Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
54d00f8b by security tracker role at 2024-03-23T20:11:48+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,13 @@
+CVE-2024-2849 (A vulnerability classified as critical was found in
SourceCodester Sim ...)
+ TODO: check
+CVE-2024-24840 (Missing Authorization vulnerability in BdThemes Element Pack
Elementor ...)
+ TODO: check
+CVE-2024-24835 (Missing Authorization vulnerability in realmag777 BEAR.This
issue affe ...)
+ TODO: check
+CVE-2024-24832 (Missing Authorization vulnerability in Metagauss
EventPrime.This issue ...)
+ TODO: check
+CVE-2024-1603 (confirmed)
+ TODO: check
CVE-2024-2832 (A vulnerability classified as problematic was found in
Campcodes Onlin ...)
NOT-FOR-US: Campcodes Online Shopping System
CVE-2024-2688 (The EmbedPress \u2013 Embed PDF, Google Docs, Vimeo, Wistia,
Embed You ...)
@@ -66,6 +76,7 @@ CVE-2024-2228 (This vulnerability allows an authenticated
user to perform a Life
CVE-2024-2227 (This vulnerability allows access to arbitrary files in the
application ...)
NOT-FOR-US: Sailpoint
CVE-2024-29944 (An attacker was able to inject an event handler into a
privileged obje ...)
+ {DSA-5645-1}
- firefox 124.0.1-1 (bug #1067523)
- firefox-esr 115.9.1esr-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-15/#CVE-2024-29944
@@ -1047,7 +1058,7 @@ CVE-2024-27439 (An error in the evaluation of the fetch
metadata headers could a
CVE-2024-24683 (Improper Input Validation vulnerability in Apache Hop
Engine.This issu ...)
NOT-FOR-US: Apache Hop Engine
CVE-2024-2616 (To harden ICU against exploitation, the behavior for
out-of-memory con ...)
- {DSA-5644-1 DSA-5643-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1}
- firefox-esr 115.9.0esr-1
- thunderbird 1:115.9.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2024-2616
@@ -1056,7 +1067,7 @@ CVE-2024-2615 (Memory safety bugs present in Firefox 123.
Some of these bugs sho
- firefox 124.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-12/#CVE-2024-2615
CVE-2024-2614 (Memory safety bugs present in Firefox 123, Firefox ESR 115.8,
and Thun ...)
- {DSA-5644-1 DSA-5643-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1}
- firefox 124.0-1
- firefox-esr 115.9.0esr-1
- thunderbird 1:115.9.0-1
@@ -1067,7 +1078,7 @@ CVE-2024-2613 (Data was not properly sanitized when
decoding a QUIC ACK frame; t
- firefox 124.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-12/#CVE-2024-2613
CVE-2024-2612 (If an attacker could find a way to trigger a particular code
path in ` ...)
- {DSA-5644-1 DSA-5643-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1}
- firefox 124.0-1
- firefox-esr 115.9.0esr-1
- thunderbird 1:115.9.0-1
@@ -1075,7 +1086,7 @@ CVE-2024-2612 (If an attacker could find a way to trigger
a particular code path
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2024-2612
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-14/#CVE-2024-2612
CVE-2024-2611 (A missing delay on when pointer lock was used could have
allowed a mal ...)
- {DSA-5644-1 DSA-5643-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1}
- firefox 124.0-1
- firefox-esr 115.9.0esr-1
- thunderbird 1:115.9.0-1
@@ -1083,7 +1094,7 @@ CVE-2024-2611 (A missing delay on when pointer lock was
used could have allowed
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2024-2611
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-14/#CVE-2024-2611
CVE-2024-2610 (Using a markup injection an attacker could have stolen nonce
values. T ...)
- {DSA-5644-1 DSA-5643-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1}
- firefox 124.0-1
- firefox-esr 115.9.0esr-1
- thunderbird 1:115.9.0-1
@@ -1094,7 +1105,7 @@ CVE-2024-2609 (The permission prompt input delay could
have expired while the wi
- firefox 124.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-12/#CVE-2024-2609
CVE-2024-2608 (`AppendEncodedAttributeValue(),
ExtraSpaceNeededForAttrEncoding()` and ...)
