Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d931bf1f by security tracker role at 2021-08-25T20:10:35+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,67 @@
+CVE-2021-40141
+ RESERVED
+CVE-2021-40140
+ RESERVED
+CVE-2021-40139
+ RESERVED
+CVE-2021-40138
+ RESERVED
+CVE-2021-40137
+ RESERVED
+CVE-2021-40136
+ RESERVED
+CVE-2021-40135
+ RESERVED
+CVE-2021-40134
+ RESERVED
+CVE-2021-40133
+ RESERVED
+CVE-2021-40132
+ RESERVED
+CVE-2021-40131
+ RESERVED
+CVE-2021-40130
+ RESERVED
+CVE-2021-40129
+ RESERVED
+CVE-2021-40128
+ RESERVED
+CVE-2021-40127
+ RESERVED
+CVE-2021-40126
+ RESERVED
+CVE-2021-40125
+ RESERVED
+CVE-2021-40124
+ RESERVED
+CVE-2021-40123
+ RESERVED
+CVE-2021-40122
+ RESERVED
+CVE-2021-40121
+ RESERVED
+CVE-2021-40120
+ RESERVED
+CVE-2021-40119
+ RESERVED
+CVE-2021-40118
+ RESERVED
+CVE-2021-40117
+ RESERVED
+CVE-2021-40116
+ RESERVED
+CVE-2021-40115
+ RESERVED
+CVE-2021-40114
+ RESERVED
+CVE-2021-40113
+ RESERVED
+CVE-2021-40112
+ RESERVED
+CVE-2021-40111
+ RESERVED
+CVE-2021-40110
+ RESERVED
CVE-2021-40109
RESERVED
CVE-2021-40108
@@ -1871,8 +1935,7 @@ CVE-2021-39232
RESERVED
CVE-2021-39231
RESERVED
-CVE-2021-3713 [out-of-bounds write in UAS (USB Attached SCSI) device emulation]
- RESERVED
+CVE-2021-3713 (An out-of-bounds write flaw was found in the UAS (USB Attached
SCSI) d ...)
- qemu <unfixed> (bug #992727)
[bullseye] - qemu <no-dsa> (Minor issue)
[buster] - qemu <no-dsa> (Minor issue)
@@ -2017,10 +2080,10 @@ CVE-2021-39162
RESERVED
CVE-2021-39161
RESERVED
-CVE-2021-39160
- RESERVED
-CVE-2021-39159
- RESERVED
+CVE-2021-39160 (nbgitpuller is a Jupyter server extension to sync a git
repository one ...)
+ TODO: check
+CVE-2021-39159 (BinderHub is a kubernetes-based cloud service that allows
users to sha ...)
+ TODO: check
CVE-2021-39158 (NVCaffe's python required dependencies list used to contain
`gfortran` ...)
TODO: check
CVE-2021-39157 (detect-character-encoding is an open source character encoding
inspect ...)
@@ -2093,8 +2156,8 @@ CVE-2021-39138 (Parse Server is an open source backend
that can be deployed to a
NOT-FOR-US: Parse Server
CVE-2021-39137 (go-ethereum is the official Go implementation of the Ethereum
protocol ...)
TODO: check
-CVE-2021-39136
- RESERVED
+CVE-2021-39136 (baserCMS is an open source content management system with a
focus on J ...)
+ TODO: check
CVE-2021-39135
RESERVED
CVE-2021-39134
@@ -12094,8 +12157,7 @@ CVE-2021-34697
RESERVED
CVE-2021-34696
RESERVED
-CVE-2021-3605 [Heap buffer overflow in the rleUncompress function]
- RESERVED
+CVE-2021-3605 (There's a flaw in OpenEXR's rleUncompress functionality in
versions pr ...)
{DLA-2732-1}
- openexr <unfixed> (bug #990899)
[buster] - openexr <no-dsa> (Minor issue)
@@ -13961,16 +14023,16 @@ CVE-2017-20005 (NGINX before 1.13.6 has a buffer
overflow for years that exceed
NOTE: https://trac.nginx.org/nginx/ticket/1368
CVE-2021-33887 (Insufficient verification of data authenticity in Peloton
TTR01 up to ...)
NOT-FOR-US: Peloton TTR01
-CVE-2021-33886
- RESERVED
-CVE-2021-33885
- RESERVED
-CVE-2021-33884
- RESERVED
-CVE-2021-33883
- RESERVED
-CVE-2021-33882
- RESERVED
+CVE-2021-33886 (An improper sanitization of input vulnerability in B. Braun
SpaceCom2 ...)
+ TODO: check
+CVE-2021-33885 (An Insufficient Verification of Data Authenticity
vulnerability in B. ...)
+ TODO: check
+CVE-2021-33884 (An Unrestricted Upload of File with Dangerous Type
vulnerability in B. ...)
+ TODO: check
+CVE-2021-33883 (A Cleartext Transmission of Sensitive Information
vulnerability in B. ...)
+ TODO: check
+CVE-2021-33882 (A Missing Authentication for Critical Function vulnerability
in B. Bra ...)
+ TODO: check
CVE-2021-33881 (On NXP MIFARE Ultralight and NTAG cards, an attacker can
interrupt a w ...)
NOT-FOR-US: NXP
CVE-2021-33880 (The aaugustin websockets library before 9.1 for Python has an
Observab ...)
@@ -14660,8 +14722,8 @@ CVE-2021-33607
RESERVED
CVE-2021-33606
RESERVED
-CVE-2021-33605
- RESERVED
+CVE-2021-33605 (Improper check in CheckboxGroup in
com.vaadin:vaadin-checkbox-flow ver ...)
+ TODO: check
CVE-2021-33604 (URL encoding error in development mode handler in
com.vaadin:flow-serv ...)
NOT-FOR-US: com.vaadin:flow-server
CVE-2021-33603
@@ -15452,7 +15514,7 @@ CVE-2021-33258
RESERVED
CVE-2021-33257
RESERVED
-CVE-2021-33256 (A CSV injection vulnerability on the login panel of
ManageEngine ADSel ...)
+CVE-2021-33256 (** DISPUTED ** A CSV injection vulnerability on the login
panel of Man ...)
NOT-FOR-US: ManageEngine
CVE-2021-33255
RESERVED
@@ -16076,8 +16138,8 @@ CVE-2021-33017
RESERVED
CVE-2021-33016
RESERVED
-CVE-2021-33015
- RESERVED
+CVE-2021-33015 (Cscape (All Versions prior to 9.90 SP5) lacks proper
validation of use ...)
+ TODO: check
CVE-2021-33014
RESERVED
CVE-2021-33013
@@ -16116,8 +16178,8 @@ CVE-2021-32997
RESERVED
CVE-2021-32996
RESERVED
-CVE-2021-32995
- RESERVED
+CVE-2021-32995 (Cscape (All Versions prior to 9.90 SP5) lacks proper
validation of use ...)
+ TODO: check
CVE-2021-32994
RESERVED
CVE-2021-32993
@@ -16156,8 +16218,8 @@ CVE-2021-32977
RESERVED
CVE-2021-32976
RESERVED
-CVE-2021-32975
- RESERVED
+CVE-2021-32975 (Cscape (All Versions prior to 9.90 SP5) lacks proper
validation of use ...)
+ TODO: check
CVE-2021-32974
RESERVED
CVE-2021-32973
@@ -18612,8 +18674,8 @@ CVE-2021-31991
RESERVED
CVE-2021-31990
RESERVED
-CVE-2021-31989
- RESERVED
+CVE-2021-31989 (A user with permission to log on to the machine hosting the
AXIS Devic ...)
+ TODO: check
CVE-2021-31988
RESERVED
CVE-2021-31987
@@ -42402,8 +42464,8 @@ CVE-2021-22258
RESERVED
CVE-2021-22257
RESERVED
-CVE-2021-22256
- RESERVED
+CVE-2021-22256 (Improper authorization in GitLab CE/EE affecting all versions
since 12 ...)
+ TODO: check
CVE-2021-22255 (SSRF in URL file upload in Baserow <1.1.0 allows remote
authenticat ...)
NOT-FOR-US: Baserow
CVE-2021-22254 (Under very specific conditions a user could be impersonated
using Gitl ...)
