[Git][security-tracker-team/security-tracker][master] CVE-2023-0809,mosquitto: link to fixing commit

Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker Commits: 291e1209 by Markus Koschany at 2023-09-29T02:48:30+02:00 CVE-2023-0809,mosquitto: link to fixing commit https://github.com/eclipse/mosquitto/commit/a3c680fbb00a0019573fb84c29332e845e6efcad - - - -

[Git][security-tracker-team/security-tracker][master] LTS: claim python-reportlab and python-git in dla-needed.txt

Guilhem Moulin pushed to branch master at Debian Security Tracker / security-tracker Commits: 93599ecb by Guilhem Moulin at 2023-09-29T01:59:50+02:00 LTS: claim python-reportlab and python-git in dla-needed.txt - - - - - 1 changed file: - data/dla-needed.txt Changes:

[Git][security-tracker-team/security-tracker][master] Document advancement on SALT

is not present in stable/testing (rouca) + NOTE: 20230928: Backported 3002.9 first non affected by crypto flaw version + NOTE: 20230928: will need python3-saltfactories >= 0.907 (that need python3-setuptools (>= 50.3.2), python3-setuptools-scm (>= 3.4) to be investigated) + NOTE:

[Git][security-tracker-team/security-tracker][master] Add upstream bug for CVE-2023-20897

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 75c0771f by Bastien Roucariès at 2023-09-28T21:58:06+00:00 Add upstream bug for CVE-2023-20897 - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] Take salt

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 28353be3 by Bastien Roucariès at 2023-09-28T21:51:59+00:00 Take salt - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt

[Git][security-tracker-team/security-tracker][master] claim gst-plugins-bad1.0

-needed.txt = @@ -90,7 +90,7 @@ gerbv (Adrian Bunk) NOTE: 20230903: Added by Front-Desk (gladk) NOTE: 20230918: DLA coming soon. (bunk) -- -gst-plugins-bad1.0 +gst-plugins-bad1.0 (Thorsten Alteholz) NOTE: 20230928: Added by Frond-Desk (ola) -- i2p

[Git][security-tracker-team/security-tracker][master] Added gst-plugins-bad1.0 to dla-needed following decision for bookworm.

: = data/dla-needed.txt = @@ -90,6 +90,9 @@ gerbv (Adrian Bunk) NOTE: 20230903: Added by Front-Desk (gladk) NOTE: 20230918: DLA coming soon. (bunk) -- +gst-plugins-bad1.0 + NOTE: 20230928: Added by Frond-Desk (ola) +-- i2p NOTE

[Git][security-tracker-team/security-tracker][master] Reserve DSA-5507-1 for jetty9

Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker Commits: 011881fc by Markus Koschany at 2023-09-28T23:01:45+02:00 Reserve DSA-5507-1 for jetty9 - - - - - 2 changed files: - data/DSA/list - data/dsa-needed.txt Changes:

[Git][security-tracker-team/security-tracker][master] Added exim4 to dla-needed following decision for bookworm.

: = data/dla-needed.txt = @@ -66,6 +66,9 @@ dogecoin exiv2 NOTE: 20230906: Added by Front-Desk (lamby) -- +exim4 + NOTE: 20230928: Added by Front-Desk (ola) +-- firefox-esr (Emilio) NOTE: 20230926: Added by pochu NOTE: 20230926: updating

[Git][security-tracker-team/security-tracker][master] CVE-2023-36479,jetty9: mark it as fixed in unstable

Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker Commits: cfd1c79c by Markus Koschany at 2023-09-28T22:51:25+02:00 CVE-2023-36479,jetty9: mark it as fixed in unstable Upstream just declared the CGI class as deprecated and it will finally be removed in the

[Git][security-tracker-team/security-tracker][master] Add Debian bug reference for libvpx issue

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 9a71702c by Salvatore Bonaccorso at 2023-09-28T22:46:56+02:00 Add Debian bug reference for libvpx issue - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Change order of commits for libvpx

