Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
383259b1 by Moritz Muehlenhoff at 2022-07-07T17:48:52+02:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1155,7 +1155,7 @@ CVE-2022-2261
CVE-2022-2260
RESERVED
CVE-2022-34835 (In Das U-Boot through 2022.07-rc5, an integer signedness error
and res ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1014529)
[bullseye] - u-boot <no-dsa> (Minor issue)
[buster] - u-boot <no-dsa> (Minor issue)
NOTE: https://lists.denx.de/pipermail/u-boot/2022-June/486113.html
@@ -5512,7 +5512,7 @@ CVE-2022-33105 (Redis v7.0 was discovered to contain a
memory leak via the compo
CVE-2022-33104
RESERVED
CVE-2022-33103 (Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to
contain an ...)
- - u-boot <unfixed>
+ - u-boot <unfixed> (bug #1014528)
[bullseye] - u-boot <no-dsa> (Minor issue)
[buster] - u-boot <no-dsa> (Minor issue)
NOTE:
https://lore.kernel.org/all/CALO=dhfb+yboxxvr5kcsk0ifdg+e7ywko4-e+72kjbcs8jb...@mail.gmail.com/
@@ -9449,7 +9449,7 @@ CVE-2022-31628
CVE-2022-31627
RESERVED
CVE-2022-31626 (In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and
8.1.x belo ...)
- - php8.1 <unfixed>
+ - php8.1 <unfixed> (bug #1014533)
- php7.4 <removed>
[bullseye] - php7.4 <postponed> (Minor issue, fix along with next
security release)
- php7.3 <removed>
@@ -9459,7 +9459,7 @@ CVE-2022-31626 (In PHP versions 7.4.x below 7.4.30, 8.0.x
below 8.0.20, and 8.1.
NOTE: Fixed in 7.4.30, 8.0.20, 8.1.7
NOTE: PHP Bug: https://bugs.php.net/bug.php?id=81719
CVE-2022-31625 (In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and
8.1.x belo ...)
- - php8.1 <unfixed>
+ - php8.1 <unfixed> (bug #1014533)
- php7.4 <removed>
[bullseye] - php7.4 <postponed> (Minor issue, fix along with next
security release)
- php7.3 <removed>
@@ -14229,14 +14229,14 @@ CVE-2022-29980 (Simple Client Management System 1.0
is vulnerable to SQL Injecti
CVE-2022-29979 (Simple Client Management System 1.0 is vulnerable to SQL
Injection via ...)
NOT-FOR-US: Sourcecodester Simple Client Management System
CVE-2022-29978 (There is a floating point exception error in
sixel_encoder_do_resize, ...)
- - libsixel <unfixed>
+ - libsixel <unfixed> (bug #1014527)
[bullseye] - libsixel <no-dsa> (Minor issue)
[buster] - libsixel <no-dsa> (Minor issue)
[stretch] - libsixel <no-dsa> (Minor issue)
NOTE: https://github.com/libsixel/libsixel/issues/63
NOTE: Previously also reported in
https://github.com/saitoha/libsixel/issues/166
CVE-2022-29977 (There is an assertion failure error in stbi__jpeg_huff_decode,
stb_ima ...)
- - libsixel <unfixed>
+ - libsixel <unfixed> (bug #1014526)
[bullseye] - libsixel <no-dsa> (Minor issue)
[buster] - libsixel <no-dsa> (Minor issue)
[stretch] - libsixel <no-dsa> (Minor issue)
@@ -20206,13 +20206,13 @@ CVE-2022-28044 (Irzip v0.640 was discovered to
contain a heap memory corruption
CVE-2022-28043
RESERVED
CVE-2022-28042 (stb_image.h v2.27 was discovered to contain an heap-based
use-after-fr ...)
- - libstb <unfixed>
+ - libstb <unfixed> (bug #1014531)
[bullseye] - libstb <no-dsa> (Minor issue)
[buster] - libstb <no-dsa> (Minor issue)
NOTE: https://github.com/nothings/stb/issues/1289
NOTE: https://github.com/nothings/stb/pull/1297
CVE-2022-28041 (stb_image.h v2.27 was discovered to contain an integer
overflow via th ...)
- - libstb <unfixed>
+ - libstb <unfixed> (bug #1014531)
[bullseye] - libstb <no-dsa> (Minor issue)
[buster] - libstb <no-dsa> (Minor issue)
NOTE: https://github.com/nothings/stb/issues/1292
@@ -51512,14 +51512,14 @@ CVE-2021-42717 (ModSecurity 3.x through 3.0.5
mishandles excessively nested JSON
NOTE: Fixed by:
https://github.com/SpiderLabs/ModSecurity/commit/41918335fa4c74fba46a986771a5a6cb457070c4
(v2.9.5)
NOTE: Fixed by:
https://github.com/SpiderLabs/ModSecurity/commit/ac79c1c29b7e6323e26cc984ad4f76ef62c731cd
(v3.0.6)
CVE-2021-42716 (An issue was discovered in stb stb_image.h 2.27. The PNM
loader incorr ...)
- - libstb <unfixed>
+ - libstb <unfixed> (bug #1014532)
[bullseye] - libstb <no-dsa> (Minor issue)
[buster] - libstb <no-dsa> (Minor issue)
NOTE: https://github.com/nothings/stb/issues/1166
NOTE: https://github.com/nothings/stb/issues/1225
NOTE: https://github.com/nothings/stb/pull/1223
CVE-2021-42715 (An issue was discovered in stb stb_image.h 1.33 through 2.27.
The HDR ...)
- - libstb <unfixed>
+ - libstb <unfixed> (bug #1014532)
[bullseye] - libstb <no-dsa> (Minor issue)
[buster] - libstb <no-dsa> (Minor issue)
NOTE: https://github.com/nothings/stb/issues/1224
@@ -90202,10 +90202,9 @@ CVE-2021-28023 (Arbitrary file upload in Service
import feature in ServiceTonic
CVE-2021-28022 (Blind SQL injection in the login form in ServiceTonic Helpdesk
softwar ...)
NOT-FOR-US: ServiceTonic
CVE-2021-28021 (Buffer overflow vulnerability in function stbi__extend_receive
in stb_ ...)
- - libstb <undetermined>
+ - libstb <unfixed> (bug #1014530)
NOTE: https://github.com/nothings/stb/issues/1108
NOTE:
https://github.com/nothings/stb/commit/86b7570cfba845e8209c6aec2d15e487bb1d8bb4
- TODO: check libstb itself, and various packages embedd a copy
CVE-2021-28020
RESERVED
CVE-2021-28019
@@ -106074,9 +106073,7 @@ CVE-2020-36125 (Pax Technology PAXSTORE
v7.0.8_20200511171508 and lower is affec
CVE-2020-36124 (Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is
affected by ...)
NOT-FOR-US: Pax Technology PAXSTORE
CVE-2020-36123 (saitoha libsixel v1.8.6 was discovered to contain a double
free via th ...)
- - libsixel <undetermined>
- NOTE: https://github.com/saitoha/libsixel/issues/144
- TODO: check, unclear why reporter did close the issue again
+ NOTE: Bogus report for libsixel
CVE-2020-36122
RESERVED
CVE-2020-36121
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/383259b140153fa407587bcb31f455d622a5d7c6
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/383259b140153fa407587bcb31f455d622a5d7c6
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
