[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: Claim apache2 in dla-needed.txt

2018-04-01 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
df6be470 by Roberto C. Sánchez at 2018-04-01T08:27:03-04:00
LTS: Claim apache2 in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,7 +10,7 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-apache2
+apache2 (Roberto C. Sánchez)
 --
 calibre
   NOTE: 20180321: Instead of replacing pickle with json, maybe disable 
bookmarking



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/df6be4708b11580d73ed94eed76a7a5ac2dc602a

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/df6be4708b11580d73ed94eed76a7a5ac2dc602a
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1285-1 for bind9

2018-02-16 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
20f9e904 by Roberto C. Sánchez at 2018-02-16T16:26:41-05:00
Reserve DLA-1285-1 for bind9

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[16 Feb 2018] DLA-1285-1 bind9 - security update
+   {CVE-2018-5735}
+   [wheezy] - bind9 9.8.4.dfsg.P1-6+nmu2+deb7u20
 [15 Feb 2018] DLA-1284-1 leptonlib - security update
{CVE-2018-3836}
[wheezy] - leptonlib 1.69-3.1+deb7u1


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,9 +10,6 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-bind9
-  NOTE: roberto was working on this on feb 7th: #889285
---
 dovecot (Thorsten Alteholz)
   NOTE: after applying the patch, login segfaults
   NOTE: maintainer and security team are looking into this



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/20f9e9047858236ebd9debb6b811092c1bff1c1b

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/20f9e9047858236ebd9debb6b811092c1bff1c1b
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: Claim gcc-4.6/gcc-4.6 in dla-needed.txt

2018-02-15 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
b0534d8f by Roberto C. Sánchez at 2018-02-15T06:49:19-05:00
LTS: Claim gcc-4.6/gcc-4.6 in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -15,13 +15,13 @@ dovecot (Thorsten Alteholz)
   NOTE: maintainer and security team are looking into this
   NOTE: probably no-dsa
 --
-gcc-4.6
+gcc-4.6 (Roberto C. Sánchez)
   NOTE: Backport the retpoline support for spectre mitigation.
   NOTE: Coordinate with jmm who started the work for gcc-4.9 in jessie.
   NOTE: This gcc version is used by the kernel build. Its update is
   NOTE: thus more important than the one of gcc-4.7.
 --
-gcc-4.7
+gcc-4.7 (Roberto C. Sánchez)
   NOTE: Backport the retpoline support for spectre mitigation.
   NOTE: Do we want/need it on this gcc version as well?
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/b0534d8f964766df5b642756264faee8d1e36783

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/b0534d8f964766df5b642756264faee8d1e36783
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1282-1 for graphicsmagick

2018-02-13 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
5ada38fc by Roberto C. Sánchez at 2018-02-13T23:35:04-05:00
Reserve DLA-1282-1 for graphicsmagick

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[13 Feb 2018] DLA-1282-1 graphicsmagick - security update
+   {CVE-2018-6799}
+   [wheezy] - graphicsmagick 1.3.16-1.1+deb7u18
 [13 Feb 2018] DLA-1281-1 advancecomp - security update
{CVE-2018-1056}
[wheezy] - advancecomp 1.15-1+deb7u1


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -15,8 +15,6 @@ dovecot (Thorsten Alteholz)
   NOTE: maintainer and security team are looking into this
   NOTE: probably no-dsa
 --
-graphicsmagick (Roberto C. Sánchez)
---
 icu (Thorsten Alteholz)
   NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in 
Chromium project; report is not visible to the public
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/5ada38fc4be719c6b15dc457c63354b01ecb686d

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/5ada38fc4be719c6b15dc457c63354b01ecb686d
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Additional commit link for CVE-2018-6799/graphicsmagick

2018-02-12 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
242039e2 by Roberto C. Sánchez at 2018-02-12T23:20:49-05:00
Additional commit link for CVE-2018-6799/graphicsmagick

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -303,6 +303,7 @@ CVE-2018-6800
 CVE-2018-6799 (The AcquireCacheNexus function in magick/pixel_cache.c in ...)
- graphicsmagick 1.3.28-1
NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/b41e2efce6d3
+   NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/d30ed06e9b87
 CVE-2018-6798
RESERVED
 CVE-2018-6797



