Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
44277987 by security tracker role at 2020-08-29T20:10:21+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,17 @@
+CVE-2020-25023
+ RESERVED
+CVE-2020-25022
+ RESERVED
+CVE-2020-25021
+ RESERVED
+CVE-2020-25020 (MPXJ through 8.1.3 allows XXE attacks. This affects the
GanttProjectRe ...)
+ TODO: check
+CVE-2020-25019 (jitsi-meet-electron (aka Jitsi Meet Electron) before 2.3.0
calls the E ...)
+ TODO: check
+CVE-2020-25018
+ RESERVED
+CVE-2020-25017
+ RESERVED
CVE-2020-25015
RESERVED
CVE-2020-25014
@@ -306,7 +320,7 @@ CVE-2020-24863
RESERVED
CVE-2020-24862
RESERVED
-CVE-2020-25016 [RUSTSEC-2020-0029: rgb: Allows viewing and modifying arbitrary
structs as bytes]
+CVE-2020-25016 (A safety violation was discovered in the rgb crate before
0.8.20 for R ...)
- rust-rgb <unfixed> (bug #969213)
NOTE: https://rustsec.org/advisories/RUSTSEC-2020-0029.html
NOTE: https://github.com/kornelski/rust-rgb/issues/35
@@ -15430,6 +15444,7 @@ CVE-2020-17355
CVE-2020-17354
RESERVED
CVE-2020-17353 (scm/define-stencil-commands.scm in LilyPond through 2.20.0,
and 2.21.x ...)
+ {DSA-4756-1}
- lilypond <unfixed> (bug #968993)
NOTE:
http://git.savannah.gnu.org/gitweb/?p=lilypond.git;a=commit;h=b84ea4740f3279516905c5db05f4074e777c16ff
CVE-2020-17352 (Two OS command injection vulnerabilities in the User Portal of
Sophos ...)
@@ -19120,7 +19135,7 @@ CVE-2020-15670
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-15670
CVE-2020-15669
RESERVED
- {DSA-4749-1 DLA-2346-1}
+ {DSA-4754-1 DSA-4749-1 DLA-2346-1}
- firefox-esr 68.12.0esr-1
- thunderbird 1:68.12.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2020-37/#CVE-2020-15669
@@ -19143,7 +19158,7 @@ CVE-2020-15665
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2020-36/#CVE-2020-15665
CVE-2020-15664
RESERVED
- {DSA-4749-1 DLA-2346-1}
+ {DSA-4754-1 DSA-4749-1 DLA-2346-1}
- firefox 80.0-1
- firefox-esr 68.12.0esr-1
- thunderbird 1:68.12.0-1
@@ -20054,12 +20069,14 @@ CVE-2020-15308 (Support Incident Tracker (aka SiT! or
SiTracker) 3.67 p2 allows
CVE-2020-15307 (Nozomi Guardian before 19.0.4 allows attackers to achieve
stored XSS ( ...)
NOT-FOR-US: Nozomi Guardian
CVE-2020-15306 (An issue was discovered in OpenEXR before v2.5.2. Invalid
chunkCount a ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.2-1
- openexr 2.5.3-2
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/738
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/6a9f8af6e89547bcd370ae3cec2b12849eee0b54
CVE-2020-15305 (An issue was discovered in OpenEXR before 2.5.2. Invalid input
could c ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.2-1
- openexr 2.5.3-2
[jessie] - openexr <no-dsa> (Minor issue)
@@ -30041,6 +30058,7 @@ CVE-2020-11767 (Istio through 1.5.1 and Envoy through
1.14.1 have a data-leak is
CVE-2020-11766 (sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX
Enterprise Web I ...)
