Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
dcb8207f by Moritz Muehlenhoff at 2025-04-22T16:31:59+02:00
trixie triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -4905,9 +4905,11 @@ CVE-2025-29594 (A vulnerability exists in the
errorpage.php file of the CS2-Weap
NOT-FOR-US: CS2-WeaponPaints-Website
CVE-2025-29482 (Buffer Overflow vulnerability in libheif 1.19.7 allows a local
attacke ...)
- libheif <unfixed> (bug #1103837)
- [bookworm] - libheif <no-dsa> (Minor issue)
+ [trixie] - libheif <postponed> (Minor issue, revisit when fixed
upstream)
+ [bookworm] - libheif <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - libheif <postponed> (Minor issue)
NOTE: https://github.com/lmarch2/poc/blob/main/libheif/libheif.md
+ NOTE: https://github.com/strukturag/libde265/issues/472
CVE-2025-29481 (Buffer Overflow vulnerability in libbpf 1.5.0 allows a local
attacker ...)
- libbpf <unfixed> (bug #1102672)
NOTE: https://github.com/lmarch2/poc/blob/main/libbpf/libbpf.md
@@ -55615,11 +55617,9 @@ CVE-2024-25566 (An Open-Redirect vulnerability exists
in PingAM where well-craft
CVE-2024-22066 (There is a privilege escalation vulnerability in ZTE ZXR10 ZSR
V2 inte ...)
NOT-FOR-US: ZTE
CVE-2024-10491 (A vulnerability has been identified in the Express
response.linksfunct ...)
- - node-express <unfixed> (bug #1088807)
- [bookworm] - node-express <no-dsa> (Minor issue)
- [bullseye] - node-express <postponed> (Minor issue, no public patch)
+ - node-express 4.1.1~dfsg-1 (bug #1088807)
NOTE: https://www.herodevs.com/vulnerability-directory/cve-2024-10491
- NOTE: check details, affects only <=3.21.4, so possibly fixed in
4.1.1~dfsg-1 onwards
+ NOTE: Specific to 3.x, marking first 4.x upload as fixed version
CVE-2024-10474 (Focus was incorrectly allowing internal links to utilize the
app schem ...)
- firefox <not-affected> (Only affects Firefox Focus for Android)
NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2024-60/
@@ -84442,18 +84442,21 @@ CVE-2024-6501 (A flaw was found in NetworkManager.
When a system running Network
NOTE: Fixed by:
https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/commit/79c1f8c93ad620d02f61ffa49dd3df04fca48069
(1.49.5-dev)
CVE-2023-39329 (A flaw was found in OpenJPEG. A resource exhaustion can occur
in the o ...)
- openjpeg2 <unfixed> (bug #1081910)
+ [trixie] - openjpeg2 <postponed> (Minor issue, revisit when fixed
upstream)
[bookworm] - openjpeg2 <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - openjpeg2 <no-dsa> (Minor issue)
NOTE: https://github.com/uclouvain/openjpeg/issues/1474
CVE-2023-39328 (A vulnerability was found in OpenJPEG similar to
CVE-2019-6988. This f ...)
- openjpeg2 <unfixed> (bug #1081909)
+ [trixie] - openjpeg2 <postponed> (Minor issue, revisit when fixed
upstream)
[bookworm] - openjpeg2 <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - openjpeg2 <no-dsa> (Minor issue)
NOTE: https://github.com/uclouvain/openjpeg/issues/1471
NOTE: https://github.com/uclouvain/openjpeg/pull/1470
CVE-2023-39327 (A flaw was found in OpenJPEG. Maliciously constructed pictures
can cau ...)
- openjpeg2 <unfixed> (bug #1081908)
- [bookworm] - openjpeg2 <no-dsa> (Minor issue)
+ [trixie] - openjpeg2 <postponed> (Minor issue, revisit when fixed
upstream)
+ [bookworm] - openjpeg2 <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - openjpeg2 <no-dsa> (Minor issue)
NOTE: https://github.com/uclouvain/openjpeg/issues/1472
NOTE: Partial mitigation of CVE-2023-39327 (in absence of EPH):
@@ -115299,10 +115302,9 @@ CVE-2024-27316 (HTTP/2 incoming headers exceeding
the limit are temporarily buff
NOTE:
https://httpd.apache.org/security/vulnerabilities_24.html#CVE-2024-27316
NOTE:
https://github.com/apache/httpd/commit/0d73970ec161300a55b630f71bbf72b5c41f28b9
CVE-2024-3296 (A timing-based side-channel flaw exists in the rust-openssl
package, w ...)
