Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6680eaab by Moritz Muehlenhoff at 2019-02-20T22:01:13Z
stretch triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1181,8 +1181,9 @@ CVE-2019-8383 (An issue was discovered in AdvanceCOMP
before 2.1. An invalid mem
CVE-2019-8382 (An issue was discovered in Bento4 1.5.1-628. A NULL pointer
dereference ...)
NOT-FOR-US: Bento4
CVE-2019-8381 (An issue was discovered in Tcpreplay 4.3.1. An invalid memory
access ...)
- - tcpreplay <unfixed> (bug #922622)
+ - tcpreplay <unfixed> (unimportant; bug #922622)
NOTE: https://github.com/appneta/tcpreplay/issues/538
+ NOTE: Crash in a CLI tool, no security impact
CVE-2019-8380 (An issue was discovered in Bento4 1.5.1-628. A NULL pointer
dereference ...)
NOT-FOR-US: Bento4
CVE-2019-8379 (An issue was discovered in AdvanceCOMP before 2.1. A NULL
pointer ...)
@@ -1190,11 +1191,13 @@ CVE-2019-8379 (An issue was discovered in AdvanceCOMP
before 2.1. A NULL pointer
CVE-2019-8378 (An issue was discovered in Bento4 1.5.1-628. A heap-based
buffer ...)
NOT-FOR-US: Bento4
CVE-2019-8377 (An issue was discovered in Tcpreplay 4.3.1. A NULL pointer
dereference ...)
- - tcpreplay <unfixed> (bug #922623)
+ - tcpreplay <unfixed> (unimportant; bug #922623)
NOTE: https://github.com/appneta/tcpreplay/issues/536
+ NOTE: Crash in a CLI tool, no security impact
CVE-2019-8376 (An issue was discovered in Tcpreplay 4.3.1. A NULL pointer
dereference ...)
- - tcpreplay <unfixed> (bug #922624)
+ - tcpreplay <unfixed> (unimportant; bug #922624)
NOTE: https://github.com/appneta/tcpreplay/issues/537
+ NOTE: Crash in a CLI tool, no security impact
CVE-2019-8375
RESERVED
CVE-2019-8374
@@ -4479,7 +4482,8 @@ CVE-2019-6977 (gdImageColorMatch in gd_color_match.c in
the GD Graphics Library
NOTE: PHP Bug: https://bugs.php.net/bug.php?id=77270
NOTE: Proposed patch:
https://gist.github.com/cmb69/1f36d285eb297ed326f5c821d7aafced
CVE-2019-6976 (libvips before 8.7.4 writes to uninitialized memory locations
in ...)
- - vips 8.7.4-1
+ - vips 8.7.4-1 (low)
+ [stretch] - vips <no-dsa> (Minor issue)
[jessie] - vips <ignored> (Minor Issue)
NOTE:
https://github.com/libvips/libvips/commit/00622428bda8d7521db8d74260b519fa41d69d0a
CVE-2019-6975 (Django 1.11.x before 1.11.19, 2.0.x before 2.0.11, and 2.1.x
before ...)
@@ -5700,6 +5704,9 @@ CVE-2019-6454 [systemd (PID1) crash with specially
crafted D-Bus message]
{DSA-4393-1 DLA-1684-1}
- systemd 240-6
NOTE: https://www.openwall.com/lists/oss-security/2019/02/18/3
+ NOTE:
https://github.com/systemd/systemd/commit/798ebaf9aea9b8ae3b8a0cc2702bc8de71acb3c6
+ NOTE:
https://github.com/systemd/systemd/commit/6d586a13717ae057aa1b4127400c3de61cd5b9e7
+ NOTE:
https://github.com/systemd/systemd/commit/f519a19bcd5afe674a9b8fc462cd77d8bad403c1
CVE-2019-6453 (mIRC before 7.55 allows remote command execution by using
argument ...)
NOT-FOR-US: mIRC
CVE-2019-6452
@@ -13014,37 +13021,44 @@ CVE-2018-20463 (An issue was discovered in the
JSmol2WP plugin 1.07 for WordPres
CVE-2018-20462 (An issue was discovered in the JSmol2WP plugin 1.07 for
WordPress. A ...)
NOT-FOR-US: JSmol2WP plugin for WordPress
CVE-2018-20461 (In radare2 prior to 3.1.1, core_anal_bytes in
libr/core/cmd_anal.c ...)
- - radare2 3.1.2+dfsg-1
+ - radare2 3.1.2+dfsg-1 (low)
+ [stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <not-affected> (vulnerable code not present)
NOTE:
https://github.com/radare/radare2/commit/a1bc65c3db593530775823d6d7506a457ed95267
NOTE: https://github.com/radare/radare2/issues/12375
CVE-2018-20460 (In radare2 prior to 3.1.2, the parseOperands function in ...)