NOT-FOR-US: iFAX AvantFAX
CVE-2020-11765 (An issue was discovered in OpenEXR before 2.4.1. There is an
off-by-on ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.0-1
- openexr 2.5.3-2 (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -30048,6 +30066,7 @@ CVE-2020-11765 (An issue was discovered in OpenEXR
before 2.4.1. There is an off
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/3eda5d70aba127bae9bd6bae9956fcf024b64031
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/2ae5f8376b0a6c3e2bb100042f5de79503ba837a
CVE-2020-11764 (An issue was discovered in OpenEXR before 2.4.1. There is an
out-of-bo ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.0-1
- openexr 2.5.3-2 (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -30055,12 +30074,14 @@ CVE-2020-11764 (An issue was discovered in OpenEXR
before 2.4.1. There is an out
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/e7c26f6ef5bf7ae8ea21ecf19963186cd1391720
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/a6408c90339bdf19f89476578d7f936b741be9b2
CVE-2020-11763 (An issue was discovered in OpenEXR before 2.4.1. There is an
std::vect ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.0-1
- openexr 2.5.3-2 (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/pull/643/commits/d0303d1785d2a8cb994efee9efa81f8ee4be4c17
CVE-2020-11762 (An issue was discovered in OpenEXR before 2.4.1. There is an
out-of-bo ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.0-1
- openexr 2.5.3-2 (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -30068,18 +30089,21 @@ CVE-2020-11762 (An issue was discovered in OpenEXR
before 2.4.1. There is an out
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/3eda5d70aba127bae9bd6bae9956fcf024b64031
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/2ae5f8376b0a6c3e2bb100042f5de79503ba837a
CVE-2020-11761 (An issue was discovered in OpenEXR before 2.4.1. There is an
out-of-bo ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.0-1
- openexr 2.5.3-2 (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/b1c34c496b62117115b1089b18a44e0031800a09
CVE-2020-11760 (An issue was discovered in OpenEXR before 2.4.1. There is an
out-of-bo ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.0-1
- openexr 2.5.3-2 (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/37750013830def57f19f3c3b7faaa9fc1dae81b3
CVE-2020-11759 (An issue was discovered in OpenEXR before 2.4.1. Because of
integer ov ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.0-1
- openexr 2.5.3-2 (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -30087,6 +30111,7 @@ CVE-2020-11759 (An issue was discovered in OpenEXR
before 2.4.1. Because of inte
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/b9997d0c045fa01af3d2e46e1a74b07cc4519446
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/acad98d6d3e787f36012a3737c23c42c7f43a00f
CVE-2020-11758 (An issue was discovered in OpenEXR before 2.4.1. There is an
out-of-bo ...)
+ {DSA-4755-1}
[experimental] - openexr 2.5.0-1
- openexr 2.5.3-2 (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -51972,8 +51997,8 @@ CVE-2020-3568
RESERVED
CVE-2020-3567
RESERVED
-CVE-2020-3566
- RESERVED
+CVE-2020-3566 (A vulnerability in the Distance Vector Multicast Routing
Protocol (DVM ...)
+ TODO: check
CVE-2020-3565
RESERVED
CVE-2020-3564
@@ -79632,7 +79657,7 @@ CVE-2019-13292 (A SQL Injection issue was discovered in
webERP 4.15. Payments.ph
CVE-2019-13291 (In Xpdf 4.01.01, there is a heap-based buffer over-read in the
functio ...)
- xpdf <not-affected> (xpdf in Debian uses poppler, which is fixed)
CVE-2019-13290 (Artifex MuPDF 1.15.0 has a heap-based buffer overflow in
fz_append_dis ...)
- {DLA-2289-1}
+ {DSA-4753-1 DLA-2289-1}
- mupdf 1.15.0+ds1-1 (bug #931475)
[jessie] - mupdf <not-affected> (Vulnerable code introduced later)
NOTE: https://bugs.ghostscript.com/show_bug.cgi?id=701118
@@ -172370,13 +172395,14 @@ CVE-2017-16909 (An error related to the
"LibRaw::panasonic_load_raw()" function
NOTE:
https://secuniaresearch.flexerasoftware.com/secunia_research/2017-19
NOTE:
https://github.com/LibRaw/LibRaw/commit/2f59bac59dbcbf6bbcf01a9f3eed74307e96ca7e
CVE-2017-16908 (In Horde Groupware 5.2.19, there is XSS via the Name field
during crea ...)
+ {DLA-2350-1}
- php-horde-kronolith 4.2.24-1 (bug #909738)
[jessie] - php-horde-kronolith <not-affected> (vulnerable code not
present)
NOTE: http://code610.blogspot.com/2017/11/rce-via-xss-horde-5219.html
NOTE: https://bugs.horde.org/ticket/14857
NOTE:
https://github.com/horde/kronolith/commit/39f740068ad21618f6f70b6e37855c61cadbd716
CVE-2017-16907 (In Horde Groupware 5.2.19 and 5.2.21, there is XSS via the
Color field ...)
