Author: jmm Date: 2017-10-21 13:50:59 +0000 (Sat, 21 Oct 2017) New Revision: 56906
Modified: data/CVE/list Log: investigated some lame issues, more to follow Modified: data/CVE/list =================================================================== --- data/CVE/list 2017-10-21 13:00:56 UTC (rev 56905) +++ data/CVE/list 2017-10-21 13:50:59 UTC (rev 56906) @@ -1549,11 +1549,17 @@ NOTE: https://github.com/antirez/redis/issues/4278 NOTE: Pull request: https://github.com/antirez/redis/pull/4365 CVE-2017-15046 (LAME 3.99.5 has a stack-based buffer overflow in unpack_read_samples ...) - - lame <unfixed> + - lame 3.99.5+repack1-8 NOTE: https://sourceforge.net/p/lame/bugs/479/ + NOTE: Starting with 3.99.5+repack1-8 libsndfile is used to read the input file, marking that as the fixed + NOTE: version, although the internal lame code was only fixed in 3.100 (strictly speaking that would be + NOTE: severity:unimportant for stretch onwards, but we don't have suite-specific severity annotations CVE-2017-15045 (LAME 3.99.5 has a heap-based buffer over-read in fill_buffer in ...) - - lame <unfixed> + - lame 3.99.5+repack1-8 NOTE: https://sourceforge.net/p/lame/bugs/478/ + NOTE: Starting with 3.99.5+repack1-8 libsndfile is used to read the input file, marking that as the fixed + NOTE: version, although the internal lame code was only fixed in 3.100 (strictly speaking that would be + NOTE: severity:unimportant for stretch onwards, but we don't have suite-specific severity annotations CVE-2017-15044 RESERVED CVE-2017-15043 @@ -1673,8 +1679,11 @@ - lame <unfixed> NOTE: https://sourceforge.net/p/lame/bugs/477/ CVE-2017-15018 (LAME 3.99.5 has a heap-based buffer over-read when handling a malformed ...) - - lame <unfixed> + - lame 3.99.5+repack1-8 NOTE: https://sourceforge.net/p/lame/bugs/480/ + NOTE: Starting with 3.99.5+repack1-8 libsndfile is used to read the input file, marking that as the fixed + NOTE: version, although the internal lame code was only fixed in 3.100 (strictly speaking that would be + NOTE: severity:unimportant for stretch onwards, but we don't have suite-specific severity annotations CVE-2017-15017 (ImageMagick 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ...) {DLA-1131-1} - imagemagick <unfixed> (bug #878554) _______________________________________________ Secure-testing-commits mailing list Secure-testing-commits@lists.alioth.debian.org http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits