Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b5e6bd69 by security tracker role at 2019-02-20T08:10:19Z
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,25 @@
+CVE-2019-8950 (The backdoor account dnsekakf2$$ in /bin/login on DASAN H665
devices ...)
+ TODO: check
+CVE-2019-8949
+ RESERVED
+CVE-2019-8948 (PaperCut MF before 18.3.6 and PaperCut NG before 18.3.6 allow
script ...)
+ TODO: check
+CVE-2019-8947
+ RESERVED
+CVE-2019-8946
+ RESERVED
+CVE-2019-8945
+ RESERVED
+CVE-2019-8944 (An Information Exposure issue in the Terraform deployment step
in ...)
+ TODO: check
+CVE-2019-8943 (WordPress through 5.0.3 allows Path Traversal in
wp_crop_image(). An ...)
+ TODO: check
+CVE-2019-8942 (WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code
...)
+ TODO: check
+CVE-2019-8941
+ RESERVED
+CVE-2019-8940
+ RESERVED
CVE-2019-8939 (data/interfaces/default/history.html in Tautulli 2.1.26 has XSS
via a ...)
TODO: check
CVE-2019-8938
@@ -3967,8 +3989,7 @@ CVE-2019-7166
RESERVED
CVE-2019-7165
RESERVED
-CVE-2019-7164 [SQL Injection when the order_by parameter can be controlled]
- RESERVED
+CVE-2019-7164 (SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL
...)
- sqlalchemy <unfixed> (bug #922669)
NOTE: https://github.com/sqlalchemy/sqlalchemy/issues/4481
NOTE:
https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
@@ -5555,7 +5576,7 @@ CVE-2018-20735 (** DISPUTED ** An issue was discovered in
BMC PATROL Agent throu
CVE-2018-20734
RESERVED
CVE-2019-6338 (In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6
and ...)
- {DSA-4370-1}
+ {DSA-4370-1 DLA-1685-1}
- drupal7 <removed>
NOTE: https://www.drupal.org/sa-core-2019-001
CVE-2019-6339 (In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6
and ...)
@@ -11414,6 +11435,7 @@ CVE-2019-3829
RESERVED
CVE-2019-3828 [path traversal in the fetch module]
RESERVED
+ {DSA-4396-1}
- ansible <unfixed> (bug #922537)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1676689
NOTE: https://github.com/ansible/ansible/pull/52133
@@ -17253,11 +17275,9 @@ CVE-2018-20028
RESERVED
CVE-2018-20027 (The yaml_parse.load method in Pylearn2 allows code injection.
...)
NOT-FOR-US: Pylearn2
-CVE-2018-20026
- RESERVED
+CVE-2018-20026 (Improper Communication Address Filtering exists in CODESYS V3
products ...)
NOT-FOR-US: 3S-Smart Software Solutions GmbH CODESYS V3 Products
-CVE-2018-20025
- RESERVED
+CVE-2018-20025 (Use of Insufficiently Random Values exists in CODESYS V3
products ...)
NOT-FOR-US: 3S-Smart Software Solutions GmbH CODESYS V3 Products
CVE-2018-20024 (LibVNC before commit 4a21bbd097ef7c44bb000c3bd0907f96a10e4ce7
contains ...)
{DSA-4383-1 DLA-1617-1}
@@ -23554,8 +23574,8 @@ CVE-2018-19107 (In Exiv2 0.26,
Exiv2::IptcParser::decode in iptc.cpp (called fro
[jessie] - exiv2 <ignored> (Minor issue)
NOTE: https://github.com/Exiv2/exiv2/issues/427
NOTE: https://github.com/Exiv2/exiv2/pull/518
-CVE-2018-19106
- RESERVED
+CVE-2018-19106 (Avi Vantage before 17.2.13 uses an invalid URL encoding during
a ...)
+ TODO: check
CVE-2018-19105 (LibreCAD 2.1.3 allows remote attackers to cause a denial of
service ...)
- librecad <undetermined>
NOTE: https://code610.blogspot.com/2018/11/crashing-librecad-213.html
@@ -29243,6 +29263,7 @@ CVE-2018-16878
CVE-2018-16877
RESERVED
CVE-2018-16876 (ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to
a ...)
+ {DSA-4396-1}
- ansible <unfixed> (bug #916102)
[jessie] - ansible <not-affected> (Vulnerable code not present)
NOTE: https://github.com/ansible/ansible/pull/49569
@@ -29458,7 +29479,7 @@ CVE-2018-16838 [improper implementation of GPOs due to
too restrictive permissio
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1640820
TODO: check, Bugzilla entry does not provide details
CVE-2018-16837 (Ansible "User" module leaks any data which is passed
on as a parameter ...)
- {DLA-1576-1}
+ {DSA-4396-1 DLA-1576-1}
- ansible 2.7.1+dfsg-1 (bug #912297)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1640642
NOTE: https://github.com/ansible/ansible/pull/47436
@@ -45265,6 +45286,7 @@ CVE-2018-10876 (A flaw was found in Linux kernel in the
ext4 filesystem code. A
[stretch] - linux 4.9.110-1
NOTE: https://bugzilla.kernel.org/show_bug.cgi?id=199403
CVE-2018-10875 (A flaw was found in ansible. ansible.cfg is read from the
current ...)
+ {DSA-4396-1}
- ansible 2.6.1+dfsg-1
[jessie] - ansible <no-dsa> (Too intrusive to backport)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1596533
@@ -45344,6 +45366,7 @@ CVE-2018-10857 (git-annex is vulnerable to a private
data exposure and exfiltrat
CVE-2018-10856 (It has been discovered that podman before version 0.6.1 does
not drop ...)
NOT-FOR-US: Podman
CVE-2018-10855 (Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not
honor the ...)
+ {DSA-4396-1}
- ansible 2.5.5+dfsg-1 (low)
[jessie] - ansible <not-affected> (vulnerable code not present)
NOTE: https://github.com/ansible/ansible/pull/41414
@@ -47901,8 +47924,8 @@ CVE-2018-9869
RESERVED
CVE-2018-9868
RESERVED
-CVE-2018-9867
- RESERVED
+CVE-2018-9867 (In SonicWall SonicOS, administrators without full permissions
can ...)
+ TODO: check
CVE-2018-9866 (A vulnerability in lack of validation of user-supplied
parameters pass ...)
NOT-FOR-US: SonicWall
CVE-2018-9865
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/b5e6bd691d072f18480aadf08912ead3b8d1618c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/b5e6bd691d072f18480aadf08912ead3b8d1618c
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