- {DSA-5644-1 DSA-5643-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1}
- firefox 124.0-1
- firefox-esr 115.9.0esr-1
- thunderbird 1:115.9.0-1
@@ -1102,7 +1113,7 @@ CVE-2024-2608 (`AppendEncodedAttributeValue(),
ExtraSpaceNeededForAttrEncoding()
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-13/#CVE-2024-2608
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-14/#CVE-2024-2608
CVE-2024-2607 (Return registers were overwritten which could have allowed an
attacker ...)
- {DSA-5644-1 DSA-5643-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1}
- firefox 124.0-1
- firefox-esr 115.9.0esr-1
- thunderbird 1:115.9.0-1
@@ -1633,6 +1644,7 @@ CVE-2021-47155 (The Net::IPV4Addr module 0.10 for Perl
does not properly conside
[buster] - libnetwork-ipv4addr-perl <postponed> (Minor issue, revisit
when fix is available)
NOTE:
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/#net-ipv4addrhttpsmetacpanorgreleasenet-ipv4addr
CVE-2021-47154 (The Net::CIDR::Lite module before 0.22 for Perl does not
properly cons ...)
+ {DLA-3770-1}
- libnet-cidr-lite-perl 0.22-1
NOTE:
https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/#net-cidr-litehttpsmetacpanorgreleasenet-cidr-lite
NOTE:
https://github.com/stigtsp/Net-CIDR-Lite/commit/23b6ff0590dc279521863a502e890ef19a5a76fc
(0.22)
@@ -4470,7 +4482,7 @@ CVE-2024-20830 (Incorrect default permission in AppLock
prior to SMR MAr-2024 Re
CVE-2024-20829 (Missing proper interaction for opening deeplink in Samsung
Internet pr ...)
NOT-FOR-US: Samsung
CVE-2024-1936 (The encrypted subject of an email message could be incorrectly
and per ...)
- {DSA-5644-1}
+ {DSA-5644-1 DLA-3769-1}
- thunderbird 1:115.8.1-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-11/#CVE-2024-1936
CVE-2024-1782 (The Blue Triad EZAnalytics plugin for WordPress is vulnerable
to Refle ...)
@@ -14232,7 +14244,7 @@ CVE-2024-0744 (In some circumstances, JIT compiled code
could have dereferenced
- firefox 122.0-1
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2024-01/#CVE-2024-0744
CVE-2024-0743 (An unchecked return value in TLS handshake code could have
caused a po ...)
- {DSA-5644-1 DSA-5643-1 DLA-3757-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1 DLA-3757-1}
- firefox 122.0-1
- firefox-esr 115.9.0esr-1
- nss 2:3.96.1-1
@@ -30977,7 +30989,7 @@ CVE-2023-39333
NOTE:
https://nodejs.org/en/blog/vulnerability/october-2023-security-releases#code-injection-via-webassembly-export-names-low---cve-2023-39333
NOTE:
https://github.com/nodejs/node/commit/eaf9083cf1e43bd897ac8244dcc0f4e3500150ca
CVE-2023-5388 (NSS was susceptible to a timing side-channel attack when
performing RS ...)
- {DSA-5644-1 DSA-5643-1 DLA-3757-1}
+ {DSA-5644-1 DSA-5643-1 DLA-3769-1 DLA-3757-1}
- firefox 124.0-1
- firefox-esr 115.9.0esr-1
- nss 2:3.98-1 (bug #1056284)
@@ -200022,8 +200034,8 @@ CVE-2021-33635 (When malicious images are pulled by
isula pull, attackers can ex
NOT-FOR-US: OpenEuler iSulad
CVE-2021-33634 (iSulad uses the lcr+lxc runtime (default) to run malicious
images, whi ...)
NOT-FOR-US: OpenEuler lcr
-CVE-2021-33633
- RESERVED
+CVE-2021-33633 (Improper Neutralization of Special Elements used in an OS
Command ('OS ...)
+ TODO: check
CVE-2021-33632
RESERVED
CVE-2021-33631 (Integer Overflow or Wraparound vulnerability in openEuler
kernel on Li ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/54d00f8b8e9846ba3ca4586c4034138b34b0b735
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/54d00f8b8e9846ba3ca4586c4034138b34b0b735
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
