buster/stretch triage

2 files changed, 31 insertions, 3 deletions

diff --git a/data/CVE/list b/data/CVE/list
index ef654f49ab..09b66a9912 100644
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -213,6 +213,8 @@ CVE-2019-20798 (An XSS issue was discovered in handler_server_info.c in Cherokee
 	- cherokee <removed>
 CVE-2019-20797 (An issue was discovered in e6y prboom-plus 2.5.1.5. There is a buffer  ...)
 	- prboom-plus <unfixed>
+	[buster] - prboom-plus <no-dsa> (Minor issue)
+	[stretch] - prboom-plus <no-dsa> (Minor issue)
 	[jessie] - prboom-plus <end-of-life> (games are not supported)
 	NOTE: https://logicaltrust.net/blog/2019/10/prboom1.html
 	NOTE: https://sourceforge.net/p/prboom-plus/bugs/252/
@@ -822,7 +824,9 @@ CVE-2020-12830
 	RESERVED
 CVE-2020-12829
 	RESERVED
-	- qemu <unfixed>
+	- qemu <unfixed> (low)
+	[buster] - qemu <no-dsa> (Minor issue)
+	[stretch] - qemu <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1808510
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1786026
 CVE-2020-12828
@@ -892,6 +896,8 @@ CVE-2020-12802
 	RESERVED
 CVE-2020-12801 (If LibreOffice has an encrypted document open and crashes, that docume ...)
 	- libreoffice 1:6.4.3-1 (low)
+	[buster] - libreoffice <no-dsa> (Minor issue)
+	[stretch] - libreoffice <no-dsa> (Minor issue)
 	NOTE: https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12801
 CVE-2020-12800
 	RESERVED
@@ -1756,7 +1762,8 @@ CVE-2020-12431
 	RESERVED
 CVE-2020-12430 (An issue was discovered in qemuDomainGetStatsIOThread in qemu/qemu_dri ...)
 	[experimental] - libvirt 6.2.0-1
-	- libvirt <unfixed> (bug #959447)
+	- libvirt <unfixed> (low; bug #959447)
+	[buster] - libvirt <no-dsa> (Minor issue)
 	[stretch] - libvirt <not-affected> (Vulnerable code introduced later)
 	[jessie] - libvirt <not-affected> (Vulnerable code introduced later)
 	NOTE: Fixed by: https://libvirt.org/git/?p=libvirt.git;a=commit;h=9bf9e0ae6af38c806f4672ca7b12a6b38d5a9581 (v6.1.0-rc1)
@@ -2202,6 +2209,8 @@ CVE-2020-12269
 	RESERVED
 CVE-2020-12268 (jbig2_image_compose in jbig2_image.c in Artifex jbig2dec before 0.18 h ...)
 	- jbig2dec 0.18-1
+	[buster] - jbig2dec <no-dsa> (Minor issue)
+	[stretch] - jbig2dec <no-dsa> (Minor issue)
 	[jessie] - jbig2dec <no-dsa> (Minor issue)
 	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=20332
 	NOTE: https://github.com/ArtifexSoftware/jbig2dec/commit/0726320a4b55078e9d8deb590e477d598b3da66e
@@ -3708,12 +3717,16 @@ CVE-2020-11867
 	RESERVED
 CVE-2020-11866 (libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows a use-aft ...)
 	- libemf 1.0.12-1
+	[buster] - libemf <no-dsa> (Minor issue)
 CVE-2020-11865 (libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows out-of-bo ...)
 	- libemf 1.0.12-1
+	[buster] - libemf <no-dsa> (Minor issue)
 CVE-2020-11864 (libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of ...)
 	- libemf 1.0.12-1
+	[buster] - libemf <no-dsa> (Minor issue)
 CVE-2020-11863 (libEMF (aka ECMA-234 Metafile Library) through 1.0.11 allows denial of ...)
 	- libemf 1.0.12-1
+	[buster] - libemf <no-dsa> (Minor issue)
 CVE-2019-20785 (An issue was discovered on LG mobile devices with Android OS 8.0 and 8 ...)
