Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1898dd4b by Moritz Muehlenhoff at 2022-03-21T15:52:46+01:00
buster/bullseye triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -6029,11 +6029,13 @@ CVE-2022-25052
RESERVED
CVE-2022-25051 (An Off-by-one Error occurs in cmr113_decode of rtl_433 21.12
when deco ...)
- rtl-433 <unfixed> (bug #1008000)
+ [bullseye] - rtl-433 <no-dsa> (Minor issue)
NOTE:
https://github.com/merbanan/rtl_433/commit/2dad7b9fc67a1d0bfbe520fbd821678b8f8cc7a8
NOTE: https://github.com/merbanan/rtl_433/issues/1960
NOTE: https://huntr.dev/bounties/78eee103-bd61-4b4f-b054-04ad996b39e7/
CVE-2022-25050 (rtl_433 21.12 was discovered to contain a stack overflow in
the functi ...)
- rtl-433 <unfixed> (bug #1008000)
+ [bullseye] - rtl-433 <no-dsa> (Minor issue)
NOTE:
https://github.com/merbanan/rtl_433/commit/2dad7b9fc67a1d0bfbe520fbd821678b8f8cc7a8
NOTE: https://github.com/merbanan/rtl_433/issues/1960
NOTE: https://huntr.dev/bounties/6c9cd35f-a206-4fdf-b6d1-fcd50926c2d9/
@@ -7053,6 +7055,8 @@ CVE-2022-24669
RESERVED
CVE-2022-0547 (OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication
bypass ...)
- openvpn 2.5.6-1 (bug #1008015)
+ [bullseye] - openvpn <no-dsa> (Minor issue)
+ [buster] - openvpn <no-dsa> (Minor issue)
NOTE: https://community.openvpn.net/openvpn/wiki/CVE-2022-0547
NOTE:
https://github.com/OpenVPN/openvpn/commit/58ec3bb4aac77131118dbbc39a65181e7847adee
(v2.4.12)
NOTE:
https://github.com/OpenVPN/openvpn/commit/af3e382649d96ae77cc5e42be8270f355e5cfec5
(v2.5.6)
@@ -9573,6 +9577,8 @@ CVE-2022-23944 (User can access /plugin api without
authentication. This issue a
NOT-FOR-US: Apache ShenYu Admin
CVE-2022-23943 (Out-of-bounds Write vulnerability in mod_sed of Apache HTTP
Server all ...)
- apache2 2.4.53-1
+ [bullseye] - apache2 <no-dsa> (Minor issue)
+ [buster] - apache2 <no-dsa> (Minor issue)
NOTE:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-23943
NOTE: Fixed by: https://svn.apache.org/r1898695
NOTE: Fixed by: https://svn.apache.org/r1898772
@@ -11261,6 +11267,8 @@ CVE-2022-23438
RESERVED
CVE-2022-23437 (There's a vulnerability within the Apache Xerces Java
(XercesJ) XML pa ...)
- libxerces2-java <unfixed>
+ [bullseye] - libxerces2-java <postponed> (revisit when/if fix is
complete)
+ [buster] - libxerces2-java <postponed> (revisit when/if fix is complete)
[stretch] - libxerces2-java <postponed> (revisit when/if fix is
complete)
NOTE: https://www.openwall.com/lists/oss-security/2022/01/24/3
CVE-2022-0311 (Heap buffer overflow in Task Manager in Google Chrome prior to
97.0.46 ...)
@@ -14191,14 +14199,20 @@ CVE-2022-22722 (A CWE-798: Use of Hard-coded
Credentials vulnerability exists th
NOT-FOR-US: Schneider Electric
CVE-2022-22721 (If LimitXMLRequestBody is set to allow request bodies larger
than 350M ...)
- apache2 2.4.53-1
+ [bullseye] - apache2 <no-dsa> (Minor issue)
+ [buster] - apache2 <no-dsa> (Minor issue)
NOTE:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-22721
NOTE: Fixed by: https://svn.apache.org/r1898693
CVE-2022-22720 (Apache HTTP Server 2.4.52 and earlier fails to close inbound
connectio ...)
- apache2 2.4.53-1
+ [bullseye] - apache2 <no-dsa> (Minor issue)
+ [buster] - apache2 <no-dsa> (Minor issue)
NOTE:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-22720
NOTE: Fixed by: https://svn.apache.org/r1898692
CVE-2022-22719 (A carefully crafted request body can cause a read to a random
memory a ...)
- apache2 2.4.53-1
+ [bullseye] - apache2 <no-dsa> (Minor issue)
+ [buster] - apache2 <no-dsa> (Minor issue)
NOTE:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2022-22719
NOTE: Fixed by: https://svn.apache.org/r1898694
CVE-2022-22718 (Windows Print Spooler Elevation of Privilege Vulnerability.
