Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
8a1df16c by Moritz Muehlenhoff at 2021-05-12T22:36:10+02:00
bullseye triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -100,8 +100,9 @@ CVE-2021-3544 [vhost-user-gpu: multiple memory leaks]
NOTE:
https://lists.nongnu.org/archive/html/qemu-devel/2021-05/msg01158.html
CVE-2021-3548 [OOB in dmg2img.c memcpy() causing undefined behavior]
RESERVED
- - dmg2img <unfixed>
+ - dmg2img <unfixed> (unimportant)
NOTE: https://github.com/Lekensteyn/dmg2img/issues/9
+ NOTE: Crash in CLI tool, no security impact
CVE-2021-3543
RESERVED
CVE-2021-32575
@@ -1347,6 +1348,8 @@ CVE-2021-3534
CVE-2021-3533
RESERVED
- ansible <unfixed>
+ [bullseye] - ansible <no-dsa> (Minor issue)
+ [buster] - ansible <no-dsa> (Minor issue)
- ansible-base <unfixed>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1956477
CVE-2021-32026
@@ -1382,6 +1385,8 @@ CVE-2021-32012
CVE-2021-3532
RESERVED
- ansible <unfixed>
+ [bullseye] - ansible <no-dsa> (Minor issue)
+ [buster] - ansible <no-dsa> (Minor issue)
- ansible-base <undetermined>
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1956464
CVE-2021-3531
@@ -6912,6 +6917,7 @@ CVE-2021-3480
RESERVED
CVE-2021-3479 (There's a flaw in OpenEXR's Scanline API functionality in
versions bef ...)
- openexr <unfixed> (bug #986796)
+ [bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
[stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25370
@@ -6919,6 +6925,7 @@ CVE-2021-3479 (There's a flaw in OpenEXR's Scanline API
functionality in version
NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/830
CVE-2021-3478 (There's a flaw in OpenEXR's scanline input file functionality
in versi ...)
- openexr <unfixed> (bug #986796)
+ [bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
[stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=27409
@@ -6926,6 +6933,7 @@ CVE-2021-3478 (There's a flaw in OpenEXR's scanline input
file functionality in
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/bc88cdb6c97fbf5bc5d11ad8ca55306da931283a
CVE-2021-3477 (There's a flaw in OpenEXR's deep tile sample size calculations
in vers ...)
- openexr <unfixed> (bug #986796)
+ [bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
[stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26956
@@ -7469,18 +7477,21 @@ CVE-2021-29425 (In Apache Commons IO before 2.7, When
invoking the method FileNa
NOTE: https://issues.apache.org/jira/browse/IO-556
CVE-2021-3476 (A flaw was found in OpenEXR's B44 uncompression functionality
in versi ...)
- openexr <unfixed> (bug #986796)
+ [bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
[stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24787
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/eec0dba242bedd2778c973ae4af112107b33d9c9
CVE-2021-3475 (There is a flaw in OpenEXR in versions before 3.0.0-beta. An
attacker ...)
- openexr <unfixed> (bug #986796)
+ [bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
[stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=25297
NOTE:
https://github.com/AcademySoftwareFoundation/openexr/commit/2a18ed424a854598c2a20b5dd7e782b436a1e753
CVE-2021-3474 (There's a flaw in OpenEXR in versions before 3.0.0-beta. A
crafted inp ...)
- openexr <unfixed> (bug #986796)
+ [bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
[stretch] - openexr <postponed> (Minor issue; can be fixed in next
update)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24831
@@ -14870,6 +14881,7 @@ CVE-2021-26292
RESERVED
CVE-2021-26291 (Apache Maven will follow repositories that are defined in a
dependency ...)
- maven <unfixed> (bug #988155)
+ [bullseye] - maven <no-dsa> (Minor issue)
[buster] - maven <no-dsa> (Minor issue)
[stretch] - maven <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2021/04/23/5
@@ -27645,6 +27657,7 @@ CVE-2021-21253 (OnlineVotingSystem is an open source
project hosted on GitHub. O
NOT-FOR-US: OnlineVotingSystem
CVE-2021-21252 (The jQuery Validation Plugin provides drop-in validation for
your exis ...)