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/242039e2405a7cdf812ee31f92cc6383541b7ef3

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/242039e2405a7cdf812ee31f92cc6383541b7ef3
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1277-1 for audacity

2018-02-11 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
1c0d00ff by Roberto C. Sánchez at 2018-02-11T23:08:34-05:00
Reserve DLA-1277-1 for audacity

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[11 Feb 2018] DLA-1277-1 audacity - security update
+   {CVE-2016-2540}
+   [wheezy] - audacity 2.0.1-1+deb7u1
 [11 Feb 2018] DLA-1276-1 tomcat-native - security update
{CVE-2017-15698}
[wheezy] - tomcat-native 1.1.24-1+deb7u1


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,8 +10,6 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-audacity (Roberto C. Sánchez)
---
 clamav (Thorsten Alteholz)
 --
 dovecot (Thorsten Alteholz)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1c0d00ff1cf1dc586619ff2b1c685e80c098433e

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1c0d00ff1cf1dc586619ff2b1c685e80c098433e
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Remove additional questionable commit (that also doesn't apply) from CVE-2016-2540/audacity.

2018-02-11 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
6f54fba4 by Roberto C. Sánchez at 2018-02-11T22:35:41-05:00
Remove additional questionable commit (that also doesnt apply) from 
CVE-2016-2540/audacity.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -91375,7 +91375,6 @@ CVE-2016-2540 (Audacity before 2.1.2 allows remote 
attackers to cause a denial o
NOTE: http://wiki.audacityteam.org/wiki/Release_Notes_2.1.2
NOTE: 
https://github.com/audacity/audacity/commit/407c1dc4b209111e4dbb3eec88f333aa8f69094c
NOTE: 
https://github.com/audacity/audacity/commit/b5f2046286b266b10f87b764faa1586aee9c23ea
-   NOTE: 
https://github.com/audacity/audacity/commit/0e43079d061a4fde133aa4682a6c552552821ff0
 CVE-2016-2539 (Cross-site request forgery (CSRF) vulnerability in 
install_modules.php ...)
NOT-FOR-US: ATutor
 CVE-2016-2550 (The Linux kernel before 4.5 allows local users to bypass ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/6f54fba4feaba8be2fa4b7daacdbdb61552ff8d9

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/6f54fba4feaba8be2fa4b7daacdbdb61552ff8d9
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Annotate another commit related to CVE-2016-2540/audacity

2018-02-11 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
935a7fef by Roberto C. Sánchez at 2018-02-11T21:18:00-05:00
Annotate another commit related to CVE-2016-2540/audacity

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -91375,6 +91375,7 @@ CVE-2016-2540 (Audacity before 2.1.2 allows remote 
attackers to cause a denial o
NOTE: http://wiki.audacityteam.org/wiki/Release_Notes_2.1.2
NOTE: 
https://github.com/audacity/audacity/commit/407c1dc4b209111e4dbb3eec88f333aa8f69094c
NOTE: 
https://github.com/audacity/audacity/commit/b5f2046286b266b10f87b764faa1586aee9c23ea
+   NOTE: 
https://github.com/audacity/audacity/commit/0e43079d061a4fde133aa4682a6c552552821ff0
 CVE-2016-2539 (Cross-site request forgery (CSRF) vulnerability in 
install_modules.php ...)
NOT-FOR-US: ATutor
 CVE-2016-2550 (The Linux kernel before 4.5 allows local users to bypass ...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/935a7fef8c6b438a689c1a94ec41dc2e1c312b84

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/935a7fef8c6b438a689c1a94ec41dc2e1c312b84
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: claim audacity in dla-needed.txt

2018-02-10 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
037dca18 by Roberto C. Sánchez at 2018-02-10T19:45:10-05:00
LTS: claim audacity in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,7 +10,7 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-audacity
+audacity (Roberto C. Sánchez)
 --
 clamav (Thorsten Alteholz)
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/037dca1869450b4baba5ffdd2c4eec93d8caf4a6

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/037dca1869450b4baba5ffdd2c4eec93d8caf4a6
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: claim graphicsmagick in dla-needed.txt

