Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
36906343 by Moritz Muehlenhoff at 2023-03-21T16:51:11+01:00
bullseye triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -1147,6 +1147,7 @@ CVE-2023-28340
RESERVED
CVE-2023-28339 (OpenDoas through 6.8.2, when TIOCSTI is available, allows
privilege es ...)
- doas <removed>
+ [bullseye] - doas <no-dsa> (Minor issue)
- opendoas <unfixed>
NOTE: https://github.com/Duncaen/OpenDoas/issues/106
NOTE: https://www.openwall.com/lists/oss-security/2023/03/14/4
@@ -1717,6 +1718,7 @@ CVE-2023-1371
RESERVED
CVE-2023-1370 ([Json-smart](https://netplex.github.io/json-smart/) is a
performance f ...)
- json-smart <unfixed>
+ [bullseye] - json-smart <no-dsa> (Minor issue)
NOTE:
https://research.jfrog.com/vulnerabilities/stack-exhaustion-in-json-smart-leads-to-denial-of-service-when-parsing-malformed-json-xray-427633/
NOTE:
https://github.com/netplex/json-smart-v2/commit/5b3205d051952d3100aa0db1535f6ba6226bd87a
(2.4.9)
CVE-2023-1369 (A vulnerability was found in TG Soft Vir.IT eXplorer 9.4.86.0.
It has ...)
@@ -1829,6 +1831,7 @@ CVE-2023-28145
RESERVED
CVE-2023-28144 (KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default
configura ...)
- hotspot <unfixed>
+ [bullseye] - hotspot <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/03/14/8
NOTE: Introduced by:
https://github.com/KDAB/hotspot/commit/3b4682565f0e53f903f3ad0f3f2c0f236d382efb
(v1.3.0)
NOTE: Opt-In to allow privilege escalation (and disable by default):
@@ -4894,10 +4897,12 @@ CVE-2023-27104
RESERVED
CVE-2023-27103 (Libde265 v1.0.11 was discovered to contain a heap buffer
overflow via ...)
- libde265 <unfixed> (bug #1033257)
+ [bullseye] - libde265 <no-dsa> (Minor issue)
NOTE: https://github.com/strukturag/libde265/issues/394
NOTE:
https://github.com/strukturag/libde265/commit/d6bf73e765b7a23627bfd7a8645c143fd9097995
CVE-2023-27102 (Libde265 v1.0.11 was discovered to contain a segmentation
violation vi ...)
- libde265 <unfixed> (bug #1033257)
+ [bullseye] - libde265 <no-dsa> (Minor issue)
NOTE: https://github.com/strukturag/libde265/issues/393
NOTE:
https://github.com/strukturag/libde265/commit/0b1752abff97cb542941d317a0d18aa50cb199b1
CVE-2023-27101
@@ -6384,7 +6389,7 @@ CVE-2022-48345 (sanitize-url (aka
@braintree/sanitize-url) before 6.0.2 allows X
[bullseye] - node-mermaid <no-dsa> (Minor issue)
NOTE:
https://github.com/braintree/sanitize-url/commit/d4bdc89f1743fe3cdb7c3f24b06e4c875f349b0c
CVE-2023-26464 (** UNSUPPORTED WHEN ASSIGNED ** When using the Chainsaw or
SocketAppen ...)
- - apache-log4j1.2 <unfixed>
+ - apache-log4j1.2 <not-affected> (Only affects legacy Java releases
which Debian hasn't shipped since 2015)
NOTE: https://lists.apache.org/thread/wkx6grrcjkh86crr49p4blc1v1nflj3t
CVE-2023-0991
RESERVED
@@ -6963,6 +6968,7 @@ CVE-2023-26250
RESERVED
CVE-2023-26249 (Knot Resolver before 5.6.0 enables attackers to consume its
resources, ...)
- knot-resolver 5.6.0-1
+ [bullseye] - knot-resolver <no-dsa> (Minor issue)
NOTE: https://www.knot-resolver.cz/2023-01-26-knot-resolver-5.6.0.html
CVE-2023-26248
RESERVED
@@ -83113,12 +83119,15 @@ CVE-2022-26891 (Microsoft Edge (Chromium-based)
Elevation of Privilege Vulnerabi
NOT-FOR-US: Microsoft
CVE-2022-26061 (A heap-based buffer overflow vulnerability exists in the
gif2h5 functi ...)
- hdf5 <unfixed> (bug #1031726)
+ [bullseye] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1487
CVE-2022-25972 (An out-of-bounds write vulnerability exists in the gif2h5
functionalit ...)
- hdf5 <unfixed> (bug #1031726)
+ [bullseye] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1485
CVE-2022-25942 (An out-of-bounds read vulnerability exists in the gif2h5
functionality ...)
- hdf5 <unfixed> (bug #1031726)
+ [bullseye] - hdf5 <postponed> (Minor issue, revisit when fixed upstream)
NOTE:
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1486
CVE-2022-0935 (Host Header injection in password Reset in GitHub repository
livehelpe ...)
NOT-FOR-US: livehelperchat
=====================================
data/dsa-needed.txt
=====================================
@@ -11,6 +11,8 @@ To pick an issue, simply add your uid behind it.
If needed, specify the release by adding a slash after the name of the source
package.
+--
+cairosvg
--
gpac (aron)
--
@@ -56,6 +58,8 @@ samba
sofia-sip
Maintainer proposed debdiff for review with additional question and sent a
followup
--
+xen
+--
xrdp
needs some additional clarification, tentatively DSA worthy
maybe upgrade to 0.9.21 within bullseye?
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/369063438fa0c83376cb33e8b99f554ef1339339
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/369063438fa0c83376cb33e8b99f554ef1339339
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