- civicrm <unfixed> (bug #980892)
+ [bullseye] - civicrm <no-dsa> (Minor issue)
- otrs2 6.0.32-4 (bug #980891)
[buster] - otrs2 <ignored> (Non-free not supported)
[stretch] - otrs2 <ignored> (Non-free not supported)
@@ -30057,6 +30070,7 @@ CVE-2021-20297 [Setting match.path and activating a
profiles crashes NetworkMana
NOTE: Fixed by:
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/420784e342da4883f6debdfe10cde68507b10d27
CVE-2021-20296 (A flaw was found in OpenEXR in versions before 3.0.0-beta. A
crafted i ...)
- openexr <unfixed> (bug #986796)
+ [bullseye] - openexr <no-dsa> (Minor issue)
[buster] - openexr <no-dsa> (Minor issue)
[stretch] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=24854
@@ -30188,6 +30202,7 @@ CVE-2021-20268 (An out-of-bounds access flaw was found
in the Linux kernel's imp
CVE-2021-20267
RESERVED
- neutron <unfixed> (bug #985104)
+ [bullseye] - neutron <no-dsa> (Minor issue)
[buster] - neutron <no-dsa> (Minor issue)
[stretch] - neutron <no-dsa> (Minor issue)
NOTE: https://bugs.launchpad.net/neutron/+bug/1902917
@@ -30633,6 +30648,7 @@ CVE-2021-20181 [9pfs: Fully restart unreclaim loop]
CVE-2021-20180
RESERVED
- ansible <unfixed> (bug #985753)
+ [bullseye] - ansible <no-dsa> (Minor issue)
[buster] - ansible <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1915808
NOTE: https://github.com/ansible-collections/community.general/pull/1635
@@ -30643,6 +30659,7 @@ CVE-2021-20179 (A flaw was found in pki-core. An
attacker who has successfully c
CVE-2021-20178 [user data leak in snmp_facts module]
RESERVED
- ansible <unfixed> (bug #985753)
+ [bullseye] - ansible <no-dsa> (Minor issue)
[buster] - ansible <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1914774
NOTE: https://github.com/ansible-collections/community.general/pull/1621
@@ -49912,6 +49929,7 @@ CVE-2020-24393 (TweetStream 2.6.1 uses the library
eventmachine in an insecure w
NOT-FOR-US: TweetStream
CVE-2020-24392 (In voloko twitter-stream 0.1.10, missing TLS hostname
validation allow ...)
- ruby-twitter-stream <unfixed>
+ [bullseye] - ruby-twitter-stream <no-dsa> (Minor issue)
[buster] - ruby-twitter-stream <no-dsa> (Minor issue)
[stretch] - ruby-twitter-stream <no-dsa> (Minor issue)
NOTE:
https://securitylab.github.com/advisories/GHSL-2020-097-voloko-twitter-stream
@@ -77405,7 +77423,8 @@ CVE-2019-20791 (OpenThread before 2019-12-13 has a
stack-based buffer overflow i
NOT-FOR-US: OpenThread
CVE-2018-21232 (re2c before 2.0 has uncontrolled recursion that causes stack
consumpti ...)
- re2c <unfixed>
- [buster] - re2c <no-dsa> (Minor issue)
+ [bullseye] - re2c <ignored> (Minor issue)
+ [buster] - re2c <ignored> (Minor issue)
[stretch] - re2c <no-dsa> (Minor issue)
[jessie] - re2c <no-dsa> (Minor issue)
NOTE: https://github.com/skvadrik/re2c/issues/219
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8a1df16c91b448f2e93e79253ef199cea0f123eb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8a1df16c91b448f2e93e79253ef199cea0f123eb
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