@@ -42414,24 +42476,24 @@ CVE-2021-22252 (A confusion between tag and branch
names in GitLab CE/EE affecti
- gitlab <not-affected> (Vulnerable code introduced later)
CVE-2021-22251 (Improper validation of invited users' email address in GitLab
EE affec ...)
TODO: check
-CVE-2021-22250
- RESERVED
+CVE-2021-22250 (Improper authorization in GitLab CE/EE affecting all versions
since 13 ...)
+ TODO: check
CVE-2021-22249 (A verbose error message in GitLab EE affecting all versions
since 12.2 ...)
TODO: check
CVE-2021-22248 (Improper authorization on the pipelines page in GitLab CE/EE
affecting ...)
- gitlab <not-affected> (Vulnerable code intrododuced later)
-CVE-2021-22247
- RESERVED
+CVE-2021-22247 (Improper authorization in GitLab CE/EE affecting all versions
since 13 ...)
+ TODO: check
CVE-2021-22246 (A vulnerability was discovered in GitLab versions before
14.0.2, 13.12 ...)
- gitlab <unfixed>
-CVE-2021-22245
- RESERVED
-CVE-2021-22244
- RESERVED
-CVE-2021-22243
- RESERVED
-CVE-2021-22242
- RESERVED
+CVE-2021-22245 (Improper validation of commit author in GitLab CE/EE affecting
all ver ...)
+ TODO: check
+CVE-2021-22244 (Improper authorization in the vulnerability report feature in
GitLab E ...)
+ TODO: check
+CVE-2021-22243 (Under specialized conditions, GitLab CE/EE versions starting
7.10 may ...)
+ TODO: check
+CVE-2021-22242 (Insufficient input sanitization in Mermaid markdown in GitLab
CE/EE ve ...)
+ TODO: check
CVE-2021-22241 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- gitlab <unfixed>
CVE-2021-22240 (Improper access control in GitLab EE versions 13.11.6,
13.12.6, and 14 ...)
@@ -42442,12 +42504,10 @@ CVE-2021-22239
NOTE:
https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/
CVE-2021-22238 (An issue has been discovered in GitLab affecting all versions
starting ...)
- gitlab <unfixed>
-CVE-2021-22237
- RESERVED
+CVE-2021-22237 (Under specialized conditions, GitLab may allow a user with an
imperson ...)
- gitlab <unfixed>
NOTE:
https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/
-CVE-2021-22236
- RESERVED
+CVE-2021-22236 (Due to improper handling of OAuth client IDs, new
subscriptions genera ...)
- gitlab <unfixed>
NOTE:
https://about.gitlab.com/releases/2021/08/03/security-release-gitlab-14-1-2-released/
CVE-2021-22235 (Crash in DNP dissector in Wireshark 3.4.0 to 3.4.6 and 3.2.0
to 3.2.14 ...)
@@ -43275,11 +43335,11 @@ CVE-2021-21871 (A memory corruption vulnerability
exists in the DMG File Format
NOT-FOR-US: PowerISO
CVE-2021-21870 (A use-after-free vulnerability exists in the JavaScript engine
of Foxi ...)
NOT-FOR-US: Foxit
-CVE-2021-21869
- RESERVED
-CVE-2021-21868 (A unsafe deserialization vulnerability exists in the
ObjectManager.plu ...)
+CVE-2021-21869 (An unsafe deserialization vulnerability exists in the
Engine.plugin Pr ...)
+ TODO: check
+CVE-2021-21868 (An unsafe deserialization vulnerability exists in the
ObjectManager.pl ...)
NOT-FOR-US: CODESYS
-CVE-2021-21867 (A unsafe deserialization vulnerability exists in the
ObjectManager.plu ...)
+CVE-2021-21867 (An unsafe deserialization vulnerability exists in the
ObjectManager.pl ...)
NOT-FOR-US: CODESYS
CVE-2021-21866 (A unsafe deserialization vulnerability exists in the
ObjectManager.plu ...)