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 3d2d6648 by Salvatore Bonaccorso at 2023-09-28T22:40:53+02:00 Change order of commits for libvpx - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: da2beb27 by Salvatore Bonaccorso at 2023-09-28T22:28:31+02:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] Process two NFUs

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: fa391c52 by Salvatore Bonaccorso at 2023-09-28T22:22:50+02:00 Process two NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: b7411d10 by security tracker role at 2023-09-28T20:12:26+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] Update information for CVE-2023-5217/libvpx

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 3bd3d19d by Salvatore Bonaccorso at 2023-09-28T21:35:56+02:00 Update information for CVE-2023-5217/libvpx - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] glibc spu

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: 35f1d318 by Moritz Mühlenhoff at 2023-09-28T20:56:40+02:00 glibc spu - - - - - 1 changed file: - data/next-point-update.txt Changes: =

[Git][security-tracker-team/security-tracker][master] LTS: claim qemu in dla-needed.txt

Sean Whitton pushed to branch master at Debian Security Tracker / security-tracker Commits: f7c4f907 by Sean Whitton at 2023-09-28T19:50:59+01:00 LTS: claim qemu in dla-needed.txt - - - - - 1 changed file: - data/dla-needed.txt Changes: =

[Git][security-tracker-team/security-tracker][master] firefox-esr DSA

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: c6d31c45 by Moritz Mühlenhoff at 2023-09-28T20:46:57+02:00 firefox-esr DSA - - - - - 1 changed file: - data/DSA/list Changes: = data/DSA/list

[Git][security-tracker-team/security-tracker][master] Add exim4 to dsa-needed list

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8d2ed4dd by Salvatore Bonaccorso at 2023-09-28T20:44:58+02:00 Add exim4 to dsa-needed list - - - - - 1 changed file: - data/dsa-needed.txt Changes: =

[Git][security-tracker-team/security-tracker][master] Add gst-plugins-bad1.0 to dsa-needed list

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: a153bdce by Salvatore Bonaccorso at 2023-09-28T20:43:28+02:00 Add gst-plugins-bad1.0 to dsa-needed list - - - - - 1 changed file: - data/dsa-needed.txt Changes:

[Git][security-tracker-team/security-tracker][master] CVE-2020-18768/tiff: fix was shipped in DLA-2777-1 through CVE-2020-19144

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker Commits: a43b2d24 by Sylvain Beucler at 2023-09-28T20:23:31+02:00 CVE-2020-18768/tiff: fix was shipped in DLA-2777-1 through CVE-2020-19144 Im not convinced we fixed CVE-2020-19144 actually, but its

[Git][security-tracker-team/security-tracker][master] dla: retake suricata

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: ab2f223f by Adrian Bunk at 2023-09-28T20:05:28+03:00 dla: retake suricata - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt

[Git][security-tracker-team/security-tracker][master] Add comment for CVE-2023-4738

Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 1892a46c by Bastien Roucariès at 2023-09-28T14:27:08+00:00 Add comment for CVE-2023-4738 - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2023-32409 is fixed in wpewebkit 2.42.0-1

Alberto Garcia pushed to branch master at Debian Security Tracker / security-tracker Commits: 2f32a089 by Alberto Garcia at 2023-09-28T16:05:23+02:00 CVE-2023-32409 is fixed in wpewebkit 2.42.0-1 - - - - - 1fa4a827 by Alberto Garcia at 2023-09-28T16:05:24+02:00 webkit2gtk / wpewebkit

[Git][security-tracker-team/security-tracker][master] Add firefox, firefox-esr to CVE-2023-5217

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 92650138 by Salvatore Bonaccorso at 2023-09-28T16:04:02+02:00 Add firefox, firefox-esr to CVE-2023-5217 Mark libvpx as undetermined for now, as the underlying issue seems to be in src:libvpx