- - rust-openssl <unfixed> (bug #1068418)
- [bookworm] - rust-openssl <no-dsa> (Minor issue)
- [bullseye] - rust-openssl <no-dsa> (Minor issue)
- [buster] - rust-openssl <no-dsa> (Minor issue)
+ NOTE: No code changes are planned, it only provides a small wrapper
around openssl
+ NOTE: the only estimated is to explicitly document the PKCS 1v1.5
functions are insecure
+ NOTE: Was also reported as #1068418
NOTE: https://github.com/sfackler/rust-openssl/issues/2171
CVE-2024-31309 (HTTP/2 CONTINUATIONDoS attack can cause Apache Traffic Server
to consu ...)
{DSA-5659-1 DLA-3799-1}
@@ -141681,6 +141683,7 @@ CVE-2023-47261 (Dokmee ECM 7.4.6 allows remote code
execution because the respon
NOT-FOR-US: Dokmee ECM
CVE-2023-46750 (URL Redirection to Untrusted Site ('Open Redirect')
vulnerability when ...)
- shiro <unfixed> (bug #1059288)
+ [trixie] - shiro <no-dsa> (Minor issue)
[bookworm] - shiro <no-dsa> (Minor issue)
[bullseye] - shiro <no-dsa> (Minor issue)
[buster] - shiro <no-dsa> (Minor issue)
@@ -151373,7 +151376,8 @@ CVE-2023-4021 (The Modern Events Calendar lite plugin
for WordPress is vulnerabl
NOT-FOR-US: WordPress plugin
CVE-2023-46277 (please (aka pleaser) through 0.5.4 allows privilege escalation
through ...)
- rust-pleaser <unfixed> (bug #1054289)
- [bookworm] - rust-pleaser <no-dsa> (Minor issue)
+ [trixie] - rust-pleaser <ignored> (Minor issue, TIOCSTI disabled on the
kernel side)
+ [bookworm] - rust-pleaser <ignored> (Minor issue)
[bullseye] - rust-pleaser <no-dsa> (Minor issue)
NOTE: https://gitlab.com/edneville/please/-/issues/13
NOTE: https://rustsec.org/advisories/RUSTSEC-2023-0066.html
@@ -164998,6 +165002,7 @@ CVE-2023-35134 (Weintek Weincloud v0.13.6 could
allow an attacker to reset a p
NOT-FOR-US: Weincloud
CVE-2023-34478 (Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be
susceptible to a ...)
- shiro <unfixed> (bug #1051228)
+ [trixie] - shiro <no-dsa> (Minor issue)
[bookworm] - shiro <no-dsa> (Minor issue)
[bullseye] - shiro <no-dsa> (Minor issue)
[buster] - shiro <no-dsa> (Minor issue)
@@ -201066,6 +201071,7 @@ CVE-2010-10003 (A vulnerability classified as
critical was found in gesellix tit
NOT-FOR-US: gesellix titlelink
CVE-2023-22602 (When using Apache Shiro before 1.11.0 together with Spring
Boot 2.6+, ...)
- shiro <unfixed> (bug #1029039)
+ [trixie] - shiro <no-dsa> (Minor issue)
[bookworm] - shiro <no-dsa> (Minor issue)
[bullseye] - shiro <no-dsa> (Minor issue)
[buster] - shiro <postponed> (Minor issue, cf. #1029039)
@@ -228198,6 +228204,7 @@ CVE-2022-40665
REJECTED
CVE-2022-40664 (Apache Shiro before 1.10.0, Authentication Bypass
Vulnerability in Shi ...)
- shiro <unfixed> (bug #1021671)
+ [trixie] - shiro <no-dsa> (Minor issue)
[bookworm] - shiro <no-dsa> (Minor issue)
[bullseye] - shiro <no-dsa> (Minor issue)
[buster] - shiro <postponed> (Minor issue, too little detail)
@@ -250299,6 +250306,7 @@ CVE-2022-32533 (Apache Jetspeed-2 does not
sufficiently filter untrusted user in
NOT-FOR-US: Apache Portals Jetspeed
CVE-2022-32532 (Apache Shiro before 1.9.1, A RegexRequestMatcher can be
misconfigured ...)
- shiro <unfixed> (bug #1014820)
+ [trixie] - shiro <no-dsa> (Minor issue)
[bookworm] - shiro <no-dsa> (Minor issue)
[bullseye] - shiro <no-dsa> (Minor issue)
[buster] - shiro <no-dsa> (Minor issue)
@@ -300946,6 +300954,7 @@ CVE-2021-3805 (object-path is vulnerable to
Improperly Controlled Modification o
NOTE:
https://github.com/mariocasciaro/object-path/commit/4f0903fd7c832d12ccbe0d9c3d7e25d985e9e884
(v0.11.8)
CVE-2021-41303 (Apache Shiro before 1.8.0, when using Apache Shiro with Spring
Boot, a ...)
- shiro <unfixed> (bug #1014819)
+ [trixie] - shiro <no-dsa> (Minor issue)
[bookworm] - shiro <no-dsa> (Minor issue)
[bullseye] - shiro <no-dsa> (Minor issue)
[buster] - shiro <no-dsa> (Minor issue)
@@ -325312,6 +325321,7 @@ CVE-2021-31812 (In Apache PDFBox, a carefully crafted
PDF file can trigger an in
[bullseye] - libpdfbox2-java <no-dsa> (Minor issue)
[buster] - libpdfbox2-java <no-dsa> (Minor issue)
- libpdfbox-java <unfixed> (bug #991527)
+ [trixie] - libpdfbox-java <ignored> (Minor issue)
[bookworm] - libpdfbox-java <ignored> (Minor issue)
[bullseye] - libpdfbox-java <no-dsa> (Minor issue)
[buster] - libpdfbox-java <no-dsa> (Minor issue)
@@ -325323,6 +325333,7 @@ CVE-2021-31811 (In Apache PDFBox, a carefully crafted
PDF file can trigger an Ou
[bullseye] - libpdfbox2-java <no-dsa> (Minor issue)
[buster] - libpdfbox2-java <no-dsa> (Minor issue)
- libpdfbox-java <unfixed> (bug #991527)
+ [trixie] - libpdfbox-java <ignored> (Minor issue)
[bookworm] - libpdfbox-java <ignored> (Minor issue)
[bullseye] - libpdfbox-java <no-dsa> (Minor issue)
[buster] - libpdfbox-java <no-dsa> (Minor issue)
@@ -337214,6 +337225,7 @@ CVE-2021-27212 (In OpenLDAP through 2.4.57 and 2.5.x
through 2.5.1alpha, an asse
NOTE: REL_ENG 2.4.x:
https://git.openldap.org/openldap/openldap/-/commit/9badb73425a67768c09bcaed1a9c26c684af6c30
CVE-2021-27211 (steghide 0.5.1 relies on a certain 32-bit seed value, which
makes it e ...)
- steghide <unfixed> (bug #983267)
+ [trixie] - steghide <postponed> (Minor issue, revisit when fixed
upstream)
[bookworm] - steghide <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - steghide <no-dsa> (Minor issue)
[buster] - steghide <no-dsa> (Minor issue)
@@ -459631,6 +459643,7 @@ CVE-2019-12423 (Apache CXF ships with a OpenId
Connect JWK Keys service, which a
NOT-FOR-US: Apache CFX
CVE-2019-12422 (Apache Shiro before 1.4.2, when using the default "remember
me" config ...)
- shiro <unfixed> (low; bug #947945)
+ [trixie] - shiro <no-dsa> (Minor issue)
[bookworm] - shiro <no-dsa> (Minor issue)
[bullseye] - shiro <no-dsa> (Minor issue)
[buster] - shiro <no-dsa> (Minor issue)
@@ -475696,7 +475709,8 @@ CVE-2019-6989 (TP-Link TL-WR940N is vulnerable to a
stack-based buffer overflow,
NOT-FOR-US: TP-Link
CVE-2019-6988 (An issue was discovered in OpenJPEG 2.3.0. It allows remote
attackers ...)
- openjpeg2 <unfixed> (low; bug #922648)
- [bookworm] - openjpeg2 <ignored> (Minor issue)
+ [trixie] - openjpeg2 <postponed> (Minor issue, revisit when fixed
upstream)
+ [bookworm] - openjpeg2 <postponed> (Minor issue, revisit when fixed
upstream)
[bullseye] - openjpeg2 <ignored> (Minor issue)
[buster] - openjpeg2 <ignored> (Minor issue)
[stretch] - openjpeg2 <ignored> (Minor issue)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dcb8207fe094aed939709be6caaea07c8b411e68
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dcb8207fe094aed939709be6caaea07c8b411e68
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