NOT-FOR-US: CODESYS
@@ -43362,22 +43422,19 @@ CVE-2021-21851 (Multiple exploitable integer overflow
vulnerabilities exist with
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21850
- RESERVED
+CVE-2021-21850 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <unfixed>
[buster] - gpac <not-affected> (Vulnerable code not present)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21849
- RESERVED
+CVE-2021-21849 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <unfixed>
[buster] - gpac <not-affected> (Vulnerable code not present)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21848
- RESERVED
+CVE-2021-21848 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <unfixed>
[buster] - gpac <not-affected> (Vulnerable code not present)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
@@ -43413,22 +43470,19 @@ CVE-2021-21843 (Multiple exploitable integer overflow
vulnerabilities exist with
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21842
- RESERVED
+CVE-2021-21842 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <unfixed>
[buster] - gpac <not-affected> (Vulnerable code not present)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21841
- RESERVED
+CVE-2021-21841 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <unfixed>
[buster] - gpac <not-affected> (Vulnerable code not present)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21840
- RESERVED
+CVE-2021-21840 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <unfixed>
[buster] - gpac <not-affected> (Vulnerable code not present)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
@@ -43452,22 +43506,19 @@ CVE-2021-21837 (Multiple exploitable integer overflow
vulnerabilities exist with
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21836
- RESERVED
+CVE-2021-21836 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <unfixed>
[buster] - gpac <not-affected> (Vulnerable code not present)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21835
- RESERVED
+CVE-2021-21835 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <not-affected> (Vulnerable code not present)
NOTE: Introduced in
https://github.com/gpac/gpac/commit/0f9761c48541bc01f0c619b7d02916d28e87dea9
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
NOTE:
https://github.com/gpac/gpac/commit/b515fd04f5f00f4a99df741042f1efb31ad56351
NOTE: https://github.com/gpac/gpac/issues/1814
-CVE-2021-21834
- RESERVED
+CVE-2021-21834 (An exploitable integer overflow vulnerability exists within
the MPEG-4 ...)
- gpac <unfixed>
[buster] - gpac <not-affected> (Vulnerable code not present)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1297
@@ -43600,8 +43651,8 @@ CVE-2021-21779 (A use-after-free vulnerability exists
in the way Webkit’s
- wpewebkit 2.32.3-1
[bullseye] - wpewebkit <postponed> (Minor issue, fix along with next
update)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2021-1238
-CVE-2021-21778
- RESERVED
+CVE-2021-21778 (A denial of service vulnerability exists in the ASDU message
processin ...)
+ TODO: check
CVE-2021-21777 (An information disclosure vulnerability exists in the
Ethernet/IP UDP ...)
NOT-FOR-US: EIP Stack Group OpENer
CVE-2021-21776 (An out-of-bounds write vulnerability exists in the SGI Format
Buffer S ...)
@@ -79921,18 +79972,18 @@ CVE-2020-18978
RESERVED
CVE-2020-18977
RESERVED
-CVE-2020-18976
- RESERVED
+CVE-2020-18976 (Buffer Overflow in Tcpreplay v4.3.2 allows attackers to cause
a Denial ...)
+ TODO: check
CVE-2020-18975
RESERVED
-CVE-2020-18974
- RESERVED
+CVE-2020-18974 (Buffer Overflow in Netwide Assembler (NASM) v2.15.xx allows
attackers ...)
+ TODO: check
CVE-2020-18973
RESERVED
-CVE-2020-18972
- RESERVED
-CVE-2020-18971
- RESERVED
+CVE-2020-18972 (Exposure of Sensitive Information to an Unauthorized Actor in
PoDoFo v ...)
+ TODO: check
+CVE-2020-18971 (Stack-based Buffer Overflow in PoDoFo v0.9.6 allows attackers
to cause ...)
+ TODO: check
CVE-2020-18970
RESERVED
CVE-2020-18969
@@ -210511,8 +210562,8 @@ CVE-2018-10792
RESERVED
CVE-2018-10791
RESERVED
-CVE-2018-10790
- RESERVED
+CVE-2018-10790 (The AP4_CttsAtom class in Core/Ap4CttsAtom.cpp in Bento4
1.5.1.0 allow ...)
+ TODO: check
CVE-2018-10789
RESERVED
CVE-2018-10788
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d931bf1f368faf7ef341033b3e6703f970738b97
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d931bf1f368faf7ef341033b3e6703f970738b97
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
