Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: a1b4bd0b by Salvatore Bonaccorso at 2022-01-02T15:03:27+01:00 Update notes for CVE-2021-45959/fmtlib Pending REJECT from MITRE to clean up the CVE entry. - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -64,10 +64,12 @@ CVE-2022-0079 CVE-2022-0078 RESERVED CVE-2021-45959 ({fmt} 7.1.0 through 8.0.1 has a stack-based buffer overflow in fmt::v8 ...) - - fmtlib <unfixed> + - fmtlib <unfixed> (unimportant) NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36110 + NOTE: https://github.com/fmtlib/fmt/issues/2685 NOTE: Fixed by: https://github.com/fmtlib/fmt/commit/2038bf61831eb8faede0883965364a974d1350fe - TODO: check correctness, introducing commit in oss-fuzz report is related when fuzzing started + NOTE: The CVE is basically invalid, as the report was one of a series of false positives + NOTE: and the "upstream fix" is effectively a noop. CVE-2021-45958 (UltraJSON (aka ujson) 4.0.2 through 5.0.0 has a stack-based buffer ove ...) - ujson <unfixed> NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=36009 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a1b4bd0b76afefa7abf5b0211385ae0a22e651ac -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a1b4bd0b76afefa7abf5b0211385ae0a22e651ac You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits