[Git][security-tracker-team/security-tracker][master] dla: take poppler
Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker Commits: abe373cd by Adrian Bunk at 2023-09-30T02:02:44+03:00 dla: take poppler - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -154,7 +154,7 @@ osslsigncode phppgadmin (Abhijith PA) NOTE: 20230925: Added by Front-Desk (apo) -- -poppler +poppler (Adrian Bunk) NOTE: 20230908: Added by Front-Desk (lamby) NOTE: 20230908: Added due to CVE-2020-23804. However, please check CVE-2020-18839 NOTE: 20230908: as I suspect this is a duplicate of CVE-2020-27778 (which has already View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abe373cdae91b004ae7cb6f9c9c43dcbbd0d6989 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/abe373cdae91b004ae7cb6f9c9c43dcbbd0d6989 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Update information on CVE-2023-5217
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
0719c06c by Salvatore Bonaccorso at 2023-09-29T23:49:54+02:00
Update information on CVE-2023-5217
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -369,14 +369,15 @@ CVE-2023-5217 (Heap buffer overflow in vp8 encoding in
libvpx in Google Chrome p
[buster] - chromium (see DSA 5046)
- firefox (unimportant)
- firefox-esr (unimportant)
+ - thunderbird 1:115.3.1-1 (unimportant)
- libvpx 1.12.0-1.1 (bug #1053182)
NOTE:
https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/#CVE-2023-5217
NOTE: https://www.openwall.com/lists/oss-security/2023/09/28/5
NOTE: Fixed by (libvpx):
https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282
NOTE: Fixed by (libvpx):
https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590
NOTE:
https://hg.mozilla.org/mozilla-central/rev/c53f5ef77b62b79af86951a7f9130e1896b695d2
- NOTE: src:firefox and firefox-esr use the system libvpx starting in
bookworm and above. For
- NOTE: older releases still needs the fixes in src:firefox-esr.
+ NOTE: src:firefox, src:firefox-esr and src:thunderbird use the system
libvpx starting in bookworm
+ NOTE: and above. For older releases still needs the fixes in
src:firefox-esr and src:thunderbird.
CVE-2023-5187 (Use after free in Extensions in Google Chrome prior to
117.0.5938.132 ...)
{DSA-5508-1}
- chromium 117.0.5938.132-1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0719c06c1405a7473c6e41e39415e25683b83ecb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0719c06c1405a7473c6e41e39415e25683b83ecb
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Track pypy3 for now as well for CVE-2023-40217
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: e65b69f4 by Salvatore Bonaccorso at 2023-09-29T23:46:47+02:00 Track pypy3 for now as well for CVE-2023-40217 - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -5110,6 +5110,7 @@ CVE-2023-40217 (An issue was discovered in Python before 3.8.18, 3.9.x before 3. - python3.7 - python2.7 [bullseye] - python2.7 (Unsupported in Bullseye, only included to build a few applications) + - pypy3 7.3.13+dfsg-1 NOTE: https://mail.python.org/archives/list/security-annou...@python.org/thread/PEPLII27KYHLF4AK3ZQGKYNCRERG4YXY/ NOTE: https://github.com/python/cpython/issues/108310 NOTE: https://github.com/python/cpython/pull/108315 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e65b69f45d5f2887e1aa8c2416fc51cdf3ac1807 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e65b69f45d5f2887e1aa8c2416fc51cdf3ac1807 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add a note about ring for dla-needed
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 58223836 by Bastien Roucariès at 2023-09-29T21:22:22+00:00 Add a note about ring for dla-needed - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -201,6 +201,7 @@ rails -- ring NOTE: 20230903: Added by Front-Desk (gladk) + NOTE: 20230928: will be likely hard to fix see https://lists.debian.org/debian-lts/2023/09/msg00035.html (rouca) -- ruby-rmagick NOTE: 20230808: Added by Front-Desk on rouca's (imagemagick package maintainer) request (Beuc) @@ -219,6 +220,7 @@ salt (rouca) NOTE: 20230928: Backported 3002.9 first non affected by crypto flaw version NOTE: 20230928: will need python3-saltfactories >= 0.907 (that need python3-setuptools (>= 50.3.2), python3-setuptools-scm (>= 3.4) to be investigated) NOTE: 20230928: will need python3-attr (>= 19.1) may from buster-backport ? or vendored ? + NOTE: 20230928: see https://lists.debian.org/debian-lts/2023/09/msg00033.html -- samba NOTE: 20230918: Added by Front-Desk (apo) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5822383671a9bc131ef6e1afb055daa77eae5be5 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5822383671a9bc131ef6e1afb055daa77eae5be5 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reserve DSA number for libvpx update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c3defa67 by Salvatore Bonaccorso at 2023-09-29T23:04:57+02:00
Reserve DSA number for libvpx update
- - - - -
1 changed file:
- data/DSA/list
Changes:
=
data/DSA/list
=
@@ -1,3 +1,7 @@
+[29 Sep 2023] DSA-5510-1 libvpx - security update
+ {CVE-2023-5217}
+ [bullseye] - libvpx 1.9.0-1+deb11u1
+ [bookworm] - libvpx 1.12.0-1+deb12u1
[29 Sep 2023] DSA-5509-1 firefox-esr - security update
{CVE-2023-5217}
[bullseye] - firefox-esr 115.3.1esr-1~deb11u1
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c3defa6706ce8c7568faf5c376f33a469a4fa6f7
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c3defa6706ce8c7568faf5c376f33a469a4fa6f7
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 256f1313 by Salvatore Bonaccorso at 2023-09-29T23:03:24+02:00 Process some NFUs - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -3,61 +3,61 @@ CVE-2023-5289 (Allocation of Resources Without Limits or Throttling in GitHub re CVE-2023-5288 (A remote unauthorized attacker may connect to the SIM1012, interact wi ...) TODO: check CVE-2023-5287 (** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified ...) - TODO: check + NOT-FOR-US: BEECMS CVE-2023-5286 (A vulnerability, which was classified as problematic, has been found i ...) - TODO: check + NOT-FOR-US: SourceCodester Expense Tracker App CVE-2023-5285 (A vulnerability classified as critical was found in Tongda OA 2017. Af ...) - TODO: check + NOT-FOR-US: Tongda OA CVE-2023-5284 (A vulnerability classified as critical has been found in SourceCodeste ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5283 (A vulnerability was found in SourceCodester Engineers Online Portal 1. ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5282 (A vulnerability was found in SourceCodester Engineers Online Portal 1. ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5281 (A vulnerability was found in SourceCodester Engineers Online Portal 1. ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5280 (A vulnerability was found in SourceCodester Engineers Online Portal 1. ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5279 (A vulnerability has been found in SourceCodester Engineers Online Port ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5278 (A vulnerability, which was classified as critical, was found in Source ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5277 (A vulnerability, which was classified as critical, has been found in S ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5276 (A vulnerability classified as critical was found in SourceCodester Eng ...) - TODO: check + NOT-FOR-US: SourceCodester Engineers Online Portal CVE-2023-5273 (A vulnerability classified as problematic was found in SourceCodester ...) - TODO: check + NOT-FOR-US: SourceCodester Best Courier Management System CVE-2023-5272 (A vulnerability classified as critical has been found in SourceCodeste ...) - TODO: check + NOT-FOR-US: SourceCodester Best Courier Management System CVE-2023-5271 (A vulnerability was found in SourceCodester Best Courier Management Sy ...) - TODO: check + NOT-FOR-US: SourceCodester Best Courier Management System CVE-2023-5270 (A vulnerability was found in SourceCodester Best Courier Management Sy ...) - TODO: check + NOT-FOR-US: SourceCodester Best Courier Management System CVE-2023-5269 (A vulnerability was found in SourceCodester Best Courier Management Sy ...) - TODO: check + NOT-FOR-US: SourceCodester Best Courier Management System CVE-2023-5268 (A vulnerability was found in DedeBIZ 6.2 and classified as critical. T ...) - TODO: check + NOT-FOR-US: DedeBIZ CVE-2023-5267 (A vulnerability has been found in Tongda OA 2017 and classified as cri ...) - TODO: check + NOT-FOR-US: Tongda OA CVE-2023-5266 (A vulnerability, which was classified as critical, was found in DedeBI ...) - TODO: check + NOT-FOR-US: DedeBIZ CVE-2023-5265 (A vulnerability, which was classified as critical, has been found in T ...) - TODO: check + NOT-FOR-US: Tongda OA CVE-2023-5264 (A vulnerability classified as critical was found in huakecms 3.0. Affe ...) - TODO: check + NOT-FOR-US: huakecms CVE-2023-5263 (A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. ...) - TODO: check + NOT-FOR-US: ZZZCMS CVE-2023-5262 (A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classif ...) - TODO: check + NOT-FOR-US: OpenRapid RapidCMS CVE-2023-5261 (A vulnerability, which was classified as critical, was found in Tongda ...) - TODO: check + NOT-FOR-US: Tongda OA CVE-2023-5260 (A vulnerability, which was classified as critical, has been found in S ...) - TODO: check + NOT-FOR-US: SourceCodester Simple Membership System CVE-2023-5259 (A vulnerability classified as problematic was found in ForU CMS. This ...) - TODO: check + NOT-FOR-US: ForU CMS CVE-2023-5258 (A vulnerability classified as critical has been found in OpenRapid Rap ...) -
[Git][security-tracker-team/security-tracker][master] Add CVE-2023-5289/rdiffweb
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: c0439e97 by Salvatore Bonaccorso at 2023-09-29T23:02:42+02:00 Add CVE-2023-5289/rdiffweb - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,5 +1,5 @@ CVE-2023-5289 (Allocation of Resources Without Limits or Throttling in GitHub reposit ...) - TODO: check + - rdiffweb (bug #969974) CVE-2023-5288 (A remote unauthorized attacker may connect to the SIM1012, interact wi ...) TODO: check CVE-2023-5287 (** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c0439e97ce389fbf32e1bcbe06505722e6f1d7b4 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c0439e97ce389fbf32e1bcbe06505722e6f1d7b4 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 7ef0dfcf by security tracker role at 2023-09-29T20:12:42+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -1,3 +1,107 @@ +CVE-2023-5289 (Allocation of Resources Without Limits or Throttling in GitHub reposit ...) + TODO: check +CVE-2023-5288 (A remote unauthorized attacker may connect to the SIM1012, interact wi ...) + TODO: check +CVE-2023-5287 (** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified ...) + TODO: check +CVE-2023-5286 (A vulnerability, which was classified as problematic, has been found i ...) + TODO: check +CVE-2023-5285 (A vulnerability classified as critical was found in Tongda OA 2017. Af ...) + TODO: check +CVE-2023-5284 (A vulnerability classified as critical has been found in SourceCodeste ...) + TODO: check +CVE-2023-5283 (A vulnerability was found in SourceCodester Engineers Online Portal 1. ...) + TODO: check +CVE-2023-5282 (A vulnerability was found in SourceCodester Engineers Online Portal 1. ...) + TODO: check +CVE-2023-5281 (A vulnerability was found in SourceCodester Engineers Online Portal 1. ...) + TODO: check +CVE-2023-5280 (A vulnerability was found in SourceCodester Engineers Online Portal 1. ...) + TODO: check +CVE-2023-5279 (A vulnerability has been found in SourceCodester Engineers Online Port ...) + TODO: check +CVE-2023-5278 (A vulnerability, which was classified as critical, was found in Source ...) + TODO: check +CVE-2023-5277 (A vulnerability, which was classified as critical, has been found in S ...) + TODO: check +CVE-2023-5276 (A vulnerability classified as critical was found in SourceCodester Eng ...) + TODO: check +CVE-2023-5273 (A vulnerability classified as problematic was found in SourceCodester ...) + TODO: check +CVE-2023-5272 (A vulnerability classified as critical has been found in SourceCodeste ...) + TODO: check +CVE-2023-5271 (A vulnerability was found in SourceCodester Best Courier Management Sy ...) + TODO: check +CVE-2023-5270 (A vulnerability was found in SourceCodester Best Courier Management Sy ...) + TODO: check +CVE-2023-5269 (A vulnerability was found in SourceCodester Best Courier Management Sy ...) + TODO: check +CVE-2023-5268 (A vulnerability was found in DedeBIZ 6.2 and classified as critical. T ...) + TODO: check +CVE-2023-5267 (A vulnerability has been found in Tongda OA 2017 and classified as cri ...) + TODO: check +CVE-2023-5266 (A vulnerability, which was classified as critical, was found in DedeBI ...) + TODO: check +CVE-2023-5265 (A vulnerability, which was classified as critical, has been found in T ...) + TODO: check +CVE-2023-5264 (A vulnerability classified as critical was found in huakecms 3.0. Affe ...) + TODO: check +CVE-2023-5263 (A vulnerability was found in ZZZCMS 2.1.7 and classified as critical. ...) + TODO: check +CVE-2023-5262 (A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classif ...) + TODO: check +CVE-2023-5261 (A vulnerability, which was classified as critical, was found in Tongda ...) + TODO: check +CVE-2023-5260 (A vulnerability, which was classified as critical, has been found in S ...) + TODO: check +CVE-2023-5259 (A vulnerability classified as problematic was found in ForU CMS. This ...) + TODO: check +CVE-2023-5258 (A vulnerability classified as critical has been found in OpenRapid Rap ...) + TODO: check +CVE-2023-5257 (A vulnerability was found in WhiteHSBG JNDIExploit 1.4 on Windows. It ...) + TODO: check +CVE-2023-5196 (Mattermost fails to enforce character limits in all possible notificat ...) + TODO: check +CVE-2023-5195 (Mattermost fails to properly validate the permissions when soft deleti ...) + TODO: check +CVE-2023-5194 (Mattermost fails to properly validate permissions when demoting and de ...) + TODO: check +CVE-2023-5193 (Mattermost fails to properly check permissions when retrieving a post ...) + TODO: check +CVE-2023-5159 (Mattermost fails to properly verify the permissions when managing/upda ...) + TODO: check +CVE-2023-43944 (A Stored Cross Site Scripting (XSS) vulnerability was found in SourceC ...) + TODO: check +CVE-2023-43909 (Hospital Management System thru commit 4770d was discovered to contain ...) + TODO: check +CVE-2023-43655 (Composer is a dependency manager for PHP. Users publishing a composer. ...) + TODO: check +CVE-2023-41691 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Pensopay ...) + TODO: check +CVE-2023-41687 (Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability i ...) + TODO: check
[Git][security-tracker-team/security-tracker][master] Add clarifying information for three exim4 issues which are unfixed
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 0cc62fe2 by Salvatore Bonaccorso at 2023-09-29T21:56:40+02:00 Add clarifying information for three exim4 issues which are unfixed >From upstream: They are debatable and miss information required needing to fix those issues. Add oss-security reference to all of the open exim4 issues. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -205,25 +205,34 @@ CVE-2023-38870 (A SQL injection vulnerability exists in gugoan Economizzer commi CVE-2023-42119 [Exim dnsdb Out-Of-Bounds Read Information Disclosure Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1473/ + NOTE: https://www.openwall.com/lists/oss-security/2023/09/29/5 + NOTE: From upstream: Issue is ebatable or miss information upstream needs to address the issue. CVE-2023-42118 [Exim libspf2 Integer Underflow Remote Code Execution Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1472/ + NOTE: https://www.openwall.com/lists/oss-security/2023/09/29/5 + NOTE: From upstream: Issue is ebatable or miss information upstream needs to address the issue. TODO: check if should be in src:libspf2 or in exim4's usage CVE-2023-42117 [Exim Improper Neutralization of Special Elements Remote Code Execution Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1471/ + NOTE: https://www.openwall.com/lists/oss-security/2023/09/29/5 + NOTE: From upstream: Issue is ebatable or miss information upstream needs to address the issue. CVE-2023-42116 [Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1470/ NOTE: https://bugs.exim.org/show_bug.cgi?id=3000 + NOTE: https://www.openwall.com/lists/oss-security/2023/09/29/5 CVE-2023-42115 [Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1469/ NOTE: https://bugs.exim.org/show_bug.cgi?id=2999 + NOTE: https://www.openwall.com/lists/oss-security/2023/09/29/5 CVE-2023-42114 [Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1468/ NOTE: https://bugs.exim.org/show_bug.cgi?id=3001 + NOTE: https://www.openwall.com/lists/oss-security/2023/09/29/5 CVE-2023-40476 [Integer overflow in H.265 video parser leading to stack overwrite] - gst-plugins-bad1.0 - gst-plugins-bad0.10 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0cc62fe29883a8583522370f106777f5efa04484 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0cc62fe29883a8583522370f106777f5efa04484 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Map upstream issues with ZDI advisories (not public yet)
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 26e33561 by Salvatore Bonaccorso at 2023-09-29T21:54:40+02:00 Map upstream issues with ZDI advisories (not public yet) - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -215,12 +215,15 @@ CVE-2023-42117 [Exim Improper Neutralization of Special Elements Remote Code Exe CVE-2023-42116 [Exim SMTP Challenge Stack-based Buffer Overflow Remote Code Execution Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1470/ + NOTE: https://bugs.exim.org/show_bug.cgi?id=3000 CVE-2023-42115 [Exim AUTH Out-Of-Bounds Write Remote Code Execution Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1469/ + NOTE: https://bugs.exim.org/show_bug.cgi?id=2999 CVE-2023-42114 [Exim NTLM Challenge Out-Of-Bounds Read Information Disclosure Vulnerability] - exim4 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1468/ + NOTE: https://bugs.exim.org/show_bug.cgi?id=3001 CVE-2023-40476 [Integer overflow in H.265 video parser leading to stack overwrite] - gst-plugins-bad1.0 - gst-plugins-bad0.10 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26e33561064c7854ac70b5f0f989f656361818e7 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/26e33561064c7854ac70b5f0f989f656361818e7 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reserve DLA-3590-1 for python-reportlab
Guilhem Moulin pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
93f732af by Guilhem Moulin at 2023-09-29T21:45:12+02:00
Reserve DLA-3590-1 for python-reportlab
- - - - -
3 changed files:
- data/CVE/list
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/CVE/list
=
@@ -207739,7 +207739,6 @@ CVE-2020-28464 (This affects the package djv before
2.1.4. By controlling the sc
NOT-FOR-US: Node djv
CVE-2020-28463 (All versions of package reportlab are vulnerable to
Server-side Reques ...)
- python-reportlab 3.5.55-1
- [buster] - python-reportlab (Minor issue)
[stretch] - python-reportlab (Can be fixed in next DLA)
NOTE: https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145
NOTE: Fixed by:
https://hg.reportlab.com/hg-public/reportlab/rev/7f2231703dc7
=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[29 Sep 2023] DLA-3590-1 python-reportlab - security update
+ {CVE-2019-19450 CVE-2020-28463}
+ [buster] - python-reportlab 3.5.13-1+deb10u2
[29 Sep 2023] DLA-3589-1 python-git - security update
{CVE-2023-41040}
[buster] - python-git 2.1.11-1+deb10u2
=
data/dla-needed.txt
=
@@ -177,9 +177,6 @@ python-os-brick
NOTE: 20230525: Added by Front-Desk (lamby)
NOTE: 20230525: NB. CVE-2023-2088 filed against python-glance-store,
python-os-brick, nova and cinder.
--
-python-reportlab (guilhem)
- NOTE: 20230926: Added by Front-Desk (ola)
---
qemu (Sean Whitton)
NOTE: 20230924: Added by Front-Desk (apo)
NOTE: 20230924: Consider fixing postponed issues as well. (apo)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/93f732afe09a0fb00d1a71e89ee712fd82613d54
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/93f732afe09a0fb00d1a71e89ee712fd82613d54
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Switch firefox and firefox-esr entries to unimportant for CVE-2023-5217
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 230771cc by Salvatore Bonaccorso at 2023-09-29T21:41:03+02:00 Switch firefox and firefox-esr entries to unimportant for CVE-2023-5217 Admittely this is *not* fully correct tracking, because we cannot say its unimportant on suite level only globally for a source package. Starting in bookworm the system libvpx library is used (for now) and so CVE-2023-5217 while affecting the source, not impacted on the binary packages. But it *is* for bullseye and buster, and there needs to be an upload for 115.3.1 ESR in those suites. As this is already beeing handled by security team and LTS team and on the radar, mark the entry as unimportant for the rest. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -250,14 +250,16 @@ CVE-2023-5221 (A vulnerability classified as critical has been found in ForU CMS CVE-2023-5217 (Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior ...) - chromium 117.0.5938.132-1 [buster] - chromium (see DSA 5046) - - firefox - - firefox-esr + - firefox (unimportant) + - firefox-esr (unimportant) - libvpx 1.12.0-1.1 (bug #1053182) NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/#CVE-2023-5217 NOTE: https://www.openwall.com/lists/oss-security/2023/09/28/5 NOTE: Fixed by (libvpx): https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 NOTE: Fixed by (libvpx): https://github.com/webmproject/libvpx/commit/3fbd1dca6a4d2dad332a2110d646e4ffef36d590 NOTE: https://hg.mozilla.org/mozilla-central/rev/c53f5ef77b62b79af86951a7f9130e1896b695d2 + NOTE: src:firefox and firefox-esr use the system libvpx starting in bookworm and above. For + NOTE: older releases still needs the fixes in src:firefox-esr. CVE-2023-5187 (Use after free in Extensions in Google Chrome prior to 117.0.5938.132 ...) - chromium 117.0.5938.132-1 [buster] - chromium (see DSA 5046) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/230771cc6faaefa0e05348f8125c4164f2c0e414 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/230771cc6faaefa0e05348f8125c4164f2c0e414 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Document file move for prometheus-alertmanager for CVE-2023-40577
