabelPrint
CVE-2017-14626 (ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference
vulnerability in ...)
- - imagemagick (bug #878524)
+ - imagemagick (low; bug #878524)
+ [stretch] - imagemagick (Minor issue)
+ [jessie] - imagemagick (Minor issue)
[wheezy] - imagemagick (Vulnerable code not present)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/720
NOTE: https://github.com/ImageMagick/ImageMagick/issues/721
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/90b301db18434b2c2228776d06c2898b5fed74f0
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/cc797c296c30f3ec31cd02418b58a2c27549b0a9
CVE-2017-14625 (ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference
vulnerability in ...)
- - imagemagick (bug #877355)
+ - imagemagick (low; bug #877355)
+ [stretch] - imagemagick (Minor issue)
+ [jessie] - imagemagick (Minor issue)
[wheezy] - imagemagick (Vulnerable code not present)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/721
NOTE: ImageMagick-6:
https://github.com/ImageMagick/ImageMagick/commit/cc797c296c30f3ec31cd02418b58a2c27549b0a9
CVE-2017-14624 (ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference
[Secure-testing-commits] r57472 - data/CVE
Author: jmm
Date: 2017-11-08 21:41:41 + (Wed, 08 Nov 2017)
New Revision: 57472
Modified:
data/CVE/list
Log:
- Diese und die folgenden Zeilen werden ignoriert --
Mdata/CVE/list
Modified: data/CVE/list
===
--- data/CVE/list 2017-11-08 21:40:26 UTC (rev 57471)
+++ data/CVE/list 2017-11-08 21:41:41 UTC (rev 57472)
@@ -11552,6 +11552,8 @@
CVE-2017-12618 (Apache Portable Runtime Utility (APR-util) 1.6.0 and prior
fail to ...)
{DLA-1163-1}
- apr-util 1.6.1-1 (low; bug #879996)
+ [stretch] - apr-util (Minor issue)
+ [jessie] - apr-util (Minor issue)
NOTE:
mail-archives.apache.org/mod_mbox/apr-dev/201710.mbox/%3CCACsi252POs4toeJJciwg09_eu2cO3XFg%3DUqsPjXsfjDoeC3-UQ%40mail.gmail.com%3E
NOTE:
https://github.com/apache/apr/commit/f672b565c825c34de9ee298b5bdc62c01cdd6147
CVE-2017-12617 (When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0
to ...)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57470 - in data: . DSA
Author: jmm
Date: 2017-11-08 21:40:04 + (Wed, 08 Nov 2017)
New Revision: 57470
Modified:
data/DSA/list
data/dsa-needed.txt
Log:
libpam4j DSA
Modified: data/DSA/list
===
--- data/DSA/list 2017-11-08 21:30:17 UTC (rev 57469)
+++ data/DSA/list 2017-11-08 21:40:04 UTC (rev 57470)
@@ -1,3 +1,7 @@
+[08 Nov 2017] DSA-4025-1 libpam4j - security update
+ {CVE-2017-12197}
+ [jessie] - libpam4j 1.4-2+deb8u1
+ [stretch] - libpam4j 1.4-2+deb9u1
[08 Nov 2017] DSA-4024-1 chromium-browser - security update
{CVE-2017-15398 CVE-2017-15399}
[stretch] - chromium-browser 62.0.3202.89-1~deb9u1
Modified: data/dsa-needed.txt
===
--- data/dsa-needed.txt 2017-11-08 21:30:17 UTC (rev 57469)
+++ data/dsa-needed.txt 2017-11-08 21:40:04 UTC (rev 57470)
@@ -25,8 +25,6 @@
libav/oldstable
We can ship the next libav 11.x point release when available
--
-libpam4j (jmm)
---
libvpx/oldstable
--
libxml-libxml-perl (carnil)
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57471 - data/CVE
