Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
301fd0e5 by security tracker role at 2022-07-08T20:10:30+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,4 +1,37 @@
+CVE-2022-35411 (rpc.py through 0.6.0 allows Remote Code Execution because an
unpickle ...)
+ TODO: check
+CVE-2022-35410 (mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows
../ dir ...)
+ TODO: check
+CVE-2022-35409
+ RESERVED
+CVE-2022-35408
+ RESERVED
+CVE-2022-35407
+ RESERVED
+CVE-2022-35406 (A URL disclosure issue was discovered in Burp Suite before
2022.6. If ...)
+ TODO: check
+CVE-2022-35405
+ RESERVED
+CVE-2022-35404
+ RESERVED
+CVE-2022-35403
+ RESERVED
+CVE-2022-35402
+ RESERVED
+CVE-2022-2353
+ RESERVED
+CVE-2022-2352
+ RESERVED
+CVE-2022-2351
+ RESERVED
+CVE-2022-2350
+ RESERVED
+CVE-2022-2349
+ RESERVED
+CVE-2022-2348
+ RESERVED
CVE-2022-2347 [Unchecked Download Size and Direction in U-Boot USB DFU]
+ RESERVED
- u-boot <unfixed>
NOTE: https://www.openwall.com/lists/oss-security/2022/07/08/2
CVE-2022-35399
@@ -215,8 +248,8 @@ CVE-2020-36555
RESERVED
CVE-2020-36554
RESERVED
-CVE-2022-2343
- RESERVED
+CVE-2022-2343 (Heap-based Buffer Overflow in GitHub repository vim/vim prior
to 9.0.0 ...)
+ TODO: check
CVE-2022-2342 (Cross-site Scripting (XSS) - Stored in GitHub repository
outline/outli ...)
TODO: check
CVE-2022-2341
@@ -2826,8 +2859,8 @@ CVE-2022-34308
RESERVED
CVE-2022-34307
RESERVED
-CVE-2022-34306
- RESERVED
+CVE-2022-34306 (IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTTP
header in ...)
+ TODO: check
CVE-2022-34305 (In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to
10.0.22, 9.0.30 ...)
- tomcat9 <unfixed> (unimportant)
- tomcat8 <removed> (unimportant)
@@ -3248,10 +3281,10 @@ CVE-2022-2145 (Cloudflare WARP client for Windows (up
to v. 2022.5.309.0) allowe
NOT-FOR-US: Cloudflare WARP client for Windows
CVE-2022-2144
RESERVED
-CVE-2022-34167
- RESERVED
-CVE-2022-34166
- RESERVED
+CVE-2022-34167 (IBM CICS TX Standard and Advanced 11.1 is vulnerable to stored
cross-s ...)
+ TODO: check
+CVE-2022-34166 (IBM CICS TX Standard and Advanced 11.1 is vulnerable to
cross-site scr ...)
+ TODO: check
CVE-2022-34165
RESERVED
CVE-2022-34164
@@ -3262,8 +3295,8 @@ CVE-2022-34162
RESERVED
CVE-2022-34161
RESERVED
-CVE-2022-34160
- RESERVED
+CVE-2022-34160 (IBM CICS TX Standard and Advanced 11.1 is vulnerable to HTML
injection ...)
+ TODO: check
CVE-2022-34159
RESERVED
CVE-2022-34158
@@ -5946,8 +5979,8 @@ CVE-2022-33013
RESERVED
CVE-2022-33012
RESERVED
-CVE-2022-33011
- RESERVED
+CVE-2022-33011 (Known v1.3.1+2020120201 was discovered to allow attackers to
perform a ...)
+ TODO: check
CVE-2022-33010
RESERVED
CVE-2022-33009 (A stored cross-site scripting (XSS) vulnerability in LightCMS
v1.3.11 ...)
@@ -8370,8 +8403,8 @@ CVE-2022-32117
RESERVED
CVE-2022-32116
RESERVED
-CVE-2022-32115
- RESERVED
+CVE-2022-32115 (An issue in the isSVG() function of Known v1.2.2+2020061101
allows att ...)
+ TODO: check
CVE-2022-32114
RESERVED
CVE-2022-32113
@@ -9676,6 +9709,7 @@ CVE-2022-31628
CVE-2022-31627
RESERVED
CVE-2022-31626 (In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and
8.1.x belo ...)
+ {DSA-5179-1}
- php8.1 8.1.7-1 (bug #1014533)
- php7.4 <removed>
- php7.3 <removed>
@@ -9685,6 +9719,7 @@ CVE-2022-31626 (In PHP versions 7.4.x below 7.4.30, 8.0.x
below 8.0.20, and 8.1.