- - radare2 3.1.2+dfsg-1
+ - radare2 3.1.2+dfsg-1 (low)
+ [stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <not-affected> (vulnerable code not present)
NOTE:
https://github.com/radare/radare2/commit/df167c7db545953bb7f71c72e98e7a3ca0c793bf
NOTE: https://github.com/radare/radare2/issues/12376
CVE-2018-20459 (In radare2 through 3.1.3, the armass_assemble function in ...)
- - radare2 3.2.1+dfsg-1 (bug #917322)
+ - radare2 3.2.1+dfsg-1 (low; bug #917322)
+ [stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <not-affected> (vulnerable code not present)
NOTE:
https://github.com/radare/radare2/commit/e5c14c167b0dcf0a53d76bd50bacbbcc0dfc1ae7
NOTE: https://github.com/radare/radare2/issues/12418
CVE-2018-20458 (In radare2 prior to 3.1.1, r_bin_dyldcache_extract in ...)
- - radare2 3.1.2+dfsg-1
+ - radare2 3.1.2+dfsg-1 (low)
+ [stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <not-affected> (vulnerable code not present)
NOTE:
https://github.com/radare/radare2/commit/30f4c7b52a4e2dc0d0b1bae487d90f5437c69d19
NOTE: https://github.com/radare/radare2/issues/12374
CVE-2018-20457 (In radare2 through 3.1.3, the assemble function inside ...)
- - radare2 3.2.1+dfsg-1 (bug #917322)
+ - radare2 3.2.1+dfsg-1 (low; bug #917322)
+ [stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <not-affected> (vulnerable code not present)
NOTE:
https://github.com/radare/radare2/commit/e5c14c167b0dcf0a53d76bd50bacbbcc0dfc1ae7
NOTE: https://github.com/radare/radare2/issues/12417
CVE-2018-20456 (In radare2 prior to 3.1.1, the parseOperand function inside
...)
- - radare2 3.1.2+dfsg-1
+ - radare2 3.1.2+dfsg-1 (low)
+ [stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <not-affected> (vulnerable code not present)
NOTE:
https://github.com/radare/radare2/commit/9b46d38dd3c4de6048a488b655c7319f845af185
NOTE: https://github.com/radare/radare2/issues/12372
CVE-2018-20455 (In radare2 prior to 3.1.1, the parseOperand function inside
...)
- - radare2 3.1.2+dfsg-1
+ - radare2 3.1.2+dfsg-1 (low)
+ [stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <not-affected> (vulnerable code not present)
NOTE:
https://github.com/radare/radare2/commit/9b46d38dd3c4de6048a488b655c7319f845af185
NOTE: https://github.com/radare/radare2/issues/12373
@@ -13263,6 +13277,7 @@ CVE-2018-20366
RESERVED
CVE-2018-20365 (LibRaw::raw2image() in libraw_cxx.cpp has a heap-based buffer
overflow. ...)
- libraw 0.19.2-2 (bug #917111)
+ [stretch] - libraw <no-dsa> (Minor issue)
[jessie] - libraw <not-affected> (Vulnerable code not present)
NOTE: https://github.com/LibRaw/LibRaw/issues/195
NOTE: Fixed by:
https://github.com/LibRaw/LibRaw/commit/7e29b9f29449fde30cc878fbb137d61c14bba3a4
@@ -13270,6 +13285,7 @@ CVE-2018-20365 (LibRaw::raw2image() in libraw_cxx.cpp
has a heap-based buffer ov
NOTE: CVE-2018-20363, CVE-2018-20364 and CVE-2018-20365 have same root
cause
CVE-2018-20364 (LibRaw::copy_bayer in libraw_cxx.cpp in LibRaw 0.19.1 has a
NULL ...)
- libraw 0.19.2-2 (bug #917112)
+ [stretch] - libraw <no-dsa> (Minor issue)
[jessie] - libraw <not-affected> (Vulnerable code not present)
NOTE: https://github.com/LibRaw/LibRaw/issues/194
NOTE: Fixed by:
https://github.com/LibRaw/LibRaw/commit/7e29b9f29449fde30cc878fbb137d61c14bba3a4
@@ -13277,6 +13293,7 @@ CVE-2018-20364 (LibRaw::copy_bayer in libraw_cxx.cpp in
LibRaw 0.19.1 has a NULL
NOTE: CVE-2018-20363, CVE-2018-20364 and CVE-2018-20365 have same root
cause
CVE-2018-20363 (LibRaw::raw2image in libraw_cxx.cpp in LibRaw 0.19.1 has a
NULL pointer ...)
- libraw 0.19.2-2 (bug #917113)
+ [stretch] - libraw <no-dsa> (Minor issue)
[jessie] - libraw <not-affected> (Vulnerable code not present)
NOTE: https://github.com/LibRaw/LibRaw/issues/193
NOTE: Fixed by:
https://github.com/LibRaw/LibRaw/commit/7e29b9f29449fde30cc878fbb137d61c14bba3a4
@@ -13364,6 +13381,7 @@ CVE-2018-20338 (Zoho ManageEngine OpManager 12.3 before
build 123239 allows SQL
NOT-FOR-US: Zoho ManageEngine OpManager
CVE-2018-20337 (There is a stack-based buffer overflow in the parse_makernote
function ...)
