Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
27be1841 by Salvatore Bonaccorso at 2022-04-19T10:56:20+02:00
Process more NFUs
- - - - -
5f44e41b by Salvatore Bonaccorso at 2022-04-19T10:57:15+02:00
Add two new libsixel issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1703,7 +1703,7 @@ CVE-2022-28812
CVE-2022-28811
RESERVED
CVE-2022-28810 (Zoho ManageEngine ADSelfService Plus before 6122 allows an
authenticat ...)
- TODO: check
+ NOT-FOR-US: Zoho ManageEngine
CVE-2022-28809
RESERVED
CVE-2022-28808
@@ -4287,7 +4287,7 @@ CVE-2022-27910
CVE-2022-27909
RESERVED
CVE-2022-27908 (Zoho ManageEngine OpManager before 125588 (and before 125603)
is vulne ...)
- TODO: check
+ NOT-FOR-US: Zoho ManageEngine
CVE-2022-27907 (Sonatype Nexus Repository Manager 3.x before 3.38.0 allows
SSRF. ...)
NOT-FOR-US: Sonatype Nexus Repository Manager
CVE-2022-27906 (Mendelson OFTP2 before 1.1 b43 is affected by directory
traversal. To ...)
@@ -5230,17 +5230,17 @@ CVE-2022-27532
CVE-2022-27531
RESERVED
CVE-2022-27530 (A maliciously crafted TIF or PICT file in Autodesk AutoCAD
2022, 2021, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27529 (A maliciously crafted PICT, BMP, PSD or TIF file in Autodesk
AutoCAD 2 ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27528 (A maliciously crafted DWFX and SKP files in Autodesk
Navisworks 2022 c ...)
NOT-FOR-US: Autodesk
CVE-2022-27527
RESERVED
CVE-2022-27526 (A malicious crafted TGA file when consumed through
DesignReview.exe ap ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27525 (A malicious crafted .dwf file when consumed through
DesignReview.exe a ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27524 (An out-of-bounds read can be exploited in Autodesk TrueView
2022 may l ...)
NOT-FOR-US: Autodesk
CVE-2022-27523 (A buffer over-read can be exploited in Autodesk TrueView 2022
may lead ...)
@@ -6676,11 +6676,19 @@ CVE-2022-27048 (A vulnerability has been discovered in
Moxa MGate which allows a
CVE-2022-27047 (mogu_blog_cms 5.2 suffers from upload arbitrary files without
any limi ...)
NOT-FOR-US: mogu_blog_cms
CVE-2022-27046 (libsixel 1.8.6 suffers from a Heap Use After Free
vulnerability in in ...)
- TODO: check
+ - libsixel 1.10.3-1
+ NOTE: https://github.com/saitoha/libsixel/issues/157
+ NOTE: https://github.com/libsixel/libsixel/issues/27
+ NOTE: https://github.com/libsixel/libsixel/pull/28
+ NOTE: Fixed by:
https://github.com/libsixel/libsixel/commit/d299d67c532a5133a57aade5c35ff8e612c73dd8
(v1.10.1)
CVE-2022-27045
RESERVED
CVE-2022-27044 (libsixel 1.8.6 is affected by Buffer Overflow in
libsixel/src/quant.c: ...)
- TODO: check
+ - libsixel 1.10.3-1
+ NOTE: https://github.com/saitoha/libsixel/issues/156
+ NOTE: https://github.com/libsixel/libsixel/issues/25
+ NOTE: https://github.com/libsixel/libsixel/pull/26
+ NOTE: Fixed by:
https://github.com/libsixel/libsixel/commit/dc96cdc27fb53e8595af67aaf68001033c808e42
(v1.10.0)
CVE-2022-27043 (Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 -
2.3.6 Ne ...)
TODO: check
CVE-2022-27042
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c9a0c5f1f0268f42e827a2902c4b84496b745082...5f44e41b5a6ac979c0c65cc5733e663a40e97fa1
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c9a0c5f1f0268f42e827a2902c4b84496b745082...5f44e41b5a6ac979c0c65cc5733e663a40e97fa1
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
