Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
89ead2a8 by Moritz Muehlenhoff at 2023-06-19T17:40:13+02:00
bullseye/bookworm triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -809,6 +809,8 @@ CVE-2015-10118 (A vulnerability classified as problematic
was found in cchetanon
NOT-FOR-US: WordPress plugin
CVE-2023-3195 (A stack-based buffer overflow issue was found in ImageMagick's
coders/ ...)
- imagemagick <unfixed>
+ [bookworm] - imagemagick <no-dsa> (Minor issue)
+ [bullseye] - imagemagick <no-dsa> (Minor issue)
[buster] - imagemagick <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/05/29/1
NOTE: ImageMagick6:
https://github.com/ImageMagick/ImageMagick6/commit/85a370c79afeb45a97842b0959366af5236e9023
(6.9.12-26)
@@ -1363,6 +1365,8 @@ CVE-2023-33477 (In Harmonic NSG 9000-6G devices, an
authenticated remote user ca
NOT-FOR-US: Harmonic NSG 9000-6G devices
CVE-2023-33460 (There's a memory leak in yajl 2.1.0 with use of
yajl_tree_parse functi ...)
- yajl <unfixed>
+ [bookworm] - yajl <no-dsa> (Minor issue)
+ [bullseye] - yajl <no-dsa> (Minor issue)
[buster] - yajl <postponed> (Minor issue)
NOTE: https://github.com/lloyd/yajl/issues/250
CVE-2023-33457 (In Sogou Workflow v0.10.6, memcpy a negtive size in
URIParser::parse , ...)
@@ -2563,6 +2567,8 @@ CVE-2023-27529 (Wacom Tablet Driver installer prior to
6.4.2-1 (for macOS) conta
NOT-FOR-US: Wacom Tablet Driver installer
CVE-2023-XXXX [Block themes parsing shortcodes in user-generated data]
- wordpress 6.2.2+dfsg1-1 (bug #1036689)
+ [bookworm] - wordpress <postponed> (Minor issue, fix along in future
update)
+ [bullseye] - wordpress <postponed> (Minor issue, fix along in future
update)
NOTE:
https://wordpress.org/news/2023/05/wordpress-6-2-2-security-release/
CVE-2023-33983 (The Introduction Client in Briar through 1.5.3 does not
implement out- ...)
- briar <itp> (bug #1019932)
@@ -3135,6 +3141,8 @@ CVE-2023-2756 (SQL Injection in GitHub repository
pimcore/customer-data-framewor
NOT-FOR-US: pimcore
CVE-2023-2745 (WordPress Core is vulnerable to Directory Traversal in versions
up to, ...)
- wordpress 6.2.1+dfsg1-1 (bug #1036296)
+ [bookworm] - wordpress <postponed> (Minor issue, fix along in future
update)
+ [bullseye] - wordpress <postponed> (Minor issue, fix along in future
update)
NOTE: https://core.trac.wordpress.org/changeset?old=55765&new=55765
NOTE:
https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/
CVE-2023-2679 (Data leakage in Adobe connector in Snow Software SPE 9.27.0 on
Windows ...)
@@ -9342,6 +9350,7 @@ CVE-2012-10010 (A vulnerability was found in BestWebSoft
Contact Form 3.21. It h
NOT-FOR-US: WordPress plugin
CVE-2023-32665 [GVariant deserialisation does not match spec for non-normal
data]
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2121
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -9351,6 +9360,7 @@ CVE-2023-32665 [GVariant deserialisation does not match
spec for non-normal data
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2841
CVE-2023-32611 [g_variant_byteswap() can take a long time with some non-normal
inputs]
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2797
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -9360,6 +9370,7 @@ CVE-2023-32611 [g_variant_byteswap() can take a long time
with some non-normal i
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2841
CVE-2023-29499 [GVariant offset table entry size is not checked in is_normal()]
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2794
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -11895,6 +11906,7 @@ CVE-2023-28766 (A vulnerability has been identified in
SIPROTEC 5 6MD85 (CP300)
CVE-2023-25180
RESERVED
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE:
https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -11906,6 +11918,7 @@ CVE-2023-25180
CVE-2023-24593
RESERVED
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE:
https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -22189,6 +22202,8 @@ CVE-2023-25441
RESERVED
CVE-2023-25440 (Stored Cross Site Scripting (XSS) vulnerability in the add
contact fun ...)
- civicrm <unfixed> (bug #1036695)
+ [bullseye] - civicrm <no-dsa> (Minor issue)
+ NOTE:
https://packetstormsecurity.com/files/172470/CiviCRM-5.59.alpha1-Cross-Site-Scripting.html
CVE-2023-25439 (Stored Cross Site Scripting (XSS) vulnerability in Square Pig
FusionIn ...)
NOT-FOR-US: Square Pig FusionInvoice
CVE-2023-25438 (An issue was discovered in Genomedics MilleGP5 5.9.2, allows
remote at ...)
@@ -102890,6 +102905,7 @@ CVE-2022-24725 (Shescape is a shell escape package
for JavaScript. An issue in v
NOT-FOR-US: Node shescape
CVE-2022-24724 (cmark-gfm is GitHub's extended version of the C reference
implementati ...)
- cmark-gfm 0.29.0.gfm.3-3 (bug #1006756)
+ [bullseye] - cmark-gfm <no-dsa> (Minor issue)
[buster] - cmark-gfm <no-dsa> (Minor issue)
- ghostwriter 2.1.6+ds-1 (bug #1006757)
[bullseye] - ghostwriter <not-affected> (Vulnerable code not present)
@@ -112123,6 +112139,7 @@ CVE-2021-45986 (Tenda routers G1 and G3
v15.11.0.17(9502)_CN were discovered to
NOT-FOR-US: Tenda routers
CVE-2021-45985 (In Lua 5.4.3, an erroneous finalizer called during a tail call
leads t ...)
- lua5.4 5.4.4-1
+ [bullseye] - lua5.4 <no-dsa> (Minor issue)
- lua5.3 <not-affected> (Specific to 5.4)
- lua5.2 <not-affected> (Specific to 5.4)
- lua5.1 <not-affected> (Specific to 5.4)
=====================================
data/dsa-needed.txt
=====================================
@@ -30,6 +30,8 @@ nbconvert/oldstable
--
maradns/oldstable
--
+minidlna
+--
netatalk/oldstable
open regression with MacOS, tentative patch not yet merged upstream
See discussion on team mailing list.
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89ead2a89eecdb02380832be6bd962e064a906b7
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89ead2a89eecdb02380832be6bd962e064a906b7
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