This CVE I ...)
@@ -19627,7 +19641,6 @@ CVE-2021-44964 (Use after free in garbage collector and
finalizer of lgc.c in Lu
NOTE: http://lua-users.org/lists/lua-l/2021-12/msg00015.html
NOTE: http://lua-users.org/lists/lua-l/2021-12/msg00030.html
NOTE:
https://github.com/Lua-Project/lua-5.4.4-sandbox-escape-with-new-vulnerability
- TODO: check possible fix and other versions of lua
CVE-2021-44963
RESERVED
CVE-2021-44962 (An out-of-bounds read vulnerability exists in the
GCode::extrude() fun ...)
@@ -21029,6 +21042,7 @@ CVE-2021-44538 (The olm_session_describe function in
Matrix libolm before 3.2.7
NOTE: Fixed by:
https://gitlab.matrix.org/matrix-org/olm/-/commit/c23ce70fc66c26db5839ddb5a3b46d4c3d3abed6
(3.2.8)
CVE-2021-44537 (ownCloud owncloud/client before 2.9.2 allows Resource
Injection by a s ...)
- owncloud-client <unfixed>
+ [buster] - owncloud-client <no-dsa> (Minor issue)
[stretch] - owncloud-client <not-affected> (OAuth support introduced in
2.4)
NOTE: https://owncloud.com/security-advisories/cve-2021-44537/
CVE-2021-44536
@@ -47171,6 +47185,8 @@ CVE-2021-35501 (PandoraFMS <=7.54 allows Stored XSS
by placing a payload in t
CVE-2021-3621 (A flaw was found in SSSD, where the sssctl command was
vulnerable to s ...)
{DLA-2758-1}
- sssd 2.5.2-1 (bug #992710)
+ [bullseye] - sssd <no-dsa> (Minor issue)
+ [buster] - sssd <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1975142
NOTE:
https://github.com/SSSD/sssd/commit/7ab83f97e1cbefb78ece17232185bdd2985f0bbe
NOTE: Introduced by
https://github.com/SSSD/sssd/commit/e157b9f6cb370e1b94bcac2044d26ad66d640fba
(v1.13.91)
@@ -49310,6 +49326,7 @@ CVE-2021-34559 (In PEPPERL+FUCHS WirelessHART-Gateway
<= 3.0.8 a vulnerabilit
NOT-FOR-US: PEPPERL+FUCHS WirelessHART-Gateway
CVE-2021-3596 (A NULL pointer dereference flaw was found in ImageMagick in
versions p ...)
- imagemagick 8:6.9.11.57+dfsg-1
+ [buster] - imagemagick <ignored> (Minor issue)
[stretch] - imagemagick <postponed> (Minor issue)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/2624
NOTE:
https://github.com/ImageMagick/ImageMagick/commit/43dfb1894761c4929d5d5c98dc80ba4e59a0d114
@@ -52369,6 +52386,8 @@ CVE-2021-33293 (Panorama Tools libpano13 v2.9.20 was
discovered to contain an ou
{DLA-2957-1}
[experimental] - libpano13 2.9.21~rc1+dfsg-1
- libpano13 <unfixed> (bug #1008024)
+ [bullseye] - libpano13 <no-dsa> (Minor issue)
+ [buster] - libpano13 <no-dsa> (Minor issue)
NOTE: https://groups.google.com/u/1/g/hugin-ptx/c/gLtz2vweD74
NOTE: Fixed by:
https://sourceforge.net/p/panotools/libpano13/ci/62aa7eed8fae5d8f247a2508a757f31000de386f/
CVE-2021-33292
@@ -76927,6 +76946,7 @@ CVE-2021-23649
RESERVED
CVE-2021-23648 (The package @braintree/sanitize-url before 6.0.0 are
vulnerable to Cro ...)
- node-mermaid <unfixed>
+ [bullseye] - node-mermaid <no-dsa> (Minor issue)
NOTE: https://github.com/braintree/sanitize-url/pull/40
NOTE: src:node-mermaid provides embedded @braintree/sanitize-url
CVE-2021-23647
=====================================
data/dsa-needed.txt
=====================================
@@ -18,6 +18,8 @@ condor/oldstable
--
faad2/oldstable (jmm)
--
+fish/stable
+--
freecad (aron)
--
linux (carnil)
@@ -45,3 +47,5 @@ trafficserver (jmm)
unzip
no details public yet
--
+wordpress
+--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1898dd4bab64bf390a47a72c3226eadc246e83ed
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/1898dd4bab64bf390a47a72c3226eadc246e83ed
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