 	NOT-FOR-US: LG mobile devices
 CVE-2019-20784 (An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, ...)
@@ -8623,6 +8636,7 @@ CVE-2020-10188 (utility.c in telnetd in netkit telnet through 0.17 allows remote
 CVE-2019-20503 (usrsctp before 2019-12-20 has out-of-bounds reads in sctp_load_address ...)
 	{DSA-4645-1 DSA-4642-1 DSA-4639-1 DLA-2150-1 DLA-2140-1}
 	- libusrsctp 0.9.3.0+20200312-1 (bug #953270)
+	[buster] - libusrsctp <no-dsa> (Minor issue)
 	- firefox 74.0-1
 	- firefox-esr 68.6.0esr-1
 	- thunderbird 1:68.6.0-1
@@ -18246,7 +18260,9 @@ CVE-2020-6098
 CVE-2020-6097
 	RESERVED
 CVE-2020-6096 (An exploitable signed comparison vulnerability exists in the ARMv7 mem ...)
-	- glibc <unfixed>
+	- glibc <unfixed> (low)
+	[buster] - glibc <no-dsa> (Minor issue)
+	[stretch] - glibc <no-dsa> (Minor issue)
 	[jessie] - glibc <not-affected> (Vulnerable code not present)
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=25620
 	NOTE: https://talosintelligence.com/vulnerability_reports/TALOS-2020-1019
@@ -20160,6 +20176,8 @@ CVE-2020-5250 (In PrestaShop before version 1.7.6.4, when a customer edits their
 	NOT-FOR-US: PrestaShop
 CVE-2020-5249 (In Puma (RubyGem) before 4.3.3 and 3.12.4, if an application using Pum ...)
 	- puma 3.12.4-1 (bug #953122)
+	[buster] - puma <no-dsa> (Minor issue)
+	[stretch] - puma <no-dsa> (Minor issue)
 	NOTE: https://github.com/puma/puma/security/advisories/GHSA-33vf-4xgg-9r58
 	NOTE: https://github.com/puma/puma/commit/c22712fc93284a45a93f9ad7023888f3a65524f3
 CVE-2020-5248 (GLPI before before version 9.4.6 has a vulnerability involving a defau ...)
@@ -20169,6 +20187,8 @@ CVE-2020-5248 (GLPI before before version 9.4.6 has a vulnerability involving a
 	NOTE: https://github.com/glpi-project/glpi/commit/efd14468c92c4da43333aa9735e65fd20cbc7c6c
 CVE-2020-5247 (In Puma (RubyGem) before 4.3.2 and before 3.12.3, if an application us ...)
 	- puma 3.12.4-1 (bug #952766)
+	[buster] - puma <no-dsa> (Minor issue)
+	[stretch] - puma <no-dsa> (Minor issue)
 	NOTE: https://github.com/puma/puma/security/advisories/GHSA-84j7-475p-hp8v
 	NOTE: https://github.com/puma/puma/commit/1b17e85a06183cd169b41ca719928c26d44a6e03 (3.12.3)
 	NOTE: https://github.com/puma/puma/commit/694feafcd4fdcea786a0730701dad933f7547bea (4.3.2)
diff --git a/data/dsa-needed.txt b/data/dsa-needed.txt
index 1717a5ff91..e1dcae604e 100644
--- a/data/dsa-needed.txt
+++ b/data/dsa-needed.txt
@@ -14,10 +14,14 @@ If needed, specify the release by adding a slash after the name of the source pa
 --
 chromium
 --
+dovecot/stable
+--
 jruby/oldstable
 --
 libopenmpt
 --
+knot-resolver/stable
+--
 linux (carnil)
   Wait until more issues have piled up
 --
@@ -28,6 +32,10 @@ nss/oldstable (jmm)
 --
 pdns-recursor (jmm)
 --
+php7.0/oldstable
+--
+php7.3/stable
+--
 poppler (jmm)
 --
 squid3/oldstable