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 0d5f7c53 by Bastien Roucariès at 2023-09-29T19:27:29+00:00 Document file move for prometheus-alertmanager for CVE-2023-40577 - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -4869,6 +4869,7 @@ CVE-2023-40577 (Alertmanager handles alerts sent by client applications such as - prometheus-alertmanager 0.26.0+ds-1 (bug #1050558) NOTE: https://github.com/prometheus/alertmanager/security/advisories/GHSA-v86x-5fm3-5p7j NOTE: https://github.com/prometheus/alertmanager/commit/8b9f2fd20c25e0d1e76aa0b407f7e354996d8e72 (v0.25.1) + NOTE: vulnerability before 625604df90b0f2e080f7d32fea4aa891675276d6 in 56 ui/app/src/Views/AlertList/AlertView.elm CVE-2023-40576 (FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), ...) - freerdp2 (Vulnerable code not present) NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x3x5-r7jm-5pq2 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0d5f7c539cab1a93524828c15d3fc2dca76bce5f -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0d5f7c539cab1a93524828c15d3fc2dca76bce5f You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Track proposed lemonldap-ng for bullseye and bookworm
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 632c2602 by Salvatore Bonaccorso at 2023-09-29T21:21:50+02:00 Track proposed lemonldap-ng for bullseye and bookworm - - - - - 2 changed files: - data/next-oldstable-point-update.txt - data/next-point-update.txt Changes: = data/next-oldstable-point-update.txt = @@ -224,3 +224,5 @@ CVE-2023-38559 [bullseye] - ghostscript 9.53.3~dfsg-7+deb11u6 CVE-2023-43115 [bullseye] - ghostscript 9.53.3~dfsg-7+deb11u6 +CVE-2023-44469 + [bullseye] - lemonldap-ng 2.0.11+ds-4+deb11u5 = data/next-point-update.txt = @@ -65,5 +65,7 @@ CVE-2023-38559 [bookworm] - ghostscript 10.0.0~dfsg-11+deb12u2 CVE-2023-43115 [bookworm] - ghostscript 10.0.0~dfsg-11+deb12u2 +CVE-2023-44469 + [bookworm] - lemonldap-ng 2.16.1+ds-deb12u2 CVE-2023- [receiving with Lightning: partial MPP might be accepted] [bookworm] - electrum 4.3.4+dfsg1-1+deb12u1 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/632c2602b62bf5062b5acb329269b0b195bdc397 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/632c2602b62bf5062b5acb329269b0b195bdc397 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Move electrum tracking to end of list
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: cf46f771 by Salvatore Bonaccorso at 2023-09-29T21:18:22+02:00 Move electrum tracking to end of list - - - - - 1 changed file: - data/next-point-update.txt Changes: = data/next-point-update.txt = @@ -57,8 +57,6 @@ CVE-2023-38039 [bookworm] - curl 7.88.1-10+deb12u3 CVE-2023-43770 [bookworm] - roundcube 1.6.3+dfsg-1~deb12u1 -CVE-2023- [receiving with Lightning: partial MPP might be accepted] - [bookworm] - electrum 4.3.4+dfsg1-1+deb12u1 CVE-2023-4527 [bookworm] - glibc 2.36-9+deb12u2 CVE-2023-4806 @@ -67,3 +65,5 @@ CVE-2023-38559 [bookworm] - ghostscript 10.0.0~dfsg-11+deb12u2 CVE-2023-43115 [bookworm] - ghostscript 10.0.0~dfsg-11+deb12u2 +CVE-2023- [receiving with Lightning: partial MPP might be accepted] + [bookworm] - electrum 4.3.4+dfsg1-1+deb12u1 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cf46f771ccdfc5aa301c795d99f613108e01bd44 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/cf46f771ccdfc5aa301c795d99f613108e01bd44 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Mark lemonldap-ng as no-dsa
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: d1ee89e1 by Salvatore Bonaccorso at 2023-09-29T21:17:39+02:00 Mark lemonldap-ng as no-dsa - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -14,6 +14,8 @@ CVE-2023-4316 (Zod in version 3.22.2 allows an attacker to perform a denial of s TODO: check CVE-2023-44469 (A Server-Side Request Forgery issue in the OpenID Connect Issuer in Le ...) - lemonldap-ng 2.17.1+ds-1 + [bookworm] - lemonldap-ng (Minor issue) + [bullseye] - lemonldap-ng (Minor issue) NOTE: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998 NOTE: https://security.lauritz-holtmann.de/post/sso-security-ssrf/ CVE-2023-44466 (An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d1ee89e1d5f6b6d0581517d4e42663b44932f65d -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d1ee89e1d5f6b6d0581517d4e42663b44932f65d You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] CVE-{2019-19450,2020-28463}/python-reportlab: Add links to patches.
Guilhem Moulin pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
c1515d6d by Guilhem Moulin at 2023-09-29T21:04:26+02:00
CVE-{2019-19450,2020-28463}/python-reportlab: Add links to patches.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -207737,6 +207737,7 @@ CVE-2020-28463 (All versions of package reportlab are
vulnerable to Server-side
[buster] - python-reportlab (Minor issue)
[stretch] - python-reportlab (Can be fixed in next DLA)
NOTE: https://snyk.io/vuln/SNYK-PYTHON-REPORTLAB-1022145
+ NOTE: Fixed by:
https://hg.reportlab.com/hg-public/reportlab/rev/7f2231703dc7
NOTE: Starting in 3.5.55 trustedSchemes and trustedHosts rl_config
variables are introduced
NOTE: which can be used to mitigate the issue, treating this as the
fixed version
CVE-2020-28462 (This affects all versions of package ion-parser. If an
attacker submit ...)
@@ -278035,6 +278036,7 @@ CVE-2019-19451 (When GNOME Dia before 2019-11-27 is
launched with a filename arg
CVE-2019-19450 (paraparser in ReportLab before 3.5.31 allows remote code
execution bec ...)
- python-reportlab 3.5.31-1
NOTE:
https://github.com/MrBitBucket/reportlab-mirror/blob/master/CHANGES.md#release-353115102019
+ NOTE: Fixed by:
https://hg.reportlab.com/hg-public/reportlab/rev/b117091a73c2
CVE-2019-19449 (In the Linux kernel 5.0.21, mounting a crafted f2fs filesystem
image c ...)
- linux
[bookworm] - linux (Minor issue, revisit once fixed
upstream)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c1515d6d067a4587c1f069f3d1e96d42cb35628d
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c1515d6d067a4587c1f069f3d1e96d42cb35628d
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Track fixed version for CVE-2023-5217/libvpx
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 166c9fe1 by Salvatore Bonaccorso at 2023-09-29T21:02:53+02:00 Track fixed version for CVE-2023-5217/libvpx - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -250,7 +250,7 @@ CVE-2023-5217 (Heap buffer overflow in vp8 encoding in libvpx in Google Chrome p [buster] - chromium (see DSA 5046) - firefox - firefox-esr - - libvpx (bug #1053182) + - libvpx 1.12.0-1.1 (bug #1053182) NOTE: https://www.mozilla.org/en-US/security/advisories/mfsa2023-44/#CVE-2023-5217 NOTE: https://www.openwall.com/lists/oss-security/2023/09/28/5 NOTE: Fixed by (libvpx): https://github.com/webmproject/libvpx/commit/af6dedd715f4307669366944cca6e0417b290282 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/166c9fe1e1e8195b540dca89561db3c4ca0d579b -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/166c9fe1e1e8195b540dca89561db3c4ca0d579b You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Take prometheus-alermanager
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: bd279d35 by Bastien Roucariès at 2023-09-29T18:53:52+00:00 Take prometheus-alermanager - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -160,7 +160,7 @@ poppler NOTE: 20230908: as I suspect this is a duplicate of CVE-2020-27778 (which has already NOTE: 20230908: been fixed). (lamby) -- -prometheus-alertmanager +prometheus-alertmanager (rouca) NOTE: 20230925: Added by Front-Desk (apo) NOTE: 20230925: Vulnerable code is in ui/app/src/Views/AlertList/AlertView.elm -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bd279d3535c8e56045a63e1bbffe7e79be20f612 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bd279d3535c8e56045a63e1bbffe7e79be20f612 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Marked a few CVEs as end-of-life for buster.
