Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5f1a9760 by Moritz Muehlenhoff at 2020-07-14T11:10:24+02:00
stable triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1737,6 +1737,7 @@ CVE-2020-14930 (An issue was discovered in BT CTROMS
Terminal OS Port Portal CT-
NOT-FOR-US: BT CTROMS Terminal OS Port Portal CT-464
CVE-2019-20892 (net-snmp before 5.8.1.pre1 has a double free in
usm_free_usmStateRefer ...)
- net-snmp 5.8+dfsg-3 (bug #963713)
+ [buster] - net-snmp <no-dsa> (Minor issue)
[stretch] - net-snmp <not-affected> (Vulnerable code introduced later)
NOTE: https://www.openwall.com/lists/oss-security/2020/06/25/4
NOTE: https://bugs.launchpad.net/ubuntu/+source/net-snmp/+bug/1877027
@@ -3372,6 +3373,7 @@ CVE-2020-14304 [ethtool when reading eeprom of device
could lead to memory leak]
- linux <unfixed> (bug #960702)
CVE-2020-14303 (A flaw was found in the AD DC NBT server in all Samba versions
before ...)
- samba 2:4.12.5+dfsg-1
+ [buster] - samba <postponed> (Minor issue, fix along in next DSA)
NOTE: https://www.samba.org/samba/security/CVE-2020-14303.html
CVE-2020-14302
RESERVED
@@ -4022,6 +4024,7 @@ CVE-2020-14041
CVE-2020-14040 (The x/text package before 0.3.3 for Go has a vulnerability in
encoding ...)
- golang-golang-x-text 0.3.3-1 (bug #964272)
- golang-x-text <unfixed> (bug #964271)
+ [buster] - golang-x-text <no-dsa> (Minor issue)
NOTE: https://github.com/golang/go/issues/39491
NOTE:
https://go.googlesource.com/text/+/23ae387dee1f90d29a23c0e87ee0b46038fbed0e
NOTE:
https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0
@@ -7313,6 +7316,7 @@ CVE-2020-12696 (The iframe plugin before 4.5 for
WordPress does not sanitize a U
NOT-FOR-US: iframe plugin for WordPress
CVE-2020-12695 (The Open Connectivity Foundation UPnP specification before
2020-04-17 ...)
- wpa <unfixed>
+ [buster] - wpa <no-dsa> (Minor issue)
- gupnp 1.2.3-1
NOTE:
https://w1.fi/security/2020-1/upnp-subscribe-misbehavior-wps-ap.txt
NOTE:
https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch
@@ -12841,7 +12845,8 @@ CVE-2020-10995 (PowerDNS Recursor from 4.1.0 up to and
including 4.3.0 does not
NOTE:
https://docs.powerdns.com/recursor/security-advisories/powerdns-advisory-2020-01.html
NOTE: https://www.openwall.com/lists/oss-security/2020/05/19/3
CVE-2020-10994 (In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are
multipl ...)
- - pillow <unfixed>
+ - pillow <unfixed> (low)
+ [buster] - pillow <no-dsa> (Minor issue)
[jessie] - pillow <no-dsa> (Minor issue)
NOTE: https://github.com/python-pillow/Pillow/pull/4505
NOTE: https://github.com/python-pillow/Pillow/pull/4538
@@ -13697,6 +13702,7 @@ CVE-2020-10761 (An assertion failure issue was found in
the Network Block Device
NOTE: Introduced in:
https://git.qemu.org/?p=qemu.git;a=commit;h=93676c88d7a5cd5971de94f9091eff8e9773b1af
CVE-2020-10760 (A use-after-free flaw was found in all samba LDAP server
versions befo ...)
- samba 2:4.12.5+dfsg-1
+ [buster] - samba <postponed> (Minor issue, fix along in next DSA)
NOTE: https://www.samba.org/samba/security/CVE-2020-10760.html
CVE-2020-10759 [Possible bypass in signature verification]
RESERVED
@@ -13767,6 +13773,7 @@ CVE-2020-10746
RESERVED
CVE-2020-10745 (A flaw was found in all Samba versions before 4.10.17, before
4.11.11 ...)
- samba 2:4.12.5+dfsg-1
+ [buster] - samba <postponed> (Minor issue, fix along in next DSA)
NOTE: https://www.samba.org/samba/security/CVE-2020-10745.html
CVE-2020-10744 (An incomplete fix was found for the fix of the flaw
CVE-2020-1733 ansi ...)
- ansible <unfixed>
@@ -13821,6 +13828,7 @@ CVE-2020-10731
CVE-2020-10730 (A NULL pointer dereference, or possible use-after-free flaw
was found ...)
