Fill in missing information for most issues

55 files changed, 398 insertions, 309 deletions

diff --git a/active/CVE-2019-10220 b/active/CVE-2019-10220
index b4ae4dea..519cf032 100644
--- a/active/CVE-2019-10220
+++ b/active/CVE-2019-10220
@@ -8,12 +8,15 @@ Notes:
  carnil> unsafe_copy_to_user() and switch filldir over to it"), cf.
  carnil> https://lore.kernel.org/linux-fsdevel/20191006222046.GA18027@roeck-us.net/
  carnil> which landed in 5.4-rc3.
+ bwh> Although this was reported against CIFS, it seems to be a general
+ bwh> vulnerability for all filesystems dealing with untrusted servers or
+ bwh> storage.  Thankfully the fix is also general.
 Bugs:
-upstream: released (5.4-rc2) [9f79b78ef74436c7507bac6bfb7b8b989263bccb, 8a23eb804ca4f2be909e372cf5a9e7b30ae476cd
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+upstream: released (5.4-rc2) [9f79b78ef74436c7507bac6bfb7b8b989263bccb, 8a23eb804ca4f2be909e372cf5a9e7b30ae476cd]
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
 sid: released (5.3.9-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-14895 b/active/CVE-2019-14895
index 88280b1c..06f75715 100644
--- a/active/CVE-2019-14895
+++ b/active/CVE-2019-14895
@@ -4,12 +4,15 @@ References:
  https://patchwork.kernel.org/patch/11256477/
  https://patchwork.kernel.org/patch/11257187/
 Notes:
+ bwh> Introduced in 3.7 by commit e89e2da29b7e "mwifiex: use country ie of
+ bwh> requested AP while associating".  Fixed by commit 3d94a4a8373b
+ bwh> "mwifiex: fix possible heap overflow in mwifiex_process_country_ie()".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-14896 b/active/CVE-2019-14896
index e9bd0f30..ed3fde70 100644
--- a/active/CVE-2019-14896
+++ b/active/CVE-2019-14896
@@ -1,15 +1,16 @@
-Description: Heap overflow in add_ie_rates() function of Marvell Wifi Driver
+Description: Heap overflow in add_ie_rates() function of libertas Wifi Driver
 References:
  https://www.openwall.com/lists/oss-security/2019/11/22/1
  https://patchwork.kernel.org/patch/11256477/
  https://patchwork.kernel.org/patch/11257187/
 Notes:
+ bwh> Introduced in 2.6.36 by commit e86dc1ca4676 "Libertas: cfg80211 support".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-14897 b/active/CVE-2019-14897
index a0356ac9..28955a0d 100644
--- a/active/CVE-2019-14897
+++ b/active/CVE-2019-14897
@@ -1,15 +1,16 @@
-Description: Stack overflow in lbs_ibss_join_existing() function of Marvell Wifi Driver
+Description: Stack overflow in lbs_ibss_join_existing() function of libertas Wifi Driver
 References:
  https://www.openwall.com/lists/oss-security/2019/11/22/1
  https://patchwork.kernel.org/patch/11256477/
  https://patchwork.kernel.org/patch/11257187/
 Notes:
+ bwh> Introduced in 2.6.36 by commit e86dc1ca4676 "Libertas: cfg80211 support".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-14901 b/active/CVE-2019-14901
index 3093e055..e194dd29 100644
--- a/active/CVE-2019-14901
+++ b/active/CVE-2019-14901
@@ -1,14 +1,16 @@
-Description: heap overflow in the marvell wifi driver
+Description: heap OOB read in mwifiex wifi driver
 References:
  https://www.openwall.com/lists/oss-security/2019/11/22/2
  https://patchwork.kernel.org/patch/11257535/
 Notes:
+ bwh> Introduced in 3.15 by commit 5f2caaf32bc6 "mwifiex: parse TDLS action
+ bwh> frames during RX".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-15291 b/active/CVE-2019-15291
index fa4b36bc..8500cae7 100644
--- a/active/CVE-2019-15291
+++ b/active/CVE-2019-15291
@@ -3,11 +3,11 @@ References:
  https://syzkaller.appspot.com/bug?id=c0203bd72037d07493f4b7562411e4f5f4553a8f
 Notes:
 Bugs:
-upstream: needed
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+upstream: pending (5.5-rc1) [1b976fc6d684e3282914cdbe7a8d68fdce19095c]
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
 sid: needed
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-18660 b/active/CVE-2019-18660
index 0a179a59..4566cfa5 100644
--- a/active/CVE-2019-18660
+++ b/active/CVE-2019-18660
@@ -10,8 +10,8 @@ Bugs:
 upstream: pending [39e72bf96f5847ba87cc5bd7a3ce0fed813dc9ad, af2e8c68b9c5403f77096969c516f742f5bb29e0]
 4.19-upstream-stable: released (4.19.87) [0a60d4bddc0ba6a7e06d10efa59f7861837860b0, 345712c95eec44bf414782b33e6d5a550fe62b3b]
 4.9-upstream-stable: released (4.9.204) [113408cdaec11a6e34d4edabb134a335dd4896b3, e2c87b1ba04bd5042f6db0780ed55abaf4836378]
-3.16-upstream-stable:
+3.16-upstream-stable: ignored "No speculation mitigations available for powerpc"
 sid: pending (5.3.14-1)
 4.19-buster-security: needed
 4.9-stretch-security: needed
-3.16-jessie-security:
+3.16-jessie-security: ignored "powerpc not supported in LTS"
diff --git a/active/CVE-2019-18675 b/active/CVE-2019-18675
index 0a90d6f4..b38dfb45 100644
--- a/active/CVE-2019-18675
+++ b/active/CVE-2019-18675
@@ -2,12 +2,14 @@ Description: integer overflow in cpia2_remap_buffer in drivers/media/usb/cpia2/c
 References:
  https://deshal3v.github.io/blog/kernel-research/mmap_exploitation
 Notes:
+ bwh> Introduced in 2.6.17 by commit ab33d5071de7 "V4L/DVB (3376): Add cpia2
+ bwh> camera support".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-18813 b/active/CVE-2019-18813
index 9154895b..5788158e 100644
--- a/active/CVE-2019-18813
+++ b/active/CVE-2019-18813
@@ -3,13 +3,13 @@ References:
 Notes:
  bwh> Intrdocued in 4.19 by commit 1a7b12f69a94 "usb: dwc3: pci: Supply
  bwh> device properties via driver data".  No security impact since this
- bwh> is on the probe path.
