Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
45c8e8dd by security tracker role at 2019-01-30T20:10:20Z
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,21 @@
+CVE-2019-7224
+ RESERVED
+CVE-2019-7223
+ RESERVED
+CVE-2019-7222
+ RESERVED
+CVE-2019-7221
+ RESERVED
+CVE-2019-7220
+ RESERVED
+CVE-2019-7219
+ RESERVED
+CVE-2019-7218
+ RESERVED
+CVE-2019-7217
+ RESERVED
+CVE-2019-7216
+ RESERVED
CVE-2019-7215
RESERVED
CVE-2019-7214
@@ -495,6 +513,7 @@ CVE-2019-6990 (A stored-self XSS exists in
web/skins/classic/views/zones.php of
CVE-2016-10740 (Various resources in Atlassian Crowd before version 2.10.1
allow remote ...)
NOT-FOR-US: Atlassian Crowd
CVE-2019-1000018 [Remote code execution in scp support]
+ {DSA-4377-1 DLA-1650-1}
- rssh 2.3.4-9 (bug #919623)
NOTE: https://sourceforge.net/p/rssh/mailman/message/36519118/
CVE-2019-6989
@@ -7422,7 +7441,7 @@ CVE-2019-3814
RESERVED
CVE-2019-3813 [Off-by-one error in array access in spice/server/memslot.c]
RESERVED
- {DSA-4375-1}
+ {DSA-4375-1 DLA-1649-1}
- spice <unfixed> (bug #920762)
NOTE: https://www.openwall.com/lists/oss-security/2019/01/28/2
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1665371
@@ -8738,6 +8757,7 @@ CVE-2018-1000890 (FrontAccounting 2.4.5 contains a Time
Based Blind SQL Injectio
CVE-2018-1000889 (Logisim Evolution version 2.14.3 and earlier contains an XML
External ...)
NOT-FOR-US: Logisim Evolution
CVE-2018-1000888 (PEAR Archive_Tar version 1.4.3 and earlier contains a
CWE-502, CWE-915 ...)
+ {DSA-4378-1}
- php-pear 1:1.10.6+submodules+notgz-1.1 (bug #919147)
NOTE: https://pear.php.net/bugs/bug.php?id=23782
NOTE:
https://github.com/pear/Archive_Tar/commit/59ace120ac5ceb5f0d36e40e48e1884de1badf76
@@ -13157,7 +13177,7 @@ CVE-2018-20020 (LibVNC before commit
7b1ef0ffc4815cab9a96c7278394152bdc89dc4d co
NOTE:
https://github.com/LibVNC/libvncserver/commit/09f2f3fb6a5a163e453e5c2979054670c39694bc
NOTE:
https://github.com/LibVNC/libvncserver/commit/7b1ef0ffc4815cab9a96c7278394152bdc89dc4d
NOTE:
https://ics-cert.kaspersky.com/advisories/klcert-advisories/2018/12/19/klcert-18-030-libvnc-heap-out-of-bound-write/
-CVE-2018-20748 [Incomplete fix for CVE-2018-20019]
+CVE-2018-20748 (LibVNC before 0.9.12 contains multiple heap out-of-bounds
write ...)
- libvncserver <unfixed> (bug #920941)
[stretch] - libvncserver <not-affected> (Incomplete fix for
CVE-2018-20019 not applied)
NOTE:
https://github.com/LibVNC/libvncserver/commit/c5ba3fee85a7ecbbca1df5ffd46d32b92757bc2a
@@ -19607,8 +19627,8 @@ CVE-2018-19029
RESERVED
CVE-2018-19028
RESERVED
-CVE-2018-19027
- RESERVED
+CVE-2018-19027 (Three type confusion vulnerabilities exist in CX-One Versions
4.50 and ...)
+ TODO: check
CVE-2018-19026
RESERVED
CVE-2018-19025
@@ -20856,6 +20876,7 @@ CVE-2018-18506
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-18506
CVE-2018-18505
RESERVED
+ {DSA-4376-1 DLA-1648-1}
- firefox 65.0-1
- firefox-esr 60.5.0esr-1
- thunderbird 1:60.5.0-1
@@ -20876,6 +20897,7 @@ CVE-2018-18502
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2019-01/#CVE-2018-18502
CVE-2018-18501
RESERVED
+ {DSA-4376-1 DLA-1648-1}
- firefox 65.0-1
- firefox-esr 60.5.0esr-1
- thunderbird 1:60.5.0-1
@@ -20884,6 +20906,7 @@ CVE-2018-18501
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2019-03/#CVE-2018-18501
CVE-2018-18500
RESERVED
+ {DSA-4376-1 DLA-1648-1}
- firefox 65.0-1
- firefox-esr 60.5.0esr-1
- thunderbird 1:60.5.0-1
@@ -29550,11 +29573,11 @@ CVE-2018-15129 (ThinkSAAS through 2018-07-25 has XSS
via the ...)
NOT-FOR-US: ThinkSAAS
CVE-2018-15128
RESERVED
-CVE-2018-20750 [Incomplete fix for CVE-2018-15127]
+CVE-2018-20750 (LibVNC through 0.9.12 contains a heap out-of-bounds write
vulnerability ...)
- libvncserver <unfixed> (bug #920941)
[stretch] - libvncserver <not-affected> (Incomplete fix for
CVE-2018-15127 not applied)
NOTE:
https://github.com/LibVNC/libvncserver/commit/09e8fc02f59f16e2583b34fe1a270c238bd9ffec
-CVE-2018-20749 [Incomplete fix for CVE-2018-15127]
+CVE-2018-20749 (LibVNC before 0.9.12 contains a heap out-of-bounds write
vulnerability ...)
- libvncserver <unfixed> (bug #920941)
[stretch] - libvncserver <not-affected> (Incomplete fix for
CVE-2018-15127 not applied)
NOTE:
https://github.com/LibVNC/libvncserver/commit/15bb719c03cc70f14c36a843dcb16ed69b405707
@@ -104785,7 +104808,7 @@ CVE-2017-6521
RESERVED
CVE-2017-6520 (The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30
...)
NOT-FOR-US: Multicast DNS (mDNS) responder used in BOSE Soundtouch 30
-CVE-2017-6519 (avahi-daemon in Avahi through 0.6.32 inadvertently responds to
IPv6 ...)
+CVE-2017-6519 (avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently
responds to IPv6 ...)
- avahi <unfixed> (unimportant; bug #917047)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1426712
NOTE: https://github.com/lathiat/avahi/issues/203
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/45c8e8ddfcba339333f1b95ec9f1a7daf7ecf53c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/45c8e8ddfcba339333f1b95ec9f1a7daf7ecf53c
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
