From b07aa3fbfc8774a5289e97f3bf781b04516ed7ca Mon Sep 17 00:00:00 2001 From: Moritz Muehlenhoff Date: Mon, 25 May 2020 19:28:57 +0200 Subject: buster/stretch triage --- data/CVE/list | 21 +++++++++++++++++---- data/DSA/list | 2 +- data/dsa-needed.txt | 2 ++ 3 files changed, 20 insertions(+), 5 deletions(-) diff --git a/data/CVE/list b/data/CVE/list index 7bfaccfd83..6d143351b3 100644 --- a/data/CVE/list +++ b/data/CVE/list @@ -176,6 +176,7 @@ CVE-2019-20803 (Gila CMS before 1.11.6 has reflected XSS via the admin/content/p NOT-FOR-US: Gila CMS CVE-2018-21234 (Jodd before 5.0.4 performs Deserialization of Untrusted JSON Data when ...) - jodd (bug #961298) + [buster] - jodd (Minor issue) NOTE: https://github.com/oblac/jodd/commit/9bffc3913aeb8472c11bb543243004b4b4376f16 NOTE: https://github.com/oblac/jodd/issues/628 CVE-2017-18868 (Digi XBee 2 devices do not have an effective protection mechanism agai ...) @@ -397,6 +398,8 @@ CVE-2020-13254 CVE-2020-13253 [sd: OOB access could crash the guest resulting in DoS] RESERVED - qemu (bug #961297) + [buster] - qemu (Minor issue, can be fixed along in next DSA) + [stretch] - qemu (Minor issue, can be fixed along in next DSA) NOTE: https://lists.gnu.org/archive/html/qemu-devel/2020-05/msg05835.html CVE-2020-13252 (Centreon before 19.04.15 allows remote attackers to execute arbitrary ...) - centreon-web (bug #913903) @@ -1553,10 +1556,11 @@ CVE-2020-12742 (The iubenda-cookie-law-solution plugin before 2.3.5 for WordPres CVE-2020-12741 RESERVED CVE-2020-12740 (tcprewrite in Tcpreplay through 4.3.2 has a heap-based buffer over-rea ...) - - tcpreplay + - tcpreplay (unimportant) [jessie] - tcpreplay (Vulnerable code added later) NOTE: https://github.com/appneta/tcpreplay/issues/576 NOTE: --fuzz-seed in PoC not present until version 4.2.0 + NOTE: Crash in CLI tool, no security impact CVE-2020-12739 RESERVED CVE-2020-12738 @@ -2144,6 +2148,7 @@ CVE-2020-12475 (TP-Link Omada Controller Software 3.2.6 allows Directory Travers NOT-FOR-US: TP-Link CVE-2020-12474 (Telegram Desktop through 2.0.1, Telegram through 6.0.1 for Android, an ...) - telegram-desktop 2.1.0+ds-1 + [buster] - telegram-desktop (Minor issue) NOTE: https://github.com/VijayT007/Vulnerability-Database/blob/master/Telegram:CVE-2020-12474 CVE-2020-12473 (MonoX through 5.1.40.5152 allows admins to execute arbitrary programs ...) NOT-FOR-US: MonoX @@ -7775,6 +7780,7 @@ CVE-2020-10738 (A flaw was found in Moodle versions 3.8 before 3.8.3, 3.7 before CVE-2020-10737 [oddjob: race condition in oddjob_selinux_mkdir function in mkhomedir.c can lead to symlink attack] RESERVED - oddjob (bug #960089) + [buster] - oddjob (Minor issue) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1833042 NOTE: https://pagure.io/oddjob/c/10b8aaa1564b723a005b53acc069df71313f4cac CVE-2020-10736 [authorization bypass in mons & mgrs] @@ -17490,13 +17496,17 @@ CVE-2020-6633 CVE-2020-6632 (In PrestaShop 1.7.6.2, XSS can occur during addition or removal of a Q ...) NOT-FOR-US: PrestaShop CVE-2020-6631 (An issue was discovered in GPAC version 0.8.0. There is a NULL pointer ...) - - gpac + - gpac (low) + [buster] - gpac (Minor issue) + [stretch] - gpac (Minor issue) [jessie] - gpac (Minor issue, clean crash, MP42TS not shipped, incomplete patch) NOTE: https://github.com/gpac/gpac/issues/1378 NOTE: https://github.com/gpac/gpac/commit/c7e46e948ebe2d4a532539c7e714cdf655b84521 NOTE: fix considered "ugly" by upstream and introduces abort(3)-based DoS CVE-2020-6630 (An issue was discovered in GPAC version 0.8.0. There is a NULL pointer ...) - - gpac + - gpac (low) + [buster] - gpac (Minor issue) + [stretch] - gpac (Minor issue) [jessie] - gpac (Minor issue, clean crash, MP42TS not shipped, incomplete patch) NOTE: https://github.com/gpac/gpac/issues/1377 NOTE: https://github.com/gpac/gpac/commit/c7e46e948ebe2d4a532539c7e714cdf655b84521 @@ -30650,6 +30660,8 @@ CVE-2020-1775 CVE-2020-1774 (When user downloads PGP or S/MIME keys/certificates, exported file has ...) {DLA-2198-1} - otrs2 6.0.28-1 (bug #959448) + [buster] - otrs2 (Non-free not supported) + [stretch] - otrs2 (Non-free not supported) NOTE: https://otrs.com/release-notes/otrs-security-advisory-2020-11/ NOTE: Fixed in 7.0.17, 6.0.28 NOTE: OTRS6: https://github.com/OTRS/otrs/commit/ff725cbea77f03fa296bb13f93f5b07086920342 @@ -39992,8 +40004,9 @@ CVE-2019-17223 (There is HTML Injection in the Note field in Dolibarr ERP/CRM 10 CVE-2019-17222 (An issue was discovered on Intelbras WRN 150 1.0.17 devices. There is ...) NOT-FOR-US: Intelbras WRN 150 devices CVE-2019-17221 (PhantomJS through 2.1.1 has an arbitrary file read vulnerability, as d ...) - - phantomjs + - phantomjs (unimportant) NOTE: https://www.darkmatter.ae/blogs/breaching-the-perimeter-phantomjs-arbitrary-file-read/ + NOTE: qtwebkit not covered by security support CVE-2019-17220 (Rocket.Chat before 2.1.0 allows XSS via a URL on a ![title] line. ...) NOT-FOR-US: Rocket.Chat CVE-2019-17219 (An issue was discovered on V-Zug Combi-Steam MSLQ devices before Ether ...) diff --git a/data/DSA/list b/data/DSA/list index 738eb6339e..a2cf3ea8cd 100644 --- a/data/DSA/list +++ b/data/DSA/list @@ -87,7 +87,7 @@ {CVE-2019-9511 CVE-2019-9513 CVE-2019-9514 CVE-2019-15604 CVE-2019-15605 CVE-2019-15606} [buster] - nodejs 10.19.0~dfsg1-1 [28 Apr 2020] DSA-4668-1 openjdk-8 - security update - {CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805} + {CVE-2020-2754 CVE-2020-2755 CVE-2020-2756 CVE-2020-2757 CVE-2020-2773 CVE-2020-2781 CVE-2020-2800 CVE-2020-2803 CVE-2020-2805 CVE-2020-2830} [stretch] - openjdk-8 8u252-b09-1~deb9u1 [28 Apr 2020] DSA-4667-1 linux - security update {CVE-2020-2732 CVE-2020-8428 CVE-2020-10942 CVE-2020-11565 CVE-2020-11884} diff --git a/data/dsa-needed.txt b/data/dsa-needed.txt index b3424191dd..650b04d0d7 100644 --- a/data/dsa-needed.txt +++ b/data/dsa-needed.txt @@ -38,6 +38,8 @@ squid3/oldstable -- teeworlds/stable (jmm) -- +unbound +-- xcftools Hugo proposed to work on this update -- -- cgit v1.2.3