Author: jmm Date: 2017-11-08 21:40:26 + (Wed, 08 Nov 2017) New Revision: 57471 Modified: data/CVE/list Log: emacs CVE ID is nonsense Modified: data/CVE/list === --- data/CVE/list 2017-11-08 21:40:04 UTC (rev 57470) +++ data/CVE/list 2017-11-08 21:40:26 UTC (rev 57471) @@ -998,14 +998,8 @@ CVE-2017-16242 RESERVED CVE-2017-1000383 (GNU Emacs version 25.3.1 (and other versions most likely) ignores ...) - - emacs25 - [stretch] - emacs25 (Minor issue) - - emacs24 - [stretch] - emacs24 (Minor issue) - [jessie] - emacs24 (Minor issue) - - emacs23 - [wheezy] - emacs23 (Minor issue) - NOTE: http://www.openwall.com/lists/oss-security/2017/10/31/15 + NOTE: This CVE assignment is nonsense, GNU emacs reuses the umask of the original + NOTE: file when creating a backup file. That's hardly incorrect behaviour CVE-2017-1000382 (VIM version 8.0.1187 (and other versions most likely) ignores umask ...) - vim [stretch] - vim (Minor issue) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57468 - data/CVE
Author: jmm Date: 2017-11-08 21:19:59 + (Wed, 08 Nov 2017) New Revision: 57468 Modified: data/CVE/list Log: NFUs Modified: data/CVE/list === --- data/CVE/list 2017-11-08 21:16:02 UTC (rev 57467) +++ data/CVE/list 2017-11-08 21:19:59 UTC (rev 57468) @@ -3,7 +3,7 @@ CVE-2017-1 RESERVED CVE-2017-16665 (RemObjects Remoting SDK 9 1.0.0.0 for Delphi is vulnerable to a ...) - TODO: check + NOT-FOR-US: RemObjects Remoting SDK CVE-2017-16664 RESERVED CVE-2017-16667 (backintime (aka Back in Time) before 1.1.24 did improper ...) @@ -6339,7 +6339,7 @@ CVE-2017-14361 RESERVED CVE-2017-14360 (A potential security vulnerability has been identified in HPE Content ...) - TODO: check + NOT-FOR-US: HPE CVE-2017-14359 (A potential security vulnerability has been identified in HPE ...) NOT-FOR-US: HPE Performance Center CVE-2017-14358 (A URL redirection to untrusted site vulnerability in HP ArcSight ESM ...) @@ -10972,7 +10972,7 @@ CVE-2017-12825 RESERVED CVE-2017-12824 (Special crafted InPage document leads to arbitrary code execution in ...) - TODO: check + NOT-FOR-US: InPage CVE-2017-12823 RESERVED CVE-2017-12822 (Remote enabling and disabling admin interface in Gemalto's HASP SRM, ...) @@ -21853,7 +21853,7 @@ CVE-2017-9097 (In Anti-Web through 3.8.7, as used on NetBiter FGW200 devices through ...) NOT-FOR-US: Anti-Web CVE-2017-9096 (The XML parsers in iText before 5.5.12 and 7.x before 7.0.3 do not ...) - TODO: check + NOT-FOR-US: iText CVE-2017-9095 (XXE in Diving Log 6.0 allows attackers to remotely view local files ...) NOT-FOR-US: Diving Log CVE-2017-9094 (The lzw_add_to_dict function in imagew-gif.c in libimageworsener.a in ...) @@ -92268,7 +92268,7 @@ CVE-2015-3934 RESERVED CVE-2015-3933 (Multiple SQL injection vulnerabilities in inc/lib/User.class.php in ...) - TODO: check + NOT-FOR-US: MetalGenix GeniXCMS CVE-2015-3932 (Netlock Mokka before 2.7.8.1204 allows remote attackers to perform XML ...) NOT-FOR-US: Netlock Mokka CVE-2015-3931 (Microsec e-Szigno before 3.2.7.12 allows remote attackers to perform ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57458 - data/CVE
Author: jmm Date: 2017-11-08 17:18:17 + (Wed, 08 Nov 2017) New Revision: 57458 Modified: data/CVE/list Log: NFU Modified: data/CVE/list === --- data/CVE/list 2017-11-08 16:19:17 UTC (rev 57457) +++ data/CVE/list 2017-11-08 17:18:17 UTC (rev 57458) @@ -4,7 +4,7 @@ CVE-2017-16662 RESERVED CVE-2017-16659 (The Gentoo mail-filter/assp package 1.9.8.13030 and earlier allows ...) - TODO: check + NOT-FOR-US: assp as packaged by Gentoo CVE-2017-16658 RESERVED CVE-2017-16657 ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57438 - data/CVE