- {DLA-1536-1 DLA-1535-1}
+ {DLA-2349-1 DLA-2348-1 DLA-1536-1 DLA-1535-1}
- php-horde 5.2.18+debian0-1 (bug #909739)
- php-horde-core 2.31.3+debian0-1 (bug #909800)
NOTE: http://code610.blogspot.com/2017/11/rce-via-xss-horde-5219.html
@@ -172384,7 +172410,7 @@ CVE-2017-16907 (In Horde Groupware 5.2.19 and 5.2.21,
there is XSS via the Color
NOTE: php-horde:
https://github.com/horde/base/commit/fb2113bbcd04bd4a28c46aad0889fb0a3979a230
NOTE: php-horde-core:
https://github.com/horde/Core/commit/ecea6ea740419e19122a50579ba2903c1cb71d7a
CVE-2017-16906 (In Horde Groupware 5.2.19-5.2.22, there is XSS via the URL
field in a ...)
- {DLA-1537-1}
+ {DLA-2351-1 DLA-1537-1}
- php-horde-kronolith 4.2.24-1 (bug #909737)
NOTE: http://code610.blogspot.com/2017/11/rce-via-xss-horde-5219.html
NOTE: https://bugs.horde.org/ticket/14857
@@ -177702,6 +177728,7 @@ CVE-2017-15237
CVE-2017-15236 (Tiandy IP cameras 5.56.17.120 do not properly restrict a
certain propr ...)
NOT-FOR-US: Tiandy IP cameras
CVE-2017-15235 (The File Manager (gollem) module 3.0.11 in Horde Groupware
5.2.21 allo ...)
+ {DLA-2352-1}
- php-horde-gollem 3.0.12-1
[jessie] - php-horde-gollem <no-dsa> (Minor issue)
NOTE: https://blogs.securiteam.com/index.php/archives/3454
@@ -196435,6 +196462,7 @@ CVE-2017-9116 (In OpenEXR 2.2.0, an invalid read of
size 1 in the uncompress fun
NOTE: https://www.openwall.com/lists/oss-security/2017/05/12/5
NOTE: https://github.com/openexr/openexr/issues/232
CVE-2017-9115 (In OpenEXR 2.2.0, an invalid write of size 2 in the = operator
functio ...)
+ {DSA-4755-1}
- openexr <unfixed> (bug #873885)
[stretch] - openexr <no-dsa> (Minor issue)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -196442,6 +196470,7 @@ CVE-2017-9115 (In OpenEXR 2.2.0, an invalid write of
size 2 in the = operator fu
NOTE: https://www.openwall.com/lists/oss-security/2017/05/12/5
NOTE: https://github.com/openexr/openexr/issues/232
CVE-2017-9114 (In OpenEXR 2.2.0, an invalid read of size 1 in the refill
function in ...)
+ {DSA-4755-1}
- openexr <unfixed> (bug #873885)
[stretch] - openexr <no-dsa> (Minor issue)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -196449,6 +196478,7 @@ CVE-2017-9114 (In OpenEXR 2.2.0, an invalid read of
size 1 in the refill functio
NOTE: https://www.openwall.com/lists/oss-security/2017/05/12/5
NOTE: https://github.com/openexr/openexr/issues/232
CVE-2017-9113 (In OpenEXR 2.2.0, an invalid write of size 1 in the
bufferedReadPixels ...)
+ {DSA-4755-1}
- openexr <unfixed> (low; bug #873885)
[stretch] - openexr <no-dsa> (Minor issue)
[jessie] - openexr <no-dsa> (Minor issue)
@@ -196463,6 +196493,7 @@ CVE-2017-9112 (In OpenEXR 2.2.0, an invalid read of
size 1 in the getBits functi
NOTE: https://www.openwall.com/lists/oss-security/2017/05/12/5
NOTE: https://github.com/openexr/openexr/issues/232
CVE-2017-9111 (In OpenEXR 2.2.0, an invalid write of size 8 in the storeSSE
function ...)
+ {DSA-4755-1}
- openexr <unfixed> (bug #873885)
[stretch] - openexr <no-dsa> (Minor issue)
[jessie] - openexr <no-dsa> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4427798752b153e834145ee0aa40ffaadf0f5838
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4427798752b153e834145ee0aa40ffaadf0f5838
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
