Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
87e0af68 by Salvatore Bonaccorso at 2022-11-17T23:08:24+01:00
Process various NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -17469,7 +17469,7 @@ CVE-2022-39835 (An issue was discovered in Gajim
through 1.4.7. The vulnerabilit
[buster] - gajim <no-dsa> (Minor issue, intrusive to backport)
NOTE:
https://dev.gajim.org/gajim/gajim/-/commit/af02c6bd53fad4e0065951597bd7ec801c002067
(1.5.0)
CVE-2022-39834 (A stored XSS vulnerability was discovered in
adminweb/ra/viewendentity ...)
- TODO: check
+ NOT-FOR-US: PrimeKey EJBCA
CVE-2022-39833
RESERVED
CVE-2022-39832 (An issue was discovered in PSPP 1.6.2. There is a heap-based
buffer ov ...)
@@ -18446,7 +18446,7 @@ CVE-2022-39385 (Discourse is the an open source
discussion platform. In some rar
CVE-2022-39384 (OpenZeppelin Contracts is a library for secure smart contract
developm ...)
NOT-FOR-US: OpenZeppelin
CVE-2022-39383 (KubeVela is an open source application delivery platform.
Users using ...)
- TODO: check
+ NOT-FOR-US: KubeVela
CVE-2022-39382 (Keystone is a headless CMS for Node.js — built with
GraphQL and ...)
NOT-FOR-US: Keystone CMS
CVE-2022-39381 (Muhammara is a node module with c/cpp bindings to modify PDF
with js f ...)
@@ -25485,7 +25485,7 @@ CVE-2022-36940
CVE-2022-36939
RESERVED
CVE-2022-36938 (DexLoader function get_stringidx_fromdex() in Redex prior to
commit 3b ...)
- TODO: check
+ NOT-FOR-US: ReDex (Android Bytecode Optimizer)
CVE-2022-36937
RESERVED
CVE-2022-36936
@@ -26554,7 +26554,7 @@ CVE-2022-36434
CVE-2022-36433
RESERVED
CVE-2022-36432 (The Preview functionality in the Amasty Blog Pro 2.10.3 plugin
for Mag ...)
- TODO: check
+ NOT-FOR-US: Amasty Blog Pro plugin for Magento
CVE-2022-36431
RESERVED
CVE-2022-36430
@@ -32502,7 +32502,7 @@ CVE-2022-34327
CVE-2022-34326 (In ambiot amb1_sdk (aka SDK for Ameba1) before 2022-06-20 on
Realtek R ...)
NOT-FOR-US: Realtek
CVE-2022-34325 (DMA transactions which are targeted at input buffers used for
the Stor ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-34324
RESERVED
CVE-2022-34323
@@ -33389,15 +33389,15 @@ CVE-2022-33987 (The got package before 12.1.0 (also
fixed in 11.8.5) for Node.js
NOTE: https://github.com/sindresorhus/got/pull/2047
NOTE: Fixed by:
https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc
(v12.1.0)
CVE-2022-33986 (DMA attacks on the parameter buffer used by the
VariableRuntimeDxe sof ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33985 (DMA transactions which are targeted at input buffers used for
the NvmE ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33984 (DMA transactions which are targeted at input buffers used for
the SdMm ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33983 (DMA transactions which are targeted at input buffers used for
the NvmE ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33982 (DMA attacks on the parameter buffer used by the
Int15ServiceSmm softwa ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33976
RESERVED
CVE-2022-33973 (Improper access control in the Intel(R) WAPI Security software
for Win ...)
@@ -33772,15 +33772,15 @@ CVE-2022-33911 (An issue was discovered in Couchbase
Server 7.x before 7.0.4. Fi
CVE-2022-33910 (An XSS vulnerability in MantisBT before 2.25.5 allows remote
attackers ...)
- mantis <removed>
CVE-2022-33909 (DMA transactions which are targeted at input buffers used for
the HddP ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33908 (DMA transactions which are targeted at input buffers used for
the SdHo ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33907 (DMA transactions which are targeted at input buffers used for
the soft ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33906 (DMA transactions which are targeted at input buffers used for
the FwBl ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33905 (DMA transactions which are targeted at input buffers used for
the Ahci ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-33904
RESERVED
CVE-2022-33903 (Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the
wedging ...)