- ldb 2:2.1.4-1
- samba 2:4.12.5+dfsg-1
+ [buster] - samba <postponed> (Minor issue, fix along in next DSA)
[stretch] - ldb <not-affected> (Vulnerable code introduced later)
NOTE: https://www.samba.org/samba/security/CVE-2020-10730.html
NOTE:
https://git.samba.org/?p=samba.git;a=commitdiff;h=9dd458956d7af1b4bbe505ba2ab72235e81c27d0
(for ldb)
@@ -14022,6 +14030,7 @@ CVE-2020-10684 (A flaw was found in Ansible Engine, all
versions 2.7.x, 2.8.x an
CVE-2020-10683 (dom4j before 2.1.3 allows external DTDs and External Entities
by defau ...)
{DLA-2191-1}
- dom4j <unfixed> (bug #958055)
+ [buster] - dom4j <no-dsa> (Minor issue)
NOTE:
https://github.com/dom4j/dom4j/commit/1707bf3d898a8ada3b213acb0e3b38f16eaae73d
(the fix?)
NOTE:
https://github.com/dom4j/dom4j/commit/a8228522a99a02146106672a34c104adbda5c658
(post-fix refactor?)
CVE-2020-10682 (The Filemanager in CMS Made Simple 2.2.13 allows remote code
execution ...)
@@ -16775,6 +16784,7 @@ CVE-2020-9490
RESERVED
CVE-2020-9489 (A carefully crafted or corrupt file may trigger a System.exit
in Tika' ...)
- tika <unfixed>
+ [buster] - tika <no-dsa> (Minor issue)
[jessie] - tika <ignored> (the fix is too invasive to backport)
NOTE: https://www.openwall.com/lists/oss-security/2020/04/24/1
CVE-2020-9488 (Improper validation of certificate with host mismatch in Apache
Log4j ...)
@@ -36303,6 +36313,7 @@ CVE-2020-1954 (Apache CXF has the ability to integrate
with JMX by registering a
NOT-FOR-US: Apache CXF
CVE-2020-1953 (Apache Commons Configuration uses a third-party library to
parse YAML ...)
- commons-configuration2 2.7-1 (bug #954713)
+ [buster] - commons-configuration2 <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2020/03/13/1
CVE-2020-1952 (An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to
0.8.2. W ...)
NOT-FOR-US: Apache IoTDB
@@ -51091,6 +51102,7 @@ CVE-2019-15609 (The kill-port-process package version
< 2.2.0 is vulnerable t
NOT-FOR-US: Node kill-port-process
CVE-2019-15608 (The package integrity validation in yarn < 1.19.0 contains
a TOCTOU ...)
- node-yarnpkg 1.19.1-1
+ [buster] - node-yarnpkg <no-dsa> (Minor issue)
NOTE: https://hackerone.com/reports/703138
CVE-2019-15607 (A stored XSS vulnerability is present within node-red
(version: <= ...)
NOT-FOR-US: node-red
@@ -121114,6 +121126,7 @@ CVE-2018-10757 (CSP MySQL User Manager 2.3.1 allows
SQL injection, and resultant
CVE-2018-10756 (Use-after-free in libtransmission/variant.c in Transmission
before 3.0 ...)
{DLA-2218-1}
- transmission 3.00-1 (bug #961461)
+ [buster] - transmission <no-dsa> (Minor issue, will be fixed via spu)
NOTE:
https://github.com/transmission/transmission/commit/2123adf8e5e1c2b48791f9d22fc8c747e974180e
(3.00)
NOTE: https://tomrichards.net/2020/05/cve-2018-10756-transmission/
CVE-2018-10755
@@ -147948,6 +147961,7 @@ CVE-2018-1312 (In Apache httpd 2.2.0 to 2.4.29, when
generating an HTTP Digest a
NOTE: http://www.openwall.com/lists/oss-security/2018/03/24/7
CVE-2018-1311 (The Apache Xerces-C 3.0.0 to 3.2.2 XML parser contains a
use-after-fre ...)
- xerces-c <unfixed> (bug #947431)
+ [buster] - xerces-c <postponed> (Minor issue, revisit when fixed
upstream)
[jessie] - xerces-c <postponed> (slow upstream interest, proper fix
likely to break ABI compatibility)
NOTE: http://xerces.apache.org/xerces-c/secadv/CVE-2018-1311.txt
NOTE: https://issues.apache.org/jira/browse/XERCESC-2188
=====================================
data/dsa-needed.txt
=====================================
@@ -22,6 +22,8 @@ knot-resolver
linux (carnil)
Wait until more issues have piled up
--
+nginx
+--
nss (jmm)
--
poppler (jmm)
@@ -29,6 +31,8 @@ poppler (jmm)
rails
Sylvain Beucler proposed to help for the update, pending upstream feedback
for CVE-2020-8163
--
+redis
+--
ruby-sanitize
--
squid (jmm)
@@ -40,3 +44,5 @@ xcftools
--
xen
--
+xrdp
+--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5f1a9760562ff7335bf1423e70fb71e6758f711a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5f1a9760562ff7335bf1423e70fb71e6758f711a
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