+ bwh> is on the probe path.  Also not enabled in any Debian config.
 Bugs:
 upstream: released (5.4-rc6) [9bbfceea12a8f145097a27d7c7267af25893c060]
 4.19-upstream-stable: released (4.19.84) [10eb9abd21bad2a9726f50557b38924cb8d81ccd]
 4.9-upstream-stable: N/A "Bug introduced later"
 3.16-upstream-stable: N/A "Bug introduced later"
 sid: pending (5.3.14-1)
-4.19-buster-security: needed
+4.19-buster-security: ignored "Not a real vulnerability"
 4.9-stretch-security: N/A "Bug introduced later"
 3.16-jessie-security: N/A "Bug introduced later"
diff --git a/active/CVE-2019-18885 b/active/CVE-2019-18885
index 8eaa2608..8c2e7a1f 100644
--- a/active/CVE-2019-18885
+++ b/active/CVE-2019-18885
@@ -1,4 +1,4 @@
-Description: btrfs: merge btrfs_find_device and find_device
+Description: btrfs: crafted image causes null deref in btrfs_verify_dev_extent
 References:
  https://github.com/bobfuzzer/CVE-2019-18885
 Notes:
diff --git a/active/CVE-2019-19036 b/active/CVE-2019-19036
index 3395f094..aedea67b 100644
--- a/active/CVE-2019-19036
+++ b/active/CVE-2019-19036
@@ -1,4 +1,4 @@
-Description:
+Description: btrfs: crafted image causes null deref in btrfs_root_node
 References:
  https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19036
 Notes:
diff --git a/active/CVE-2019-19037 b/active/CVE-2019-19037
index 6d7f5d85..5031d421 100644
--- a/active/CVE-2019-19037
+++ b/active/CVE-2019-19037
@@ -11,8 +11,8 @@ Bugs:
 upstream: needed 
 4.19-upstream-stable: needed
 4.9-upstream-stable: needed
-3.16-upstream-stable:
+3.16-upstream-stable: N/A "Vulnerability introduced later"
 sid: needed
 4.19-buster-security: needed
 4.9-stretch-security: needed
-3.16-jessie-security:
+3.16-jessie-security: N/A "Vulnerability introduced later"
diff --git a/active/CVE-2019-19039 b/active/CVE-2019-19039
index e21bdf75..e1c4c8a2 100644
--- a/active/CVE-2019-19039
+++ b/active/CVE-2019-19039
@@ -1,13 +1,18 @@
-Description:
+Description: btrfs: crafted image triggers WARN() in __btrfs_free_extent
 References:
  https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19039
 Notes:
+ bwh> The reporter describes this as an information leak because a WARN()
+ bwh> causes register contents to be logged.  This is mitigated on stretch
+ bwh> onward because we restrict access to the kernel log by default.
+ bwh> However this can still be a denial-of-service if panic_on_warn is
+ bwh> enabled.
 Bugs:
-upstream:
+upstream: needed
 4.19-upstream-stable:
 4.9-upstream-stable:
 3.16-upstream-stable:
-sid:
+sid: needed
 4.19-buster-security:
 4.9-stretch-security:
 3.16-jessie-security:
diff --git a/active/CVE-2019-19043 b/active/CVE-2019-19043
index 5993ff9f..e7060faa 100644
--- a/active/CVE-2019-19043
+++ b/active/CVE-2019-19043
@@ -2,12 +2,14 @@ Description: i40e: prevent memory leak in i40e_setup_macvlans
 References:
  https://github.com/torvalds/linux/commit/27d461333459d282ffa4a2bdb6b215a59d493a8f
 Notes:
+ bwh> Introduced in 5.3 by commit 1d8d80b4e4ff "i40e: Add macvlan support on
+ bwh> i40e".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [27d461333459d282ffa4a2bdb6b215a59d493a8f]
+4.19-upstream-stable: N/A "Vulnerable code not present"
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
+sid: needed
+4.19-buster-security: N/A "Vulnerable code not present"
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19044 b/active/CVE-2019-19044
index d22314b3..9fdf5ee0 100644
--- a/active/CVE-2019-19044
+++ b/active/CVE-2019-19044
@@ -1,12 +1,14 @@
 Description: drm/v3d: Fix memory leak in v3d_submit_cl_ioctl
 References:
 Notes:
+ bwh> Not enabled in any Debian configuration.  Introduced in 5.3 by
+ bwh> commit a783a09ee76d.