@@ -37760,9 +37760,9 @@ CVE-2022-32269 (In Real Player 20.0.8.310, the G2
Control allows injection of un
CVE-2022-32268 (StarWind SAN and NAS v0.2 build 1914 allow remote code
execution. A fl ...)
NOT-FOR-US: StarWind SAN and NAS
CVE-2022-32267 (DMA transactions which are targeted at input buffers used for
the SmmR ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-32266 (DMA attacks on the parameter buffer used by a software SMI
handler use ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-32265 (qDecoder before 12.1.0 does not ensure that the percent
character is f ...)
NOT-FOR-US: qDecoder
CVE-2022-32264 (** UNSUPPORTED WHEN ASSIGNED ** sys/netinet/tcp_timer.h in
FreeBSD bef ...)
@@ -40845,7 +40845,7 @@ CVE-2022-31245 (mailcow before 2022-05d allows a remote
authenticated user to in
CVE-2022-31244
RESERVED
CVE-2022-31243 (Update description and links DMA transactions which are
targeted at in ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-31242
RESERVED
CVE-2022-31241
@@ -42350,13 +42350,13 @@ CVE-2022-30776 (atmail 6.5.0 allows XSS via the
index.php/admin/index/ error par
CVE-2022-30775 (xpdf 4.04 allocates excessive memory when presented with
crafted input ...)
- xpdf <not-affected> (Debian uses poppler, which is not affected)
CVE-2022-30774 (DMA attacks on the parameter buffer used by the PnpSmm driver
could ch ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-30773 (DMA attacks on the parameter buffer used by the IhisiSmm
driver could ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-30772 (Manipulation of the input address in PnpSmm function 0x52
could be use ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-30771 (Initialization function in PnpSmm could lead to SMRAM
corruption when ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-30770 (Terminalfour versions 8.3.7, 8.3.x versions prior to version
8.3.8 and ...)
NOT-FOR-US: Terminalfour
CVE-2022-30769 (Session fixation exists in ZoneMinder through 1.36.12 as an
attacker c ...)
@@ -43815,7 +43815,7 @@ CVE-2022-30285 (In Quest KACE Systems Management
Appliance (SMA) through 12.0, a
CVE-2022-30284 (** DISPUTED ** In the python-libnmap package through 0.7.2 for
Python, ...)
NOTE: Bogus python-libnmap issue
CVE-2022-30283 (In UsbCoreDxe, tampering with the contents of the USB working
buffer u ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-30282
RESERVED
CVE-2022-30281
@@ -46724,15 +46724,15 @@ CVE-2022-29281 (Notable before 1.9.0-beta.8 doesn't
effectively prevent the open
CVE-2022-29280
REJECTED
CVE-2022-29279 (Use of a untrusted pointer allows tampering with SMRAM and OS
memory i ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-29278 (Incorrect pointer checks within the NvmExpressDxe driver can
allow tam ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-29277 (Incorrect pointer checks within the the FwBlockServiceSmm
driver can a ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-29276 (SMI functions in AhciBusDxe use untrusted inputs leading to
corruption ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-29275 (In UsbCoreDxe, untrusted input may allow SMRAM or OS memory
tampering ...)
- TODO: check
+ NOT-FOR-US: Insyde
CVE-2022-29274
RESERVED
CVE-2022-29273
@@ -48193,7 +48193,7 @@ CVE-2022-28766
CVE-2022-28765
RESERVED
CVE-2022-28764 (The Zoom Client for Meetings (for Android, iOS, Linux, macOS,
and Wind ...)
- TODO: check
+ NOT-FOR-US: Zoom
CVE-2022-28763 (The Zoom Client for Meetings (for Android, iOS, Linux, macOS,
and Wind ...)
NOT-FOR-US: Zoom
CVE-2022-28762 (Zoom Client for Meetings for macOS (Standard and for IT Admin)
startin ...)
@@ -50915,9 +50915,9 @@ CVE-2022-27898
CVE-2022-27897
RESERVED
CVE-2022-27896 (Information Exposure Through Log Files vulnerability
discovered in Fou ...)
- TODO: check
+ NOT-FOR-US: Foundry Code-Workbooks
CVE-2022-27895 (Information Exposure Through Log Files vulnerability
discovered in Fou ...)
- TODO: check
+ NOT-FOR-US: Foundry
CVE-2022-27894 (The Foundry Blobster service was found to have a cross-site
scripting ...)
