Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d4905577 by Moritz Muehlenhoff at 2019-05-29T16:42:02Z
remove no-dsa for a number of qemu CVEs which were initially scheduled for
the last point release, but then didn't make it in time and which are
now again piggybacked on the forthcoming update
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -7015,7 +7015,6 @@ CVE-2019-9824
RESERVED
{DLA-1781-1}
- qemu 1:3.1+dfsg-6
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
- qemu-kvm <removed>
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg01871.html
NOTE: https://www.openwall.com/lists/oss-security/2019/03/18/1
@@ -14775,7 +14774,6 @@ CVE-2019-6779 (Cscms 4.1.8 allows admin.php/links/save
CSRF to add, modify, or d
CVE-2019-6778 (In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based
buffer ove ...)
{DLA-1694-1}
- qemu 1:3.1+dfsg-3 (bug #921525)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
- qemu-kvm <removed>
- slirp4netns 0.2.1-1
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2019-01/msg03132.html
@@ -21689,7 +21687,6 @@ CVE-2019-3813 (Spice, versions 0.5.2 through 0.14.1,
are vulnerable to an out-of
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1665371
CVE-2019-3812 (QEMU, through version 2.10 and through version 3.1.0, is
vulnerable to ...)
- qemu 1:3.1+dfsg-5 (bug #922635)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
[jessie] - qemu <not-affected> (vulnerable code introduced later)
- qemu-kvm <removed>
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=b05b267840515730dbf6753495d5b7bd8b04ad1c
@@ -32633,7 +32630,6 @@ CVE-2018-19490 (An issue was discovered in datafile.c
in Gnuplot 5.2.5. This iss
CVE-2018-19489 (v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to
cause a de ...)
{DLA-1646-1}
- qemu 1:3.1+dfsg-1 (bug #914727)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
- qemu-kvm <removed>
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg04489.html
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=1d20398694a3b67a388d955b7a945ba4aa90a8a8
(master)
@@ -32991,7 +32987,6 @@ CVE-2018-19365 (The REST API in Wowza Streaming Engine
4.7.4.01 allows traversal
CVE-2018-19364 (hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid
path while ...)
{DLA-1646-1}
- qemu 1:3.1+dfsg-1 (bug #914599)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
- qemu-kvm <removed>
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=5b76ef50f62079a2389ba28cacaf6cce68b1a0ed
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=5b3c77aa581ebb215125c84b0742119483571e55
@@ -34403,7 +34398,6 @@ CVE-2018-18955 (In the Linux kernel 4.15.x through
4.19.x before 4.19.2, map_wri
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1712
CVE-2018-18954 (The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu
before 3.1 al ...)
- qemu 1:3.1+dfsg-1 (low; bug #914604)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
[jessie] - qemu <not-affected> (Vulnerable code not present. ppc/pnv
lpc was added in 2.7)
- qemu-kvm <removed>
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=d07945e78eb6b593cd17a4640c1fc9eb35e3245d
@@ -34636,7 +34630,6 @@ CVE-2018-18850 (In Octopus Deploy 2018.8.0 through
2018.9.x before 2018.9.1, an
CVE-2018-18849 (In Qemu 3.0.0, lsi_do_msgin in hw/scsi/lsi53c895a.c allows
out-of-boun ...)
{DLA-1781-1}
- qemu 1:3.1+dfsg-1 (bug #912535)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
- qemu-kvm <removed>
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=e58ccf039650065a9442de43c9816f81e88f27f6
NOTE: https://www.openwall.com/lists/oss-security/2018/11/01/1
@@ -37165,7 +37158,6 @@ CVE-2018-17959
CVE-2018-17958 (Qemu has a Buffer Overflow in rtl8139_do_receive in
hw/net/rtl8139.c b ...)
{DLA-1646-1}
- qemu 1:3.1+dfsg-1 (bug #911499)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
- qemu-kvm <removed>
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03269.html
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=1a326646fef38782e5542280040ec3ea23e4a730
@@ -39829,7 +39821,6 @@ CVE-2018-16873 (In Go before 1.10.6 and 1.11.x before
1.11.3, the "go get" comma
CVE-2018-16872 (A flaw was found in qemu Media Transfer Protocol (MTP). The
code openi ...)
{DLA-1694-1}
- qemu 1:3.1+dfsg-2 (bug #916397)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
- qemu-kvm <removed>
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg03135.html
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=bab9df35ce73d1c8e19a37e2737717ea1c984dc1
@@ -50801,7 +50792,6 @@ CVE-2018-12618
CVE-2018-12617 (qmp_guest_file_read in qga/commands-posix.c and
qga/commands-win32.c i ...)
{DLA-1694-1}
- qemu 1:3.1+dfsg-1 (low; bug #902725)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
NOTE:
https://gist.github.com/fakhrizulkifli/c7740d28efa07dafee66d4da5d857ef6
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg03385.html
NOTE: Fixed by:
https://git.qemu.org/?p=qemu.git;a=commit;h=141b197408ab398c4f474ac1a728ab316e921f2b
@@ -53144,7 +53134,6 @@ CVE-2018-11807
CVE-2018-11806 (m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow
via inc ...)
{DLA-1781-1}
- qemu 1:3.1+dfsg-1 (bug #901017)
- [stretch] - qemu <no-dsa> (Minor issue, pending for stable point update)
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg01012.html
NOTE:
https://git.qemu.org/?p=qemu.git;a=commit;h=864036e251f54c99d31df124aad7f34f01f5344c
CVE-2018-1000202 (A persisted cross-site scripting vulnerability exists in
Jenkins Groov ...)
=====================================
data/dsa-needed.txt
=====================================
@@ -48,6 +48,8 @@ python2.7 (jmm)
--
python3.5 (jmm)
--
+qemu (jmm)
+--
simplesamlphp
--
smarty3
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/d49055776f7dd05436ebffb7d3a0136650b9c413
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/d49055776f7dd05436ebffb7d3a0136650b9c413
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