Author: jmm Date: 2017-11-08 09:14:34 + (Wed, 08 Nov 2017) New Revision: 57438 Modified: data/CVE/list Log: NFUs golang no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-11-08 09:10:21 UTC (rev 57437) +++ data/CVE/list 2017-11-08 09:14:34 UTC (rev 57438) @@ -99,13 +99,13 @@ CVE-2017-16619 RESERVED CVE-2017-16618 (An exploitable vulnerability exists in the YAML loading functionality ...) - TODO: check + NOT-FOR-US: OwlMixin CVE-2017-16617 RESERVED CVE-2017-16616 (An exploitable vulnerability exists in the YAML parsing functionality ...) - TODO: check + NOT-FOR-US: pyanyapi CVE-2017-16615 (An exploitable vulnerability exists in the YAML parsing functionality ...) - TODO: check + NOT-FOR-US: MLAlchemy CVE-2017-16614 RESERVED CVE-2017-16613 @@ -213,7 +213,7 @@ CVE-2017-16562 RESERVED CVE-2017-16561 (/view/friend_profile.php in Ingenious School Management System 2.3.0 is ...) - TODO: check + NOT-FOR-US: Ingenious School Management System CVE-2017-16560 RESERVED CVE-2017-16559 @@ -4287,6 +4287,7 @@ - golang-1.7 [stretch] - golang-1.7 (Minor issue, would require builds of all go packages in stable) - golang + [jessie] - golang (Minor issue, would require builds of all go packages in stable) [wheezy] - golang (Vulnerable code introduced later in version 1.1) NOTE: https://github.com/golang/go/issues/22134 NOTE: https://golang.org/cl/68023 @@ -4299,6 +4300,7 @@ [stretch] - golang-1.8 (Minor issue) - golang-1.7 [stretch] - golang-1.7 (Minor issue) + [jessie] - golang (Minor issue) - golang NOTE: https://go.googlesource.com/go/+/a4544a0f8af001d1fb6df0e70750f570ec49ccf9%5E%21/ NOTE: https://github.com/golang/go/issues/22125 @@ -76735,7 +76737,7 @@ CVE-2016-0873 RESERVED CVE-2016-0872 (A Plaintext Storage of a Password issue was discovered in Kabona AB ...) - TODO: check + NOT-FOR-US: Kabona AB WebDatorCentral CVE-2016-0871 (Eaton Lighting EG2 Web Control 4.04P and earlier allows remote ...) NOT-FOR-US: Eaton Lighting EG2 Web Control CVE-2016-0870 (The web server in Trane Tracer SC 4.2.1134 and earlier allows remote ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57424 - data
Author: jmm Date: 2017-11-07 22:13:21 + (Tue, 07 Nov 2017) New Revision: 57424 Modified: data/dsa-needed.txt Log: take pam4j Modified: data/dsa-needed.txt === --- data/dsa-needed.txt 2017-11-07 22:09:47 UTC (rev 57423) +++ data/dsa-needed.txt 2017-11-07 22:13:21 UTC (rev 57424) @@ -22,6 +22,8 @@ libav/oldstable We can ship the next libav 11.x point release when available -- +libpam4j (jmm) +-- libvpx/oldstable -- libxml-libxml-perl (carnil) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
[Secure-testing-commits] r57415 - data/CVE
Author: jmm Date: 2017-11-07 21:00:39 + (Tue, 07 Nov 2017) New Revision: 57415 Modified: data/CVE/list Log: libnet-ping-external-perl no-dsa Modified: data/CVE/list === --- data/CVE/list 2017-11-07 20:56:31 UTC (rev 57414) +++ data/CVE/list 2017-11-07 21:00:39 UTC (rev 57415) @@ -1,5 +1,7 @@ CVE-2008-7319 [command injection via crafted arguments] - libnet-ping-external-perl (bug #881097) + [stretch] - libnet-ping-external-perl (Remove in next point update) + [jessie] - libnet-ping-external-perl (Remove in next point update) NOTE: https://rt.cpan.org/Public/Bug/Display.html?id=33230 NOTE: Proposed patch: http://matthias.sdfeu.org/devel/net-ping-external-cmd-injection.patch CVE-2017-16638 (The Gentoo net-misc/vde package before version 2.3.2-r4 may allow ...) ___ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