 Bugs:
 upstream: released (5.4-rc6) [29cd13cfd7624726d9e6becbae9aa419ef35af7f]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: N/A "Vulnerability introduced later"
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
 sid: pending (5.3.14-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: N/A "Vulnerability introduced later"
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19045 b/active/CVE-2019-19045
index 3637d8cf..c0b335c7 100644
--- a/active/CVE-2019-19045
+++ b/active/CVE-2019-19045
@@ -1,12 +1,13 @@
 Description: net/mlx5: prevent memory leak in mlx5_fpga_conn_create_cq
 References:
 Notes:
+ bwh> Introduced in 4.13 by commit 537a50574175.
 Bugs:
 upstream: released (5.4-rc6) [c8c2a057fdc7de1cd16f4baa51425b932a42eb39]
 4.19-upstream-stable: released (4.19.84) [42de3a902443b64c6e3cf9c61d9cd6f30b2c0d67]
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
 sid: pending (5.3.14-1)
 4.19-buster-security: needed
-4.9-stretch-security:
-3.16-jessie-security:
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19046 b/active/CVE-2019-19046
index a126430a..175db8e5 100644
--- a/active/CVE-2019-19046
+++ b/active/CVE-2019-19046
@@ -2,12 +2,14 @@ Description: ipmi: Fix memory leak in __ipmi_bmc_register
 References:
  https://github.com/torvalds/linux/commit/4aa7afb0ee20a97fbf0c5bab3df028d5fb85fdab
 Notes:
+ bwh> This is a potential memory leak on probe or triggered by a change
+ bwh> on the BMC, which is not a vulnerability.
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [4aa7afb0ee20a97fbf0c5bab3df028d5fb85fdab]
+4.19-upstream-stable: ignored "Not a real issue"
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
+sid: ignored "Not a real issue"
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19047 b/active/CVE-2019-19047
index eeacc10e..cf6a6ce5 100644
--- a/active/CVE-2019-19047
+++ b/active/CVE-2019-19047
@@ -1,12 +1,15 @@
 Description: net/mlx5: fix memory leak in mlx5_fw_fatal_reporter_dump
 References:
 Notes:
+ bwh> This facility is only exposed to privileged users, so this
+ bwh> probably has no security impact.  Introduced in 5.3 by
+ bwh> commit 9b1f29823605.
 Bugs:
 upstream: released (5.4-rc6) [c7ed6d0183d5ea9bc31bcaeeba4070bd62546471
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: N/A "Vulnerability introduced later"
+4.9-upstream-stable: N/A "Vulnerability introduced later"
+3.16-upstream-stable: N/A "Vulnerability introduced later"
 sid: pending (5.3.14-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: N/A "Vulnerability introduced later"
+4.9-stretch-security: N/A "Vulnerability introduced later"
+3.16-jessie-security: N/A "Vulnerability introduced later"
diff --git a/active/CVE-2019-19048 b/active/CVE-2019-19048
index 8bb0328d..0a951ad3 100644
--- a/active/CVE-2019-19048
+++ b/active/CVE-2019-19048
@@ -1,12 +1,14 @@
 Description: virt: vbox: fix memory leak in hgcm_call_preprocess_linaddr
 References:
 Notes:
+ bwh> Introduced in 4.16 by commit 579db9d45cb4 "virt: Add vboxguest VMMDEV
+ bwh> communication code".
 Bugs:
 upstream: released (5.4-rc3) [e0b0cb9388642c104838fac100a4af32745621e2]
 4.19-upstream-stable: released (4.19.82) [c2ea451f22f180e9e46225f54b5ec50c50bb639f]
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
 sid: released (5.3.9-1)
 4.19-buster-security: needed
-4.9-stretch-security:
-3.16-jessie-security:
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19049 b/active/CVE-2019-19049
index 8c3b2ae5..93587c1b 100644
--- a/active/CVE-2019-19049
+++ b/active/CVE-2019-19049
@@ -2,12 +2,13 @@ Description: of: unittest: fix memory leak in unittest_data_add
 References:
 Notes:
  carnil> unittest.c can only be reached during boot?
+ bwh> Indeed, so not a vulnerability at all.
