Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b1bac99d by Moritz Muehlenhoff at 2019-03-14T21:52:28Z
buster triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1556,7 +1556,7 @@ CVE-2019-9170 [IDOR milestone name information disclosure]
- gitlab <unfixed> (bug #924447)
NOTE:
https://about.gitlab.com/2019/03/04/security-release-gitlab-11-dot-8-dot-1-released/
CVE-2019-9169 (In the GNU C Library (aka glibc or libc6) through 2.29, ...)
- - glibc <unfixed>
+ - glibc <unfixed> (bug #924612)
[stretch] - glibc <no-dsa> (Minor issue)
[jessie] - glibc <no-dsa> (Minor issue)
- eglibc <removed>
@@ -1600,7 +1600,7 @@ CVE-2018-20796 (In the GNU C Library (aka glibc or libc6)
through 2.29, ...)
NOTE: No treated as vulnerability:
https://sourceware.org/glibc/wiki/Security%20Exceptions
CVE-2009-5155 (In the GNU C Library (aka glibc or libc6) before 2.28,
parse_reg_exp in ...)
[experimental] - gnulib 20180621~6979c25-1
- - gnulib <unfixed>
+ - gnulib <unfixed> (bug #924613)
- glibc 2.28-1
[stretch] - glibc <no-dsa> (Minor issue)
[jessie] - glibc <no-dsa> (Minor issue)
@@ -5015,35 +5015,35 @@ CVE-2019-7639 (An issue was discovered in
gsi-openssh-server 7.9p1 on Fedora 29.
NOT-FOR-US: gsi-openssh-server (OpenSSH patched with
openssh-7.9p1-gsissh.patch)
CVE-2019-7638 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4500
NOTE: https://hg.libsdl.org/SDL/rev/19d8c3b9c251 (SDL-1.2)
NOTE: https://hg.libsdl.org/SDL/rev/07c39cbbeacf
CVE-2019-7637 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4497
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3630
CVE-2019-7636 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4499
NOTE: https://hg.libsdl.org/SDL/rev/19d8c3b9c251 (SDL-1.2)
NOTE: https://hg.libsdl.org/SDL/rev/07c39cbbeacf
CVE-2019-7635 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4498
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3637
@@ -5171,59 +5171,59 @@ CVE-2019-7579
RESERVED
CVE-2019-7578 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4494
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3623
CVE-2019-7577 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4492
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3608
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3694
CVE-2019-7576 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4490
NOTE: Proposed patch:
https://bugzilla.libsdl.org/attachment.cgi?id=3620&action=diff
NOTE: very similar bug to CVE-2019-7573, fix for CVE-2019-7573 is
applicable to this
CVE-2019-7575 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4493
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3609
CVE-2019-7574 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4496
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3610
CVE-2019-7573 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4491
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3620
CVE-2019-7572 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 has ...)
{DLA-1714-1 DLA-1713-1}
- - libsdl1.2 <unfixed>
+ - libsdl1.2 <unfixed> (bug #924609)
[stretch] - libsdl1.2 <no-dsa> (Minor issue)
- - libsdl2 <unfixed>
+ - libsdl2 <unfixed> (bug #924610)
[stretch] - libsdl2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4495
NOTE: Proposed patch:
https://bugzilla-attachments.libsdl.org/attachment.cgi?id=3612
@@ -15165,7 +15165,8 @@ CVE-2018-20540 (There is memory leak at liblas::Open
(liblas/liblas.hpp) in libL
NOTE: https://github.com/libLAS/libLAS/issues/158
NOTE:
https://github.com/libLAS/libLAS/commit/ba7346d349fb00b18d0c12e226ac3090eac25d7b
CVE-2018-20539 (There is a Segmentation fault triggered by illegal address
access at ...)
- - liblas <unfixed>
+ - liblas <unfixed> (low; bug #924614)
+ [buster] - liblas <no-dsa> (Minor issue)
[stretch] - liblas <no-dsa> (Minor issue)
[jessie] - liblas <no-dsa> (Minor issue)
NOTE: https://github.com/libLAS/libLAS/issues/159
@@ -15175,12 +15176,14 @@ CVE-2018-20538 (There is a use-after-free at
asm/preproc.c (function pp_getline)
[jessie] - nasm <no-dsa> (Minor issue)
NOTE: https://bugzilla.nasm.us/show_bug.cgi?id=3392531
CVE-2018-20537 (There is a NULL pointer dereference at ...)
- - liblas <unfixed>
+ - liblas <unfixed> (low; bug #924614)
+ [buster] - liblas <no-dsa> (Minor issue)
[stretch] - liblas <no-dsa> (Minor issue)
[jessie] - liblas <no-dsa> (Minor issue)
NOTE: https://github.com/libLAS/libLAS/issues/160
CVE-2018-20536 (There is a heap-based buffer over-read at ...)
