[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: dafdedd2 by security tracker role at 2019-11-23T08:10:14Z automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] Add CVE-2019-18622/phpmyadmin

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 5d76e3b5 by Salvatore Bonaccorso at 2019-11-23T08:29:36Z Add CVE-2019-18622/phpmyadmin - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] dla-needed: reclaim pam-python and freeimage

Hugo Lefeuvre pushed to branch master at Debian Security Tracker / security-tracker Commits: ba6e32e2 by Hugo Lefeuvre at 2019-11-23T08:26:20Z dla-needed: reclaim pam-python and freeimage - - - - - 1 changed file: - data/dla-needed.txt Changes: =

[Git][security-tracker-team/security-tracker][master] Process NFUs

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 219a624f by Salvatore Bonaccorso at 2019-11-23T08:23:47Z Process NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] 2 commits: dla-needed: update freeimage

NOTE: 20191028: submitted a patch for CVE-2019-12211, see Debian bug report + NOTE: 20191123: upstream appears to have merged a modified version of my patch -- ibus NOTE: 20191020: Fix for regression in KDE apps still not available (apo) View it on GitLab: https://salsa.debian.org

[Git][security-tracker-team/security-tracker][master] CVE-2019-18622,phpmyadmin: Mark as not affected for stable and oldstable

Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker Commits: a3ab3148 by Markus Koschany at 2019-11-23T13:15:08Z CVE-2019-18622,phpmyadmin: Mark as not affected for stable and oldstable releases According to Debians maintainer, William Desportes, Buster,

[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for CVE-2019-13566/ros-ros-comm

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8849a5c7 by Salvatore Bonaccorso at 2019-11-23T15:46:39Z Add Debian bug reference for CVE-2019-13566/ros-ros-comm - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Add CVE-2019-13566/ros-ros-comm

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 1566b495 by Salvatore Bonaccorso at 2019-11-23T08:36:01Z Add CVE-2019-13566/ros-ros-comm - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] CVE-2019-15593 fixed in gitlab 12.0.8 upstream

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 68fa4b14 by Salvatore Bonaccorso at 2019-11-23T15:33:24Z CVE-2019-15593 fixed in gitlab 12.0.8 upstream Thus included in the experimental upload of gitlab based on 12.0.8. But gitlab has not

[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for CVE-2019-18622/phpmyadmin

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c9f5f795 by Salvatore Bonaccorso at 2019-11-23T08:36:57Z Add Debian bug reference for CVE-2019-18622/phpmyadmin - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Add upstream references (ticket + and fixing commit) for CVE-2019-13390/ffmpeg

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 7acde4cc by Salvatore Bonaccorso at 2019-11-23T15:23:56Z Add upstream references (ticket + and fixing commit) for CVE-2019-13390/ffmpeg - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Replace source-package name for CVE-2019-2212

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 4814ed77 by Salvatore Bonaccorso at 2019-11-23T15:37:53Z Replace source-package name for CVE-2019-2212 Assuming the 7.0 was a typo, as there is no such source package, but instead reference

[Git][security-tracker-team/security-tracker][master] Reserve DLA-2000-1 for pam-python

ting that it is low priority for them. (roberto) -- python-reportlab (Hugo Lefeuvre) - NOTE: 20191104: still no upstream fix + NOTE: 20191123: still no upstream fix -- radare2 NOTE: 20190816: Affected by CVE-2019-14745. Vulnerable code is in View it on GitLab: https://salsa.debian.org/secu

[Git][security-tracker-team/security-tracker][master] Reserve DLA-2001-1 for libofx

Dylan Aïssi pushed to branch master at Debian Security Tracker / security-tracker Commits: a524583d by Dylan Aïssi at 2019-11-23T09:09:45Z Reserve DLA-2001-1 for libofx - - - - - 2 changed files: - data/DLA/list - data/dla-needed.txt Changes: =

[Git][security-tracker-team/security-tracker][master] dla: update libav status

with and see if the fix worked. - NOTE: 20191114: Triaging new vulnerabilities and cross-referencing with ffmpeg (Beuc) + NOTE: 20191123: Triaging new vulnerabilities, cross-referencing with ffmpeg, updating MITRE (Beuc) -- libexif NOTE: 2019: Contacted upstream for relevant commits

[Git][security-tracker-team/security-tracker][master] Correct entry for CVE-2019-18622/phpmyadmin

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 7fb07a9b by Salvatore Bonaccorso at 2019-11-23T14:37:17Z Correct entry for CVE-2019-18622/phpmyadmin There is no phpmyadmin in buster. - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] libav: tidy updated vulnerabilities

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker Commits: 8a18936e by Sylvain Beucler at 2019-11-23T11:03:10Z libav: tidy updated vulnerabilities - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] CVE-2019-13390 fixed in ffmpeg 7:4.2.1-1

Sebastian Ramacher pushed to branch master at Debian Security Tracker / security-tracker Commits: 290cf571 by Sebastian Ramacher at 2019-11-23T14:33:05Z CVE-2019-13390 fixed in ffmpeg 7:4.2.1-1 - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] no point release in jessie anymore but issue will be fixed

Thorsten Alteholz pushed to branch master at Debian Security Tracker / security-tracker Commits: e18d0d43 by Thorsten Alteholz at 2019-11-23T18:58:07Z no point release in jessie anymore but issue will be fixed - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Update information for CVE-2019-11037/php-imagick

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: a71293b5 by Salvatore Bonaccorso at 2019-11-23T20:58:56Z Update information for CVE-2019-11037/php-imagick - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Mark CVE-2019-11010057/nfdump as no-dsa

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8ea0cf71 by Salvatore Bonaccorso at 2019-11-23T20:11:23Z Mark CVE-2019-11010057/nfdump as no-dsa - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] Add CVE-2019-18790/asterisk

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 133050a2 by Salvatore Bonaccorso at 2019-11-23T20:32:45Z Add CVE-2019-18790/asterisk - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] Reserve DLA-2002-1 for libice

Thorsten Alteholz pushed to branch master at Debian Security Tracker / security-tracker Commits: 0953f907 by Thorsten Alteholz at 2019-11-23T19:02:51Z Reserve DLA-2002-1 for libice - - - - - 1 changed file: - data/DLA/list Changes: = data/DLA/list

[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for tracking tightvnc issues

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 13f7772d by Salvatore Bonaccorso at 2019-11-23T19:49:26Z Add Debian bug reference for tracking tightvnc issues Actually a bugreport referrring to please backport fixes from NixOS, but we can

[Git][security-tracker-team/security-tracker][master] Mark CVE-2018-17206/openvswitch as no-dsa for stretch

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 1538d054 by Salvatore Bonaccorso at 2019-11-23T20:20:19Z Mark CVE-2018-17206/openvswitch as no-dsa for stretch - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Mark CVE-2018-17205 as no-dsa for stretch

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 57b35c2a by Salvatore Bonaccorso at 2019-11-23T20:21:12Z Mark CVE-2018-17205 as no-dsa for stretch - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Add fixed version for CVE-2019-13566/ros-ros-comm

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 1f9e0961 by Salvatore Bonaccorso at 2019-11-23T19:46:50Z Add fixed version for CVE-2019-13566/ros-ros-comm - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for CVE-2019-1020001/yard

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 02d7da15 by Salvatore Bonaccorso at 2019-11-23T20:06:14Z Add Debian bug reference for CVE-2019-1020001/yard - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Add CVE-2019-18610/asterisk

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: e775637e by Salvatore Bonaccorso at 2019-11-23T20:34:28Z Add CVE-2019-18610/asterisk - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] Mark CVE-2017-18635/novnc as no-dsa for stretch

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: b3c37e5c by Salvatore Bonaccorso at 2019-11-23T22:58:37Z Mark CVE-2017-18635/novnc as no-dsa for stretch - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] add link to commit for fix of CVE-2019-16255 in ruby2.5

Thorsten Alteholz pushed to branch master at Debian Security Tracker / security-tracker Commits: b84b4f9f by Thorsten Alteholz at 2019-11-23T18:17:53Z add link to commit for fix of CVE-2019-16255 in ruby2.5 - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] 3 commits: mark CVE-2019-19221 as no-dsa for jessie

a patch for CVE-2019-12211, see Debian bug report NOTE: 20191123: upstream appears to have merged a modified version of my patch @@ -133,6 +135,8 @@ vino (Mike Gabriel) wordpress NOTE: 20191106: no upstream fix found for CVE-2019-17672 and CVE-2019-17674. Rest uploaded. (abhijith

[Git][security-tracker-team/security-tracker][master] Update status for CVE-2018-17205/openvswitch

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8e18a838 by Salvatore Bonaccorso at 2019-11-23T20:27:17Z Update status for CVE-2018-17205/openvswitch - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Add CVE-2019-18976/asterisk

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 3c1ed760 by Salvatore Bonaccorso at 2019-11-23T20:52:13Z Add CVE-2019-18976/asterisk - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] CVE-2019-11037/php-imagick: Reference full set of commits needed

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: f56a864d by Salvatore Bonaccorso at 2019-11-23T22:03:00Z CVE-2019-11037/php-imagick: Reference full set of commits needed - - - - - 1 changed file: - data/CVE/list Changes: