Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b32a3589 by security tracker role at 2022-01-31T20:10:16+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,55 @@
+CVE-2022-24282
+ RESERVED
+CVE-2022-24281
+ RESERVED
+CVE-2022-24280
+ RESERVED
+CVE-2022-24277
+ RESERVED
+CVE-2022-24276
+ RESERVED
+CVE-2022-24275
+ RESERVED
+CVE-2022-24274
+ RESERVED
+CVE-2022-24273
+ RESERVED
+CVE-2022-24272
+ RESERVED
+CVE-2022-23400
+ RESERVED
+CVE-2022-0435
+ RESERVED
+CVE-2022-0434
+ RESERVED
+CVE-2022-0433
+ RESERVED
+CVE-2022-0432
+ RESERVED
+CVE-2022-0431
+ RESERVED
+CVE-2022-0430
+ RESERVED
+CVE-2022-0429
+ RESERVED
+CVE-2022-0428
+ RESERVED
+CVE-2022-0427
+ RESERVED
+CVE-2022-0426
+ RESERVED
+CVE-2022-0425
+ RESERVED
+CVE-2022-0424
+ RESERVED
+CVE-2022-0423
+ RESERVED
+CVE-2022-0422
+ RESERVED
+CVE-2022-0421
+ RESERVED
+CVE-2022-0420
+ RESERVED
CVE-2022-24271
RESERVED
CVE-2022-24270
@@ -335,8 +387,8 @@ CVE-2021-46657 (get_sort_by_table in MariaDB before 10.6.2
allows an application
[buster] - mariadb-10.3 1:10.3.31-0+deb10u1
NOTE: https://jira.mariadb.org/browse/MDEV-25629
NOTE: Fixed in MariaDB: 10.2.39, 10.3.30, 10.4.20, 10.5.11, 10.6.2
-CVE-2022-0414
- RESERVED
+CVE-2022-0414 (Business Logic Errors in Packagist dolibarr/dolibarr prior to
16.0. ...)
+ TODO: check
CVE-2022-0413 (Use After Free in Conda vim prior to 8.2. ...)
- vim <unfixed>
[bullseye] - vim <no-dsa> (Minor issue)
@@ -1508,10 +1560,10 @@ CVE-2021-46461
RESERVED
CVE-2021-46460
RESERVED
-CVE-2021-46459
- RESERVED
-CVE-2021-46458
- RESERVED
+CVE-2021-46459 (Victor CMS v1.0 was discovered to contain multiple SQL
injection vulne ...)
+ TODO: check
+CVE-2021-46458 (Victor CMS v1.0 was discovered to contain a SQL injection
vulnerabilit ...)
+ TODO: check
CVE-2021-46457
RESERVED
CVE-2021-46456
@@ -2747,8 +2799,8 @@ CVE-2022-0288
RESERVED
CVE-2022-0287
RESERVED
-CVE-2022-0286
- RESERVED
+CVE-2022-0286 (A flaw was found in the Linux kernel. A null pointer
dereference in bo ...)
+ TODO: check
CVE-2022-0285 (Cross-site Scripting (XSS) - Stored in Packagist
pimcore/pimcore prior ...)
NOT-FOR-US: pimcore
CVE-2022-0284
@@ -3289,11 +3341,13 @@ CVE-2022-0266 (Authorization Bypass Through
User-Controlled Key in Packagist rem
CVE-2022-0265
RESERVED
CVE-2022-23307 (CVE-2020-9493 identified a deserialization issue that was
present in A ...)
+ {DLA-2905-1}
- apache-log4j1.2 1.2.17-11 (bug #1004482)
NOTE: https://www.openwall.com/lists/oss-security/2022/01/18/5
CVE-2022-23306
RESERVED
CVE-2022-23305 (By design, the JDBCAppender in Log4j 1.2.x accepts an SQL
statement as ...)
+ {DLA-2905-1}
- apache-log4j1.2 1.2.17-11 (bug #1004482)
NOTE: https://www.openwall.com/lists/oss-security/2022/01/18/4
CVE-2022-0263 (Unrestricted Upload of File with Dangerous Type in Packagist
pimcore/p ...)
@@ -3359,6 +3413,7 @@ CVE-2022-0244 (An issue has been discovered in GitLab
CE/EE affecting all versio
CVE-2022-0243 (Cross-site Scripting (XSS) - Stored in NuGet
OrchardCore.Application.C ...)
NOT-FOR-US: Orchard CMS
CVE-2022-23302 (JMSSink in all versions of Log4j 1.x is vulnerable to
deserialization ...)
+ {DLA-2905-1}
- apache-log4j1.2 1.2.17-11 (bug #1004482)
NOTE: https://www.openwall.com/lists/oss-security/2022/01/18/3
CVE-2022-22142
@@ -6578,8 +6633,8 @@ CVE-2021-46103
RESERVED
CVE-2021-46102 (From version 0.2.14 to 0.2.16 for Solana rBPF, function
"relocate" in ...)
