diff options
| author | Moritz Muehlenhoff <jmm@debian.org> | 2020-10-27 19:23:10 +0100 |
|---|---|---|
| committer | Moritz Muehlenhoff <jmm@debian.org> | 2020-10-27 19:24:08 +0100 |
| commit | 5012e0b3fc4f1216278c1fcfc8099285dd50352d (patch) | |
| tree | b31f2f39391d97d93188450269ad9a65c4e6a9af /data/CVE/2020.list | |
| parent | f5e77110d0b29b7aec2ffb24f331140d25874d4b (diff) | |
buster triage
Diffstat (limited to 'data/CVE/2020.list')
| -rw-r--r-- | data/CVE/2020.list | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/data/CVE/2020.list b/data/CVE/2020.list index 2db63b3089..0585561863 100644 --- a/data/CVE/2020.list +++ b/data/CVE/2020.list @@ -156,6 +156,7 @@ CVE-2020-27662 CVE-2020-27661 [divide by zero in dwc2_handle_packet() in hw/usb/hcd-dwc2.c] RESERVED - qemu <unfixed> (bug #972864) + [buster] - qemu <postponed> (Fix along in future DSA) [stretch] - qemu <postponed> (Fix along in future DLA) NOTE: https://lists.nongnu.org/archive/html/qemu-devel/2020-10/msg04263.html NOTE: Fixed by: https://git.qemu.org/?p=qemu.git;a=commit;h=bea2a9e3e00b275dc40cfa09c760c715b8753e03 @@ -1242,6 +1243,7 @@ CVE-2020-27151 CVE-2020-27153 (In BlueZ before 5.55, a double free was found in the gatttool disconne ...) {DLA-2410-1} - bluez 5.55-1 + [buster] - bluez <no-dsa> (Minor issue) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1884817 NOTE: https://github.com/bluez/bluez/commit/1cd644db8c23a2f530ddb93cebed7dacc5f5721a CVE-2020-27150 @@ -4503,6 +4505,7 @@ CVE-2020-25627 RESERVED CVE-2020-25626 (A flaw was found in Django REST Framework versions before 3.12.0 and b ...) - djangorestframework 3.12.1-1 (bug #971554) + [buster] - djangorestframework <no-dsa> (Minor issue) [stretch] - djangorestframework <no-dsa> (Minor issue) NOTE: https://github.com/encode/django-rest-framework/commit/4121b01b912668c049b26194a9a107c27a332429 NOTE: Fixed upstream in 3.12.0 and 3.11.2 @@ -7479,11 +7482,13 @@ CVE-2020-24268 CVE-2020-24267 RESERVED CVE-2020-24266 (An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap b ...) - - tcpreplay <unfixed> (bug #972889) + - tcpreplay <unfixed> (bug #972889; unimportant) NOTE: https://github.com/appneta/tcpreplay/issues/617 + NOTE: Crash in CLI tool, no security impact CVE-2020-24265 (An issue was discovered in tcpreplay tcpprep v4.3.3. There is a heap b ...) - - tcpreplay <unfixed> (bug #972890) + - tcpreplay <unfixed> (bug #972890; unimportant) NOTE: https://github.com/appneta/tcpreplay/issues/616 + NOTE: Crash in CLI tool, no security impact CVE-2020-24264 RESERVED CVE-2020-24263 @@ -29460,6 +29465,7 @@ CVE-2020-13944 (In Apache Airflow < 1.10.12, the "origin" parameter passed to CVE-2020-13943 (If an HTTP/2 client connecting to Apache Tomcat 10.0.0-M1 to 10.0.0-M7 ...) {DLA-2407-1} - tomcat9 9.0.38-1 + [buster] - tomcat9 <no-dsa> (Minor issue) - tomcat8 <removed> NOTE: https://github.com/apache/tomcat/commit/55911430df13f8c9998fbdee1f9716994d2db59b (9.0.38) NOTE: https://github.com/apache/tomcat/commit/9d7def063b47407a09a2f9202beed99f4dcb292a (8.5.58) @@ -29662,6 +29668,7 @@ CVE-2020-13872 (Royal TS before 5 has a 0.0.0.0 listener, which makes it easier CVE-2020-13871 (SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c bec ...) {DLA-2340-1} - sqlite3 3.32.2-2 + [buster] - sqlite3 <not-affected> (Vulnerability introduced later) [jessie] - sqlite3 <not-affected> (Vulnerable code not present) NOTE: New fix: https://www.sqlite.org/src/info/44a58d6cb135a104 NOTE: Fixed by: https://www.sqlite.org/src/info/79eff1d0383179c4 @@ -50194,6 +50201,7 @@ CVE-2020-5422 (BOSH System Metrics Server releases prior to 0.1.0 exposed the UA NOT-FOR-US: BOSH System Metrics Server CVE-2020-5421 (In Spring Framework versions 5.2.0 - 5.2.8, 5.1.0 - 5.1.17, 5.0.0 - 5. ...) - libspring-java <unfixed> + [buster] - libspring-java <no-dsa> (Minor issue) [stretch] - libspring-java <no-dsa> (Minor issue) NOTE: https://tanzu.vmware.com/security/cve-2020-5421 CVE-2020-5420 (Cloud Foundry Routing (Gorouter) versions prior to 0.206.0 allow a mal ...) |