- libraw 0.19.2-1 (bug #917080)
+ [stretch] - libraw <no-dsa> (Minor issue)
[jessie] - libraw <not-affected> (Vulnerable code not present)
NOTE: https://github.com/LibRaw/LibRaw/issues/192
CVE-2018-20336
@@ -18871,9 +18889,9 @@ CVE-2018-19779
CVE-2018-19778
RESERVED
CVE-2018-19777 (In Artifex MuPDF 1.14.0, there is an infinite loop in the
function ...)
- - mupdf <unfixed> (bug #915137)
- [jessie] - mupdf <ignored> (Minor issue)
+ - mupdf <unfixed> (unimportant; bug #915137)
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=700301
+ NOTE: No security impact, hang in GUI/CLI tool
CVE-2018-19776
RESERVED
CVE-2018-19775 (Cross Site Scripting exists in InfoVista VistaPortal SE
Version 5.1 ...)
@@ -25948,18 +25966,23 @@ CVE-2019-0001 (Receipt of a malformed packet on MX
Series devices with dynamic v
NOT-FOR-US: Juniper
CVE-2018-18250 (Icinga Web 2 before 2.6.2 allows parameters that break
navigation ...)
- icingaweb2 2.6.2-1
+ [stretch] - icingaweb2 <no-dsa> (Minor issue)
NOTE:
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180030.txt
CVE-2018-18249 (Icinga Web 2 before 2.6.2 allows injection of PHP ini-file
directives ...)
- icingaweb2 2.6.2-1
+ [stretch] - icingaweb2 <no-dsa> (Minor issue)
NOTE:
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180030.txt
CVE-2018-18248 (Icinga Web 2 has XSS via the
/icingaweb2/monitoring/list/services dir ...)
- icingaweb2 2.6.2-1
+ [stretch] - icingaweb2 <no-dsa> (Minor issue)
NOTE:
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180028.txt
CVE-2018-18247 (Icinga Web 2 before 2.6.2 has XSS via the
/icingaweb2/navigation/add ...)
- icingaweb2 2.6.2-1
+ [stretch] - icingaweb2 <no-dsa> (Minor issue)
NOTE:
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180029.txt
CVE-2018-18246 (Icinga Web 2 before 2.6.2 has CSRF via ...)
- icingaweb2 2.6.2-1
+ [stretch] - icingaweb2 <no-dsa> (Minor issue)
NOTE:
https://herolab.usd.de/wp-content/uploads/sites/4/2018/12/usd20180027.txt
CVE-2018-18245 (Nagios Core 4.4.2 has XSS via the alert summary reports of
plugin ...)
{DLA-1615-1}
@@ -26414,6 +26437,7 @@ CVE-2018-1000807 (Python Cryptographic Authority
pyopenssl version prior to vers
CVE-2018-1000805 (Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5,
1.17.6 ...)
{DLA-1556-1}
- paramiko 2.4.2-0.1 (bug #910760)
+ [stretch] - paramiko <no-dsa> (Minor issue)
NOTE: https://github.com/paramiko/paramiko/issues/1283
NOTE:
https://github.com/paramiko/paramiko/commit/56c96a659658acdbb873aef8809a7b508434dcce
CVE-2018-1000804 (contiki-ng version 4 contains a Buffer Overflow
vulnerability in AQL ...)
@@ -59754,11 +59778,13 @@ CVE-2018-5810 (An error within the
"rollei_load_raw()" function ...)
NOTE:
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-10/
CVE-2018-5809 (An error within the "LibRaw::parse_exif()" function
...)
- libraw 0.18.11-1
+ [stretch] - libraw <no-dsa> (Minor issue)
[jessie] - libraw <ignored> (Minor issue)
NOTE:
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-9/
NOTE:
https://github.com/LibRaw/LibRaw/commit/fd6330292501983ac75fe4162275794b18445bd9
CVE-2018-5808 (An error within the "find_green()" function ...)
- libraw 0.18.11-1
+ [stretch] - libraw <no-dsa> (Minor issue)
[jessie] - libraw <ignored> (Minor issue)
NOTE:
https://secuniaresearch.flexerasoftware.com/secunia_research/2018-9/
NOTE:
https://github.com/LibRaw/LibRaw/commit/fd6330292501983ac75fe4162275794b18445bd9
=====================================
data/dsa-needed.txt
=====================================
@@ -45,6 +45,8 @@ mumble
mysql-connector-python
Proposed to update to 2.1.9 via stretch-security
--
+nss
+--
openjdk-8 (jmm)
--
openjpeg2 (luciano)
@@ -59,6 +61,8 @@ simplesamlphp
--
smarty3
--
+sox
+--
sssd
Maintainer prepared an update and proposed debdiff, acked for upload, but
update needs further testing before release.
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/6680eaab5224dd056b25158be80c50d578034289
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/6680eaab5224dd056b25158be80c50d578034289
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