2018-02-07 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f9db8690 by Roberto C. Sánchez at 2018-02-07T13:19:35-05:00
LTS: claim graphicsmagick in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -17,7 +17,7 @@ dovecot (Thorsten Alteholz)
   NOTE: maintainer and security team are looking into this
   NOTE: probably no-dsa
 --
-graphicsmagick
+graphicsmagick (Roberto C. Sánchez)
 --
 icu
   NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in 
Chromium project; report is not visible to the public



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f9db8690121b49175717fee7d07a313792e16c31

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f9db8690121b49175717fee7d07a313792e16c31
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: adjust status of binutils/CVE-2018-6543

2018-02-02 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
a7c17400 by Roberto C. Sánchez at 2018-02-02T21:33:56-05:00
LTS: adjust status of binutils/CVE-2018-6543

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -104,6 +104,7 @@ CVE-2018-6543 (In GNU Binutils 2.30, there's an integer 
overflow in the function
- binutils 
[stretch] - binutils  (Minor issue)
[jessie] - binutils  (Minor issue)
+   [wheezy] - binutils  (Minor issue)
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=22769
NOTE: 
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=f2023ce7e8d70b0155cc6206c901e185260918f0
 CVE-2018-6542 (In ZZIPlib 0.13.67, there is a bus error (when handling a ...)


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,8 +10,6 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-binutils
---
 dovecot (Thorsten Alteholz)
   NOTE: after applying the patch, login segfaults
   NOTE: maintainer and security team are looking into this



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/a7c174004bf5c50a8d59ff8a78c24bbc376fc740

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/a7c174004bf5c50a8d59ff8a78c24bbc376fc740
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1266-1 for squid3

2018-02-02 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
872a4bc8 by Roberto C. Sánchez at 2018-02-02T08:54:59-05:00
Reserve DLA-1266-1 for squid3

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[02 Feb 2018] DLA-1266-1 squid3 - security update
+   {CVE-2018-124 CVE-2018-127}
+   [wheezy] - squid3 3.1.20-2.2+deb7u8
 [01 Feb 2018] DLA-1249-2 smarty3 - regression update
[wheezy] - smarty3 3.1.10-2+deb7u3
 [31 Jan 2018] DLA-1265-1 krb5 - security update


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -68,8 +68,6 @@ squid (Roberto C. Sánchez)
   NOTE: that the code is actually not vulnerable.
   NOTE: 20180201: Similar code pattern exists in src/client_side.c (Abhijith)
 --
-squid3 (Roberto C. Sánchez)
---
 xen
   NOTE: mention mitigation for CVE-2017-15590 in next DLA
   NOTE: https://xenbits.xen.org/xsa/advisory-237.html



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/872a4bc8810f7f9f255ac9ae2e901df1a5ab0656

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/872a4bc8810f7f9f255ac9ae2e901df1a5ab0656
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: claim squid3 in dla-needed.txt

2018-01-30 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
453e65ae by Roberto C. Sánchez at 2018-01-30T14:41:32-05:00
LTS: claim squid3 in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -61,7 +61,7 @@ openjdk-7 (Emilio Pozuelo)
 --
 p7zip
 --
-squid3
+squid3 (Roberto C. Sánchez)
 --
 xen
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/453e65aec799d006877caf4de844bb576fa36b2d

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/453e65aec799d006877caf4de844bb576fa36b2d
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1261-1 for clamav

2018-01-27 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
8bbf9793 by Roberto C. Sánchez at 2018-01-27T21:21:36-05:00
Reserve DLA-1261-1 for clamav

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[27 Jan 2018] DLA-1261-1 clamav - security update
+   {CVE-2017-6418 CVE-2017-6420 CVE-2017-12374 CVE-2017-12375 
CVE-2017-12376 CVE-2017-12377 CVE-2017-12378 CVE-2017-12379 CVE-2017-12380}
+   [wheezy] - clamav 0.99.2+dfsg-0+deb7u4
 [27 Jan 2018] DLA-1260-1 tiff3 - security update
{CVE-2017-18013}
[wheezy] - tiff3 3.9.6-11+deb7u9


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,9 +10,6 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-clamav (Roberto C. Sánchez)
-  NOTE: jessie and stretch got update via -update
---
 curl (Thorsten Alteholz)
 --
 dovecot (Thorsten Alteholz)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/8bbf9793342470b926382b1f35352d6e364fb04d

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/8bbf9793342470b926382b1f35352d6e364fb04d
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: claim clamav in dla-needed.txt

2018-01-27 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
65efe53e by Roberto C. Sánchez at 2018-01-27T15:33:52-05:00
LTS: claim clamav in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,7 +10,7 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-clamav
+clamav (Roberto C. Sánchez)
   NOTE: jessie and stretch got update via -update
 --
 curl (Thorsten Alteholz)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/65efe53efad650fb1f28ca08bc43ec2edee13886

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/65efe53efad650fb1f28ca08bc43ec2edee13886
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1260-1 for tiff3

2018-01-27 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
861c10d6 by Roberto C. Sánchez at 2018-01-27T14:51:40-05:00
Reserve DLA-1260-1 for tiff3

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[27 Jan 2018] DLA-1260-1 tiff3 - security update
+   {CVE-2017-18013}
+   [wheezy] - tiff3 3.9.6-11+deb7u9
 [27 Jan 2018] DLA-1259-1 tiff - security update
{CVE-2017-18013}
[wheezy] - tiff 4.0.2-6+deb7u18


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -72,8 +72,6 @@ swftools (Guido Günther)
 --
 thunderbird (Guido Günther)
 --
-tiff3 (Roberto C. Sánchez)
---
 unbound (Markus Koschany)
 --
 wordpress



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/861c10d694b3eb98d89678abfe09e9093075c316

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/861c10d694b3eb98d89678abfe09e9093075c316
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1259-1 for tiff

2018-01-27 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
edd93c28 by Roberto C. Sánchez at 2018-01-27T14:51:16-05:00
Reserve DLA-1259-1 for tiff

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[27 Jan 2018] DLA-1259-1 tiff - security update
+   {CVE-2017-18013}
+   [wheezy] - tiff 4.0.2-6+deb7u18
 [26 Jan 2018] DLA-1258-1 wireshark - security update
{CVE-2018-5334 CVE-2018-5335 CVE-2018-5336}
[wheezy] - wireshark 1.12.1+g01b65bf-4+deb8u6~deb7u9


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -72,8 +72,6 @@ swftools (Guido Günther)
 --
 thunderbird (Guido Günther)
 --
-tiff (Roberto C. Sánchez)
---
 tiff3 (Roberto C. Sánchez)
 --
 unbound (Markus Koschany)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/edd93c2853d15b86cdbf5e0f81488a69676ca9d3

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/edd93c2853d15b86cdbf5e0f81488a69676ca9d3
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: tiff/tiff3 CVE triage

