Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: 768badb6 by security tracker role at 2018-04-24T08:10:12+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== --- a/data/CVE/list +++ b/data/CVE/list @@ -1,3 +1,59 @@ +CVE-2018-10329 (app/tools/mac-lookup/index.php in phpIPAM 1.3.1 has Reflected XSS on ...) + TODO: check +CVE-2018-10328 (Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming ...) + TODO: check +CVE-2018-10327 + RESERVED +CVE-2018-10326 + RESERVED +CVE-2018-10325 + RESERVED +CVE-2018-10324 + RESERVED +CVE-2018-10323 (The xfs_bmap_extents_to_btree function in fs/xfs/libxfs/xfs_bmap.c in ...) + TODO: check +CVE-2018-10322 (The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the ...) + TODO: check +CVE-2018-10321 (Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via ...) + TODO: check +CVE-2018-10320 (Frog CMS 0.9.5 has XSS via the admin/?/layout/edit layout[name] ...) + TODO: check +CVE-2018-10319 (Frog CMS 0.9.5 has XSS via the admin/?/snippet/edit snippet[name] ...) + TODO: check +CVE-2018-10318 (Frog CMS 0.9.5 has XSS via the admin/?/page/edit page[keywords] ...) + TODO: check +CVE-2018-10317 + RESERVED +CVE-2018-10316 (Netwide Assembler (NASM) 2.14rc0 has an endless while loop in the ...) + TODO: check +CVE-2018-10315 + RESERVED +CVE-2018-10314 + RESERVED +CVE-2018-10313 (WUZHI CMS 4.1.0 allows persistent XSS via the form%5Bqq_10%5D parameter ...) + TODO: check +CVE-2018-10312 (index.php?m=member&v=pw_reset in WUZHI CMS 4.1.0 allows CSRF to change ...) + TODO: check +CVE-2018-10311 (A vulnerability was discovered in WUZHI CMS 4.1.0. There is persistent ...) + TODO: check +CVE-2018-10310 + RESERVED +CVE-2018-10309 (The Responsive Cookie Consent plugin before 1.8 for WordPress ...) + TODO: check +CVE-2018-10308 + RESERVED +CVE-2018-10307 + RESERVED +CVE-2018-10306 + RESERVED +CVE-2018-10305 (The MessageSearch2 function in PersonalMessage.php in Simple Machines ...) + TODO: check +CVE-2018-10304 + RESERVED +CVE-2018-10303 (A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 ...) + TODO: check +CVE-2018-10302 (A use-after-free in Foxit Reader before 9.1 and PhantomPDF before 9.1 ...) + TODO: check CVE-2018-XXXX [Authorization bypass] - phpliteadmin <unfixed> (bug #896682) NOTE: https://github.com/phpLiteAdmin/pla/issues/11 @@ -3615,8 +3671,7 @@ CVE-2018-8783 RESERVED CVE-2018-8782 RESERVED -CVE-2018-8781 [Integer overflow in drivers/gpu/drm/udl/udl_fb.c:udl_fb_mmap() can allow attackers to execute code in kernel space] - RESERVED +CVE-2018-8781 (The udl_fb_mmap function in drivers/gpu/drm/udl/udl_fb.c at the Linux ...) - linux <unfixed> NOTE: https://patchwork.freedesktop.org/patch/211845/ CVE-2018-8780 (In Ruby before 2.2.10, 2.3.x before 2.3.7, 2.4.x before 2.4.4, 2.5.x ...) @@ -5996,8 +6051,8 @@ CVE-2018-7755 (An issue was discovered in the fd_locked_ioctl function in ...) NOTE: https://lkml.org/lkml/2018/3/7/1116 CVE-2018-7754 RESERVED -CVE-2018-7751 - RESERVED +CVE-2018-7751 (The svg_probe function in libavformat/img2dec.c in FFmpeg through 3.4.2 ...) + TODO: check CVE-2018-7750 (transport.py in the SSH server implementation of Paramiko before ...) - paramiko <unfixed> (bug #892859) [stretch] - paramiko <no-dsa> (Minor issue) @@ -10038,8 +10093,8 @@ CVE-2018-6493 RESERVED CVE-2018-6492 RESERVED -CVE-2018-6491 - RESERVED +CVE-2018-6491 (Local Escalation of Priviledge vulnerability to Micro Focus Universal ...) + TODO: check CVE-2018-6490 (Denial of Service vulnerability in Micro Focus Operations ...) NOT-FOR-US: Micro Focus Operations Orchestration Software CVE-2018-6489 (XML External Entity (XXE) vulnerability in Micro Focus Project and ...) @@ -24895,8 +24950,7 @@ CVE-2018-1108 [random: fix crng_ready() test] CVE-2018-1107 RESERVED NOT-FOR-US: is-my-json-valid package for Node.js -CVE-2018-1106 [Installation of Signed Packages without Administrator Authentication (Security Issue 1)] - RESERVED +CVE-2018-1106 (An authentication bypass flaw has been found in PackageKit before ...) - packagekit 1.1.10-1 (bug #896703) [jessie] - packagekit <not-affected> (Issue introduced later) NOTE: http://www.openwall.com/lists/oss-security/2018/04/23/3 @@ -55664,8 +55718,8 @@ CVE-2014-9960 (In all Android releases from CAF using the Linux kernel, a buffer NOT-FOR-US: Qualcomm component for Android CVE-2017-7894 (WinDjView 2.1 might allow user-assisted attackers to execute code via ...) NOT-FOR-US: WinDjView -CVE-2017-7893 - RESERVED +CVE-2017-7893 (In SaltStack Salt before 2016.3.6, compromised salt-minions can ...) + TODO: check CVE-2017-7892 (Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a ...) - capnproto 0.6.1-1 (unimportant; bug #860960) NOTE: https://github.com/sandstorm-io/capnproto/blob/master/security-advisories/2017-04-17-0-apple-clang-elides-bounds-check.md @@ -78137,8 +78191,7 @@ CVE-2016-9602 [9p: virtfs allows guest to access host filesystem] NOTE: If fixing this issue for older suites, then make sure not to open the NOTE: CVE-2017-7471 vulnerability and apply as well 9c6b899f7a46893ab3b671e341a2234e9c0c060e NOTE: See further details in the CVE-2017-7471 tracker entry. -CVE-2016-9601 [Heap-buffer overflow due to Integer overflow in jbig2_image_new function] - RESERVED +CVE-2016-9601 (ghostscript before version 0.14 is vulnerable to a heap based buffer ...) {DSA-3817-1 DLA-874-1} - jbig2dec 0.13-4 (bug #850497) NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=697457 @@ -78148,8 +78201,7 @@ CVE-2016-9600 (JasPer before version 2.0.10 is vulnerable to a null pointer ...) NOTE: https://github.com/mdadams/jasper/issues/109 NOTE: Fixed by: https://github.com/mdadams/jasper/commit/a632c6b54bd4ffc3bebab420e00b7e7688aa3846 NOTE: Not suitable for code injection, hardly denial of service -CVE-2016-9599 - RESERVED +CVE-2016-9599 (puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an ...) NOT-FOR-US: puppet-tripleo CVE-2016-9598 [out-of-bounds read] RESERVED @@ -78164,8 +78216,7 @@ CVE-2016-9596 [stack exhaustion while parsing xml files in recovery mode] CVE-2016-9595 RESERVED NOT-FOR-US: Katello -CVE-2016-9594 - RESERVED +CVE-2016-9594 (curl before version 7.52.1 is vulnerable to an unitialized random in ...) - curl <not-affected> (Only affects 7.52.0) NOTE: https://curl.haxx.se/docs/adv_20161223.html CVE-2016-9593 (foreman-debug before version 1.15.0 is vulnerable to a flaw in ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/768badb6898d017ccacaee0f79f9a277758bb10e --- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/768badb6898d017ccacaee0f79f9a277758bb10e You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits