Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
499e83f7 by Moritz Muehlenhoff at 2018-09-04T15:04:15Z
new modsecurity-crs issue
bluez, elfutils no-dsa
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -107,11 +107,13 @@ CVE-2018-16405 (An issue was discovered in Mayan EDMS
before 3.0.2. The Appearan
CVE-2018-16404
RESERVED
CVE-2018-16403 (libdw in elfutils 0.173 checks the end of the attributes list
...)
- - elfutils <unfixed>
+ - elfutils <unfixed> (low)
+ [stretch] - elfutils <no-dsa> (Minor issue)
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=23529
NOTE:
https://sourceware.org/git/?p=elfutils.git;a=commit;h=6983e59b727458a6c64d9659c85f08218bc4fcda
CVE-2018-16402 (libelf/elf_end.c in elfutils 0.173 allows remote attackers to
cause a ...)
- - elfutils <unfixed>
+ - elfutils <unfixed> (low)
+ [stretch] - elfutils <no-dsa> (Minor issue)
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=23528
NOTE:
https://sourceware.org/git/?p=elfutils.git;a=commit;h=56b18521fb8d46d40fc090c0de9d11a08bc982fa
CVE-2018-16401
@@ -149,7 +151,9 @@ CVE-2018-16386
CVE-2018-16385 (ThinkPHP before 5.1.23 allows SQL Injection via the ...)
NOT-FOR-US: ThinkPHP
CVE-2018-16384 (A SQL injection bypass (aka PL1 bypass) exists in OWASP
ModSecurity ...)
- TODO: check
+ - modsecurity-crs <unfixed> (low)
+ [stretch] - modsecurity-crs <no-dsa> (Minor issue)
+ NOTE: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167
CVE-2018-16383
RESERVED
CVE-2018-16382 (Netwide Assembler (NASM) 2.14rc15 has a buffer over-read in
...)
@@ -13817,12 +13821,12 @@ CVE-2018-10911
CVE-2018-10910 [ailure in disabling Bluetooth discoverability in certain cases
may lead to the unauthorized pairing of Bluetooth devices]
RESERVED
- bluez <unfixed>
+ [stretch] - bluez <ignored> (Minor issue, does not affected Gnome
Bluetooth in stretch)
[jessie] - bluez <no-dsa> (Minor issue because in gnome-bluetooth <=
3.26 the D-Bus calls were synchronous and thus the issue in bluez will have no
actual affect)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1606203
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1602985
NOTE: Bug in src:bluez itself and would need fixing there, but it is
workaroundable in
NOTE: gnome-bluetooth:
https://gitlab.gnome.org/GNOME/gnome-bluetooth/commit/6b5086d42ea64d46277f3c93b43984f331d12f89
- TODO: check, might not be a problem with Gnome <= 3.26, i.e. no-dsa for
those suites
CVE-2018-10909
RESERVED
CVE-2018-10908 (It was found that vdsm before version 4.20.37 invokes qemu-img
on ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/499e83f71ca41aee4a069c0649fa73c48e358fe8
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/499e83f71ca41aee4a069c0649fa73c48e358fe8
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