2018-01-27 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
1a4b562d by Roberto C. Sánchez at 2018-01-27T14:22:26-05:00
LTS: tiff/tiff3 CVE triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -1388,7 +1388,9 @@ CVE-2018-5784 (In LibTIFF 4.0.9, there is an uncontrolled 
resource consumption i
- tiff 
[stretch] - tiff  (Minor issue, revisit once fixed upstream)
[jessie] - tiff  (Minor issue, revisit once fixed upstream)
+   [wheezy] - tiff  (Minor issue, revisit once fixed upstream)
- tiff3 
+   [wheezy] - tiff3  (Minor issue, revisit once fixed upstream)
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2772
 CVE-2018-5783 (In PoDoFo 0.9.5, there is an uncontrolled memory allocation in 
the ...)
- libpodofo 
@@ -2427,7 +2429,9 @@ CVE-2018-5360 (LibTIFF before 4.0.6 mishandles the 
reading of TIFF files, as ...
- tiff 
[stretch] - tiff  (Minor issue, revisit once fixed upstream)
[jessie] - tiff  (Minor issue, revisit once fixed upstream)
+   [wheezy] - tiff  (Minor issue, revisit once fixed upstream)
- tiff3 
+   [wheezy] - tiff3  (Minor issue, revisit once fixed upstream)
NOTE: Issue demostrated in tiff via a vector through graphicsmagick, cf.
NOTE: https://sourceforge.net/p/graphicsmagick/bugs/540/
TODO: claimed to be fixed in latest libtiff, but no idication yet which 
changes adresses the issue
@@ -6621,7 +6625,9 @@ CVE-2017-17942 (In LibTIFF 4.0.9, there is a heap-based 
buffer over-read in the 
- tiff  (bug #885579)
[stretch] - tiff  (Minor issue, revisit once fixed upstream)
[jessie] - tiff  (Minor issue, revisit once fixed upstream)
+   [wheezy] - tiff  (Minor issue, revisit once fixed upstream)
- tiff3 
+   [wheezy] - tiff3  (Minor issue, revisit once fixed upstream)
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2767
 CVE-2017-17941 (PHP Scripts Mall Single Theater Booking has SQL Injection via 
the ...)
NOT-FOR-US: PHP Scripts Mall Single Theater Booking
@@ -32731,7 +32737,9 @@ CVE-2017-11613 (In LibTIFF 4.0.8, there is a denial of 
service vulnerability in 
- tiff  (low; bug #869823)
[stretch] - tiff  (Minor issue, revisit once fixed upstream)
[jessie] - tiff  (Minor issue, revisit once fixed upstream)
+   [wheezy] - tiff  (Minor issue, revisit once fixed upstream)
- tiff3 
+   [wheezy] - tiff3  (Minor issue, revisit once fixed upstream)
NOTE: 
https://gist.github.com/dazhouzhou/1a3b7400547f23fe316db303ab9b604f
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2724
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1475530
@@ -36272,9 +36280,9 @@ CVE-2017-9816 (Cross-site scripting (XSS) vulnerability 
in Paessler PRTG Network
 CVE-2017-9815 (In LibTIFF 4.0.7, the TIFFReadDirEntryLong8Array function in 
...)
- tiff 4.0.8-1
[jessie] - tiff  (Minor issue)
-   [wheezy] - tiff  (Minor issue)
+   [wheezy] - tiff  (Minor issue)
- tiff3 
-   [wheezy] - tiff3  (Minor issue)
+   [wheezy] - tiff3  (Minor issue)
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2682
NOTE: Fixed by: 
https://github.com/vadz/libtiff/commit/fb3dc46a2fcf6197ff3b93fc76f0c37fddc0333b
NOTE: The issue is addressed with the same commit as for CVE-2017-9403



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1a4b562d322879e33b760d7fa018bed4fad7570c

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1a4b562d322879e33b760d7fa018bed4fad7570c
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1245-1 for graphicsmagick

2018-01-15 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
6e42cd16 by Roberto C. Sánchez at 2018-01-15T23:12:47-05:00
Reserve DLA-1245-1 for graphicsmagick

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[15 Jan 2018] DLA-1245-1 graphicsmagick - security update
+   {CVE-2018-5685}
+   [wheezy] - graphicsmagick 1.3.16-1.1+deb7u17
 [16 Jan 2018] DLA-1244-1 ca-certificates - security update
[wheezy] - ca-certificates 20130119+deb7u2
 [15 Jan 2018] DLA-1243-1 xbmc - security update


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -16,8 +16,6 @@ couchdb (Thorsten Alteholz)
 exiv2 (Brian May)
   NOTE: 20180101: built wheezy version with ASAN in jessie and confirmed that 
CVE-2017-17669 applies to wheezy version
 --
-graphicsmagick (Roberto C. Sánchez)
---
 icu
   NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in 
Chromium project; report is not visible to the public
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/6e42cd16f5636613aa1e1a0fda3185de0e8ab53b

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/6e42cd16f5636613aa1e1a0fda3185de0e8ab53b
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Note that CVE-2018-5685/graphicsmagick only affects 32-bit arch << 1.3.27

2018-01-15 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
699ef605 by Roberto C. Sánchez at 2018-01-15T20:44:45-05:00
Note that CVE-2018-5685/graphicsmagick only affects 32-bit arch  1.3.27

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -41,6 +41,7 @@ CVE-2018-5685 (In GraphicsMagick 1.3.27, there is an infinite 
loop and applicati
- graphicsmagick 1.3.27-4 (bug #887158)
NOTE: http://hg.graphicsmagick.org/hg/GraphicsMagick/rev/52a91ddb1aa6
NOTE: https://sourceforge.net/p/graphicsmagick/bugs/541/
+   NOTE: Before 1.3.27, the problem only affects 32-bit architectures 
(i.e., 4-byte long) it expanded to 64-bit architectures with upstream commit 
be5e89e6032d
 CVE-2018-5684 (In Libav through 12.2, there is an invalid memcpy call in the 
...)
- libav 
NOTE: https://bugzilla.libav.org/show_bug.cgi?id=1110



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/699ef605c758669ef0ec2cb148664c600f219069

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/699ef605c758669ef0ec2cb148664c600f219069
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Claim graphicsmagick in dla-needed.txt

2018-01-14 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
1326c3ba by Roberto C. Sánchez at 2018-01-14T12:40:53-05:00
Claim graphicsmagick in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -20,7 +20,7 @@ couchdb (Thorsten Alteholz)
 exiv2 (Brian May)
   NOTE: 20180101: built wheezy version with ASAN in jessie and confirmed that 
CVE-2017-17669 applies to wheezy version
 --
-graphicsmagick
+graphicsmagick (Roberto C. Sánchez)
 --
 icu
   NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in 
Chromium project; report is not visible to the public



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1326c3ba3dd436ccac526fe6764383d02359ea43

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1326c3ba3dd436ccac526fe6764383d02359ea43
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: annotate CVE-2018-4868/exiv2 does not affect wheezy

2018-01-10 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
3f55e61a by Roberto C. Sánchez at 2018-01-10T22:45:23-05:00
LTS: annotate CVE-2018-4868/exiv2 does not affect wheezy

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -1011,6 +1011,7 @@ CVE-2018-4868 (The Exiv2::Jp2Image::readMetadata function 
in jp2image.cpp in Exi
- exiv2 
[stretch] - exiv2  (Minor issue)
[jessie] - exiv2  (Minor issue)
+   [wheezy] - exiv2  (Reproducer does not cause failure; 
vulnerable code not present)
NOTE: https://github.com/Exiv2/exiv2/issues/202
 CVE-2017-1000500 (Keycloak SSO versions prior to 2.x are vulnerable to Host 
Header ...)
NOT-FOR-US: Keycloak



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/3f55e61a695b8d87ddc232438e3cfff3515a0e51

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/3f55e61a695b8d87ddc232438e3cfff3515a0e51
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: remove imagemagick from dla-needed.txt, it has no issues outstanding

2018-01-07 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f91d5b76 by Roberto C. Sánchez at 2018-01-07T23:29:24-05:00
LTS: remove imagemagick from dla-needed.txt, it has no issues outstanding

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -29,8 +29,6 @@ gifsicle (Chris Lamb)
 icu
   NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in 
Chromium project; report is not visible to the public
 --
-imagemagick (Roberto C. Sánchez)
---
 lame (Hugo Lefeuvre)
   NOTE: Couldn't reproduce CVE-2017-{69-72}, but successfully reproduced 
CVE-2017-150{18,45,46}
   NOTE: 20171120: Backporting 3.100 is not conceivable, diff >40k lines.



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f91d5b7681e36fa77d218008db6d80ca20e60721

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f91d5b7681e36fa77d218008db6d80ca20e60721
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: annotate CVE-2018-5248/imagemagick as not affecting wheezy

2018-01-07 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
f9ccd47e by Roberto C. Sánchez at 2018-01-07T23:27:19-05:00
LTS: annotate CVE-2018-5248/imagemagick as not affecting wheezy

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -17,6 +17,7 @@ CVE-2018-5249 (Cross-site scripting (XSS) vulnerability in 
Shaarli before 0.8.5 
- shaarli  (bug #864559)
 CVE-2018-5248 (In ImageMagick 7.0.7-17 Q16, there is a heap-based buffer 
over-read in ...)
- imagemagick  (bug #886588)
+   [wheezy] - imagemagick  (Vulnerable code not present)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/927
NOTE: ImageMagick-6: 
https://github.com/ImageMagick/ImageMagick/commit/c76434c16b5ac8861ee0c5d5c3ab8974fae3d624
NOTE: 
https://github.com/ImageMagick/ImageMagick/commit/0272305f91763b5ce119a2c7a0e0084d8241a58d



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f9ccd47e586260863b1945290620ff208144d677