NOTE: Fixed in 7.4.30, 8.0.20, 8.1.7
NOTE: PHP Bug: https://bugs.php.net/bug.php?id=81719
CVE-2022-31625 (In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and
8.1.x belo ...)
+ {DSA-5179-1}
- php8.1 8.1.7-1 (bug #1014533)
- php7.4 <removed>
- php7.3 <removed>
@@ -10630,8 +10665,8 @@ CVE-2022-31291 (An issue in dlt_config_file_parser.c of
dlt-daemon v2.18.8 allow
[buster] - dlt-daemon <no-dsa> (Minor issue)
NOTE: https://github.com/COVESA/dlt-daemon/pull/376
NOTE:
https://github.com/COVESA/dlt-daemon/commit/6a3bd901d825c7206797e36ea98e10a218f5aad2
-CVE-2022-31290
- RESERVED
+CVE-2022-31290 (A cross-site scripting (XSS) vulnerability in Known
v1.2.2+2020061101 ...)
+ TODO: check
CVE-2022-31289
REJECTED
CVE-2022-31288
@@ -12053,8 +12088,8 @@ CVE-2022-30854
RESERVED
CVE-2022-30853
RESERVED
-CVE-2022-30852
- RESERVED
+CVE-2022-30852 (Known v1.3.1 was discovered to contain an Insecure Direct
Object Refer ...)
+ TODO: check
CVE-2022-30851
RESERVED
CVE-2022-30850
@@ -18527,10 +18562,10 @@ CVE-2022-28626
RESERVED
CVE-2022-28625
RESERVED
-CVE-2022-28624
- RESERVED
-CVE-2022-28623
- RESERVED
+CVE-2022-28624 (A potential security vulnerability has been identified in
certain HPE ...)
+ TODO: check
+CVE-2022-28623 (Security vulnerabilities in HPE IceWall SSO 10.0 certd could
be exploi ...)
+ TODO: check
CVE-2022-28622 (A potential security vulnerability has been identified in HPE
StoreOnc ...)
NOT-FOR-US: HPE
CVE-2022-28621 (A remote disclosure of sensitive information vulnerability was
discove ...)
@@ -33634,7 +33669,7 @@ CVE-2022-23746
RESERVED
CVE-2022-23745
RESERVED
-CVE-2022-23744 (Check Point Endpoint Security Client E83 through E86 before
E86.50 doe ...)
+CVE-2022-23744 (Check Point Endpoint before version E86.50 failed to protect
against s ...)
TODO: check
CVE-2022-23743 (Check Point ZoneAlarm before version 15.8.200.19118 allows a
local act ...)
NOT-FOR-US: Check Point ZoneAlarm
@@ -38191,8 +38226,8 @@ CVE-2022-22478 (IBM Spectrum Protect Client 8.1.0.0
through 8.1.14.0 stores user
NOT-FOR-US: IBM
CVE-2022-22477
RESERVED
-CVE-2022-22476
- RESERVED
+CVE-2022-22476 (IBM WebSphere Application Server Liberty 17.0.0.3 through
22.0.0.7 and ...)
+ TODO: check
CVE-2022-22475 (IBM WebSphere Application Server Liberty and Open Liberty
17.0.0.3 thr ...)
NOT-FOR-US: IBM
CVE-2022-22474 (IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc,
and dsmcsv ...)
@@ -38213,12 +38248,12 @@ CVE-2022-22467
RESERVED
CVE-2022-22466
RESERVED
-CVE-2022-22465
- RESERVED
-CVE-2022-22464
- RESERVED
-CVE-2022-22463
- RESERVED
+CVE-2022-22465 (IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0,
10.0.2.0, an ...)
+ TODO: check
+CVE-2022-22464 (IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0,
10.0.2.0, an ...)
+ TODO: check
+CVE-2022-22463 (IBM Security Access Manager Appliance 10.0.0.0, 10.0.1.0,
10.0.2.0, an ...)
+ TODO: check
CVE-2022-22462
RESERVED
CVE-2022-22461
@@ -38403,8 +38438,8 @@ CVE-2022-22372
RESERVED
CVE-2022-22371
RESERVED
-CVE-2022-22370
- RESERVED
+CVE-2022-22370 (IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, and
10.0.3.0 ...)
+ TODO: check
CVE-2022-22369
RESERVED
CVE-2022-22368 (IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than
expected cry ...)
@@ -376894,7 +376929,7 @@ CVE-2015-8821 (Use-after-free vulnerability in Adobe
Flash Player before 18.0.0.
CVE-2015-8820 (Adobe Flash Player before 18.0.0.268 and 19.x and 20.x before
20.0.0.2 ...)