- - liblas <unfixed>
+ - liblas <unfixed> (low; bug #924614)
+ [buster] - liblas <no-dsa> (Minor issue)
[stretch] - liblas <no-dsa> (Minor issue)
[jessie] - liblas <no-dsa> (Minor issue)
NOTE: https://github.com/libLAS/libLAS/issues/161
@@ -21347,7 +21350,7 @@ CVE-2018-19760 (cfg_init in confuse.c in libConfuse
3.2.2 has a memory leak. ...
NOTE: Issue caused by premature exit without cleanup on an error in the
caller
NOTE: not in the library; Negligible security impact in itself and
disputed.
CVE-2018-19759 (There is a heap-based buffer over-read at stb_image_write.h
(function: ...)
- - libsixel <unfixed>
+ - libsixel <undetermined>
NOTE: https://github.com/saitoha/libsixel/issues/77
CVE-2018-19758 (There is a heap-based buffer over-read at wav.c in
wav_write_header in ...)
{DLA-1632-1}
@@ -122912,24 +122915,32 @@ CVE-2016-9843 (The crc32_big function in crc32.c in
zlib 1.2.8 might allow ...)
- zlib 1:1.2.8.dfsg-3 (bug #847275)
[jessie] - zlib <no-dsa> (Minor issue)
[wheezy] - zlib <no-dsa> (Minor issue)
+ - rsync <unfixed> (bug #924509)
+ [stretch] - rsync <no-dsa> (Minor issue)
NOTE:
https://github.com/madler/zlib/commit/d1d577490c15a0c6862473d7576352a9f18ef811
NOTE: Report: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf
CVE-2016-9842 (The inflateMark function in inflate.c in zlib 1.2.8 might allow
...)
- zlib 1:1.2.8.dfsg-3 (bug #847274)
[jessie] - zlib <no-dsa> (Minor issue)
[wheezy] - zlib <no-dsa> (Minor issue)
+ - rsync <unfixed> (bug #924509)
+ [stretch] - rsync <no-dsa> (Minor issue)
NOTE:
https://github.com/madler/zlib/commit/e54e1299404101a5a9d0cf5e45512b543967f958
NOTE: Report: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf
CVE-2016-9841 (inffast.c in zlib 1.2.8 might allow context-dependent attackers
to ...)
- zlib 1:1.2.8.dfsg-4 (bug #847270)
[jessie] - zlib <no-dsa> (Minor issue)
[wheezy] - zlib <no-dsa> (Minor issue)
+ - rsync <unfixed> (bug #924509)
+ [stretch] - rsync <no-dsa> (Minor issue)
NOTE:
https://github.com/madler/zlib/commit/9aaec95e82117c1cb0f9624264c3618fc380cecb
NOTE: Report: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf
CVE-2016-9840 (inftrees.c in zlib 1.2.8 might allow context-dependent
attackers to ...)
- zlib 1:1.2.8.dfsg-3 (bug #847270)
[jessie] - zlib <no-dsa> (Minor issue)
[wheezy] - zlib <no-dsa> (Minor issue)
+ - rsync <unfixed> (bug #924509)
+ [stretch] - rsync <no-dsa> (Minor issue)
NOTE:
https://github.com/madler/zlib/commit/6a043145ca6e9c55184013841a67b2fef87e44c0
NOTE: Report: https://wiki.mozilla.org/images/0/09/Zlib-report.pdf
CVE-2016-9844 (Buffer overflow in the zi_short function in zipinfo.c in
Info-Zip ...)
@@ -144097,6 +144108,7 @@ CVE-2016-4456 (The "GNUTLS_KEYLOGFILE"
environment variable in gnutls
CVE-2016-1000002
RESERVED
- gdm3 <unfixed> (low; bug #849432)
+ [buster] - gdm3 <ignored> (Minor issue)
[stretch] - gdm3 <ignored> (Minor issue)
[jessie] - gdm3 <ignored> (Minor issue)
[wheezy] - gdm3 <ignored> (Minor issue)
@@ -190926,6 +190938,7 @@ CVE-2014-XXXX [rsync collision attack]
CVE-2014-8242 (librsync before 1.0.0 uses a truncated MD4 checksum to match
blocks, ...)
[experimental] - librsync 1.0.0-1~exp1
- librsync <unfixed> (low; bug #776246)
+ [buster] - librsync <no-dsa> (Minor issue, too instrusive to backport)
[stretch] - librsync <no-dsa> (Minor issue, too instrusive to backport)
[jessie] - librsync <no-dsa> (Minor issue, too instrusive to backport)
[wheezy] - librsync <no-dsa> (Minor issue, too instrusive to backport)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/b1bac99d7beb0476168a6e8be36ee1526a52dcc0
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/b1bac99d7beb0476168a6e8be36ee1526a52dcc0
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