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f9ccd47e586260863b1945290620ff208144d677
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Claim imagemagick in dla-needed.txt

2018-01-07 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
e82c4353 by Roberto C. Sánchez at 2018-01-07T08:11:58-05:00
Claim imagemagick in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -31,7 +31,7 @@ graphicsmagick (Markus Koschany)
 icu
   NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in 
Chromium project; report is not visible to the public
 --
-imagemagick
+imagemagick (Roberto C. Sánchez)
 --
 lame (Hugo Lefeuvre)
   NOTE: Couldn't reproduce CVE-2017-{69-72}, but successfully reproduced 
CVE-2017-150{18,45,46}



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/e82c435398837210657157ae6a584bac715496ed

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/e82c435398837210657157ae6a584bac715496ed
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: note CVE-2017-18013 affects tiff3

2018-01-01 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
50bc4c89 by Roberto C. Sánchez at 2018-01-01T12:31:12-05:00
LTS: note CVE-2017-18013 affects tiff3

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -4,6 +4,7 @@ CVE-2018-3810 (Authentication Bypass vulnerability in the 
Oturia Smart Google Co
NOT-FOR-US: Oturia Smart Google Code Inserter plugin for WordPress
 CVE-2017-18013 (In LibTIFF 4.0.9, there is a Null-Pointer Dereference in the 
...)
- tiff  (bug #885985)
+   - tiff3 
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2770
NOTE: 
https://gitlab.com/libtiff/libtiff/commit/c6f41df7b581402dfba3c19a1e3df4454c551a01
 CVE-2017-18012 (The Z-URL Preview plugin 1.6.1 for WordPress has XSS via the 
...)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/50bc4c891d146f4f21d699204e0430ddba0b2b2d

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/50bc4c891d146f4f21d699204e0430ddba0b2b2d
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: add exiv2 along with note that CVE-2017-17669 applies

2018-01-01 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ec5d6fda by Roberto C. Sánchez at 2018-01-01T12:00:02-05:00
LTS: add exiv2 along with note that CVE-2017-17669 applies

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -17,6 +17,9 @@ ca-certificates
 couchdb
   NOTE: Only in wheezy, we are on our own.
 --
+exiv2
+  NOTE: 20180101: built wheezy version with ASAN in jessie and confirmed that 
CVE-2017-17669 applies to wheezy version
+--
 graphicsmagick (Markus Koschany)
 --
 icu



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/ec5d6fdaf5a18e7549ea74f82a18544aa1cdae66

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/ec5d6fdaf5a18e7549ea74f82a18544aa1cdae66
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: mark CVE-2017-17973/tiff no-dsa, same as for jessie and stretch

2017-12-30 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
ea419ad2 by Roberto C. Sánchez at 2017-12-30T20:41:46-05:00
LTS: mark CVE-2017-17973/tiff no-dsa, same as for jessie and stretch

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -62,6 +62,7 @@ CVE-2017-17973 (In LibTIFF 4.0.8, there is a heap-based 
use-after-free in the ..
- tiff 
[stretch] - tiff  (Minor issue)
[jessie] - tiff  (Minor issue)
+   [wheezy] - tiff  (Minor issue)
- tiff3  (unimportant)
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2769
 CVE-2017-1000447



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/ea419ad2916fb986bd1855a8e37d0a3f59b243be

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/ea419ad2916fb986bd1855a8e37d0a3f59b243be
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: claim tiff/tiff3 in dla-needed.txt

2017-12-30 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
171b745a by Roberto C. Sánchez at 2017-12-30T13:59:54-05:00
LTS: claim tiff/tiff3 in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -54,9 +54,9 @@ swftools (Guido Günther)
   NOTE: 20171118: At least CVE-2017-16797 is present. (lamby)
   NOTE: 20171210: likely to be turned into a pkg with limited sec support
 --
-tiff
+tiff (Roberto C. Sánchez)
 --
-tiff3
+tiff3 (Roberto C. Sánchez)
 --
 wireshark (Thorsten Alteholz)
   NOTE: 2017-08-28: Contacted maintainer since most issues affect 
Jessie/Stretch as well



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/171b745acf2fd5ece217f4c38bdf6cb2e8216415

