Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b94bdbe7 by security tracker role at 2020-11-09T08:10:22+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,35 @@
+CVE-2020-28361
+ RESERVED
+CVE-2020-28360
+ RESERVED
+CVE-2020-28359
+ RESERVED
+CVE-2020-28358
+ RESERVED
+CVE-2020-28357
+ RESERVED
+CVE-2020-28356
+ RESERVED
+CVE-2020-28355
+ RESERVED
+CVE-2020-28354
+ RESERVED
+CVE-2020-28353
+ RESERVED
+CVE-2020-28352
+ RESERVED
+CVE-2020-28351 (The conferencing component on Mitel ShoreTel 19.46.1802.0
devices coul ...)
+ TODO: check
+CVE-2020-28350
+ RESERVED
+CVE-2020-28349 (** DISPUTED ** An inaccurate frame deduplication process in
ChirpStack ...)
+ TODO: check
+CVE-2020-28348
+ RESERVED
+CVE-2020-28347 (tdpServer on TP-Link Archer A7 AC1750 devices before 201029
allows rem ...)
+ TODO: check
+CVE-2020-28346
+ RESERVED
CVE-2020-28345 (An issue was discovered on LG mobile devices with Android OS
10 softwa ...)
NOT-FOR-US: LG mobile devices
CVE-2020-28344 (An issue was discovered on LG mobile devices with Android OS
8.0, 8.1, ...)
@@ -10691,24 +10723,24 @@ CVE-2020-24410 (Adobe Illustrator version 24.2 (and
earlier) is affected by an o
NOT-FOR-US: Adobe
CVE-2020-24409 (Adobe Illustrator version 24.2 (and earlier) is affected by an
out-of- ...)
NOT-FOR-US: Adobe
-CVE-2020-24408 (New description: Magento versions 2.4.0 and 2.3.5p2 (and
earlier) are ...)
+CVE-2020-24408 (Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected
by a per ...)
NOT-FOR-US: Magento
-CVE-2020-24407
- RESERVED
-CVE-2020-24406
- RESERVED
-CVE-2020-24405
- RESERVED
-CVE-2020-24404
- RESERVED
-CVE-2020-24403
- RESERVED
-CVE-2020-24402
- RESERVED
-CVE-2020-24401
- RESERVED
-CVE-2020-24400
- RESERVED
+CVE-2020-24407 (Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected
by an un ...)
+ TODO: check
+CVE-2020-24406 (When in maintenance mode, Magento version 2.4.0 and 2.3.4 (and
earlier ...)
+ TODO: check
+CVE-2020-24405 (Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected
by an inc ...)
+ TODO: check
+CVE-2020-24404 (Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected
by an inc ...)
+ TODO: check
+CVE-2020-24403 (Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected
by an inc ...)
+ TODO: check
+CVE-2020-24402 (Magento version 2.4.0 and 2.3.5p1 (and earlier) are affected
by an inc ...)
+ TODO: check
+CVE-2020-24401 (Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected
by an in ...)
+ TODO: check
+CVE-2020-24400 (Magento versions 2.4.0 and 2.3.5 (and earlier) are affected by
an SQL ...)
+ TODO: check
CVE-2020-24399
RESERVED
CVE-2020-24398
@@ -84858,6 +84890,7 @@ CVE-2019-14496 (LoaderXM::load in LoaderXM.cpp in
milkyplay in MilkyTracker 1.02
CVE-2019-14495 (webadmin.c in 3proxy before 0.8.13 has an out-of-bounds write
in the a ...)
- 3proxy <itp> (bug #718219)
CVE-2019-14494 (An issue was discovered in Poppler through 0.78.0. There is a
divide-b ...)
+ {DLA-2440-1}
[experimental] - poppler 0.81.0-1
- poppler 0.85.0-2 (bug #933812)
[buster] - poppler <ignored> (Minor issue)
@@ -99046,6 +99079,7 @@ CVE-2019-10020 (An issue was discovered in Xpdf
4.01.01. There is an FPE in the
CVE-2019-10019 (An issue was discovered in Xpdf 4.01.01. There is an FPE in
the functi ...)
- xpdf <not-affected> (xpdf in Debian uses poppler, which is not
affected or fixed)
CVE-2019-10018 (An issue was discovered in Xpdf 4.01.01. There is an FPE in
the functi ...)
+ {DLA-2440-1}
- poppler 0.57.0-2 (low; bug #926133)
[jessie] - poppler <ignored> (Minor issue)
NOTE: https://forum.xpdfreader.com/viewtopic.php?f=3&t=41276
(PostScriptFunction::[email protected]:1374-42___FPE PoC)
@@ -99168,7 +99202,7 @@ CVE-2019-9961 (A cross-site scripting (XSS)
vulnerability in ressource view in c
CVE-2019-9960 (The downloadZip function in
application/controllers/admin/export.php i ...)
- limesurvey <itp> (bug #472802)
CVE-2019-9959 (The JPXStream::init function in Poppler 0.78.0 and earlier
doesn't che ...)
- {DLA-1963-1}
+ {DLA-2440-1 DLA-1963-1}
[experimental] - poppler 0.81.0-1
- poppler 0.85.0-2 (low; bug #941776)
[buster] - poppler <ignored> (Minor issue)
@@ -107384,7 +107418,7 @@ CVE-2019-7312 (Limited plaintext disclosure exists in
PRIMX Zed Entreprise for W
CVE-2019-7311 (An issue was discovered on Linksys WRT1900ACS 1.0.3.187766
devices. A ...)
NOT-FOR-US: Linksys
CVE-2019-7310 (In Poppler 0.73.0, a heap-based buffer over-read (due to an
integer si ...)
- {DLA-1706-1}
+ {DLA-2440-1 DLA-1706-1}
- poppler 0.71.0-4 (bug #921215)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=12797
NOTE: https://gitlab.freedesktop.org/poppler/poppler/issues/717
@@ -116449,7 +116483,7 @@ CVE-2018-20664 (Zoho ManageEngine ADSelfService Plus
5.x before build 5701 has X
CVE-2018-20663 (The Reporting Addon (aka Reports Addon) through 2019-01-02 for
CUBA Pl ...)
NOT-FOR-US: Reporting Addon for CUBA Platform
CVE-2018-20662 (In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers
to caus ...)
- {DLA-1706-1}
+ {DLA-2440-1 DLA-1706-1}
- poppler 0.71.0-4 (low; bug #918158)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/issues/706
NOTE:
https://gitlab.freedesktop.org/poppler/poppler/commit/7b4e372deeb716eb3fe3a54b31ed41af759224f9
@@ -116674,7 +116708,7 @@ CVE-2018-20651 (A NULL pointer dereference was
discovered in elf_link_add_object
NOTE:
https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=54025d5812ff100f5f0654eb7e1ffd50f2e37f5f
NOTE: binutils not covered by security support
CVE-2018-20650 (A reachable Object::dictLookup assertion in Poppler 0.72.0
allows atta ...)
- {DLA-1939-1}
+ {DLA-2440-1 DLA-1939-1}
[experimental] - poppler 0.81.0-1
- poppler 0.85.0-2 (low; bug #917974)
[buster] - poppler <ignored> (Minor issue)
@@ -128788,7 +128822,7 @@ CVE-2018-19059 (An issue was discovered in Poppler
0.71.0. There is a out-of-bou
NOTE:
https://gitlab.freedesktop.org/poppler/poppler/commit/77a30e94d96220d7e22dff5b3f0a7f296f01b118
(poppler-0.72.0)
NOTE: Issue in pdfdetach cli tool leading to crash
CVE-2018-19058 (An issue was discovered in Poppler 0.71.0. There is a
reachable abort ...)
- {DLA-1706-1}
+ {DLA-2440-1 DLA-1706-1}
[experimental] - poppler 0.81.0-1
- poppler 0.85.0-2 (low; bug #913177)
[buster] - poppler <ignored> (Minor issue)
@@ -189013,6 +189047,7 @@ CVE-2017-14929 (In Poppler 0.59.0, memory corruption
occurs in a call to Object:
NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=102969
NOTE:
https://cgit.freedesktop.org/poppler/poppler/commit/?id=2c92c7b6a828c9db8a38f079ea7a3d51c12a481d
CVE-2017-14928 (In Poppler 0.59.0, a NULL Pointer Dereference exists in
AnnotRichMedia ...)
+ {DLA-2440-1}
- poppler 0.61.1-2 (low; bug #877231)
[jessie] - poppler <not-affected> (Problematic code introduced in 0.36)
[wheezy] - poppler <not-affected> (Problematic code introduced in 0.36)
@@ -189026,6 +189061,7 @@ CVE-2017-14927 (In Poppler 0.59.0, a NULL Pointer
Dereference exists in the Spla
NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=102604
NOTE:
https://cgit.freedesktop.org/poppler/poppler/commit/?id=6472d8493f7e82cc78b41da20a2bf19fcb4e0a7d
CVE-2017-14926 (In Poppler 0.59.0, a NULL Pointer Dereference exists in
AnnotRichMedia ...)
+ {DLA-2440-1}
- poppler 0.61.1-2 (low; bug #877239)
[jessie] - poppler <not-affected> (Problematic code introduced in 0.36)
[wheezy] - poppler <not-affected> (Problematic code introduced in 0.36)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b94bdbe7a102c8bf9a2a286abf3ab55eb8fcfe2d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b94bdbe7a102c8bf9a2a286abf3ab55eb8fcfe2d
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
