buster/stretch triage

3 files changed, 20 insertions, 5 deletions

diff --git a/data/CVE/list b/data/CVE/list
index 7bfaccfd83..6d143351b3 100644
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -176,6 +176,7 @@ CVE-2019-20803 (Gila CMS before 1.11.6 has reflected XSS via the admin/content/p
 	NOT-FOR-US: Gila CMS
 CVE-2018-21234 (Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when ...)
 	- jodd <unfixed> (bug #961298)
+	[buster] - jodd <no-dsa> (Minor issue)
 	NOTE: https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16
 	NOTE: https://github.com/oblac/jodd/issues/628
 CVE-2017-18868 (Digi XBee 2 devices do not have an effective protection mechanism agai ...)
@@ -397,6 +398,8 @@ CVE-2020-13254
 CVE-2020-13253 [sd: OOB access could crash the guest resulting in DoS]
 	RESERVED
 	- qemu <unfixed> (bug #961297)
+	[buster] - qemu <postponed> (Minor issue, can be fixed along in next DSA)
+	[stretch] - qemu <postponed> (Minor issue, can be fixed along in next DSA)
 	NOTE: https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html
 CVE-2020-13252 (Centreon before 19.04.15 allows remote attackers to execute arbitrary  ...)
 	- centreon-web <itp> (bug #913903)
@@ -1553,10 +1556,11 @@ CVE-2020-12742 (The iubenda-cookie-law-solution plugin before 2.3.5 for WordPres
 CVE-2020-12741
 	RESERVED
 CVE-2020-12740 (tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-rea ...)
-	- tcpreplay <unfixed>
+	- tcpreplay <unfixed> (unimportant)
 	[jessie] - tcpreplay <not-affected> (Vulnerable code added later)
 	NOTE: https://github.com/appneta/tcpreplay/issues/576
 	NOTE: --fuzz-seed in PoC not present until version 4.2.0
+	NOTE: Crash in CLI tool, no security impact
 CVE-2020-12739
 	RESERVED
 CVE-2020-12738
@@ -2144,6 +2148,7 @@ CVE-2020-12475 (TP-Link Omada Controller Software 3.2.6 allows Directory Travers
 	NOT-FOR-US: TP-Link
 CVE-2020-12474 (Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, an ...)
 	- telegram-desktop 2.1.0+ds-1
+	[buster] - telegram-desktop <no-dsa> (Minor issue)
 	NOTE: https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-12474
 CVE-2020-12473 (MonoX through 5.1.40.5152 allows admins to execute arbitrary programs  ...)
 	NOT-FOR-US: MonoX
@@ -7775,6 +7780,7 @@ CVE-2020-10738 (A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before
 CVE-2020-10737 [oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack]
 	RESERVED
 	- oddjob <unfixed> (bug #960089)
+	[buster] - oddjob <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1833042
 	NOTE: https://pagure.io/oddjob/c/10b8aaa1564b723a005b53acc069df71313f4cac
 CVE-2020-10736 [authorization bypass in mons & mgrs]
@@ -17490,13 +17496,17 @@ CVE-2020-6633
 CVE-2020-6632 (In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a Q ...)
 	NOT-FOR-US: PrestaShop
 CVE-2020-6631 (An issue was discovered in GPAC version 0.8.0. There is a NULL pointer ...)
-	- gpac <unfixed>
+	- gpac <unfixed> (low)
+	[buster] - gpac <no-dsa> (Minor issue)
+	[stretch] - gpac <no-dsa> (Minor issue)
 	[jessie] - gpac <postponed> (Minor issue, clean crash, MP42TS not shipped, incomplete patch)
 	NOTE: https://github.com/gpac/gpac/issues/1378
 	NOTE: https://github.com/gpac/gpac/commit/c7e46e948ebe2d4a532539c7e714cdf655b84521
 	NOTE: fix considered "ugly" by upstream and introduces abort(3)-based DoS
 CVE-2020-6630 (An issue was discovered in GPAC version 0.8.0. There is a NULL pointer ...)
-	- gpac <unfixed>
+	- gpac <unfixed> (low)
+	[buster] - gpac <no-dsa> (Minor issue)
+	[stretch] - gpac <no-dsa> (Minor issue)
 	[jessie] - gpac <postponed> (Minor issue, clean crash, MP42TS not shipped, incomplete patch)
 	NOTE: https://github.com/gpac/gpac/issues/1377
 	NOTE: https://github.com/gpac/gpac/commit/c7e46e948ebe2d4a532539c7e714cdf655b84521
@@ -30650,6 +30660,8 @@ CVE-2020-1775
 CVE-2020-1774 (When user downloads PGP or S/MIME keys/certificates, exported file has ...)
 	{DLA-2198-1}
 	- otrs2 6.0.28-1 (bug #959448)
+	[buster] - otrs2 <no-dsa> (Non-free not supported)
+	[stretch] - otrs2 <no-dsa> (Non-free not supported)
 	NOTE: https://otrs.com/release-notes/otrs-security-advisory-2020-11/
 	NOTE: Fixed in 7.0.17, 6.0.28
 	NOTE: OTRS6: https://github.com/OTRS/otrs/commit/ff725cbea77f03fa296bb13f93f5b07086920342
@@ -39992,8 +40004,9 @@ CVE-2019-17223 (There is HTML Injection in the Note field in Dolibarr ERP/CRM 10
 CVE-2019-17222 (An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is  ...)
 	NOT-FOR-US: Intelbras WRN 150 devices
 CVE-2019-17221 (PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as d ...)
-	- phantomjs <unfixed>
+	- phantomjs <unfixed> (unimportant)
 	NOTE: https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/
+	NOTE: qtwebkit not covered by security support
 CVE-2019-17220 (Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line. ...)
 	NOT-FOR-US: Rocket.Chat
 CVE-2019-17219 (An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ether ...)
diff --git a/data/DSA/list b/data/DSA/list
index 738eb6339e..a2cf3ea8cd 100644
--- a/data/DSA/list
+++ b/data/DSA/list
@@ -87,7 +87,7 @@
 	{CVE-2019-9511 CVE-2019-9513 CVE-2019-9514 CVE-2019-15604 CVE-2019-15605 CVE-2019-15606}
 	[buster] - nodejs 10.19.0~dfsg1-1
 [28 Apr 2020] DSA-4668-1 openjdk-8 - security update
-	{CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805}
+	{CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830}
 	[stretch] - openjdk-8 8u252-b09-1~deb9u1
 [28 Apr 2020] DSA-4667-1 linux - security update
 	{CVE-2020-2732 CVE-2020-8428 CVE-2020-10942 CVE-2020-11565 CVE-2020-11884}
diff --git a/data/dsa-needed.txt b/data/dsa-needed.txt
index b3424191dd..650b04d0d7 100644
--- a/data/dsa-needed.txt
+++ b/data/dsa-needed.txt
@@ -38,6 +38,8 @@ squid3/oldstable
 --
 teeworlds/stable (jmm)
 --
+unbound
+--
 xcftools
   Hugo proposed to work on this update
 --