Thorsten Alteholz pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
b427d65e by Thorsten Alteholz at 2021-07-25T19:03:14+02:00
mark CVE-2021-36976 as not-affected for Stretch
- - - - -
f2f8a18e by Thorsten Alteholz at 2021-07-25T19:39:09+02:00
mark CVE-2020-36430 as not-affected
- - - - -
8eab5399 by Thorsten Alteholz at 2021-07-25T19:42:43+02:00
mark several CVEs for libcommons-compress-java as no-dsa in Stretch
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -969,6 +969,7 @@ CVE-2021-36976 (libarchive 3.4.1 through 3.5.1 has a
use-after-free in copy_stri
- libarchive <unfixed> (bug #991442)
[bullseye] - libarchive <no-dsa> (Minor issue)
[buster] - libarchive <no-dsa> (Minor issue)
+ [stretch] - libarchive <not-affected> (Vulnerable code introduced by
47bb818 in version 3.4.1)
NOTE: https://github.com/libarchive/libarchive/issues/1554
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32375
NOTE:
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libarchive/OSV-2021-557.yaml
@@ -1316,6 +1317,7 @@ CVE-2020-36431 (Unicorn Engine 1.0.2 has an out-of-bounds
write in helper_wfe_ar
NOT-FOR-US: Unicorn Engine
CVE-2020-36430 (libass 0.15.x before 0.15.1 has a heap-based buffer overflow
in decode ...)
- libass 1:0.15.0-2
+ [stretch] - libass <not-affected> (Vulnerable code not present)
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674
NOTE:
https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml
NOTE: Introduced by:
https://github.com/libass/libass/commit/910211f1c0078e37546f73e95306724358b89be2
(0.15.0)
@@ -2907,6 +2909,7 @@ CVE-2021-36090 (When reading a specially crafted ZIP
archive, Compress can be ma
- libcommons-compress-java <unfixed> (bug #991041)
[bullseye] - libcommons-compress-java <no-dsa> (Minor issue)
[buster] - libcommons-compress-java <no-dsa> (Minor issue)
+ [stretch] - libcommons-compress-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2021/07/13/4
CVE-2020-36416 (A stored cross scripting (XSS) vulnerability in CMS Made
Simple 2.2.14 ...)
NOT-FOR-US: CMS Made Simple
@@ -4244,16 +4247,19 @@ CVE-2021-35517 (When reading a specially crafted TAR
archive, Compress can be ma
- libcommons-compress-java <unfixed> (bug #991041)
[bullseye] - libcommons-compress-java <no-dsa> (Minor issue)
[buster] - libcommons-compress-java <no-dsa> (Minor issue)
+ [stretch] - libcommons-compress-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2021/07/13/3
CVE-2021-35516 (When reading a specially crafted 7Z archive, Compress can be
made to a ...)
- libcommons-compress-java <unfixed> (bug #991041)
[bullseye] - libcommons-compress-java <no-dsa> (Minor issue)
[buster] - libcommons-compress-java <no-dsa> (Minor issue)
+ [stretch] - libcommons-compress-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2021/07/13/2
CVE-2021-35515 (When reading a specially crafted 7Z archive, the construction
of the l ...)
- libcommons-compress-java <unfixed> (bug #991041)
[bullseye] - libcommons-compress-java <no-dsa> (Minor issue)
[buster] - libcommons-compress-java <no-dsa> (Minor issue)
+ [stretch] - libcommons-compress-java <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2021/07/13/1
CVE-2021-35514 (Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection
via the t ...)
NOT-FOR-US: Narou
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/da17668693c6435bfe809d112efd79f7f3daa851...8eab5399cc80d013f3579569826c7e72055f25b3
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/da17668693c6435bfe809d112efd79f7f3daa851...8eab5399cc80d013f3579569826c7e72055f25b3
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
