Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
f1b229cd by Moritz Muehlenhoff at 2019-08-09T16:37:18Z
icedtea-web bugs
sdl, kde4libs no-dsa
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -126,6 +126,8 @@ CVE-2019-14745 (In radare2 before 3.7.0, a command
injection vulnerability exist
CVE-2019-14744 (In KDE Frameworks KConfig before 5.61.0, malicious desktop
files and c ...)
- kconfig <unfixed> (bug #934267)
- kde4libs <unfixed> (bug #934268)
+ [buster] - kde4libs <no-dsa> (Minor issue)
+ [stretch] - kde4libs <no-dsa> (Minor issue)
NOTE:
https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt
NOTE: https://kde.org/info/security/advisory-20190807-1.txt
NOTE: kconfig:
https://cgit.kde.org/kconfig.git/commit/?id=5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22
@@ -3347,7 +3349,11 @@ CVE-2019-13627
RESERVED
CVE-2019-13626 (SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a
heap-based buff ...)
- libsdl2 <unfixed>
+ [buster] - libsdl2 <no-dsa> (Minor issue)
+ [stretch] - libsdl2 <no-dsa> (Minor issue)
- libsdl1.2 <unfixed>
+ [buster] - libsdl1.2 <no-dsa> (Minor issue)
+ [stretch] - libsdl1.2 <no-dsa> (Minor issue)
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4522
CVE-2019-13625 (NSA Ghidra before 9.0.1 allows XXE when a project is opened or
restore ...)
- ghidra <itp> (bug #923851)
@@ -3379,11 +3385,20 @@ CVE-2019-13617 (njs through 0.3.3, used in NGINX, has a
heap-based buffer over-r
NOT-FOR-US: njs
CVE-2019-13616 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through
2.0.9 ha ...)
- libsdl2 <unfixed>
+ [buster] - libsdl2 <no-dsa> (Minor issue)
+ [stretch] - libsdl2 <no-dsa> (Minor issue)
- libsdl1.2 <unfixed>
+ [buster] - libsdl1.2 <no-dsa> (Minor issue)
+ [stretch] - libsdl1.2 <no-dsa> (Minor issue)
- libsdl2-image <unfixed>
+ [buster] - libsdl2-image <no-dsa> (Minor issue)
+ [stretch] - libsdl2-image <no-dsa> (Minor issue)
[jessie] - libsdl2-image <postponed> (can be fixed along with more
important patches)
- sdl-image1.2 <unfixed>
+ [buster] - sdl-image1.2 <no-dsa> (Minor issue)
+ [stretch] - sdl-image1.2 <no-dsa> (Minor issue)
[jessie] - sdl-image1.2 <postponed> (can be fixed along with more
important patches)
+ - libsdl1.2 <unfixed>
NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4538
NOTE: libsdl2: https://hg.libsdl.org/SDL/rev/e7ba650a643a
NOTE: libsdl1.2: https://hg.libsdl.org/SDL/rev/ad1bbfbca760
@@ -13280,7 +13295,7 @@ CVE-2019-10187 (A flaw was found in moodle before
versions 3.7.1, 3.6.5, 3.5.7.
CVE-2019-10186 (A flaw was found in moodle before versions 3.7.1, 3.6.5,
3.5.7. A sess ...)
- moodle <removed>
CVE-2019-10185 (It was found that icedtea-web up to and including 1.7.2 and
1.8.2 was ...)
- - icedtea-web <unfixed>
+ - icedtea-web <unfixed> (bug #934319)
NOTE: https://www.openwall.com/lists/oss-security/2019/07/31/2
NOTE: https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
CVE-2019-10184 (undertow before version 2.0.23.Final is vulnerable to an
information l ...)
@@ -13291,11 +13306,11 @@ CVE-2019-10183 (Virt-install(1) utility used to
provision new virtual machines h
- virt-manager <not-affected> (Vulnerable code introduced in v2.2.0)
NOTE:
https://www.redhat.com/archives/virt-tools-list/2019-July/msg00014.html
CVE-2019-10182 (It was found that icedtea-web though 1.7.2 and 1.8.2 did not
properly ...)
- - icedtea-web <unfixed>
+ - icedtea-web <unfixed> (bug #934319)
NOTE: https://www.openwall.com/lists/oss-security/2019/07/31/2
NOTE: https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
CVE-2019-10181 (It was found that in icedtea-web up to and including 1.7.2 and
1.8.2 e ...)
- - icedtea-web <unfixed>
+ - icedtea-web <unfixed> (bug #934319)
NOTE: https://www.openwall.com/lists/oss-security/2019/07/31/2
NOTE: https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
CVE-2019-10180
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f1b229cddcb82621d3f2c31686a6d3d06dff0239
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/f1b229cddcb82621d3f2c31686a6d3d06dff0239
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