Ola Lundqvist pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
56490f6a by Ola Lundqvist at 2023-09-29T18:46:49+00:00
Marked a few CVEs as end-of-life for buster.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -519,6 +519,7 @@ CVE-2023-41078 (An authorization issue was addressed with
improved state managem
TODO: check
CVE-2023-41074 (The issue was addressed with improved checks. This issue is
fixed in t ...)
- webkit2gtk 2.42.0-1
+ [buster] - webkit2gtk (EOL in buster LTS)
- wpewebkit 2.42.0-1
[bookworm] - wpewebkit (wpewebkit not covered by security
support in Bookworm)
NOTE: https://webkitgtk.org/security/WSA-2023-0009.html
@@ -575,6 +576,7 @@ CVE-2023-40452 (The issue was addressed with improved
bounds checks. This issue
CVE-2023-40451 (This issue was addressed with improved iframe sandbox
enforcement. Thi ...)
{DSA-5468-1}
- webkit2gtk 2.40.5-1
+ [buster] - webkit2gtk (EOL in buster LTS)
- wpewebkit 2.40.5-1
[bookworm] - wpewebkit (wpewebkit not covered by security
support in Bookworm)
NOTE: https://webkitgtk.org/security/WSA-2023-0009.html
@@ -649,6 +651,7 @@ CVE-2023-40330 (Unauth. Reflected Cross-Site Scripting
(XSS) vulnerability in Mi
CVE-2023-39434 (A use-after-free issue was addressed with improved memory
management. ...)
{DSA-5468-1}
- webkit2gtk 2.40.5-1
+ [buster] - webkit2gtk (EOL in buster LTS)
- wpewebkit 2.40.5-1
[bookworm] - wpewebkit (wpewebkit not covered by security
support in Bookworm)
NOTE: https://webkitgtk.org/security/WSA-2023-0009.html
@@ -671,6 +674,7 @@ CVE-2023-35793 (An issue was discovered in Cassia Access
Controller 2.1.1.230327
CVE-2023-35074 (The issue was addressed with improved memory handling. This
issue is f ...)
{DSA-5396-1}
- webkit2gtk 2.40.0-1
+ [buster] - webkit2gtk (EOL in buster LTS)
- wpewebkit 2.40.2-2
[bookworm] - wpewebkit (wpewebkit not covered by security
support in Bookworm)
NOTE: https://webkitgtk.org/security/WSA-2023-0009.html
@@ -1210,6 +1214,7 @@ CVE-2023-42279 (Dreamer CMS 4.1.3 is vulnerable to SQL
Injection.)
NOT-FOR-US: Dreamer CMS
CVE-2023-41993 (The issue was addressed with improved checks. This issue is
fixed in S ...)
- webkit2gtk 2.42.1-1
+ [buster] - webkit2gtk (EOL in buster LTS)
- wpewebkit 2.42.1-1
[bookworm] - wpewebkit (wpewebkit not covered by security
support in Bookworm)
NOTE: https://webkitgtk.org/security/WSA-2023-0009.html
@@ -2090,6 +2095,7 @@ CVE-2023-3280 (A problem with a protection mechanism in
the Palo Alto Networks C
NOT-FOR-US: Palo Alto Networks
CVE-2023-39928 [A malicious web page can cause memory corruption and
potentially arbitrary code execution]
- webkit2gtk 2.42.0-1
+ [buster] - webkit2gtk (EOL in buster LTS)
- wpewebkit 2.42.0-1
[bookworm] - wpewebkit (wpewebkit not covered by security
support in Bookworm)
NOTE: https://webkitgtk.org/security/WSA-2023-0009.html
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/56490f6ace0a0e70202d214015e58c73229b93f5
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/56490f6ace0a0e70202d214015e58c73229b93f5
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] lts: take firefox-esr
Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker Commits: 17194f99 by Emilio Pozuelo Monfort at 2023-09-29T20:04:37+02:00 lts: take firefox-esr - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -66,6 +66,9 @@ dogecoin exim4 NOTE: 20230928: Added by Front-Desk (ola) -- +firefox-esr (Emilio) + NOTE: 20230929: Added by pochu +-- firmware-nonfree (tobi) NOTE: 20230820: Added by Front-Desk (ta) -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/17194f992760fefc3c8e30ff29c85c65afe6edc2 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/17194f992760fefc3c8e30ff29c85c65afe6edc2 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reserve DLA-3589-1 for python-git
Guilhem Moulin pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
4eea415b by Guilhem Moulin at 2023-09-29T19:55:08+02:00
Reserve DLA-3589-1 for python-git
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[29 Sep 2023] DLA-3589-1 python-git - security update
+ {CVE-2023-41040}
+ [buster] - python-git 2.1.11-1+deb10u2
[29 Sep 2023] DLA-3588-1 vim - security update
{CVE-2023-4752 CVE-2023-4781}
[buster] - vim 2:8.1.0875-5+deb10u6
=
data/dla-needed.txt
=
@@ -164,9 +164,6 @@ prometheus-alertmanager
puma (Abhijith PA)
NOTE: 20230925: Added by Front-Desk (apo)
--
-python-git (guilhem)
- NOTE: 20230923: Added by Front-Desk (apo)
---
python-glance-store
NOTE: 20230525: Added by Front-Desk (lamby)
NOTE: 20230525: NB. CVE-2023-2088 filed against python-glance-store,
python-os-brick, nova and cinder.
