diff options
author | Moritz Muehlenhoff <jmm@debian.org> | 2020-05-25 19:28:57 +0200 |
---|---|---|
committer | Moritz Muehlenhoff <jmm@debian.org> | 2020-05-25 19:28:57 +0200 |
commit | b07aa3fbfc8774a5289e97f3bf781b04516ed7ca (patch) | |
tree | 7a050095204ae39858fd28608f7cc8445490d0cf /data | |
parent | 36998d4a66443d4a70a46d4176033d0914188eef (diff) |
buster/stretch triage
Diffstat (limited to 'data')
-rw-r--r-- | data/CVE/list | 21 | ||||
-rw-r--r-- | data/DSA/list | 2 | ||||
-rw-r--r-- | data/dsa-needed.txt | 2 |
3 files changed, 20 insertions, 5 deletions
diff --git a/data/CVE/list b/data/CVE/list index 7bfaccfd83..6d143351b3 100644 --- a/data/CVE/list +++ b/data/CVE/list @@ -176,6 +176,7 @@ CVE-2019-20803 (Gila CMS before 1.11.6 has reflected XSS via the admin/content/p NOT-FOR-US: Gila CMS CVE-2018-21234 (Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when ...) - jodd <unfixed> (bug #961298) + [buster] - jodd <no-dsa> (Minor issue) NOTE: https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16 NOTE: https://github.com/oblac/jodd/issues/628 CVE-2017-18868 (Digi XBee 2 devices do not have an effective protection mechanism agai ...) @@ -397,6 +398,8 @@ CVE-2020-13254 CVE-2020-13253 [sd: OOB access could crash the guest resulting in DoS] RESERVED - qemu <unfixed> (bug #961297) + [buster] - qemu <postponed> (Minor issue, can be fixed along in next DSA) + [stretch] - qemu <postponed> (Minor issue, can be fixed along in next DSA) NOTE: https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html CVE-2020-13252 (Centreon before 19.04.15 allows remote attackers to execute arbitrary ...) - centreon-web <itp> (bug #913903) @@ -1553,10 +1556,11 @@ CVE-2020-12742 (The iubenda-cookie-law-solution plugin before 2.3.5 for WordPres CVE-2020-12741 RESERVED CVE-2020-12740 (tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-rea ...) - - tcpreplay <unfixed> + - tcpreplay <unfixed> (unimportant) [jessie] - tcpreplay <not-affected> (Vulnerable code added later) NOTE: https://github.com/appneta/tcpreplay/issues/576 NOTE: --fuzz-seed in PoC not present until version 4.2.0 + NOTE: Crash in CLI tool, no security impact CVE-2020-12739 RESERVED CVE-2020-12738 @@ -2144,6 +2148,7 @@ CVE-2020-12475 (TP-Link Omada Controller Software 3.2.6 allows Directory Travers NOT-FOR-US: TP-Link CVE-2020-12474 (Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, an ...) - telegram-desktop 2.1.0+ds-1 + [buster] - telegram-desktop <no-dsa> (Minor issue) NOTE: https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-12474 CVE-2020-12473 (MonoX through 5.1.40.5152 allows admins to execute arbitrary programs ...) NOT-FOR-US: MonoX @@ -7775,6 +7780,7 @@ CVE-2020-10738 (A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before CVE-2020-10737 [oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack] RESERVED - oddjob <unfixed> (bug #960089) + [buster] - oddjob <no-dsa> (Minor issue) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1833042 NOTE: https://pagure.io/oddjob/c/10b8aaa1564b723a005b53acc069df71313f4cac CVE-2020-10736 [authorization bypass in mons & mgrs] @@ -17490,13 +17496,17 @@ CVE-2020-6633 CVE-2020-6632 (In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a Q ...) NOT-FOR-US: PrestaShop CVE-2020-6631 (An issue was discovered in GPAC version 0.8.0. There is a NULL pointer ...) - - gpac <unfixed> + - gpac <unfixed> (low) + [buster] - gpac <no-dsa> (Minor issue) + [stretch] - gpac <no-dsa> (Minor issue) [jessie] - gpac <postponed> (Minor issue, clean crash, MP42TS not shipped, incomplete patch) NOTE: https://github.com/gpac/gpac/issues/1378 NOTE: https://github.com/gpac/gpac/commit/c7e46e948ebe2d4a532539c7e714cdf655b84521 NOTE: fix considered "ugly" by upstream and introduces abort(3)-based DoS CVE-2020-6630 (An issue was discovered in GPAC version 0.8.0. There is a NULL pointer ...) - - gpac <unfixed> + - gpac <unfixed> (low) + [buster] - gpac <no-dsa> (Minor issue) + [stretch] - gpac <no-dsa> (Minor issue) [jessie] - gpac <postponed> (Minor issue, clean crash, MP42TS not shipped, incomplete patch) NOTE: https://github.com/gpac/gpac/issues/1377 NOTE: https://github.com/gpac/gpac/commit/c7e46e948ebe2d4a532539c7e714cdf655b84521 @@ -30650,6 +30660,8 @@ CVE-2020-1775 CVE-2020-1774 (When user downloads PGP or S/MIME keys/certificates, exported file has ...) {DLA-2198-1} - otrs2 6.0.28-1 (bug #959448) + [buster] - otrs2 <no-dsa> (Non-free not supported) + [stretch] - otrs2 <no-dsa> (Non-free not supported) NOTE: https://otrs.com/release-notes/otrs-security-advisory-2020-11/ NOTE: Fixed in 7.0.17, 6.0.28 NOTE: OTRS6: https://github.com/OTRS/otrs/commit/ff725cbea77f03fa296bb13f93f5b07086920342 @@ -39992,8 +40004,9 @@ CVE-2019-17223 (There is HTML Injection in the Note field in Dolibarr ERP/CRM 10 CVE-2019-17222 (An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is ...) NOT-FOR-US: Intelbras WRN 150 devices CVE-2019-17221 (PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as d ...) - - phantomjs <unfixed> + - phantomjs <unfixed> (unimportant) NOTE: https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/ + NOTE: qtwebkit not covered by security support CVE-2019-17220 (Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line. ...) NOT-FOR-US: Rocket.Chat CVE-2019-17219 (An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ether ...) diff --git a/data/DSA/list b/data/DSA/list index 738eb6339e..a2cf3ea8cd 100644 --- a/data/DSA/list +++ b/data/DSA/list @@ -87,7 +87,7 @@ {CVE-2019-9511 CVE-2019-9513 CVE-2019-9514 CVE-2019-15604 CVE-2019-15605 CVE-2019-15606} [buster] - nodejs 10.19.0~dfsg1-1 [28 Apr 2020] DSA-4668-1 openjdk-8 - security update - {CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805} + {CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830} [stretch] - openjdk-8 8u252-b09-1~deb9u1 [28 Apr 2020] DSA-4667-1 linux - security update {CVE-2020-2732 CVE-2020-8428 CVE-2020-10942 CVE-2020-11565 CVE-2020-11884} diff --git a/data/dsa-needed.txt b/data/dsa-needed.txt index b3424191dd..650b04d0d7 100644 --- a/data/dsa-needed.txt +++ b/data/dsa-needed.txt @@ -38,6 +38,8 @@ squid3/oldstable -- teeworlds/stable (jmm) -- +unbound +-- xcftools Hugo proposed to work on this update -- |