[Git][security-tracker-team/security-tracker][master] chromium fixed in sid

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker Commits: baa5e206 by Moritz Muehlenhoff at 2023-09-28T14:06:40+02:00 chromium fixed in sid - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] Reserve DLA-3586-1 for ncurses

Sean Whitton pushed to branch master at Debian Security Tracker / security-tracker Commits: 721a0925 by Sean Whitton at 2023-09-28T12:45:28+01:00 Reserve DLA-3586-1 for ncurses - - - - - 2 changed files: - data/DLA/list - data/dla-needed.txt Changes:

[Git][security-tracker-team/security-tracker][master] LTS: mark another buster ncurses fixed version

Sean Whitton pushed to branch master at Debian Security Tracker / security-tracker Commits: 065cd5fc by Sean Whitton at 2023-09-28T12:10:40+01:00 LTS: mark another buster ncurses fixed version - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] LTS: mark two more buster ncurses fixed versions

Sean Whitton pushed to branch master at Debian Security Tracker / security-tracker Commits: 4d9a0712 by Sean Whitton at 2023-09-28T12:06:15+01:00 LTS: mark two more buster ncurses fixed versions - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] CVE-2022-1354/tiff: reference introductory commit

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker Commits: e04ba347 by Sylvain Beucler at 2023-09-28T12:46:21+02:00 CVE-2022-1354/tiff: reference introductory commit (using git-bisect and poc.zip from https://gitlab.com/libtiff/libtiff/-/issues/319) - - -

[Git][security-tracker-team/security-tracker][master] Update status for CVE-2016-1243 and CVE-2016-1244

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 4dfa1dd5 by Salvatore Bonaccorso at 2023-09-28T11:01:46+02:00 Update status for CVE-2016-1243 and CVE-2016-1244 While the security fixed did include the CVE patches, the upload to unstable

[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 042f62b5 by Salvatore Bonaccorso at 2023-09-28T10:42:13+02:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] Remove notes from CVE-2023-5129

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c02c9dca by Salvatore Bonaccorso at 2023-09-28T10:27:47+02:00 Remove notes from CVE-2023-5129 - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] automatic update

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 9acddbd3 by security tracker role at 2023-09-28T08:12:20+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] Add new exim4 issues

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 168e3026 by Salvatore Bonaccorso at 2023-09-28T09:23:49+02:00 Add new exim4 issues - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list

[Git][security-tracker-team/security-tracker][master] Add CVE-2023-4047{4,5,6}/gst-plugins-bad1.0

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: d58af468 by Salvatore Bonaccorso at 2023-09-28T09:14:10+02:00 Add CVE-2023-4047{4,5,6}/gst-plugins-bad1.0 - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Add thunderbird to dsa-needed and assign to jmm

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 74437ed9 by Salvatore Bonaccorso at 2023-09-28T08:55:21+02:00 Add thunderbird to dsa-needed and assign to jmm - - - - - 1 changed file: - data/dsa-needed.txt Changes:

[Git][security-tracker-team/security-tracker][master] Track fixed version for thunderbird issues fixed via unstable

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 6690d370 by Salvatore Bonaccorso at 2023-09-28T08:54:06+02:00 Track fixed version for thunderbird issues fixed via unstable - - - - - 1 changed file: - data/CVE/list Changes:

[Git][security-tracker-team/security-tracker][master] Add new thunderbird issues from mfsa2023-43

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 4cbb244e by Salvatore Bonaccorso at 2023-09-28T08:51:16+02:00 Add new thunderbird issues from mfsa2023-43 While at it, upstream has updated the CVE-2023-5168 entry to mark it only affecting

[Git][security-tracker-team/security-tracker][master] Process one additional NFU

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: ba9c3f52 by Salvatore Bonaccorso at 2023-09-28T08:44:19+02:00 Process one additional NFU - - - - - 1 changed file: - data/CVE/list Changes: =

[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: b1ac19b8 by Salvatore Bonaccorso at 2023-09-28T08:25:39+02:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list