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4eea415bd1ab2c42ec5194026351de71496d8cfb
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4eea415bd1ab2c42ec5194026351de71496d8cfb
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] chromium, firefox DSAs
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
57853076 by Moritz Mühlenhoff at 2023-09-29T19:42:46+02:00
chromium, firefox DSAs
- - - - -
2 changed files:
- data/DSA/list
- data/dsa-needed.txt
Changes:
=
data/DSA/list
=
@@ -1,3 +1,10 @@
+[29 Sep 2023] DSA-5509-1 firefox-esr - security update
+ {CVE-2023-5217}
+ [bullseye] - firefox-esr 115.3.1esr-1~deb11u1
+[29 Sep 2023] DSA-5508-1 chromium - security update
+ {CVE-2023-5186 CVE-2023-5187 CVE-2023-5217}
+ [bullseye] - chromium 117.0.5938.132-1~deb11u1
+ [bookworm] - chromium 117.0.5938.132-1~deb12u1
[28 Sep 2023] DSA-5507-1 jetty9 - security update
{CVE-2023-26048 CVE-2023-26049 CVE-2023-36479 CVE-2023-40167
CVE-2023-41900}
[bullseye] - jetty9 9.4.39-3+deb11u2
=
data/dsa-needed.txt
=
@@ -17,14 +17,10 @@ audiofile
--
cacti
--
-chromium
---
cinder/oldstable
--
exim4
--
-firefox-esr (jmm)
---
gpac/oldstable (jmm)
--
gst-plugins-bad1.0 (carnil)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57853076142f2410a774f7674cbf4558e3f30a21
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/57853076142f2410a774f7674cbf4558e3f30a21
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Further triage CVE-2020-18831/exiv2
Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker Commits: 3591a7af by Emilio Pozuelo Monfort at 2023-09-29T18:43:39+02:00 Further triage CVE-2020-18831/exiv2 Mark the introductory commit, verified by source inspection and by testing it to trigger the invalid read. - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -232124,10 +232124,11 @@ CVE-2020-18832 RESERVED CVE-2020-18831 (Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cp ...) - exiv2 0.27.2-6 - [buster] - exiv2 (exiv2 -pR flags introduced later and poc fail with "Exiv2 exception in print action for file poc.png". Introduced later by chunked read.) + [buster] - exiv2 (Vulnerable code introduced later) NOTE: https://github.com/Exiv2/exiv2/issues/828 NOTE: https://github.com/Exiv2/exiv2/pull/862 - NOTE: https://github.com/Exiv2/exiv2/commit/6068df4c01ce915befb763bd0fd718d16a5df130 (v0.27.2-RC1) + NOTE: Introduced by: https://github.com/Exiv2/exiv2/commit/4617dc37284bb14c15fb884a7252de7c2b8b8854 + NOTE: Fixed by: https://github.com/Exiv2/exiv2/commit/6068df4c01ce915befb763bd0fd718d16a5df130 (v0.27.2-RC1) CVE-2020-18830 RESERVED CVE-2020-18829 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3591a7afcc995b33143f7ea9de0581c789b53498 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3591a7afcc995b33143f7ea9de0581c789b53498 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Remove exiv2 (only no-dsa remaining cve) from dla-needed
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: ac9242a7 by Bastien Roucariès at 2023-09-29T16:22:11+00:00 Remove exiv2 (only no-dsa remaining cve) from dla-needed - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -63,9 +63,6 @@ dogecoin NOTE: 20230619: also I just referenced 3 older bitcoin-related CVEs to fix; NOTE: 20230619: dogecoin not present in bullseye/bookworm, so we lead the initiatives. (Beuc/front-desk) -- -exiv2 (rouca) - NOTE: 20230906: Added by Front-Desk (lamby) --- exim4 NOTE: 20230928: Added by Front-Desk (ola) -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ac9242a7b092ef46d5f0a12cf61efb70dad4d024 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ac9242a7b092ef46d5f0a12cf61efb70dad4d024 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] CVE-2020-18832 does not affect buster
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: d70320a9 by Bastien Roucariès at 2023-09-29T15:20:16+00:00 CVE-2020-18832 does not affect buster Code was refactored after buster in order to read chunked png. Poc was tested under vlagrind and fail gracefuly without leak and out of bound read - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -232124,6 +232124,7 @@ CVE-2020-18832 RESERVED CVE-2020-18831 (Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cp ...) - exiv2 0.27.2-6 + [buster] - exiv2 (exiv2 -pR flags introduced later and poc fail with "Exiv2 exception in print action for file poc.png". Introduced later by chunked read.) NOTE: https://github.com/Exiv2/exiv2/issues/828 NOTE: https://github.com/Exiv2/exiv2/pull/862 NOTE: https://github.com/Exiv2/exiv2/commit/6068df4c01ce915befb763bd0fd718d16a5df130 (v0.27.2-RC1) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d70320a9873a3f717ed567ae1688e142be6b85f4 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d70320a9873a3f717ed567ae1688e142be6b85f4 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Take exiv2
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 0627818d by Bastien Roucariès at 2023-09-29T14:41:08+00:00 Take exiv2 - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -63,7 +63,7 @@ dogecoin NOTE: 20230619: also I just referenced 3 older bitcoin-related CVEs to fix; NOTE: 20230619: dogecoin not present in bullseye/bookworm, so we lead the initiatives. (Beuc/front-desk) -- -exiv2 +exiv2 (rouca) NOTE: 20230906: Added by Front-Desk (lamby) -- exim4 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0627818dd5900995a8a09dd06c143e5bbc683870 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0627818dd5900995a8a09dd06c143e5bbc683870 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add note about salt and vendoring python3-attr in dla-needed
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker Commits: 452f2d36 by Bastien Roucariès at 2023-09-29T14:36:14+00:00 Add note about salt and vendoring python3-attr in dla-needed - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -224,7 +224,7 @@ salt (rouca) NOTE: 20230720: Last but not least salt is not present in stable/testing (rouca) NOTE: 20230928: Backported 3002.9 first non affected by crypto flaw version NOTE: 20230928: will need python3-saltfactories >= 0.907 (that need python3-setuptools (>= 50.3.2), python3-setuptools-scm (>= 3.4) to be investigated) - NOTE: 20230928: will need python3-attr (>= 19.1) + NOTE: 20230928: will need python3-attr (>= 19.1) may from buster-backport ? or vendored ? -- samba NOTE: 20230918: Added by Front-Desk (apo) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/452f2d363c1aa8eeb5ff8b010e6f99b33c961b1c -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/452f2d363c1aa8eeb5ff8b010e6f99b33c961b1c You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] data/dla-needed.txt: Claim phppgadmin
Abhijith PA pushed to branch master at Debian Security Tracker / security-tracker Commits: 4c2d8361 by Abhijith PA at 2023-09-29T19:51:40+05:30 data/dla-needed.txt: Claim phppgadmin - - - - - 1 changed file: - data/dla-needed.txt Changes: = data/dla-needed.txt = @@ -151,7 +151,7 @@ osslsigncode NOTE: 20230925: Added by Front-Desk (apo) NOTE: 20230925: Maybe a new upstream release should just do the trick here. -- -phppgadmin +phppgadmin (Abhijith PA) NOTE: 20230925: Added by Front-Desk (apo) -- poppler View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c2d8361b15f9450c3ddc674369ae3433a43bf10 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4c2d8361b15f9450c3ddc674369ae3433a43bf10 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reserve DLA-3588-1 for vim
Bastien Roucariès pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
dfa140ee by Bastien Roucariès at 2023-09-29T13:40:59+00:00
Reserve DLA-3588-1 for vim
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[29 Sep 2023] DLA-3588-1 vim - security update
+ {CVE-2023-4752 CVE-2023-4781}
+ [buster] - vim 2:8.1.0875-5+deb10u6
[29 Sep 2023] DLA-3587-1 firefox-esr - security update
{CVE-2023-5169 CVE-2023-5171 CVE-2023-5176}
[buster] - firefox-esr 115.3.0esr-1~deb10u1
=
data/dla-needed.txt
=
@@ -248,9 +248,6 @@ trafficserver (Adrian Bunk)
NOTE: 20230826: I have the answer here. (utkarsh)
NOTE: 20230918: Needs first fixing in bullseye. (bunk)
--
-vim (rouca)