NOT-FOR-US: Adobe Flash Player
CVE-2015-8819
- RESERVED
+ REJECTED
CVE-2016-2841 (The ne2000_receive function in the NE2000 NIC emulation support
(hw/ne ...)
{DLA-1599-1}
- qemu 1:2.6+dfsg-1 (bug #817181)
@@ -388664,7 +388699,7 @@ CVE-2015-7801 (Use-after-free vulnerability in
OptiPNG 0.6.4 allows remote attac
- optipng 0.7.5-1
[wheezy] - optipng 0.6.4-1+deb7u1
CVE-2015-7800
- RESERVED
+ REJECTED
CVE-2015-7799 (The slhc_init function in drivers/net/slip/slhc.c in the Linux
kernel ...)
{DSA-3426-1 DLA-360-1}
- linux 4.2.6-2
@@ -394581,11 +394616,11 @@ CVE-2015-5600 (The kbdint_next_device function in
auth2-chall.c in sshd in OpenS
CVE-2015-5599 (Multiple SQL injection vulnerabilities in upload.php in the
Powerplay ...)
NOT-FOR-US: Powerplay Gallery plugin for WordPress
CVE-2015-5598
- RESERVED
+ REJECTED
CVE-2015-5597
- RESERVED
+ REJECTED
CVE-2015-5596
- RESERVED
+ REJECTED
CVE-2015-5595 (Cross-site request forgery (CSRF) vulnerability in admin.php in
Zenpho ...)
NOT-FOR-US: Zenphoto
CVE-2015-5594 (The sanitize_string function in ZenPhoto before 1.4.9 utilized
the htm ...)
@@ -395350,7 +395385,7 @@ CVE-2015-5330 (ldb before 1.1.24, as used in the AD
LDAP server in Samba 4.x bef
CVE-2015-5329 (The TripleO Heat templates (tripleo-heat-templates), as used in
Red Ha ...)
- tripleo-heat-templates 5.2.0-1 (bug #851396)
CVE-2015-5328
- RESERVED
+ REJECTED
CVE-2015-5327 (Out-of-bounds memory read in the x509_decode_time function in
x509_cer ...)
- linux <not-affected> (Only affected 4.3-rc1 onwards)
- linux-2.6 <not-affected> (Only affected 4.3-rc1 onwards)
@@ -398244,7 +398279,7 @@ CVE-2015-4334 (The default configuration of SGOS in
Blue Coat ProxySG before 6.2
CVE-2015-4333
RESERVED
CVE-2015-4332
- RESERVED
+ REJECTED
CVE-2015-4331 (Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA
authen ...)
NOT-FOR-US: Cisco Prime Infrastructure
CVE-2015-4330 (A local file script in Cisco TelePresence Video Communication
Server ( ...)
@@ -398646,7 +398681,7 @@ CVE-2015-4171 (strongSwan 4.3.0 through 5.x before
5.3.2 and strongSwan VPN Clie
- strongswan 5.3.1-1
NOTE:
https://www.strongswan.org/blog/2015/06/08/strongswan-vulnerability-(cve-2015-4171).html
CVE-2015-4169
- RESERVED
+ REJECTED
CVE-2015-4168
RESERVED
CVE-2015-4166 (Cloudera Key Trustee Server before 5.4.3 does not store keys
synchrono ...)
@@ -398893,9 +398928,9 @@ CVE-2015-4103 (Xen 3.3.x through 4.5.x does not
properly restrict write access t
NOTE: Xen switched to qemu-system in 4.4.0-1
NOTE: http://xenbits.xen.org/xsa/advisory-128.html
CVE-2015-4102
- RESERVED
+ REJECTED
CVE-2015-4101
- RESERVED
+ REJECTED
CVE-2015-4100 (Puppet Enterprise 3.7.x and 3.8.0 might allow remote
authenticated use ...)
- puppet <not-affected> (Only affects Puppet Enterprise)
NOTE: https://puppet.com/security/cve/CVE-2015-4100
@@ -400899,7 +400934,7 @@ CVE-2015-3379 (The Views module before 6.x-2.18,
6.x-3.x before 6.x-3.2, and 7.x
CVE-2015-3378 (Open redirect vulnerability in the Views module before
6.x-2.18, 6.x-3 ...)
NOT-FOR-US: Drupal Views module
CVE-2015-3377
- RESERVED
+ REJECTED
CVE-2015-3376 (Cross-site scripting (XSS) vulnerability in the Quizzler module
before ...)
NOT-FOR-US: Quizzler module for Drupal
CVE-2015-3375 (Cross-site request forgery (CSRF) vulnerability in the
Shibboleth Auth ...)
@@ -401257,19 +401292,19 @@ CVE-2015-3268 (Cross-site scripting (XSS)
vulnerability in the DisplayEntityFiel
CVE-2015-3267 (Cross-site scripting (XSS) vulnerability in the 404 error page
in Red ...)
NOT-FOR-US: JBoss Operations Network
CVE-2015-3266
- RESERVED
+ REJECTED
CVE-2015-3265
- RESERVED
+ REJECTED
CVE-2015-3264
- RESERVED
+ REJECTED
CVE-2015-3263
- RESERVED
+ REJECTED
CVE-2015-3262
- RESERVED
+ REJECTED
CVE-2015-3261
- RESERVED
+ REJECTED
CVE-2015-3260
- RESERVED
+ REJECTED
CVE-2015-3259 (Stack-based buffer overflow in the xl command line utility in
Xen 4.1. ...)
{DSA-3414-1}
- xen 4.6.0-1 (low; bug #795721)
@@ -403282,7 +403317,7 @@ CVE-2015-2687 (OpenStack Compute (nova) Icehouse,
Juno and Havana when live migr
CVE-2015-2673 (The ec_ajax_update_option and ec_ajax_clear_all_taxrates
functions in ...)
NOT-FOR-US: WP EasyCart plugin for Wordpress
CVE-2015-2671
- RESERVED
+ REJECTED
CVE-2015-2670
REJECTED
CVE-2015-2669
@@ -404625,7 +404660,7 @@ CVE-2015-2238 (Multiple unspecified vulnerabilities
in Google V8 before 4.1.0.21
CVE-2015-2237 (Multiple SQL injection vulnerabilities in Betster (aka PHP
Betoffice) ...)
NOT-FOR-US: Betster
CVE-2015-2236
- RESERVED
+ REJECTED
CVE-2015-2235
REJECTED
CVE-2015-2234 (Race condition in Lenovo System Update (formerly ThinkVantage
System U ...)
@@ -405579,7 +405614,7 @@ CVE-2015-1872 (The ff_mjpeg_decode_sof function in
libavcodec/mjpegdec.c in FFmp
[wheezy] - libav <no-dsa> (Minor issue, can be fixed along in a future
DSA)
NOTE:
https://git.videolan.org/?p=ffmpeg.git;a=commit;h=fabbfaa095660982cc0bc63242c459561fa37037
CVE-2015-1871
- RESERVED
+ REJECTED
CVE-2015-1870 (The event scripts in Automatic Bug Reporting Tool (ABRT) uses
world-re ...)
NOT-FOR-US: abrt is Red Hat / Fedora specific
CVE-2015-1869 (The default event handling scripts in Automatic Bug Reporting
Tool (AB ...)
@@ -405717,7 +405752,7 @@ CVE-2015-1838 (modules/serverdensity_device.py in
SaltStack before 2014.7.4 does
- salt <not-affected> (Vulnerable code only present in experimental
version; introduced in 2014.7.0)
NOTE:
https://github.com/saltstack/salt/commit/e11298d7155e9982749483ca5538e46090caef9c
CVE-2015-1837
- RESERVED
+ REJECTED
CVE-2015-1836 (Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1
before ...)
NOT-FOR-US: Apache HBase
CVE-2015-1835 (Apache Cordova Android before 3.7.2 and 4.x before 4.0.2, when
an appl ...)
@@ -412739,9 +412774,9 @@ CVE-2015-0282 (GnuTLS before 3.1.0 does not verify
that the RSA PKCS #1 signatur
- gnutls28 <not-affected> (Fixed in 3.1.0)
NOTE: http://www.gnutls.org/security.html#GNUTLS-SA-2015-1
CVE-2015-0281
- RESERVED
+ REJECTED
CVE-2015-0280
- RESERVED
+ REJECTED
CVE-2015-0279 (JBoss RichFaces before 4.5.4 allows remote attackers to inject
express ...)
NOT-FOR-US: RichFaces
CVE-2015-0278 (libuv before 0.10.34 does not properly drop group privileges,
which al ...)
@@ -412815,7 +412850,7 @@ CVE-2015-0258 (Multiple incomplete blacklist
vulnerabilities in the avatar uploa
CVE-2015-0257 (Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1
uses wea ...)
NOT-FOR-US: ovirt / RHEV
CVE-2015-0256
- RESERVED
+ REJECTED
CVE-2015-0255 (X.Org Server (aka xserver and xorg-server) before 1.16.3 and
1.17.x be ...)
{DSA-3160-1 DLA-218-1}
- xorg-server 2:1.16.4-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/301fd0e56b184539a239c39f7cb331105ddece28
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/301fd0e56b184539a239c39f7cb331105ddece28
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