 Bugs:
 upstream: released (5.4-rc5) [e13de8fe0d6a51341671bbe384826d527afe8d44]
 4.19-upstream-stable: released (4.19.83) [fcc3f7c810c3bc595ce179ea4d9e18f506fd0d03]
 4.9-upstream-stable: released (4.9.200) [0228cd262dda0916948b52a74b88fa1f8b3cc810]
-3.16-upstream-stable:
+3.16-upstream-stable: ignored "Not a real issue"
 sid: pending (5.3.14-1)
-4.19-buster-security: needed
-4.9-stretch-security: needed
-3.16-jessie-security:
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19050 b/active/CVE-2019-19050
index ab836f4c..2f90bb2d 100644
--- a/active/CVE-2019-19050
+++ b/active/CVE-2019-19050
@@ -2,12 +2,14 @@ Description: crypto: user - fix memory leak in crypto_reportstat
 References:
  https://github.com/torvalds/linux/commit/c03b04dcdba1da39903e23cc4d072abf8f68f2dd
 Notes:
+ bwh> Introduced in 4.20 by commit cac5818c25d0 "crypto: user - Implement a
+ bwh> generic crypto statistics".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [c03b04dcdba1da39903e23cc4d072abf8f68f2dd]
+4.19-upstream-stable: needed
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19051 b/active/CVE-2019-19051
index e909d8b2..0edc4669 100644
--- a/active/CVE-2019-19051
+++ b/active/CVE-2019-19051
@@ -1,12 +1,14 @@
 Description: wimax: i2400: Fix memory leak in i2400m_op_rfkill_sw_toggle
 References:
 Notes:
+ bwh> Introduced in 2.6.29 by commit 024f7f31ed15 "i2400m: Generic probe/
+ bwh> disconnect, reset and message passing".
 Bugs:
 upstream: released (5.4-rc6) [6f3ef5c25cc762687a7341c18cbea5af54461407]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
 sid: pending (5.3.14-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-19052 b/active/CVE-2019-19052
index 2ac2b3df..aa764874 100644
--- a/active/CVE-2019-19052
+++ b/active/CVE-2019-19052
@@ -1,12 +1,14 @@
 Description: can: gs_usb: gs_can_open(): prevent memory leak
 References:
 Notes:
+ bwh> Introduced in 3.16 by commit d08e973a77d1 "can: gs_usb: Added support
+ bwh> for the GS_USB CAN devices".
 Bugs:
 upstream: released (5.4-rc7) [fb5be6a7b4863ecc44963bb80ca614584b6c7817]
 4.19-upstream-stable: released (4.19.84) [9289226f69822de0b716c0fbfc31db0283f14e2b]
 4.9-upstream-stable: released (4.9.201) [b46a2067f36d7c5f2f259c4ed476359e6e9d668f]
-3.16-upstream-stable:
+3.16-upstream-stable: needed
 sid: pending (5.3.14-1)
 4.19-buster-security: needed
 4.9-stretch-security: needed
-3.16-jessie-security:
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-19053 b/active/CVE-2019-19053
index fbce1057..cfb36e00 100644
--- a/active/CVE-2019-19053
+++ b/active/CVE-2019-19053
@@ -2,12 +2,14 @@ Description: rpmsg: char: release allocated memory
 References:
  https://github.com/torvalds/linux/commit/bbe692e349e2a1edf3fe0a29a0e05899c9c94d51
 Notes:
+ bwh> Introduced in 4.20 by commit ccf45b18ce89 ("rpmsg: char: Migrate to
+ bwh> iter versions of read and write".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: N/A "Vulnerability introduced later"
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
+sid: needed
+4.19-buster-security: N/A "Vulnerability introduced later"
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19054 b/active/CVE-2019-19054
index 10d8aca2..c30712ab 100644
--- a/active/CVE-2019-19054
+++ b/active/CVE-2019-19054
@@ -2,12 +2,13 @@ Description: media: rc: prevent memory leak in cx23888_ir_probe
 References:
  https://github.com/torvalds/linux/commit/a7b2df76b42bdd026e3106cf2ba97db41345a177
 Notes:
+ bwh> This is a potential memory leak on probe, which is not a vulnerability.
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [a7b2df76b42bdd026e3106cf2ba97db41345a177]
+4.19-upstream-stable: ignored "Not a real issue"
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
+sid: ignored "Not a real issue"
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19056 b/active/CVE-2019-19056
index bffff9c3..46b66d74 100644
--- a/active/CVE-2019-19056
+++ b/active/CVE-2019-19056
@@ -2,12 +2,14 @@ Description: mwifiex: pcie: Fix memory leak in mwifiex_pcie_alloc_cmdrsp_buf
 References:
  https://github.com/torvalds/linux/commit/db8fd2cde93227e566a412cf53173ffa227998bc
 Notes:
+ bwh> Introduced in 3.9 by commit fc3314609047 "mwifiex: use pci_alloc/
+ bwh> free_consistent APIs for PCIe".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [db8fd2cde93227e566a412cf53173ffa227998bc]
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-19057 b/active/CVE-2019-19057
index ff5384b7..10bda93f 100644
--- a/active/CVE-2019-19057
+++ b/active/CVE-2019-19057
@@ -2,12 +2,14 @@ Description: mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring
 References:
  https://github.com/torvalds/linux/commit/d10dcb615c8e29d403a24d35f8310a7a53e3050c
 Notes:
+ bwh> Introduced in 3.9 by commit fc3314609047 "mwifiex: use pci_alloc/
+ bwh> free_consistent APIs for PCIe".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [d10dcb615c8e29d403a24d35f8310a7a53e3050c]
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-19060 b/active/CVE-2019-19060
index 927099bd..d8d10931 100644
--- a/active/CVE-2019-19060
+++ b/active/CVE-2019-19060
@@ -1,12 +1,15 @@
 Description: iio: imu: adis16400: release allocated memory on failure
 References:
 Notes:
+ bwh> The "leaked" memory will still be freed on the next call to
+ bwh> adis_update_scan_mode() or removal of the driver, so this is not
+ bwh> exploitable.