- NOTE: 20230924: Added by Front-Desk (apo)
---
zabbix
NOTE: 20230924: Added by Front-Desk (apo)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dfa140ee789abec3af3f52d576b5f03a43c43c0c
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/dfa140ee789abec3af3f52d576b5f03a43c43c0c
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Track proposed ghostscript updates for bullseye and bookworm
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: 8dc596c8 by Salvatore Bonaccorso at 2023-09-29T14:48:54+02:00 Track proposed ghostscript updates for bullseye and bookworm - - - - - 2 changed files: - data/next-oldstable-point-update.txt - data/next-point-update.txt Changes: = data/next-oldstable-point-update.txt = @@ -220,3 +220,7 @@ CVE-2023-41081 [bullseye] - libapache-mod-jk 1:1.2.48-1+deb11u1 CVE-2023-43770 [bullseye] - roundcube 1.4.14+dfsg.1-1~deb11u1 +CVE-2023-38559 + [bullseye] - ghostscript 9.53.3~dfsg-7+deb11u6 +CVE-2023-43115 + [bullseye] - ghostscript 9.53.3~dfsg-7+deb11u6 = data/next-point-update.txt = @@ -63,3 +63,7 @@ CVE-2023-4527 [bookworm] - glibc 2.36-9+deb12u2 CVE-2023-4806 [bookworm] - glibc 2.36-9+deb12u2 +CVE-2023-38559 + [bookworm] - ghostscript 10.0.0~dfsg-11+deb12u2 +CVE-2023-43115 + [bookworm] - ghostscript 10.0.0~dfsg-11+deb12u2 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8dc596c81c32c04fb8cabb648d426aa37cbea73a -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/8dc596c81c32c04fb8cabb648d426aa37cbea73a You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Reserve DLA-3587-1 for firefox-esr
Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
e446e29d by Emilio Pozuelo Monfort at 2023-09-29T14:31:53+02:00
Reserve DLA-3587-1 for firefox-esr
- - - - -
2 changed files:
- data/DLA/list
- data/dla-needed.txt
Changes:
=
data/DLA/list
=
@@ -1,3 +1,6 @@
+[29 Sep 2023] DLA-3587-1 firefox-esr - security update
+ {CVE-2023-5169 CVE-2023-5171 CVE-2023-5176}
+ [buster] - firefox-esr 115.3.0esr-1~deb10u1
[28 Sep 2023] DLA-3586-1 ncurses - security update
{CVE-2020-19189}
[buster] - ncurses 6.1+20181013-2+deb10u4
=
data/dla-needed.txt
=
@@ -69,10 +69,6 @@ exiv2
exim4
NOTE: 20230928: Added by Front-Desk (ola)
--
-firefox-esr (Emilio)
- NOTE: 20230926: Added by pochu
- NOTE: 20230926: updating to ESR 115.3
---
firmware-nonfree (tobi)
NOTE: 20230820: Added by Front-Desk (ta)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e446e29d2238f8a69d7558136be5874ece01af0b
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e446e29d2238f8a69d7558136be5874ece01af0b
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2023-44469/lemonldap-ng
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: f82cdc4d by Salvatore Bonaccorso at 2023-09-29T14:06:41+02:00 Add CVE-2023-44469/lemonldap-ng - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -13,7 +13,9 @@ CVE-2023-4532 (An issue has been discovered in GitLab affecting all versions sta CVE-2023-4316 (Zod in version 3.22.2 allows an attacker to perform a denial of servic ...) TODO: check CVE-2023-44469 (A Server-Side Request Forgery issue in the OpenID Connect Issuer in Le ...) - TODO: check + - lemonldap-ng 2.17.1+ds-1 + NOTE: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2998 + NOTE: https://security.lauritz-holtmann.de/post/sso-security-ssrf/ CVE-2023-44466 (An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel ...) - linux 6.4.11-1 [bookworm] - linux 6.1.52-1 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f82cdc4d2c840f91a2f18a304874968ceb12214a -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f82cdc4d2c840f91a2f18a304874968ceb12214a You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Add CVE-2023-44466/linux
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker Commits: def0f312 by Salvatore Bonaccorso at 2023-09-29T14:01:31+02:00 Add CVE-2023-44466/linux - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -15,7 +15,11 @@ CVE-2023-4316 (Zod in version 3.22.2 allows an attacker to perform a denial of s CVE-2023-44469 (A Server-Side Request Forgery issue in the OpenID Connect Issuer in Le ...) TODO: check CVE-2023-44466 (An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel ...) - TODO: check + - linux 6.4.11-1 + [bookworm] - linux 6.1.52-1 + [bullseye] - linux (Vulnerable code not present) + [buster] - linux (Vulnerable code not present) + NOTE: https://git.kernel.org/linus/a282a2f10539dce2aa619e71e1817570d557fc97 (6.5-rc2) CVE-2023-44464 (pretix before 2023.7.2 allows Pillow to parse EPS files.) NOT-FOR-US: pretix CVE-2023-44174 (Online Movie Ticket Booking System v1.0 is vulnerable to an authentic ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/def0f3121e9e9dd3d5f903ff15ac16a106b21cd9 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/def0f3121e9e9dd3d5f903ff15ac16a106b21cd9 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] Process some NFUs
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
6e98dd29 by Salvatore Bonaccorso at 2023-09-29T13:52:05+02:00
Process some NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -1,13 +1,13 @@
CVE-2023-5198 (An issue has been discovered in GitLab affecting all versions
prior to ...)
TODO: check
CVE-2023-5185 (Gym Management System Project v1.0 is vulnerable to an
Insecure File ...)
- TODO: check
+ NOT-FOR-US: Gym Management System Project
CVE-2023-5077 (The Vault and Vault Enterprise ("Vault") Google Cloud secrets
engine d ...)
- TODO: check
+ NOT-FOR-US: HashiCorp Vault
CVE-2023-5053 (Hospital management system version 378c157 allows to bypass
authentica ...)
- TODO: check
+ NOT-FOR-US: Hospital management system
CVE-2023-5004 (Hospital management system version 378c157 allows to bypass
authentica ...)
- TODO: check
+ NOT-FOR-US: Hospital management system
CVE-2023-4532 (An issue has been discovered in GitLab affecting all versions
starting ...)
TODO: check
CVE-2023-4316 (Zod in version 3.22.2 allows an attacker to perform a denial of
servic ...)
@@ -17,11 +17,11 @@ CVE-2023-44469 (A Server-Side Request Forgery issue in the
OpenID Connect Issuer
CVE-2023-44466 (An issue was discovered in net/ceph/messenger_v2.c in the
Linux kernel ...)
TODO: check
CVE-2023-44464 (pretix before 2023.7.2 allows Pillow to parse EPS files.)
- TODO: check
+ NOT-FOR-US: pretix
CVE-2023-44174 (Online Movie Ticket Booking System v1.0 is vulnerable to an
authentic ...)
- TODO: check
+ NOT-FOR-US: Online Movie Ticket Booking System
CVE-2023-44173 (Online Movie Ticket Booking System v1.0 is vulnerable to an
authentic ...)
- TODO: check
+ NOT-FOR-US: Online Movie Ticket Booking System
CVE-2023-44168 (The 'phone' parameter of the process_registration.php resource
does n ...)
TODO: check
CVE-2023-44167 (The 'name' parameter of the process_registration.php resource
does no ...)
@@ -39,13 +39,13 @@ CVE-2023-43740 ([PROBLEMTYPE] in [COMPONENT] in [VENDOR]
[PRODUCT] [VERSION] on
CVE-2023-43739 (The 'bookisbn' parameter of the cart.php resource does not
validate t ...)
TODO: check
CVE-2023-43662 (ShokoServer is a media server which specializes in organizing
anime. I ...)
- TODO: check
+ NOT-FOR-US: ShokoServer
CVE-2023-43654 (TorchServe is a tool for serving and scaling PyTorch models in
product ...)
TODO: check
CVE-2023-43014 (Asset Management System v1.0 is vulnerable to an
Authenticated SQL In ...)
- TODO: check
+ NOT-FOR-US: Asset Management System
CVE-2023-43013 (Asset Management System v1.0 is vulnerable to an
unauthenticated SQL ...)
- TODO: check
+ NOT-FOR-US: Asset Management System
CVE-2023-3979 (An issue has been discovered in GitLab affecting all versions
starting ...)
TODO: check
CVE-2023-3922 (An issue has been discovered in GitLab affecting all versions
starting ...)
@@ -59,11 +59,11 @@ CVE-2023-3914 (A business logic error in GitLab EE
affecting all versions prior
CVE-2023-3906 (An input validation issue in the asset proxy in GitLab EE,
affecting a ...)
TODO: check
CVE-2023-3775 (A Vault Enterprise Sentinel Role Governing Policy created by an
operat ...)
- TODO: check
+ NOT-FOR-US: HashiCorp Vault
CVE-2023-3115 (An issue has been discovered in GitLab EE affecting all
versions affec ...)
