Anton Gladky pushed to branch master at Debian Security Tracker / security-tracker
Commits: e794e0ed by Anton Gladky at 2023-10-24T21:20:34+02:00 Mark CVE-2023-{5586,5595} as EOL for LTS (gpac) - - - - - b60ef744 by Anton Gladky at 2023-10-24T21:38:01+02:00 Mark CVE-2023-41914 as EOL for buster (slurm-llnl) - - - - - c594f8a6 by Anton Gladky at 2023-10-24T21:40:21+02:00 Add firefox-esr - - - - - 944e210f by Anton Gladky at 2023-10-24T21:43:09+02:00 LTS: Add pmix - - - - - b6e80ee3 by Anton Gladky at 2023-10-24T21:49:32+02:00 LTS: add request-tracker4 - - - - - 2 changed files: - data/CVE/list - data/dla-needed.txt Changes: ===================================== data/CVE/list ===================================== @@ -1207,6 +1207,7 @@ CVE-2011-10004 (A vulnerability was found in reciply Plugin up to 1.1.7 on WordP NOT-FOR-US: WordPress plugin CVE-2023-5595 (Denial of Service in GitHub repository gpac/gpac prior to 2.3.0-DEV.) - gpac <unfixed> + [buster] - gpac <end-of-life> (EOL in buster LTS) NOTE: https://huntr.dev/bounties/0064cf76-ece1-495d-82b4-e4a1bebeb28e NOTE: https://github.com/gpac/gpac/commit/7a6f636db3360bb16d18078d51e8c596f31302a1 CVE-2023-5575 (Improper access control in the permission inheritance in Devolutions S ...) @@ -1508,6 +1509,7 @@ CVE-2018-25091 (urllib3 before 1.24.2 does not remove the authorization HTTP hea NOTE: Fixed by https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc (1.25) CVE-2023-5586 (NULL Pointer Dereference in GitHub repository gpac/gpac prior to 2.3.0 ...) - gpac <unfixed> + [buster] - gpac <end-of-life> (EOL in buster LTS) NOTE: https://huntr.dev/bounties/d2a6ea71-3555-47a6-9b18-35455d103740 NOTE: https://github.com/gpac/gpac/commit/ca1b48f0abe71bf81a58995d7d75dc27f5a17ddc CVE-2023-5585 (A vulnerability was found in SourceCodester Online Motorcycle Rental S ...) @@ -1548,6 +1550,7 @@ CVE-2023-41914 - slurm-wlm 23.02.6-1 [bullseye] - slurm-wlm <postponed> (Very intrusive patch and upstream does not release patches for unsupported versions) - slurm-llnl <removed> + [buster] - slurm-llnl <end-of-life> (EOL in buster LTS) NOTE: https://groups.google.com/g/slurm-users/c/N9WHFVefSHA NOTE: slurm-wlm-contrib also changed, but actual security issue is in slurm-wlm CVE-2023-4263 (Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nR ...) ===================================== data/dla-needed.txt ===================================== @@ -58,6 +58,9 @@ dogecoin NOTE: 20230619: also I just referenced 3 older bitcoin-related CVEs to fix; NOTE: 20230619: dogecoin not present in bullseye/bookworm, so we lead the initiatives. (Beuc/front-desk) -- +firefox-esr + NOTE: 20231024: Added by Front-Desk (gladk) +-- flatpak NOTE: 20231006: Added by Front-Desk (Beuc) NOTE: 20231006: Follow fixes from bullseye 11.7 (2 CVEs) (Beuc/front-desk) @@ -159,6 +162,9 @@ osslsigncode phppgadmin (Chris Lamb) NOTE: 20230925: Added by Front-Desk (apo) -- +pmix + NOTE: 20231024: Added by Front-Desk (gladk) +-- python-django (Chris Lamb) NOTE: 20231006: Added by Front-Desk (Beuc) NOTE: 20231006: Fix the 4 no-dsa issues that are fixed in all other dists (Beuc/front-desk) @@ -189,6 +195,11 @@ rails NOTE: 20230131: Utkarsh to start a thread with sec+ruby team with the possible path forward. (utkarsh) NOTE: 20230828: want to rollout ruby-rack first. (utkarsh) -- +request-tracker4 + NOTE: 20231024: Added by Front-Desk (gladk) + NOTE: 20231024: Please check the commit: https://github.com/bestpractical/rt/commit/a7a83dfdf591cd4d9f547048e89a5a310eeef32d + NOTE: 20231024: Please check the commit: https://github.com/bestpractical/rt/commit/afb7dcded721e27028e47b62e7e5ed8ffc492beb +-- ring NOTE: 20230903: Added by Front-Desk (gladk) NOTE: 20230928: will be likely hard to fix see https://lists.debian.org/debian-lts/2023/09/msg00035.html (rouca) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/cf08268df07488cd908bcfeeda4b0dff8ad6c346...b6e80ee32afc2cdb18397cc1b3984781cecb9387 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/cf08268df07488cd908bcfeeda4b0dff8ad6c346...b6e80ee32afc2cdb18397cc1b3984781cecb9387 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits