Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d51e2549 by Moritz Muehlenhoff at 2020-01-22T23:54:21+01:00
NFUs
bugs for roundcube, libstb
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1345,7 +1345,7 @@ CVE-2019-20386 (An issue was discovered in button_open in
login/logind-button.c
CVE-2019-20385 (The CSV upload feature in /supervisor/procesa_carga.php on
Logaritmo A ...)
NOT-FOR-US: Logaritmo Aware CallManager 2012 devices
CVE-2019-20384 (Gentoo Portage through 2.3.84 allows local users to place a
Trojan hor ...)
- TODO: check
+ NOT-FOR-US: Portage
CVE-2019-20383
RESERVED
CVE-2019-20382
@@ -1369,13 +1369,13 @@ CVE-2020-7232 (Evoko Home 1.31 devices allow remote
attackers to obtain sensitiv
CVE-2020-7231 (Evoko Home 1.31 devices provide different error messages for
failed lo ...)
NOT-FOR-US: Evoko Home devices
CVE-2019-20381 (TestLink before 1.9.20 allows XSS via non-lowercase
javascript: in the ...)
- TODO: check
+ NOT-FOR-US: TestLink
CVE-2016-11018 (An issue was discovered in the Huge-IT gallery-images plugin
before 1. ...)
NOT-FOR-US: Huge-IT gallery-images plugin for WordPress
CVE-2020-7230
RESERVED
CVE-2020-7229 (An issue was discovered in Simplejobscript.com SJS before 1.65.
There ...)
- TODO: check
+ NOT-FOR-US: Simplejobscript.com SJS
CVE-2020-7228 (The Calculated Fields Form plugin through 1.0.353 for WordPress
suffer ...)
NOT-FOR-US: Calculated Fields Form plugin for WordPress
CVE-2020-7227 (Westermo MRD-315 1.7.3 and 1.7.4 devices have an information
disclosur ...)
@@ -1407,7 +1407,7 @@ CVE-2020-7215 (An issue was discovered in Gallagher
Command Centre 7.x before 7.
CVE-2020-7214
RESERVED
CVE-2020-7213 (Parallels 13 uses cleartext HTTP as part of the update process,
allowi ...)
- TODO: check
+ NOT-FOR-US: Parallels
CVE-2020-7212
RESERVED
CVE-2020-7211 (tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not
prevent ..\ ...)
@@ -2691,7 +2691,7 @@ CVE-2020-6624 (jhead through 3.04 has a heap-based buffer
over-read in process_D
NOTE: https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1858744
NOTE: Crash in CLI tool, no security impact
CVE-2020-6623 (stb stb_truetype.h through 1.22 has an assertion failure in
stbtt__cff ...)
- - libstb <unfixed> (low)
+ - libstb <unfixed> (low; bug #949560)
[buster] - libstb <no-dsa> (Minor issue)
NOTE: https://github.com/nothings/stb/issues/865
NOTE: Potentially affects mame, embree, libtcod, sumo, goxel, mesa,
godot, dart
@@ -13085,9 +13085,8 @@ CVE-2019-19603 (SQLite 3.30.1 mishandles certain SELECT
statements with a nonexi
[stretch] - sqlite3 <no-dsa> (Minor issue)
NOTE:
https://github.com/sqlite/sqlite/commit/527cbd4a104cb93bf3994b3dd3619a6299a78b13
CVE-2019-19601 (OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l
because of ...)
- - texlive-bin <undetermined>
+ - texlive-bin <unfixed> (bug #949630)
NOTE: https://github.com/pkubowicz/opendetex/issues/60
- TODO: check affected, detex is embedded in src:texlive-bin but unclear
which versions affected.
CVE-2019-19600
RESERVED
CVE-2019-19599
@@ -20065,7 +20064,7 @@ CVE-2019-18428
CVE-2019-18427
RESERVED
CVE-2019-18426 (A vulnerability in WhatsApp Desktop versions prior to 0.3.9309
when pa ...)
- TODO: check
+ NOT-FOR-US: WhatsApp Desktop
CVE-2019-18425 (An issue was discovered in Xen through 4.12.x allowing 32-bit
PV guest ...)
{DSA-4602-1}
- xen 4.11.3+24-g14b62ab3e5-1 (bug #947944)
@@ -22732,9 +22731,9 @@ CVE-2019-17637
CVE-2019-17636
RESERVED
CVE-2019-17635 (Eclipse Memory Analyzer version 1.9.1 and earlier is subject
to a dese ...)
- TODO: check
+ NOT-FOR-US: Eclipse Memory Analyzer
CVE-2019-17634 (Eclipse Memory Analyzer version 1.9.1 and earlier is subject
to a cros ...)
- TODO: check
+ NOT-FOR-US: Eclipse Memory Analyzer
CVE-2019-17633 (For Eclipse Che versions 6.16 to 7.3.0, with both
authentication and T ...)
NOT-FOR-US: Eclipse Che
CVE-2019-17632 (In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022,
and 9.4. ...)
@@ -29608,7 +29607,7 @@ CVE-2019-15239 (In the Linux kernel, a certain
net/ipv4/tcp_output.c change, whi
CVE-2019-15238 (The cforms2 plugin before 15.0.2 for WordPress has CSRF
related to the ...)
NOT-FOR-US: Wordpress plugin
CVE-2019-15237 (Roundcube Webmail through 1.3.9 mishandles Punycode xn--
domain names, ...)
- - roundcube <unfixed> (low)
+ - roundcube <unfixed> (low; bug #949629)
[buster] - roundcube <no-dsa> (Minor issue)
[stretch] - roundcube <no-dsa> (Minor issue)
NOTE: https://github.com/roundcube/roundcubemail/issues/6891
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/d51e25494da963f8543ce92d6666923f79af8e70
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/d51e25494da963f8543ce92d6666923f79af8e70
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