 Bugs:
 upstream: released (5.4-rc3) [ab612b1daf415b62c58e130cb3d0f30b255a14d0]
 4.19-upstream-stable: released (4.19.82) [4a4206a83fc69782d4ef36d8f5eb28836d8b6814]
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
 sid: released (5.3.9-1)
-4.19-buster-security: needed
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19061 b/active/CVE-2019-19061
index 15682ead..c69e1d5f 100644
--- a/active/CVE-2019-19061
+++ b/active/CVE-2019-19061
@@ -1,12 +1,15 @@
 Description: iio: imu: adis16400: fix memory leak
 References:
 Notes:
+ bwh> The "leaked" memory will still be freed on the next call to
+ bwh> adis_update_scan_mode() or removal of the driver, so this is not
+ bwh> exploitable.
 Bugs:
 upstream: released (5.4-rc3) [9c0530e898f384c5d279bfcebd8bb17af1105873]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: ignored "Not a real issue"
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
 sid: released (5.3.9-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19062 b/active/CVE-2019-19062
index 9059736d..29a1dbc0 100644
--- a/active/CVE-2019-19062
+++ b/active/CVE-2019-19062
@@ -2,12 +2,14 @@ Description: crypto: user - fix memory leak in crypto_report
 References:
  https://github.com/torvalds/linux/commit/ffdde5932042600c6807d46c1550b28b0db6a3bc
 Notes:
+ bwh> Introduced in 3.2 by commit a38f7907b926 "crypto: Add userspace
+ bwh> configuration API".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [ffdde5932042600c6807d46c1550b28b0db6a3bc]
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-19063 b/active/CVE-2019-19063
index 69af1547..4d26a566 100644
--- a/active/CVE-2019-19063
+++ b/active/CVE-2019-19063
@@ -2,12 +2,13 @@ Description: rtlwifi: prevent memory leak in rtl_usb_probe
 References:
  https://github.com/torvalds/linux/commit/3f93616951138a598d930dcaec40f2bfd9ce43bb
 Notes:
+ bwh> These are potential memory leaks on probe, which are not a vulnerability.
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [3f93616951138a598d930dcaec40f2bfd9ce43bb]
+4.19-upstream-stable: ignored "Not a real issue"
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
+sid: ignored "Not a real issue"
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19064 b/active/CVE-2019-19064
index 184b058b..c71d1e59 100644
--- a/active/CVE-2019-19064
+++ b/active/CVE-2019-19064
@@ -2,12 +2,13 @@ Description: spi: lpspi: fix memory leak in fsl_lpspi_probe
 References:
  https://github.com/torvalds/linux/commit/057b8945f78f76d0b04eeb5c27cd9225e5e7ad86
 Notes:
+ bwh> This is a potential memory leak on probe, which is not a vulnerability.
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [057b8945f78f76d0b04eeb5c27cd9225e5e7ad86]
+4.19-upstream-stable: ignored "Not a real issue"
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
+sid: ignored "Not a real issue"
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19065 b/active/CVE-2019-19065
index 2bfea657..9cbcbfea 100644
--- a/active/CVE-2019-19065
+++ b/active/CVE-2019-19065
@@ -1,12 +1,14 @@
 Description: RDMA/hfi1: Prevent memory leak in sdma_init
 References:
 Notes:
+ bwh> Intrdocued in 4.12 by commit 5a52a7acf7e2 "IB/hfi1: NULL pointer
+ bwh> dereference when freeing rhashtable".
 Bugs:
 upstream: released (5.4-rc3) [34b3be18a04ecdc610aae4c48e5d1b799d8689f6]
 4.19-upstream-stable: released (4.19.82) [962cff4f3f89acf54b6fb418e7ff386b720b0fd6]
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.9-upstream-stable: N/A "Vulnerability introduced later"
+3.16-upstream-stable: N/A "Vulnerability introduced later"
 sid: released (5.3.9-1)
 4.19-buster-security: needed
-4.9-stretch-security:
-3.16-jessie-security:
+4.9-stretch-security: N/A "Vulnerability introduced later"
+3.16-jessie-security: N/A "Vulnerability introduced later"
diff --git a/active/CVE-2019-19066 b/active/CVE-2019-19066
index 50e685ae..90e413e3 100644
--- a/active/CVE-2019-19066
+++ b/active/CVE-2019-19066
@@ -2,12 +2,13 @@ Description: scsi: bfa: release allocated memory in case of error
 References:
  https://github.com/torvalds/linux/commit/0e62395da2bd5166d7c9e14cbc7503b256a34cb0
 Notes:
+ bwh> Introduced in 2.6.37 by commit a36c61f9025b "[SCSI] bfa: cleanup driver".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-19067 b/active/CVE-2019-19067
index c5f61855..2b75e2c6 100644
--- a/active/CVE-2019-19067
+++ b/active/CVE-2019-19067
@@ -1,12 +1,13 @@
 Description: drm/amdgpu: fix multiple memory leaks in acp_hw_init
 References:
 Notes:
+ bwh> This is a potential memory leak on probe, which is not a vulnerability.
 Bugs:
 upstream: released (5.4-rc2) [57be09c6e8747bf48704136d9e3f92bfb93f5725]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: ignored "Not a real issue"
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
 sid: released (5.3.9-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19068 b/active/CVE-2019-19068
index 47ba7f96..799457ed 100644
--- a/active/CVE-2019-19068
+++ b/active/CVE-2019-19068
@@ -2,12 +2,14 @@ Description: rtl8xxxu: prevent leaking urb
 References:
  https://github.com/torvalds/linux/commit/a2cdd07488e666aa93a49a3fc9c9b1299e27ef3c
 Notes:
+ bwh> Introduced in 4.4 by commit 26f1fad29ad9 "New driver: rtl8xxxu
+ bwh> (mac80211)".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [a2cdd07488e666aa93a49a3fc9c9b1299e27ef3c]
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: N/A "Vulnerable code not present"
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19069 b/active/CVE-2019-19069
index 0ffaef4b..496dacc0 100644
--- a/active/CVE-2019-19069
+++ b/active/CVE-2019-19069
@@ -1,12 +1,14 @@
 Description: misc: fastrpc: prevent memory leak in fastrpc_dma_buf_attach
 References:
 Notes:
+ bwh> Introduced in 5.1 by commit 6cffd79504ce "misc: fastrpc: Add support
+ bwh> for dmabuf exporter".
 Bugs:
 upstream: released (5.4-rc3) [fc739a058d99c9297ef6bfd923b809d85855b9a9]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: N/A "Vulnerable code not present"
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
 sid: released (5.3.9-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: N/A "Vulnerable code not present"
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19070 b/active/CVE-2019-19070
index 11980a7e..37776111 100644
--- a/active/CVE-2019-19070
+++ b/active/CVE-2019-19070
@@ -2,12 +2,13 @@ Description: spi: gpio: prevent memory leak in spi_gpio_probe
 References:
  https://github.com/torvalds/linux/commit/d3b0ffa1d75d5305ebe34735598993afbb8a869d
 Notes:
+ bwh> This is a potential memory leak on probe, which is not a vulnerability.
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [d3b0ffa1d75d5305ebe34735598993afbb8a869]
+4.19-upstream-stable: ignored "Not a real issue"
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
+sid: ignored "Not a real issue"
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19071 b/active/CVE-2019-19071
index 707eb804..e43d3358 100644
--- a/active/CVE-2019-19071
+++ b/active/CVE-2019-19071
@@ -2,12 +2,14 @@ Description: rsi: release skb if rsi_prepare_beacon fails
 References:
  https://github.com/torvalds/linux/commit/d563131ef23cbc756026f839a82598c8445bc45f
 Notes:
+ bwh> Introduced in 4.14 by commit d26a9559403c "rsi: add beacon changes for
+ bwh> AP mode".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [d563131ef23cbc756026f839a82598c8445bc45f]
+4.19-upstream-stable: needed
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19073 b/active/CVE-2019-19073
index 9b0150c1..60d9ae8c 100644
--- a/active/CVE-2019-19073
+++ b/active/CVE-2019-19073
@@ -1,6 +1,9 @@
 Description: ath9k_htc: release allocated buffer if timed out
 References:
 Notes:
+ bwh> I suspect that the "fix" for this actually introduces a
+ bwh> use-after-free, since the command might still complete
+ bwh> after the driver gives up waiting.
 Bugs:
 upstream: released (5.4-rc1) [853acf7caf10b828102d92d05b5c101666a6142b]
 4.19-upstream-stable:
diff --git a/active/CVE-2019-19074 b/active/CVE-2019-19074
index 06e5a70e..b909cdc8 100644
--- a/active/CVE-2019-19074
+++ b/active/CVE-2019-19074
@@ -1,6 +1,9 @@
 Description: ath9k: release allocated buffer if timed out
 References:
 Notes:
+ bwh> I suspect that the "fix" for this actually introduces a
+ bwh> use-after-free, since the command might still complete
+ bwh> after the driver gives up waiting.
 Bugs:
 upstream: released (5.4-rc1) [728c1e2a05e4b5fc52fab3421dce772a806612a2]
 4.19-upstream-stable:
diff --git a/active/CVE-2019-19075 b/active/CVE-2019-19075
index e0338fdc..86a4d029 100644
--- a/active/CVE-2019-19075
+++ b/active/CVE-2019-19075
@@ -1,12 +1,13 @@
 Description: ieee802154: ca8210: prevent memory leak
 References:
 Notes:
+ bwh: This is a potential memory leak on probe, which is not a vulnerability.
