Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
46a43437 by Moritz Muehlenhoff at 2021-10-19T22:31:18+02:00
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -133,7 +133,7 @@ CVE-2021-42652
CVE-2021-42651
RESERVED
CVE-2021-42650 (Cross Site Scripting (XSS vulnerability exists in Portainer
before 2.9 ...)
- TODO: check
+ NOT-FOR-US: Portainer
CVE-2021-42649
RESERVED
CVE-2021-42648
@@ -281,9 +281,9 @@ CVE-2021-42578
CVE-2021-42577
RESERVED
CVE-2021-42576 (The bluemonday sanitizer before 1.0.16 for Go, and before
0.0.8 for Py ...)
- TODO: check
+ NOT-FOR-US: bluemonday sanitizer
CVE-2021-42575 (The OWASP Java HTML Sanitizer before 20211018.1 does not
properly enfo ...)
- TODO: check
+ NOT-FOR-US: OWASP HTML Sanitizer
CVE-2021-42574
RESERVED
CVE-2021-42573
@@ -2597,7 +2597,7 @@ CVE-2021-42085 (An issue was discovered in Zammad before
4.1.1. There is stored
CVE-2021-42084 (An issue was discovered in Zammad before 4.1.1. An attacker
with valid ...)
- zammad <itp> (bug #841355)
CVE-2021-3869 (corenlp is vulnerable to Improper Restriction of XML External
Entity R ...)
- TODO: check
+ NOT-FOR-US: CoreNLP
CVE-2021-42083
RESERVED
CVE-2021-42082
@@ -4713,17 +4713,17 @@ CVE-2021-41158
CVE-2021-41157
RESERVED
CVE-2021-41156 (anuko/timetracker is an, open source time tracking system. In
affected ...)
- TODO: check
+ NOT-FOR-US: anuko/timetracker
CVE-2021-41155 (Tuleap is a Free & Open Source Suite to improve management
of soft ...)
- TODO: check
+ NOT-FOR-US: Tuleap
CVE-2021-41154 (Tuleap is a Free & Open Source Suite to improve management
of soft ...)
- TODO: check
+ NOT-FOR-US: Tuleap
CVE-2021-41153 (The evm crate is a pure Rust implementation of Ethereum
Virtual Machin ...)
TODO: check
CVE-2021-41152 (OpenOlat is a web-based e-learning platform for teaching,
learning, as ...)
NOT-FOR-US: OpenOlat
CVE-2021-41151 (Backstage is an open platform for building developer portals.
In affec ...)
- TODO: check
+ NOT-FOR-US: Backstage
CVE-2021-41150
RESERVED
CVE-2021-41149 (Tough provides a set of Rust libraries and tools for using and
generat ...)
@@ -4745,7 +4745,7 @@ CVE-2021-41142 (Tuleap Open ALM is a libre and open
source tool for end to end t
CVE-2021-41141
RESERVED
CVE-2021-41140 (Discourse-reactions is a plugin for the Discourse platform
that allows ...)
- TODO: check
+ NOT-FOR-US: Discourse plugin
CVE-2021-41139 (Anuko Time Tracker is an open source, web-based time tracking
applicat ...)
NOT-FOR-US: Anuko Time Tracker
CVE-2021-41138 (Frontier is Substrate's Ethereum compatibility layer. In the
newly int ...)
@@ -22584,7 +22584,7 @@ CVE-2021-33586 (InspIRCd 3.8.0 through 3.9.x before
3.10.0 allows any user (able
CVE-2021-3566 (Prior to ffmpeg version 4.3, the tty demuxer did not have a
'read_prob ...)
{DLA-2742-1}
- ffmpeg 7:4.3-2
- [buster] - ffmpeg <postponed> (Wait for 4.1.8)
+ [buster] - ffmpeg <postponed> (Wait for 4.1.9)
NOTE:
https://github.com/FFmpeg/FFmpeg/commit/3bce9e9b3ea35c54bacccc793d7da99ea5157532
CVE-2021-33579
RESERVED
@@ -82742,7 +82742,7 @@ CVE-2020-21698
CVE-2020-21697 (A heap-use-after-free in the mpeg_mux_write_packet function in
libavfo ...)
- ffmpeg 7:4.4-5
[bullseye] - ffmpeg <postponed> (Wait for 4.3.3)
- [buster] - ffmpeg <postponed> (Wait for 4.1.8)
+ [buster] - ffmpeg <postponed> (Wait for 4.1.9)
NOTE: https://trac.ffmpeg.org/ticket/8188
NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=cfce16449cb815132f829d5a07beb138dfb2cba6
CVE-2020-21696
@@ -82764,7 +82764,7 @@ CVE-2020-21689
CVE-2020-21688 (A heap-use-after-free in the av_freep function in
libavutil/mem.c of F ...)
- ffmpeg 7:4.4-5
[bullseye] - ffmpeg <postponed> (Wait for 4.3.3)
- [buster] - ffmpeg <postponed> (Wait for 4.1.8)
+ [buster] - ffmpeg <postponed> (Wait for 4.1.9)
NOTE: https://trac.ffmpeg.org/ticket/8186
NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=22c3cd176079dd104ec7610ead697235b04396f1
CVE-2020-21687
@@ -84220,7 +84220,7 @@ CVE-2020-21041 (Buffer Overflow vulnerability exists in
FFmpeg 4.1 via apng_do_i
{DSA-4990-1 DLA-2742-1}
[experimental] - ffmpeg 7:4.4-1
- ffmpeg 7:4.3.2-0+deb11u2 (bug #989439)
- [stretch] - ffmpeg <postponed> (Wait for 4.1.8)
+ [stretch] - ffmpeg <postponed> (Wait for 4.1.9)
NOTE: https://trac.ffmpeg.org/ticket/7989
NOTE:
https://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=5d9f44da460f781a1604d537d0555b78e29438ba
CVE-2020-21040
@@ -84522,7 +84522,7 @@ CVE-2020-20897
REJECTED
CVE-2020-20896 (An issue was discovered in function latm_write_packet in
libavformat/l ...)
- ffmpeg 7:4.3-2
- [buster] - ffmpeg <postponed> (Wait for 4.1.8)
+ [buster] - ffmpeg <postponed> (Wait for 4.1.9)
NOTE:
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/dd01947397b98e94c3f2a79d5820aaf4594f4d3b
(4.3)
NOTE: https://trac.ffmpeg.org/ticket/8273
CVE-2020-20895
@@ -84538,7 +84538,7 @@ CVE-2020-20892 (An issue was discovered in function
filter_frame in libavfilter/
NOTE: https://trac.ffmpeg.org/ticket/8265
CVE-2020-20891 (Buffer Overflow vulnerability in function config_input in
libavfilter/ ...)
- ffmpeg 7:4.3-2
- [buster] - ffmpeg <postponed> (Wait for 4.1.8)
+ [buster] - ffmpeg <postponed> (Wait for 4.1.9)
NOTE:
https://git.ffmpeg.org/gitweb/ffmpeg.git/commit/64a805883d7223c868a683f0030837d859edd2ab
(4.3)
NOTE: https://trac.ffmpeg.org/ticket/8282
CVE-2020-20890
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/46a43437d3b679810990473828576ec36f51c92c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/46a43437d3b679810990473828576ec36f51c92c
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
