Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
d7368f17 by Moritz Muehlenhoff at 2023-12-24T20:48:00+01:00
gitlab issues fixed in sid (more to investigate)
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4738,7 +4738,7 @@ CVE-2023-4912 (An issue has been discovered in GitLab EE
affecting all versions
CVE-2023-4658 (An issue has been discovered in GitLab EE affecting all
versions start ...)
- gitlab <not-affected> (Specific to EE)
CVE-2023-4317 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-49735 (** UNSUPPORTED WHEN ASSIGNED ** The value set as the
DefaultLocaleRes ...)
- tiles <unfixed> (unimportant; bug #1057315)
NOTE: https://lists.apache.org/thread/8ktm4vxr6vvc1qsxh6ft8jzmom1zl65p
@@ -4808,11 +4808,11 @@ CVE-2023-42916 (An out-of-bounds read was addressed
with improved input validati
[bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be
sensibly backported)
NOTE: https://webkitgtk.org/security/WSA-2023-0011.html
CVE-2023-3964 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3949 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3443 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-39226 (In Delta Electronics InfraSuite Device Master v.1.0.7, a
vulnerability ...)
NOT-FOR-US: Delta Electronics
CVE-2023-6439 (A vulnerability classified as problematic was found in ZenTao
PMS 18.8 ...)
@@ -9427,13 +9427,13 @@ CVE-2023-4700 (An authorization issue affecting GitLab
EE affecting all versions
CVE-2023-5600
- gitlab <not-affected> (Specific to EE)
CVE-2023-3246 (An issue has been discovered in GitLab EE/CE affecting all
versions st ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3909 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-5825 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- gitlab <unfixed>
CVE-2023-3399 (An issue has been discovered in GitLab EE affecting all
versions start ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-5904 (Cross-site Scripting (XSS) - Stored in GitHub repository
pkp/pkp-lib p ...)
NOT-FOR-US: pkp-lib
CVE-2023-5903 (Cross-site Scripting (XSS) - Stored in GitHub repository
pkp/pkp-lib p ...)
@@ -15268,7 +15268,7 @@ CVE-2023-41657 (Auth. (admin+) Stored Cross-Site
Scripting (XSS) vulnerability i
CVE-2023-41655 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Andr ...)
NOT-FOR-US: WordPress plugin
CVE-2023-3413 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3024 (Forcing the Bluetooth LE stack to segment 'prepare write
response' pac ...)
NOT-FOR-US: Silabs
CVE-2023-39410 (When deserializing untrusted or corrupted data, it is possible
for a r ...)
@@ -15286,7 +15286,7 @@ CVE-2023-5053 (Hospital management system version
378c157 allows to bypass authe
CVE-2023-5004 (Hospital management system version 378c157 allows to bypass
authentica ...)
NOT-FOR-US: Hospital management system
CVE-2023-4532 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-4316 (Zod in version 3.22.2 allows an attacker to perform a denial of
servic ...)
NOT-FOR-US: Zod
CVE-2023-44469 (A Server-Side Request Forgery issue in the OpenID Connect
Issuer in Le ...)
@@ -15342,13 +15342,13 @@ CVE-2023-43014 (Asset Management System v1.0 is
vulnerable to an Authenticated
CVE-2023-43013 (Asset Management System v1.0 is vulnerable to an
unauthenticated SQL ...)
NOT-FOR-US: Asset Management System
CVE-2023-3979 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3922 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3920 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3917 (Denial of Service in pipelines affecting all versions of Gitlab
EE and ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3914 (A business logic error in GitLab EE affecting all versions
prior to 16 ...)
- gitlab <not-affected> (Specific to EE)
CVE-2023-3906 (An input validation issue in the asset proxy in GitLab EE,
affecting a ...)
@@ -19324,7 +19324,7 @@ CVE-2023-40771 (SQL injection vulnerability in DataEase
v.1.18.9 allows a remote
CVE-2023-40239 (Certain Lexmark devices (such as CS310) before 2023-08-25
allow XXE at ...)
NOT-FOR-US: Lexmark
CVE-2023-3210 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-39714 (Multiple cross-site scripting (XSS) vulnerabilities in Free
and Open S ...)
NOT-FOR-US: Free and Open Source Inventory Management System
CVE-2023-39710 (Multiple cross-site scripting (XSS) vulnerabilities in Free
and Open S ...)
@@ -19377,19 +19377,19 @@ CVE-2023-36076 (SQL Injection vulnerability in smanga
version 3.1.9 and earlier,
CVE-2023-34011 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Shop ...)
NOT-FOR-US: WordPress plugin
CVE-2023-4647 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3205 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-4018 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-4638
- gitlab <unfixed>
CVE-2023-4630 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3950 (An information disclosure issue in GitLab EE affecting all
versions fr ...)
