Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c5b15d49 by Moritz Muehlenhoff at 2024-11-29T17:25:39+01:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -250,7 +250,7 @@ CVE-2024-11738
NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0399.html
NOTE: https://github.com/rustls/rustls/issues/2227
CVE-2024-53920 (In elisp-mode.el in GNU Emacs through 30.0.92, a user who
chooses to i ...)
- - emacs <unfixed>
+ - emacs <unfixed> (bug #1088690)
[bookworm] - emacs <postponed> (Minor issue, revisit when fixed
upstream)
NOTE:
https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
NOTE:
https://yhetil.org/emacs/CAFXAjY5f4YfHAtZur1RAqH34UbYU56_t6t2Er0YEh1Sb7-W=hg%40mail.gmail.com/
@@ -279,28 +279,28 @@ CVE-2024-46055 (OpenVidReview 1.0 is vulnerable to Cross
Site Scripting (XSS) in
CVE-2024-46054 (OpenVidReview 1.0 is vulnerable to Incorrect Access Control.
The /uplo ...)
NOT-FOR-US: OpenVidReview
CVE-2024-42333 (The researcher is showing that it is possible to leak a small
amount o ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25629
CVE-2024-42332 (The researcher is showing that due to the way the SNMP trap
log is par ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25628
CVE-2024-42331 (In the src/libs/zbxembed/browser.c file, the es_browser_ctor
method re ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25627
CVE-2024-42330 (The HttpRequest object allows to get the HTTP headers from the
server' ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25626
CVE-2024-42329 (The webdriver for the Browser object expects an error object
to be ini ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: ttps://support.zabbix.com/browse/ZBX-25625
CVE-2024-42328 (When the webdriver for the Browser object downloads data from
a HTTP s ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25624
CVE-2024-42327 (A non-admin user account on the Zabbix frontend with the
default User ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25623
CVE-2024-42326 (There was discovered a use after free bug in browser.c in the
es_brows ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25622
CVE-2024-41126 (Contiki-NG is an open-source, cross-platform operating system
for IoT ...)
NOT-FOR-US: Contiki-NG
@@ -309,10 +309,10 @@ CVE-2024-41125 (Contiki-NG is an open-source,
cross-platform operating system fo
CVE-2024-37816 (Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain
a stack ...)
NOT-FOR-US: Quectel
CVE-2024-36468 (The reported vulnerability is a stack buffer overflow in the
zbx_snmp_ ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25621
CVE-2024-36464 (When exporting media types, the password is exported in the
YAML in pl ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25630
CVE-2024-31976 (EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote
attacker ...)
NOT-FOR-US: EnGenius EWS356-FIR
@@ -362,7 +362,7 @@ CVE-2024-50942 (qiwen-file v1.4.0 was discovered to contain
a SQL injection vuln
CVE-2024-43784 (lakeFS is an open-source tool that transforms object storage
into a Gi ...)
NOT-FOR-US: lakeFS
CVE-2024-36467 (An authenticated user with API access (e.g.: user with default
User ro ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25614
CVE-2024-11820 (A vulnerability, which was classified as problematic, has been
found i ...)
NOT-FOR-US: code-projects Crud Operation System
@@ -2308,32 +2308,32 @@ CVE-2024-11477 (7-Zip Zstandard Decompression Integer
Underflow Remote Code Exec
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-24-1532/
CVE-2024-11233 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26,
8.3.* before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43
NOTE:
https://github.com/php/php-src/commit/a6c84cd7efd7eaaaefd4463412508df570d35358
(php-8.2.26)
CVE-2024-11234 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26,
8.3.* before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2
NOTE:
https://github.com/php/php-src/commit/cf6700e86d6357420a7c8386da63d48fec55f633
(php-8.2.26)
CVE-2024-11236 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26,
8.3.* before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv
NOTE:
https://github.com/php/php-src/commit/7742f79a8a9c20522dbf40e1dc1d4ccad71d399c
(php-8.2.26)
NOTE:
https://github.com/php/php-src/commit/2dbe1425c5768faea2aa7bca26081dd208c94ac8
(php-8.2.26)
CVE-2024-8929 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.*
before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678
NOTE:
https://github.com/php/php-src/commit/6c0e2eb2f839d066924c164f65f17d1261529334
(php-8.2.26)
CVE-2024-8932 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.*
before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE:
https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff
NOTE:
https://github.com/php/php-src/commit/90c851a8b1dc409d074ab369acbfd318bc8aea4e
(php-8.2.26)
@@ -4315,7 +4315,7 @@ CVE-2024-10571 (The Chartify \u2013 WordPress Chart
Plugin plugin for WordPress
CVE-2024-10979 (Incorrect control of environment variables in PostgreSQL
PL/Perl allow ...)