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/171b745acf2fd5ece217f4c38bdf6cb2e8216415
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] Reserve DLA-1225-1 for asterisk

2017-12-30 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
4c3d3298 by Roberto C. Sánchez at 2017-12-30T12:37:34-05:00
Reserve DLA-1225-1 for asterisk

- - - - -


2 changed files:

- data/DLA/list
- data/dla-needed.txt


Changes:

=
data/DLA/list
=
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -1,3 +1,6 @@
+[30 Dec 2017] DLA-1225-1 asterisk - security update
+   {CVE-2017-17090}
+   [wheezy] - asterisk 1:1.8.13.1~dfsg1-3+deb7u8
 [28 Dec 2017] DLA-1224-1 mercurial - security update
{CVE-2017-17458}
[wheezy] - mercurial 2.2.2-4+deb7u6


=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,8 +10,6 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-asterisk (Roberto C. Sánchez)
---
 ca-certificates
   NOTE: 20170719: maintainer will handle the upload, see 
https://lists.debian.org/d0b9674a-ac5b-5cc9-1982-fb6f36155...@pbandjelly.org
   NOTE: 20171013: pinged maintainer: 
https://lists.debian.org/87efpuc95w@curie.anarc.at (anarcat)



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/4c3d32980c63238cc6b3c63524ed890f9bc6e64a

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/4c3d32980c63238cc6b3c63524ed890f9bc6e64a
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: claim asterisk in dla-needed.txt

2017-12-30 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
7d95fe64 by Roberto C. Sánchez at 2017-12-30T11:23:22-05:00
LTS: claim asterisk in dla-needed.txt

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -10,7 +10,7 @@ this list is updated have a look at
 https://wiki.debian.org/LTS/Development#Triage_new_security_issues
 
 --
-asterisk
+asterisk (Roberto C. Sánchez)
 --
 ca-certificates
   NOTE: 20170719: maintainer will handle the upload, see 
https://lists.debian.org/d0b9674a-ac5b-5cc9-1982-fb6f36155...@pbandjelly.org



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/7d95fe64d4fcc33c91f8281ac111fd7931ec56fd

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/7d95fe64d4fcc33c91f8281ac111fd7931ec56fd
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: update status of ICU

2017-12-29 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
c0f1f95b by Roberto C. Sánchez at 2017-12-29T18:09:43-05:00
LTS: update status of ICU

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=
data/dla-needed.txt
=
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -21,7 +21,8 @@ couchdb
 --
 graphicsmagick (Markus Koschany)
 --
-icu (Roberto C. Sánchez)
+icu
+  NOTE: 20171229: CVE-2017-15422 was reported via Google Code issue report in 
Chromium project; report is not visible to the public
 --
 imagemagick (Markus Koschany)
 --



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/c0f1f95beb143950412499da286ccb51f9b9a1d4

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/c0f1f95beb143950412499da286ccb51f9b9a1d4
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] LTS: annotate CVE-2017-17484/icu as not affecting wheezy

2017-12-29 Thread Roberto C . Sánchez 
Roberto C. Sánchez pushed to branch master at Debian Security Tracker / 
security-tracker


Commits:
0961d114 by Roberto C. Sánchez at 2017-12-29T17:56:55-05:00
LTS: annotate CVE-2017-17484/icu as not affecting wheezy

- - - - -


1 changed file:

- data/CVE/list


Changes:

=
data/CVE/list
=
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -6345,6 +6345,7 @@ CVE-2017-17485
 CVE-2017-17484 (The ucnv_UTF8FromUTF8 function in ucnv_u8.cpp in International 
...)
[experimental] - icu 60.2-1
- icu 
+   [wheezy] - icu  (Vulnerable code not present)
NOTE: https://ssl.icu-project.org/trac/ticket/13510
NOTE: https://ssl.icu-project.org/trac/ticket/13490
NOTE: Fixed by: https://ssl.icu-project.org/trac/changeset/40714



View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/0961d114e204018cc0e088f12f1830c508665c5e

---
View it on GitLab: 
https://salsa.debian.org/security-tracker-team/security-tracker/commit/0961d114e204018cc0e088f12f1830c508665c5e
You're receiving this email because of your account on salsa.debian.org.
___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits