Author: alteholz
Date: 2016-11-26 21:47:15 +0000 (Sat, 26 Nov 2016)
New Revision: 46586
Modified:
data/CVE/list
Log:
take care of some jasper issues
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2016-11-26 20:02:32 UTC (rev 46585)
+++ data/CVE/list 2016-11-26 21:47:15 UTC (rev 46586)
@@ -547,6 +547,7 @@
CVE-2016-9557 [signed integer overflow in jas_image.c]
RESERVED
- jasper <removed>
+ [wheezy] - jasper <no-dsa> (the fix is too invasive)
NOTE:
https://blogs.gentoo.org/ago/2016/11/19/jasper-signed-integer-overflow-in-jas_image-c
NOTE: Fixed by:
https://github.com/mdadams/jasper/commit/d42b2388f7f8e0332c846675133acea151fc557a
CVE-2016-9555 [net/sctp: slab-out-of-bounds in sctp_sf_ootb]
@@ -1457,6 +1458,7 @@
CVE-2016-9262 [use after free in jas_realloc (jas_malloc.c)]
RESERVED
- jasper <removed>
+ [wheezy] - jasper <no-dsa> (Vulnerable code introduced later)
NOTE: Fixed by:
https://github.com/mdadams/jasper/commit/634ce8e8a5accc0fa05dd2c20d42b4749d4b2735
NOTE:
https://blogs.gentoo.org/ago/2016/11/07/jasper-use-after-free-in-jas_realloc-jas_malloc-c
CVE-2016-9258
@@ -2857,6 +2859,7 @@
RESERVED
- jasper <removed> (low)
[jessie] - jasper <no-dsa> (Minor issue)
+ [wheezy] - jasper <no-dsa> (Minor issue)
NOTE:
https://blogs.gentoo.org/ago/2016/10/18/jasper-memory-allocation-failure-in-jas_malloc-jas_malloc-c
CVE-2016-XXXX [sendmail: Privilege escalation from group smmsp to root]
- sendmail <unfixed> (bug #841257)
@@ -2884,10 +2887,12 @@
CVE-2016-8881 [Heap overflow in jpc_getuint16()]
RESERVED
- jasper <removed>
+ [wheezy] - jasper <no-dsa> (no patch available for just this issue)
NOTE: https://github.com/mdadams/jasper/issues/29
CVE-2016-8880 [Heap overflow in jpc_dec_cp_setfromcox()]
RESERVED
- jasper <removed>
+ [wheezy] - jasper <no-dsa> (no patch available for just this issue)
NOTE: https://github.com/mdadams/jasper/issues/28
CVE-2016-8866 [memory allocation failure in AcquireMagickMemory (memory.c)
(incomplete fix for CVE-2016-8862)]
RESERVED
_______________________________________________
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
