libraw ELTS triage

Yeah, this doesn't really belong here. However, we need to remove
conflicting declarations to allow adding them to the elts tracker
without messing up the database. This is the bulk of changes.

I'm also adding commit references as this is independent of ELTS.

Beyond this, two earlier DLAs have a wrong CVE list. DLA-2903-1 did not
fix CVE-2017-16909. It contains a CVE-2017-16909.patch, which fixes a
different vulnerability. DLA-1734-1 missed CVE-2018-5807 and
CVE-2018-5810, which are fixed by the same commit that fixes
CVE-2018-5808.

Except for the commit id notes, none of this can be fixed in the elts
tracker.

2 files changed, 8 insertions, 17 deletions

diff --git a/data/CVE/list b/data/CVE/list
index 457efd7412..d86a1471bd 100644
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -183005,7 +183005,6 @@ CVE-2020-15503 (LibRaw before 0.20-RC1 lacks a thumbnail size range check. This
 	[experimental] - libraw 0.20.0-1
 	- libraw 0.20.0-4 (bug #964747)
 	[buster] - libraw <no-dsa> (Minor issue)
-	[stretch] - libraw <not-affected> (Vulnerable code not present)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1853477
 	NOTE: https://github.com/LibRaw/LibRaw/commit/20ad21c0d87ca80217aee47533d91e633ce1864d
 CVE-2020-15502 (** DISPUTED ** The DuckDuckGo application through 5.58.0 for Android,  ...)
@@ -306475,15 +306474,11 @@ CVE-2018-10530
 	RESERVED
 CVE-2018-10529 (An issue was discovered in LibRaw 0.18.9. There is an out-of-bounds re ...)
 	- libraw 0.18.11-1 (low; bug #897186)
-	[stretch] - libraw <not-affected> (Vulnerable code not present)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	[wheezy] - libraw <no-dsa> (Minor issue)
 	NOTE: https://github.com/LibRaw/LibRaw/commit/f0c505a3e5d47989a5f69be2d0d4f250af6b1a6c
 	NOTE: https://github.com/LibRaw/LibRaw/issues/144
 CVE-2018-10528 (An issue was discovered in LibRaw 0.18.9. There is a stack-based buffe ...)
 	- libraw 0.18.11-1 (low; bug #897185)
-	[stretch] - libraw <not-affected> (Vulnerable code not present)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	[wheezy] - libraw <no-dsa> (Minor issue)
 	NOTE: https://github.com/LibRaw/LibRaw/commit/895529fc2f2eb8bc633edd6b04b5b237eb4db564
 	NOTE: https://github.com/LibRaw/LibRaw/issues/144
@@ -319914,8 +319909,8 @@ CVE-2018-5816 (An integer overflow error within the "identify()" function (inter
 CVE-2018-5815 (An integer overflow error within the "parse_qt()" function (internal/d ...)
 	{DLA-2903-1}
 	- libraw 0.18.13-1 (low)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	NOTE: http://seclists.org/bugtraq/2018/Jul/58
+	NOTE: https://github.com/LibRaw/LibRaw/commit/1334647862b0c90b2e8cb2f668e66627d9517b17
 CVE-2018-5814 (In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and 4.4. ...)
 	{DLA-1423-1 DLA-1422-1}
 	- linux 4.16.12-1
@@ -319925,7 +319920,6 @@ CVE-2018-5814 (In the Linux Kernel before version 4.16.11, 4.14.43, 4.9.102, and
 CVE-2018-5813 (An error within the "parse_minolta()" function (dcraw/dcraw.c) in LibR ...)
 	{DLA-2903-1}
 	- libraw 0.18.11-1 (low)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	NOTE: https://secuniaresearch.flexerasoftware.com/secunia_research/2018-13/
 CVE-2018-5812 (An error within the "nikon_coolscan_load_raw()" function (internal/dcr ...)
 	{DLA-2903-1}
@@ -319942,6 +319936,7 @@ CVE-2018-5810 (An error within the "rollei_load_raw()" function (internal/dcraw_
 	- libraw 0.18.11-1
 	[jessie] - libraw <no-dsa> (Minor issue)
 	NOTE: https://secuniaresearch.flexerasoftware.com/secunia_research/2018-10/
+	NOTE: https://github.com/LibRaw/LibRaw/commit/fd6330292501983ac75fe4162275794b18445bd9
 CVE-2018-5809 (An error within the "LibRaw::parse_exif()" function (internal/dcraw_co ...)
 	- libraw 0.18.11-1
 	[stretch] - libraw <not-affected> (Vulnerable code not present)
@@ -319958,21 +319953,22 @@ CVE-2018-5807 (An error within the "samsung_load_raw()" function (internal/dcraw
 	- libraw 0.18.11-1
 	[jessie] - libraw <no-dsa> (Minor issue)
 	NOTE: https://secuniaresearch.flexerasoftware.com/secunia_research/2018-10/
+	NOTE: https://github.com/LibRaw/LibRaw/commit/fd6330292501983ac75fe4162275794b18445bd9
 CVE-2018-5806 (An error within the "leaf_hdr_load_raw()" function (internal/dcraw_com ...)
 	{DLA-2903-1}
 	- libraw 0.18.8-1 (low)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	NOTE: https://secuniaresearch.flexerasoftware.com/secunia_research/2018-03
+	NOTE: https://github.com/LibRaw/LibRaw/commit/9f26ce37f5be86ea11bfc6831366558650b1f6ff
 CVE-2018-5805 (A boundary error within the "quicktake_100_load_raw()" function (inter ...)
 	{DLA-2903-1}
 	- libraw 0.18.8-1 (low)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	NOTE: https://secuniaresearch.flexerasoftware.com/secunia_research/2018-03
+	NOTE: https://github.com/LibRaw/LibRaw/commit/9f26ce37f5be86ea11bfc6831366558650b1f6ff
 CVE-2018-5804 (A type confusion error within the "identify()" function (internal/dcra ...)
 	{DLA-2903-1}
 	- libraw 0.18.8-1 (low)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	NOTE: https://secuniaresearch.flexerasoftware.com/secunia_research/2018-03
+	NOTE: https://github.com/LibRaw/LibRaw/commit/9f26ce37f5be86ea11bfc6831366558650b1f6ff
 CVE-2018-5803 (In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4 ...)
 	{DSA-4188-1 DSA-4187-1 DLA-1369-1}
 	- linux 4.15.11-1
@@ -337155,14 +337151,12 @@ CVE-2017-16911 (The vhci_hcd driver in the Linux Kernel before version 4.14.8 an
 CVE-2017-16910 (An error within the "LibRaw::xtrans_interpolate()" function (internal/ ...)
 	{DLA-2903-1}
 	- libraw 0.18.6-1
-	[jessie] - libraw <no-dsa> (Minor issue)
 	[wheezy] - libraw <no-dsa> (Minor issue)
 	NOTE: https://secuniaresearch.flexerasoftware.com/secunia_research/2017-19
 	NOTE: https://github.com/LibRaw/LibRaw/commit/2f59bac59dbcbf6bbcf01a9f3eed74307e96ca7e
 CVE-2017-16909 (An error related to the "LibRaw::panasonic_load_raw()" function (dcraw ...)
 	{DLA-2903-1}
 	- libraw 0.18.6-1
-	[jessie] - libraw <no-dsa> (Minor issue)
 	[wheezy] - libraw <no-dsa> (Minor issue)
 	NOTE: https://secuniaresearch.flexerasoftware.com/secunia_research/2017-19
 	NOTE: https://github.com/LibRaw/LibRaw/commit/f1394822a0152ceed77815eafa5cac4e8baab10a
@@ -344592,7 +344586,6 @@ CVE-2017-14609 (The server daemons in Kannel 1.5.0 and earlier create a PID file
 CVE-2017-14608 (In LibRaw through 0.18.4, an out of bounds read flaw related to kodak_ ...)
 	{DLA-2903-1 DLA-1109-1}
 	- libraw 0.18.5-1 (low)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	NOTE: https://github.com/LibRaw/LibRaw/commit/d13e8f6d1e987b7491182040a188c16a395f1d21
 	NOTE: https://github.com/LibRaw/LibRaw/issues/101
 CVE-2017-14607 (In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw related to Read ...)
@@ -345582,7 +345575,6 @@ CVE-2017-14266 (tcprewrite in Tcpreplay 3.4.4 has a Heap-Based Buffer Overflow v
 CVE-2017-14265 (A Stack-based Buffer Overflow was discovered in xtrans_interpolate in  ...)
 	{DLA-2903-1}
 	- libraw 0.18.5-1
-	[jessie] - libraw <no-dsa> (Minor issue)
 	[wheezy] - libraw <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/LibRaw/LibRaw/issues/99
 	NOTE: https://github.com/LibRaw/LibRaw/commit/82616eff4c7f7437e96bdeeed238c3ef3dc12d60
@@ -347143,7 +347135,6 @@ CVE-2017-13736 (There are lots of memory leaks in the GMCommand function in magi
 CVE-2017-13735 (There is a floating point exception in the kodak_radc_load_raw functio ...)
 	{DLA-2903-1}
 	- libraw 0.18.5-1 (low; bug #874729)
-	[jessie] - libraw <no-dsa> (Minor issue)
 	[wheezy] - libraw <no-dsa> (Minor issue)
 	NOTE: https://github.com/LibRaw/LibRaw/issues/96
 	NOTE: Isolated patch: https://github.com/LibRaw/LibRaw/files/1276421/radc_divbyzero.txt
diff --git a/data/DLA/list b/data/DLA/list
index fb4ea67c12..b70ace5d02 100644
--- a/data/DLA/list
+++ b/data/DLA/list
@@ -917,7 +917,7 @@
 	{CVE-2021-45960 CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827 CVE-2022-23852 CVE-2022-23990}
 	[stretch] - expat 2.2.0-2+deb9u4
 [29 Jan 2022] DLA-2903-1 libraw - security update
-	{CVE-2017-13735 CVE-2017-14265 CVE-2017-14348 CVE-2017-14608 CVE-2017-16909 CVE-2017-16910 CVE-2018-5800 CVE-2018-5801 CVE-2018-5802 CVE-2018-5804 CVE-2018-5805 CVE-2018-5806 CVE-2018-5807 CVE-2018-5808 CVE-2018-5810 CVE-2018-5811 CVE-2018-5812 CVE-2018-5813 CVE-2018-5815 CVE-2018-5817 CVE-2018-5818 CVE-2018-5819 CVE-2018-20363 CVE-2018-20364 CVE-2018-20365}
+	{CVE-2017-13735 CVE-2017-14265 CVE-2017-14348 CVE-2017-14608 CVE-2017-16910 CVE-2018-5800 CVE-2018-5801 CVE-2018-5802 CVE-2018-5804 CVE-2018-5805 CVE-2018-5806 CVE-2018-5807 CVE-2018-5808 CVE-2018-5810 CVE-2018-5811 CVE-2018-5812 CVE-2018-5813 CVE-2018-5815 CVE-2018-5817 CVE-2018-5818 CVE-2018-5819 CVE-2018-20363 CVE-2018-20364 CVE-2018-20365}
 	[stretch] - libraw 0.17.2-6+deb9u2
 [27 Jan 2022] DLA-2902-1 graphicsmagick - security update
 	{CVE-2020-12672}
@@ -4527,7 +4527,7 @@
 	{CVE-2019-8320 CVE-2019-8322 CVE-2019-8323 CVE-2019-8324 CVE-2019-8325}
 	[jessie] - ruby2.1 2.1.5-2+deb8u7
 [28 Mar 2019] DLA-1734-1 libraw - security update
-	{CVE-2018-5800 CVE-2018-5801 CVE-2018-5802 CVE-2018-5808 CVE-2018-5817 CVE-2018-5818 CVE-2018-5819}
+	{CVE-2018-5800 CVE-2018-5801 CVE-2018-5802 CVE-2018-5807 CVE-2018-5808 CVE-2018-5810 CVE-2018-5817 CVE-2018-5818 CVE-2018-5819}
 	[jessie] - libraw 0.16.0-9+deb8u4
 [28 Mar 2019] DLA-1733-1 wpa - security update
 	{CVE-2016-10743}