 Bugs:
 upstream: released (5.4-rc2) [6402939ec86eaf226c8b8ae00ed983936b164908]
 4.19-upstream-stable: released (4.19.81) [960019214539ce75398eaf38d31c77b86aadd739]
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.9-upstream-stable: ignored "Not a real issue"
+3.16-upstream-stable: ignored "Not a real issue"
 sid: released (5.3.9-1)
-4.19-buster-security: needed
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: ignored "Not a real issue"
+4.9-stretch-security: ignored "Not a real issue"
+3.16-jessie-security: ignored "Not a real issue"
diff --git a/active/CVE-2019-19076 b/active/CVE-2019-19076
index dec41dfe..1db88098 100644
--- a/active/CVE-2019-19076
+++ b/active/CVE-2019-19076
@@ -1,12 +1,14 @@
 Description: nfp: abm: fix memory leak in nfp_abm_u32_knode_replace
 References:
 Notes:
+ bwh> Introduced in 5.0 by commit 174ab544e3bc "nfp: abm: add cls_u32
+ bwh> offload for simple band classification".
 Bugs:
 upstream: released (5.4-rc1) [78beef629fd95be4ed853b2d37b832f766bd96ca]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: N/A "Vulnerable code not present"
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
 sid: released (5.3.7-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: N/A "Vulnerable code not present"
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19078 b/active/CVE-2019-19078
index a56d507a..289ea758 100644
--- a/active/CVE-2019-19078
+++ b/active/CVE-2019-19078
@@ -2,12 +2,14 @@ Description: ath10k: fix memory leak
 References:
  https://github.com/torvalds/linux/commit/b8d17e7d93d2beb89e4f34c59996376b8b544792
 Notes:
+ bwh> Introduced in 4.14 by commit 4db66499df91 "ath10k: add initial USB
+ bwh> support".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: pending (5.5-rc1) [b8d17e7d93d2beb89e4f34c59996376b8b544792]
+4.19-upstream-stable: needed
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19079 b/active/CVE-2019-19079
index 69cc0966..3c7f4897 100644
--- a/active/CVE-2019-19079
+++ b/active/CVE-2019-19079
@@ -1,12 +1,14 @@
 Description: net: qrtr: fix memort leak in qrtr_tun_write_iter
 References:
 Notes:
+ bwh> Introduced in 4.18 by commit 28fb4e59a47d "net: qrtr: Expose tunneling
+ bwh> endpoint to user space".  Driver is not enabled in any Debian config.
 Bugs:
 upstream: released (5.3) [a21b7f0cff1906a93a0130b74713b15a0b36481d]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: needed
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
 sid: released (5.3.7-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: needed
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19080 b/active/CVE-2019-19080
index bf49ad89..3822043e 100644
--- a/active/CVE-2019-19080
+++ b/active/CVE-2019-19080
@@ -1,12 +1,14 @@
 Description: nfp: flower: prevent memory leak in nfp_flower_spawn_phy_reprs
 References:
 Notes:
+ bwh> Introduced in 4.18 by commit b94524529741 "nfp: flower: add per repr
+ bwh> private data for LAG offload".
 Bugs:
 upstream: released (5.4-rc1) [8572cea1461a006bce1d06c0c4b0575869125fa4]
 4.19-upstream-stable: released (4.19.77) [5b6c791f494d5e770dfd015390386f321b9a94da]
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
 sid: released (5.3.7-1)
 4.19-buster-security: needed
-4.9-stretch-security:
-3.16-jessie-security:
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19081 b/active/CVE-2019-19081
index 14e54cca..3ac120b2 100644
--- a/active/CVE-2019-19081
+++ b/active/CVE-2019-19081
@@ -1,12 +1,14 @@
 Description: nfp: flower: fix memory leak in nfp_flower_spawn_vnic_reprs
 References:
 Notes:
+ bwh> Introduced in 4.18 by commit b94524529741 "nfp: flower: add per repr
+ bwh> private data for LAG offload".
 Bugs:
 upstream: released (5.4-rc1) [8ce39eb5a67aee25d9f05b40b673c95b23502e3e]
 4.19-upstream-stable: released (4.19.79) [04e0c84f137dd07aa931c00db1a2ac80f3be4be5]
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.9-upstream-stable: N/A "Vulnerable code not present"
+3.16-upstream-stable: N/A "Vulnerable code not present"
 sid: released (5.3.7-1)
 4.19-buster-security: needed
-4.9-stretch-security:
-3.16-jessie-security:
+4.9-stretch-security: N/A "Vulnerable code not present"
+3.16-jessie-security: N/A "Vulnerable code not present"
diff --git a/active/CVE-2019-19083 b/active/CVE-2019-19083
index e94d90e3..117614d3 100644
--- a/active/CVE-2019-19083
+++ b/active/CVE-2019-19083
@@ -1,12 +1,13 @@
 Description: drm/amd/display: memory leak
 References:
 Notes:
+ bwh: This is a potential memory leak on probe, which is not a vulnerability.