{DSA-5812-1 DLA-3954-1}
- postgresql-17 17.1-1
- - postgresql-16 <unfixed>
+ - postgresql-16 <unfixed> (bug #1088687)
- postgresql-15 <removed>
- postgresql-13 <removed>
NOTE: https://www.postgresql.org/support/security/CVE-2024-10979/
@@ -4340,7 +4340,7 @@ CVE-2024-10979 (Incorrect control of environment
variables in PostgreSQL PL/Perl
CVE-2024-10978 (Incorrect privilege assignment in PostgreSQL allows a
less-privileged ...)
{DSA-5812-1 DLA-3954-1}
- postgresql-17 17.1-1
- - postgresql-16 <unfixed>
+ - postgresql-16 <unfixed> (bug #1088687)
- postgresql-15 <removed>
- postgresql-13 <removed>
NOTE: https://www.postgresql.org/support/security/CVE-2024-10978/
@@ -4365,7 +4365,7 @@ CVE-2024-10978 (Incorrect privilege assignment in
PostgreSQL allows a less-privi
CVE-2024-10977 (Client use of server error message in PostgreSQL allows a
server not t ...)
{DSA-5812-1 DLA-3954-1}
- postgresql-17 17.1-1
- - postgresql-16 <unfixed>
+ - postgresql-16 <unfixed> (bug #1088687)
- postgresql-15 <removed>
- postgresql-13 <removed>
NOTE: https://www.postgresql.org/support/security/CVE-2024-10977/
@@ -4378,7 +4378,7 @@ CVE-2024-10977 (Client use of server error message in
PostgreSQL allows a server
CVE-2024-10976 (Incomplete tracking in PostgreSQL of tables with row security
allows a ...)
{DSA-5812-1 DLA-3954-1}
- postgresql-17 17.1-1
- - postgresql-16 <unfixed>
+ - postgresql-16 <unfixed> (bug #1088687)
- postgresql-15 <removed>
- postgresql-13 <removed>
NOTE: https://www.postgresql.org/support/security/CVE-2024-10976/
@@ -8993,7 +8993,7 @@ CVE-2024-48272 (D-Link DSL6740C v6.TR069.20211230 was
discovered to use an insec
CVE-2024-48271 (D-Link DSL6740C v6.TR069.20211230 was discovered to use
insecure defau ...)
NOT-FOR-US: D-Link
CVE-2024-48241 (An issue in radare2 v5.8.0 through v5.9.4 allows a local
attacker to c ...)
- - radare2 <unfixed>
+ - radare2 <unfixed> (bug #1088693)
NOTE: https://github.com/radareorg/radare2/issues/23317
NOTE: https://github.com/radareorg/radare2/pull/23318
NOTE: Fixed by:
https://github.com/radareorg/radare2/commit/b2a467cd13c561042554901313ebdcb749eb0de7
(5.9.6)
@@ -10129,12 +10129,12 @@ CVE-2024-50614 (TinyXML2 through 10.0.0 has a
reachable assertion for UINT_MAX/1
[bullseye] - tinyxml2 <postponed> (Minor issue, revisit when fixed
upstream)
NOTE: https://github.com/leethomason/tinyxml2/issues/996
CVE-2024-50613 (libsndfile through 1.2.2 has a reachable assertion, that may
lead to a ...)
- - libsndfile <unfixed>
+ - libsndfile <unfixed> (bug #1088691)
[bookworm] - libsndfile <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - libsndfile <postponed> (Minor issue, revisit when fixed
upstream)
NOTE: https://github.com/libsndfile/libsndfile/issues/1034
CVE-2024-50612 (libsndfile through 1.2.2 has an ogg_vorbis.c
vorbis_analysis_wrote out ...)
- - libsndfile <unfixed>
+ - libsndfile <unfixed> (bug #1088692)
[bookworm] - libsndfile <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - libsndfile <postponed> (Minor issue, CLI DoS)
NOTE: https://github.com/libsndfile/libsndfile/issues/1035
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5b15d490ca076bd68644ed4dc555f1866c5cc33
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5b15d490ca076bd68644ed4dc555f1866c5cc33
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