TODO: check
CVE-2023-32477 (Dell Common Event Enabler 8.9.8.2 for Windows and prior,
contain an im ...)
- TODO: check
+ NOT-FOR-US: Dell
CVE-2023-5256 (In certain scenarios, Drupal's JSON:API module will output
error backt ...)
TODO: check
CVE-2023-5215 (A flaw was found in libnbd. A server can reply with a block
size large ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e98dd2986dea373b5724d3f5cefb70e7bc33eb9
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e98dd2986dea373b5724d3f5cefb70e7bc33eb9
You're receiving this email because of your account on salsa.debian.org.
___
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] CVE-2022-40090/tiff: precise affected versions
Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker Commits: 4ecd8436 by Sylvain Beucler at 2023-09-29T11:18:07+02:00 CVE-2022-40090/tiff: precise affected versions - - - - - 1 changed file: - data/CVE/list Changes: = data/CVE/list = @@ -73759,6 +73759,10 @@ CVE-2022-40090 (An issue was discovered in function TIFFReadDirectory libtiff be NOTE: https://gitlab.com/libtiff/libtiff/-/issues/455 NOTE: https://gitlab.com/libtiff/libtiff/-/merge_requests/386 NOTE: https://gitlab.com/libtiff/libtiff/-/commit/d093eb5d961e21ba51420bc22382c514683a4d91 (v4.5.0rc1) + NOTE: The specific PoC starts triggering with https://gitlab.com/libtiff/libtiff/-/commit/7db4f2b62206b9cba6cda538e0f296df0ac371bd (v4.4.0) + NOTE: but the patch mentions this is an older, more general issue, requiring prior incomplete fix from: + NOTE: https://gitlab.com/libtiff/libtiff/-/commit/f01c22704826d1587fb8d91b253752b13c6713ba (v4.0.10) + NOTE: so let's assume versions < v4.4.0 are vulnerable. CVE-2022-40089 (A remote file inclusion (RFI) vulnerability in Simple College Website ...) NOT-FOR-US: Simple College Website CVE-2022-40088 (Simple College Website v1.0 was discovered to contain a reflected cros ...) View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4ecd8436790b50c95483c3d3cd9d25f7cc702ee2 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4ecd8436790b50c95483c3d3cd9d25f7cc702ee2 You're receiving this email because of your account on salsa.debian.org. ___ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
312c275e by security tracker role at 2023-09-29T08:11:59+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=
data/CVE/list
=
@@ -1,3 +1,69 @@
+CVE-2023-5198 (An issue has been discovered in GitLab affecting all versions
prior to ...)
+ TODO: check
+CVE-2023-5185 (Gym Management System Project v1.0 is vulnerable to an
Insecure File ...)
+ TODO: check
+CVE-2023-5077 (The Vault and Vault Enterprise ("Vault") Google Cloud secrets
engine d ...)
+ TODO: check
+CVE-2023-5053 (Hospital management system version 378c157 allows to bypass
authentica ...)
+ TODO: check
+CVE-2023-5004 (Hospital management system version 378c157 allows to bypass
authentica ...)
+ TODO: check
+CVE-2023-4532 (An issue has been discovered in GitLab affecting all versions
starting ...)
+ TODO: check
+CVE-2023-4316 (Zod in version 3.22.2 allows an attacker to perform a denial of
servic ...)
+ TODO: check
+CVE-2023-44469 (A Server-Side Request Forgery issue in the OpenID Connect
Issuer in Le ...)
+ TODO: check
+CVE-2023-44466 (An issue was discovered in net/ceph/messenger_v2.c in the
Linux kernel ...)
+ TODO: check
+CVE-2023-44464 (pretix before 2023.7.2 allows Pillow to parse EPS files.)
+ TODO: check
+CVE-2023-44174 (Online Movie Ticket Booking System v1.0 is vulnerable to an
authentic ...)
+ TODO: check
+CVE-2023-44173 (Online Movie Ticket Booking System v1.0 is vulnerable to an
authentic ...)
+ TODO: check
+CVE-2023-44168 (The 'phone' parameter of the process_registration.php resource
does n ...)
+ TODO: check
+CVE-2023-44167 (The 'name' parameter of the process_registration.php resource
does no ...)
+ TODO: check
+CVE-2023-44166 (The 'age' parameter of the process_registration.php resource
does not ...)
+ TODO: check
+CVE-2023-44165 (The 'Password' parameter of the process_login.php resource
does not v ...)
+ TODO: check
+CVE-2023-44164 (The 'Email' parameter of the process_login.php resource does
not vali ...)
+ TODO: check
+CVE-2023-44163 (The 'search' parameter of the process_search.php resource
does not va ...)
+ TODO: check
+CVE-2023-43740 ([PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION]
on [PLATF ...)
+ TODO: check
+CVE-2023-43739 (The 'bookisbn' parameter of the cart.php resource does not
validate t ...)
+ TODO: check
+CVE-2023-43662 (ShokoServer is a media server which specializes in organizing
anime. I ...)
+ TODO: check
+CVE-2023-43654 (TorchServe is a tool for serving and scaling PyTorch models in
product ...)
+ TODO: check
+CVE-2023-43014 (Asset Management System v1.0 is vulnerable to an
Authenticated SQL In ...)
+ TODO: check
+CVE-2023-43013 (Asset Management System v1.0 is vulnerable to an
unauthenticated SQL ...)
+ TODO: check
+CVE-2023-3979 (An issue has been discovered in GitLab affecting all versions
starting ...)
+ TODO: check
+CVE-2023-3922 (An issue has been discovered in GitLab affecting all versions
starting ...)
+ TODO: check
+CVE-2023-3920 (An issue has been discovered in GitLab affecting all versions
starting ...)
+ TODO: check
+CVE-2023-3917 (Denial of Service in pipelines affecting all versions of Gitlab
EE and ...)
+ TODO: check
+CVE-2023-3914 (A business logic error in GitLab EE affecting all versions
prior to 16 ...)
+ TODO: check
+CVE-2023-3906 (An input validation issue in the asset proxy in GitLab EE,
affecting a ...)
+ TODO: check
+CVE-2023-3775 (A Vault Enterprise Sentinel Role Governing Policy created by an
operat ...)
+ TODO: check
+CVE-2023-3115 (An issue has been discovered in GitLab EE affecting all
versions affec ...)
+ TODO: check
+CVE-2023-32477 (Dell Common Event Enabler 8.9.8.2 for Windows and prior,
contain an im ...)
+ TODO: check
CVE-2023-5256 (In certain scenarios, Drupal's JSON:API module will output
error backt ...)
TODO: check
CVE-2023-5215 (A flaw was found in libnbd. A server can reply with a block
size large ...)
@@ -652,7 +718,7 @@ CVE-2023-43857 (Dreamer CMS v4.1.3 was discovered to
contain a stored cross-site
NOT-FOR-US: Dreamer CMS
CVE-2023-43856 (Dreamer CMS v4.1.3 was discovered to contain an arbitrary file
read vu ...)
NOT-FOR-US: Dreamer CMS
-CVE-2023-43775 (Denial-of-service vulnerability in the web server of the Eaton
SMP SG- ...)
+CVE-2023-43775 (Denial-of-service vulnerability in the web server of the Eaton
SMP Gat ...)
NOT-FOR-US: Eaton
CVE-2023-43646 (get-func-name is a module to retrieve a function's name
securely and c ...)
TODO: check
@@ -1667,6 +1733,7 @@ CVE-2023-42336 (An issue in NETIS SYSTEMS WF2409Ev4
v.1.0.1.705 allows a remote
CVE-2023-41901