- gitlab <not-affected> (Specific to EE)
CVE-2023-4378 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3915 (An issue has been discovered in GitLab EE affecting all
versions start ...)
- gitlab <not-affected> (Specific to EE)
CVE-2023-40325
@@ -19889,7 +19889,7 @@ CVE-2023-4526
CVE-2023-4525
REJECTED
CVE-2023-4522 (An issue has been discovered in GitLab affecting all versions
before 1 ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-4296 (If an attacker tricks an admin user of PTC Codebeamer into
clicking on ...)
NOT-FOR-US: PTC Codebeamer
CVE-2023-41269
@@ -23833,7 +23833,7 @@ CVE-2023-3993 (An issue has been discovered in GitLab
EE affecting all versions
CVE-2023-3994 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- gitlab 16.0.8+ds1-1
CVE-2023-3900 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-3500 (An issue has been discovered in GitLab CE/EE affecting all
versions st ...)
- gitlab 16.0.8+ds1-1
CVE-2023-3401 (An issue has been discovered in GitLab affecting all versions
before 1 ...)
@@ -34986,9 +34986,9 @@ CVE-2023-2235 (A use-after-free vulnerability in the
Linux Kernel Performance Ev
CVE-2023-2234 (Union variant confusion allows any malicious BT controller to
execute ...)
NOT-FOR-US: Zephyr
CVE-2023-2233 (An improper authorization issue has been discovered in GitLab
CE/EE af ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-2232 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-2231 (A vulnerability, which was classified as critical, was found in
MAXTEC ...)
NOT-FOR-US: MAXTECH
CVE-2023-2230
@@ -41887,7 +41887,7 @@ CVE-2023-1557 (A vulnerability was found in
SourceCodester E-Commerce System 1.0
CVE-2023-1556 (A vulnerability was found in SourceCodester Judging Management
System ...)
NOT-FOR-US: SourceCodester Judging Management System
CVE-2023-1555 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2013-10022 (A vulnerability, which was classified as problematic, has been
found i ...)
NOT-FOR-US: WordPress plugin
CVE-2023-28730 (A memory corruption vulnerability Panasonic Control FPWIN Pro
versions ...)
@@ -44604,7 +44604,7 @@ CVE-2023-1281 (Use After Free vulnerability in Linux
kernel traffic control inde
CVE-2023-1280
RESERVED
CVE-2023-1279 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-1278 (A vulnerability, which was classified as problematic, has been
found i ...)
NOT-FOR-US: IBOS
CVE-2023-1277 (A vulnerability, which was classified as critical, was found in
kylin- ...)
@@ -45077,7 +45077,7 @@ CVE-2023-1212 (Cross-site Scripting (XSS) - Stored in
GitHub repository phpipam/
CVE-2023-1211 (SQL Injection in GitHub repository phpipam/phpipam prior to
v1.5.2.)
- phpipam <itp> (bug #731713)
CVE-2023-1210 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-1209 (Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow
records ...)
NOT-FOR-US: ServiceNow
CVE-2023-1208 (This HTTP Headers WordPress plugin before 1.18.11 allows
arbitrary dat ...)
@@ -48794,7 +48794,7 @@ CVE-2023-0991
CVE-2023-0990
RESERVED
CVE-2023-0989 (An information disclosure issue in GitLab CE/EE affecting all
versions ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-0988 (A vulnerability, which was classified as problematic, has been
found i ...)
NOT-FOR-US: SourceCodester Online Pizza Ordering System
CVE-2023-0987 (A vulnerability classified as problematic was found in
SourceCodester ...)
@@ -53358,7 +53358,7 @@ CVE-2023-0634
CVE-2023-0633 (In Docker Desktop on Windows before 4.12.0 an argument
injection to in ...)
NOT-FOR-US: Docker Desktop
CVE-2023-0632 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-0631 (The Paid Memberships Pro WordPress plugin before 2.9.12 does
not preve ...)
NOT-FOR-US: WordPress plugin
CVE-2023-0630 (The Slimstat Analytics WordPress plugin before 4.9.3.3 does not
preven ...)
@@ -60037,7 +60037,7 @@ CVE-2023-0122 (A NULL pointer dereference vulnerability
in the Linux kernel NVMe
CVE-2023-0121 (A denial of service issue was discovered in GitLab CE/EE
affecting all ...)
- gitlab 15.10.8+ds1-2
CVE-2023-0120 (An issue has been discovered in GitLab affecting all versions
starting ...)
- - gitlab <unfixed>
+ - gitlab 16.4.4+ds2-2
CVE-2023-0119 (A stored Cross-site scripting vulnerability was found in
foreman. The ...)
- foreman <itp> (bug #663101)
CVE-2023-0118 (An arbitrary code execution flaw was found in Foreman. This
flaw allow ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d7368f1755d8b9ef1ac51c62b9730553abec453e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d7368f1755d8b9ef1ac51c62b9730553abec453e
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