 Bugs:
 upstream: released (5.4-rc2) [055e547478a11a6360c7ce05e2afc3e366968a12]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: ignored "Not a real isue"
+4.9-upstream-stable: N/A "Affected code not present"
+3.16-upstream-stable: N/A "Affected code not present"
 sid: released (5.3.9-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: ignored "Not a real isue"
+4.9-stretch-security: N/A "Affected code not present"
+3.16-jessie-security: N/A "Affected code not present"
diff --git a/active/CVE-2019-19227 b/active/CVE-2019-19227
index aaf30d87..9d75ed8f 100644
--- a/active/CVE-2019-19227
+++ b/active/CVE-2019-19227
@@ -3,10 +3,10 @@ References:
 Notes:
 Bugs:
 upstream: released (5.1-rc3) [9804501fa1228048857910a6bf23e085aade37cc]
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: needed
 sid: released (5.2.6-1)
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: needed
diff --git a/active/CVE-2019-19252 b/active/CVE-2019-19252
index e5e91bef..5aae6169 100644
--- a/active/CVE-2019-19252
+++ b/active/CVE-2019-19252
@@ -1,13 +1,17 @@
-Description:
+Description: vt: heap OOB read/write in vcs_scr_readw
 References:
  https://lore.kernel.org/lkml/c30fc539-68a8-65d7-226c-6f8e6fd8bdfb@suse.com/
+ https://lore.kernel.org/lkml/nycvar.YSQ.7.76.1911051030580.30289@knanqh.ubzr/
 Notes:
+ bwh> Fix appears to be commit 0c9acb1af77a "vcs: prevent write access to
+ bwh> vcsu devices", which blames commit d21b0be246bf "vt: introduce unicode
+ bwh> mode for /dev/vcs" from 4.19.
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: needed
+4.9-upstream-stable: N/A "Vulnerability introduced later"
+3.16-upstream-stable: N/A "Vulnerability introduced later"
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: N/A "Vulnerability introduced later"
+3.16-jessie-security: N/A "Vulnerability introduced later"
diff --git a/active/CVE-2019-19318 b/active/CVE-2019-19318
index 589db678..cd9a2789 100644
--- a/active/CVE-2019-19318
+++ b/active/CVE-2019-19318
@@ -1,13 +1,13 @@
-Description:
+Description: btrfs: crafted image causes use-after-free in rwsem_can_spin_on_owner
 References:
  https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19318
 Notes:
 Bugs:
-upstream:
+upstream: released (5.4)
 4.19-upstream-stable:
 4.9-upstream-stable:
 3.16-upstream-stable:
-sid:
+sid: needed
 4.19-buster-security:
 4.9-stretch-security:
 3.16-jessie-security:
diff --git a/active/CVE-2019-19319 b/active/CVE-2019-19319
index 56f98373..61d00685 100644
--- a/active/CVE-2019-19319
+++ b/active/CVE-2019-19319
@@ -1,13 +1,14 @@
-Description:
+Description: ext4: crafted image causes heap OOB write in ext4_xattr_set_entry
 References:
  https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19319
 Notes:
+ bwh> The fix is unknown but the PoC is reported to fail on 5.3.11 and 5.4.0.
 Bugs:
-upstream:
+upstream: released (5.4)
 4.19-upstream-stable:
 4.9-upstream-stable:
 3.16-upstream-stable:
-sid:
+sid: pending (5.3.14-1)
 4.19-buster-security:
 4.9-stretch-security:
 3.16-jessie-security:
diff --git a/active/CVE-2019-19377 b/active/CVE-2019-19377
index 2f93720e..93d44c66 100644
--- a/active/CVE-2019-19377
+++ b/active/CVE-2019-19377
@@ -1,4 +1,4 @@
-Description:
+Description: btrfs: crafted image causes use-after-free in btrfs_queue_work
 References:
  https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19377
 Notes:
diff --git a/active/CVE-2019-19378 b/active/CVE-2019-19378
index 7f327d50..d0e642eb 100644
--- a/active/CVE-2019-19378
+++ b/active/CVE-2019-19378
@@ -1,4 +1,4 @@
-Description:
+Description: btrfs: crafted image causes heap OOB write in index_rbio_pages
 References:
  https://github.com/bobfuzzer/CVE/tree/master/CVE-2019-19378
 Notes:
diff --git a/active/CVE-2019-19462 b/active/CVE-2019-19462
index bba33992..4ddc0b5a 100644
--- a/active/CVE-2019-19462
+++ b/active/CVE-2019-19462
@@ -6,12 +6,14 @@ References:
  https://syzkaller.appspot.com/bug?id=e4265490d26d6c01cd9bc79dc915ef0a1bf15046
  https://syzkaller.appspot.com/bug?id=f4d1cb4330bd3ddf4a628332b4285407b2eedd7b 
 Notes:
+ bwh> Introduced in 4.9 (not 4.10) by commit 017c59c042d0 "relay: Use per
+ bwh> CPU constructs for the relay channel buffer pointers".
 Bugs:
-upstream:
-4.19-upstream-stable:
-4.9-upstream-stable:
-3.16-upstream-stable:
-sid:
-4.19-buster-security:
-4.9-stretch-security:
-3.16-jessie-security:
+upstream: needed
+4.19-upstream-stable: needed
+4.9-upstream-stable: needed
+3.16-upstream-stable: N/A "Vulnerability introduced later"
+sid: needed
+4.19-buster-security: needed
+4.9-stretch-security: needed
+3.16-jessie-security: N/A "Vulnerability introduced later"