TODO: check
-CVE-2021-46101
- RESERVED
+CVE-2021-46101 (In Git for windows through 2.34.1 when using git pull to
update the lo ...)
+ TODO: check
CVE-2021-46100
RESERVED
CVE-2021-46099
@@ -10155,8 +10210,7 @@ CVE-2021-45081
RESERVED
CVE-2021-45080
RESERVED
-CVE-2021-45079
- RESERVED
+CVE-2021-45079 (In strongSwan before 5.9.5, a malicious responder can send an
EAP-Succ ...)
{DSA-5056-1}
- strongswan 5.9.5-1
NOTE:
https://www.strongswan.org/blog/2022/01/24/strongswan-vulnerability-(cve-2021-45079).html
@@ -11034,6 +11088,7 @@ CVE-2018-25021 (The TCP Server module in toxcore before
0.2.8 doesn't free the T
CVE-2021-44833 (The CLI 1.0.0 for Amazon AWS OpenSearch has weak permissions
for the c ...)
NOT-FOR-US: CLI for Amazon AWS OpenSearch
CVE-2021-4104 (JMSAppender in Log4j 1.2 is vulnerable to deserialization of
untrusted ...)
+ {DLA-2905-1}
- apache-log4j1.2 1.2.17-11
[bullseye] - apache-log4j1.2 <no-dsa> (Minor issue; JMSAppender not
configured to be used by default)
[buster] - apache-log4j1.2 <no-dsa> (Minor issue; JMSAppender not
configured to be used by default)
@@ -12705,8 +12760,8 @@ CVE-2021-44257
RESERVED
CVE-2021-44256
RESERVED
-CVE-2021-44255
- RESERVED
+CVE-2021-44255 (Authenticated remote code execution in MotionEye <= 0.42.1
and Moti ...)
+ TODO: check
CVE-2021-44254
RESERVED
CVE-2021-44253
@@ -13183,10 +13238,12 @@ CVE-2021-44143 (A flaw was found in mbsync in isync
1.4.0 through 1.4.3. Due to
[stretch] - isync <not-affected> (Vulnerable code introduced later)
NOTE: https://www.openwall.com/lists/oss-security/2021/12/03/2
CVE-2021-44142 [Out-of-bounds heap read/write vulnerability in VFS module
vfs_fruit allows code execution]
+ RESERVED
- samba <unfixed>
NOTE: https://www.samba.org/samba/security/CVE-2021-44142.html
NOTE: https://bugzilla.samba.org/show_bug.cgi?id=14914
CVE-2021-44141 [Information leak via symlinks of existance of files or
directories outside of the exported share]
+ RESERVED
- samba <unfixed>
NOTE: https://www.samba.org/samba/security/CVE-2021-44141.html
NOTE: https://bugzilla.samba.org/show_bug.cgi?id=14911
@@ -13259,8 +13316,8 @@ CVE-2021-44116 (Cross Site Scripting (XSS)
vulnerability exits in Anchor CMS <
NOT-FOR-US: Anchor CMS
CVE-2021-44115
RESERVED
-CVE-2021-44114
- RESERVED
+CVE-2021-44114 (Cross Site Scripting (XSS) vulnerability exists in
Sourcecodester Stoc ...)
+ TODO: check
CVE-2021-44113
RESERVED
CVE-2021-44112
@@ -13831,7 +13888,7 @@ CVE-2022-21701 (Istio is an open platform to connect,
manage, and secure microse
CVE-2022-21700 (Micronaut is a JVM-based, full stack Java framework designed
for build ...)
TODO: check
CVE-2022-21699 (IPython (Interactive Python) is a command shell for
interactive comput ...)
- {DLA-2896-1}
+ {DSA-5065-1 DLA-2896-1}
- ipython 7.31.1-1 (bug #1004122)
NOTE:
https://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x
NOTE: Fixed by:
https://github.com/ipython/ipython/commit/1ec91ebf328bdf3450130de4b4604c79dc1e19d9
@@ -19157,16 +19214,16 @@ CVE-2021-42637
RESERVED
CVE-2021-42636
RESERVED
-CVE-2021-42635
- RESERVED
+CVE-2021-42635 (PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a
hardcode ...)
+ TODO: check
CVE-2021-42634
RESERVED
CVE-2021-42633
RESERVED
CVE-2021-42632
RESERVED
-CVE-2021-42631
- RESERVED
+CVE-2021-42631 (PrinterLogic Web Stack versions 19.1.1.13 SP9 and below
deserializes a ...)
+ TODO: check
CVE-2021-42630
RESERVED
CVE-2021-42629
@@ -26764,8 +26821,8 @@ CVE-2021-40044
RESERVED
CVE-2021-40043
RESERVED
-CVE-2021-40042
- RESERVED
+CVE-2021-40042 (There is a release of invalid pointer vulnerability in some
Huawei pro ...)
+ TODO: check
CVE-2021-40041 (There is a Cross-Site Scripting(XSS) vulnerability in HUAWEI
WS318n pr ...)
NOT-FOR-US: Huawei
CVE-2021-40040
@@ -26782,8 +26839,8 @@ CVE-2021-40035 (There is a Buffer overflow
vulnerability due to a boundary error
NOT-FOR-US: Huawei
CVE-2021-40034
RESERVED
-CVE-2021-40033
- RESERVED
+CVE-2021-40033 (There is an information exposure vulnerability on several
Huawei Produ ...)
+ TODO: check
CVE-2021-40032 (The bone voice ID TA has a vulnerability in information
management,Suc ...)
NOT-FOR-US: Huawei
CVE-2021-40031 (There is a Null pointer dereference vulnerability in the
camera module ...)
@@ -39528,8 +39585,8 @@ CVE-2021-34807 (An open redirect vulnerability exists
in the /preauth Servlet in
NOT-FOR-US: Zimbra
CVE-2021-34806
RESERVED
-CVE-2021-34805
- RESERVED
+CVE-2021-34805 (An issue was discovered in FAUST iServer before 9.0.019.019.7.
For eac ...)
+ TODO: check
CVE-2021-34804
RESERVED
CVE-2021-34803 (TeamViewer before 14.7.48644 on Windows loads untrusted DLLs
in certai ...)
@@ -47606,8 +47663,8 @@ CVE-2021-31618 (Apache HTTP Server protocol handler for
the HTTP/2 protocol chec
NOTE:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2021-31618
NOTE:
https://github.com/apache/httpd/commit/a4fba223668c554e06bc78d6e3a88f33d4238ae4
NOTE:
https://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/http2/h2_stream.c?r1=1889759&r2=1889758&pathrev=1889759
-CVE-2021-31617
- RESERVED
+CVE-2021-31617 (In ASQ in Stormshield Network Security (SNS) 1.0.0 through
2.7.8, 2.8. ...)
+ TODO: check
CVE-2021-31616 (Insufficient length checks in the ShapeShift KeepKey hardware
wallet f ...)
NOT-FOR-US: ShapeShift KeepKey hardware wallet firmware
CVE-2021-31615 (Unencrypted Bluetooth Low Energy baseband links in Bluetooth
Core Spec ...)
@@ -54630,8 +54687,8 @@ CVE-2021-28964 (A race condition was discovered in
get_old_root in fs/btrfs/ctre
- linux 5.10.26-1
[buster] - linux 4.19.194-1
NOTE:
https://git.kernel.org/linus/dbcc7d57bffc0c8cac9dac11bec548597d59a6a5
-CVE-2021-28962
- RESERVED
+CVE-2021-28962 (Stormshield Network Security (SNS) before 4.2.2 allows a
read-only adm ...)
+ TODO: check
CVE-2021-28961 (applications/luci-app-ddns/luasrc/model/cbi/ddns/detail.lua in
the DDN ...)
NOT-FOR-US: DDNS package for OpenWrt
CVE-2021-28960 (Zoho ManageEngine Desktop Central before build 10.0.683 allows
unauthe ...)
@@ -67894,10 +67951,10 @@ CVE-2021-23523
RESERVED
CVE-2021-23522
RESERVED
-CVE-2021-23521
- RESERVED
-CVE-2021-23520
- RESERVED
+CVE-2021-23521 (This affects the package juce-framework/JUCE before 6.1.5.
This vulner ...)
+ TODO: check
+CVE-2021-23520 (The package juce-framework/juce before 6.1.5 are vulnerable to
Arbitra ...)
+ TODO: check
CVE-2021-23519
RESERVED
CVE-2021-23518 (The package cached-path-relative before 1.1.0 are vulnerable
to Protot ...)
@@ -72957,8 +73014,8 @@ CVE-2020-36066 (GJSON <1.6.5 allows attackers to
cause a denial of service (r
NOTE: fix in golang-github-tidwall-gjson is dependency on
golang-github-tidwall-match v1.0.3
CVE-2020-36065
RESERVED
-CVE-2020-36064
- RESERVED
+CVE-2020-36064 (Online Course Registration v1.0 was discovered to contain
hardcoded cr ...)
+ TODO: check
CVE-2020-36063
RESERVED
CVE-2020-36062
@@ -72973,8 +73030,8 @@ CVE-2020-36058
RESERVED
CVE-2020-36057
RESERVED
-CVE-2020-36056
- RESERVED
+CVE-2020-36056 (Beetel 777VR1-DI Hardware Version REV.1.01 Firmware Version
V01.00.09_ ...)
+ TODO: check
CVE-2020-36055
RESERVED
CVE-2020-36054
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b32a3589e1361391cb676aef07f9489c547cd56a
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b32a3589e1361391cb676aef07f9489c547cd56a
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