NOT-FOR-US: Foundry Blobster service
CVE-2022-27893 (The Foundry Magritte plugin osisoft-pi-web-connector versions
0.15.0 - ...)
@@ -57027,11 +57027,11 @@ CVE-2022-25745
CVE-2022-25744
RESERVED
CVE-2022-25743 (Memory corruption in graphics due to use-after-free while
importing gr ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25742 (Denial of service in modem due to infinite loop while parsing
IGMPv2 p ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25741 (Denial of service in WLAN due to potential null pointer
dereference wh ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25740
RESERVED
CVE-2022-25739
@@ -57059,13 +57059,13 @@ CVE-2022-25729
CVE-2022-25728
RESERVED
CVE-2022-25727 (Memory Corruption in modem due to improper length check while
copying ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25726
RESERVED
CVE-2022-25725
RESERVED
CVE-2022-25724 (Memory corruption in graphics due to buffer overflow while
validating ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25723 (Memory corruption in multimedia due to use after free during
callback ...)
NOT-FOR-US: Snapdragon
CVE-2022-25722
@@ -57093,7 +57093,7 @@ CVE-2022-25712
CVE-2022-25711
RESERVED
CVE-2022-25710 (Denial of service due to null pointer dereference when GATT is
disconn ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25709
RESERVED
CVE-2022-25708 (Memory corruption in WLAN due to buffer copy without checking
size of ...)
@@ -57155,23 +57155,23 @@ CVE-2022-25681
CVE-2022-25680 (Memory corruption in multimedia due to buffer overflow while
processin ...)
NOT-FOR-US: Snapdragon
CVE-2022-25679 (Denial of service in video due to improper access control in
broadcast ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25678
RESERVED
CVE-2022-25677
RESERVED
CVE-2022-25676 (Information disclosure in video due to buffer over-read while
parsing ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25675
RESERVED
CVE-2022-25674 (Cryptographic issues in WLAN during the group key handshake of
the WPA ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25673
RESERVED
CVE-2022-25672
RESERVED
CVE-2022-25671 (Denial of service in MODEM due to reachable assertion in
Snapdragon Mo ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25670 (Denial of service in WLAN HOST due to buffer over read while
unpacking ...)
NOT-FOR-US: Qualcomm
CVE-2022-25669 (Denial of service in video due to buffer over read while
parsing MP4 c ...)
@@ -57179,7 +57179,7 @@ CVE-2022-25669 (Denial of service in video due to
buffer over read while parsing
CVE-2022-25668 (Memory corruption in video driver due to double free while
parsing ASF ...)
NOT-FOR-US: Snapdragon
CVE-2022-25667 (Information disclosure in kernel due to improper handling of
ICMP requ ...)
- TODO: check
+ NOT-FOR-US: Snapdragon
CVE-2022-25666 (Memory corruption due to use after free in service while
trying to acc ...)
NOT-FOR-US: Snapdragon
CVE-2022-25665 (Information disclosure due to buffer over read in kernel in
Snapdragon ...)
@@ -59391,7 +59391,7 @@ CVE-2022-24944
CVE-2022-24943
RESERVED
CVE-2022-24942 (Heap based buffer overflow in HTTP Server functionality in
Micrium uC- ...)
- TODO: check
+ NOT-FOR-US: Micrium uC-HTTP
CVE-2022-24941
RESERVED
CVE-2022-24940
@@ -59399,9 +59399,9 @@ CVE-2022-24940
CVE-2022-24939
RESERVED
CVE-2022-24938 (A malformed packet causes a stack overflow in the Ember ZNet
stack. Th ...)
- TODO: check
+ NOT-FOR-US: Ember ZNet
CVE-2022-24937 (Improper Restriction of Operations within the Bounds of a
Memory Buffe ...)
- TODO: check
+ NOT-FOR-US: Ember ZNet
CVE-2022-24936 (Out-of-Bounds error in GBL parser in Silicon Labs Gecko
Bootloader ver ...)
NOT-FOR-US: Silicon Labs Gecko Bootloader
CVE-2022-24935 (Lexmark products through 2022-02-10 have Incorrect Access
Control. ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/87e0af6877b4e9f4264ddedbe0d37007e6529aaf
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/87e0af6877b4e9f4264ddedbe0d37007e6529aaf
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
