Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
39b30653 by Salvatore Bonaccorso at 2020-03-29T17:17:27+02:00
Fix source package ordering for old CVE-2016-5319
- - - - -
a3f567d2 by Salvatore Bonaccorso at 2020-03-29T17:18:49+02:00
Update information on CVE-2017-17942
Mark the issue as unimportant as it had negligible security impact in
the bmp2tiff tool, which furthermore was not anymore installed since
4.0.6-3.
Add reference to the "new" upstream issue after bugzilla moved entries
to gitlab issues.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -126844,14 +126844,14 @@ CVE-2017-17944 (The ASUS Vivobaby application
before 1.1.09 for Android has Miss
CVE-2017-17943
RESERVED
CVE-2017-17942 (In LibTIFF 4.0.9, there is a heap-based buffer over-read in
the functi ...)
- - tiff <unfixed> (low; bug #885579)
- [buster] - tiff <postponed> (Minor issue, revisit once fixed upstream)
- [stretch] - tiff <postponed> (Minor issue, revisit once fixed upstream)
- [jessie] - tiff <postponed> (Minor issue, revisit once fixed upstream)
- [wheezy] - tiff <postponed> (Minor issue, revisit once fixed upstream)
- - tiff3 <removed>
- [wheezy] - tiff3 <postponed> (Minor issue, revisit once fixed upstream)
+ - tiff 4.0.6-3 (unimportant; bug #885579)
+ [jessie] - tiff 4.0.3-12.3+deb8u2
+ - tiff3 <removed> (unimportant)
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2767
+ NOTE: https://gitlab.com/libtiff/libtiff/issues/120
+ NOTE: No patch available. Marked as wontfix by upstream.
+ NOTE: bmp2tiff was removed in 4.0.6-3 and DSA 3762, marking as fixed
+ NOTE: although technically still present in the source package.
CVE-2017-17941 (PHP Scripts Mall Single Theater Booking has SQL Injection via
the admi ...)
NOT-FOR-US: PHP Scripts Mall Single Theater Booking
CVE-2017-17940 (PHP Scripts Mall Single Theater Booking has XSS via the title
paramete ...)
@@ -202504,8 +202504,8 @@ CVE-2014-9855
CVE-2016-5319 (Heap-based buffer overflow in tif_packbits.c in libtiff 4.0.6
and earl ...)
{DLA-693-1}
- tiff 4.0.6-3 (bug #842046)
- - tiff3 <removed>
[jessie] - tiff 4.0.3-12.3+deb8u2
+ - tiff3 <removed>
[wheezy] - tiff3 <not-affected> (tools like bmp2tiff not shipped by
tiff3 source package)
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2562
NOTE: Reproducer http://bugzilla.maptools.org/attachment.cgi?id=652
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/dcc7227524badfbd2d6aea33b9c6c397d4f007fe...a3f567d2b97d0418c96710622512f79385924d5f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/dcc7227524badfbd2d6aea33b9c6c397d4f007fe...a3f567d2b97d0418c96710622512f79385924d5f
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
