[Secure-testing-commits] r47166 - data/CVE

security tracker role sectracker at moszumanska.debian.org
Sat Dec 17 09:10:32 UTC 2016


Author: sectracker
Date: 2016-12-17 09:10:32 +0000 (Sat, 17 Dec 2016)
New Revision: 47166

Modified:
   data/CVE/list
Log:
automatic update

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2016-12-17 08:07:29 UTC (rev 47165)
+++ data/CVE/list	2016-12-17 09:10:32 UTC (rev 47166)
@@ -9,27 +9,27 @@
 	NOTE: https://bugs.exim.org/show_bug.cgi?id=1996
 	NOTE: http://www.openwall.com/lists/oss-security/2016/12/16/1
 CVE-2016-9961
-	{DSA-3735-1}
+	{DSA-3735-1 DLA-750-1}
 	- game-music-emu 0.6.0-4 (bug #848071)
 	NOTE: http://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html
 	NOTE: http://www.openwall.com/lists/oss-security/2016/12/15/1
 CVE-2016-9960
-	{DSA-3735-1}
+	{DSA-3735-1 DLA-750-1}
 	- game-music-emu 0.6.0-4 (bug #848071)
 	NOTE: http://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html
 	NOTE: http://www.openwall.com/lists/oss-security/2016/12/15/1
 CVE-2016-9959
-	{DSA-3735-1}
+	{DSA-3735-1 DLA-750-1}
 	- game-music-emu 0.6.0-4 (bug #848071)
 	NOTE: http://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html
 	NOTE: http://www.openwall.com/lists/oss-security/2016/12/15/1
 CVE-2016-9958
-	{DSA-3735-1}
+	{DSA-3735-1 DLA-750-1}
 	- game-music-emu 0.6.0-4 (bug #848071)
 	NOTE: http://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html
 	NOTE: http://www.openwall.com/lists/oss-security/2016/12/15/1
 CVE-2016-9957
-	{DSA-3735-1}
+	{DSA-3735-1 DLA-750-1}
 	- game-music-emu 0.6.0-4 (bug #848071)
 	NOTE: http://scarybeastsecurity.blogspot.de/2016/12/redux-compromising-linux-using-snes.html
 	NOTE: http://www.openwall.com/lists/oss-security/2016/12/15/1
@@ -113,6 +113,7 @@
 	NOTE: http://www.openwall.com/lists/oss-security/2016/12/12/2
 CVE-2016-9935 [Invalid read when wddx decodes empty boolean element]
 	RESERVED
+	{DSA-3737-1}
 	- php7.0 7.0.14-1
 	- php5 <unfixed>
 	NOTE: Fixed in PHP 5.6.29 and 7.0.14
@@ -7577,6 +7578,7 @@
 	NOTE: http://www.openwall.com/lists/oss-security/2016/12/02/5
 CVE-2016-9774 [tomcat8: privilege escalation during package upgrade]
 	RESERVED
+	{DLA-746-1}
 	- tomcat8 8.5.8-2 (bug #845393)
 	- tomcat7 7.0.72-3
 	NOTE: Since 7.0.72-3, src:tomcat7 only builds the Servlet API
@@ -8034,12 +8036,14 @@
 	NOT-FOR-US: Samsung
 CVE-2016-9566 [privilege escalation]
 	RESERVED
+	{DLA-751-1}
 	- nagios3 <removed>
 	NOTE: https://github.com/NagiosEnterprises/nagioscore/commit/c29557dec91eba2306f5fb11b8da4474ba63f8c4
 	NOTE: https://legalhackers.com/advisories/Nagios-Exploit-Root-PrivEsc-CVE-2016-9566.html
 	NOTE: nagios < 3.5 is not vulnerable through the regular logfile, but through the debug logfile
 CVE-2016-9565 [Curl Command Injection]
 	RESERVED
+	{DLA-751-1}
 	- nagios3 3.5.1-1
 	NOTE: https://legalhackers.com/advisories/Nagios-Exploit-Command-Injection-CVE-2016-9565-2008-4796.html
 	NOTE: The RSS feed and call-home was removed in src:nagios3 3.5.1-1 where the affected
@@ -8275,7 +8279,7 @@
 	NOTE: unlikely PHP configuration required, unclear impact
 CVE-2014-9911
 	RESERVED
-	{DSA-3725-1}
+	{DSA-3725-1 DLA-744-1}
 	- icu 55.1-3
 	NOTE: http://bugs.icu-project.org/trac/ticket/10891
 	NOTE: Fixed by: http://bugs.icu-project.org/trac/changeset/35699
@@ -10428,6 +10432,7 @@
 	NOTE: upstream fix https://source.isc.org/cgi-bin/gitweb.cgi?p=bind9.git;a=commitdiff;h=8bd0c12d53bea6f299e92d20ee0a23b16a7f65bc
 CVE-2016-8863 [Buffer overflow in create_url_list]
 	RESERVED
+	{DSA-3736-1 DLA-748-1 DLA-747-1}
 	- libupnp 1:1.6.19+git20160116-1.2 (bug #842093)
 	- libupnp4 <removed>
 	NOTE: https://sourceforge.net/p/pupnp/bugs/133/
@@ -15095,7 +15100,7 @@
 	NOTE: https://github.com/owncloud/gallery/commit/6933d27afe518967bd1b60e6a7eacd88288929fc
 	NOTE: https://hackerone.com/reports/145355
 CVE-2016-7418 (The php_wddx_push_element function in ext/wddx/wddx.c in PHP before ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.11-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=73065
@@ -15104,21 +15109,21 @@
 	NOTE: The scope of this CVE also includes all of the "other four similar issues"
 	NOTE: in the "[2016-09-12 06:44 UTC]" comment.
 CVE-2016-7417 (ext/spl/spl_array.c in PHP before 5.6.26 and 7.x before 7.0.11 ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.11-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=73029
 	NOTE: Fixed in 7.0.11, 5.6.26
 	NOTE: https://github.com/php/php-src/commit/ecb7f58a069be0dec4a6131b6351a761f808f22e?w=1
 CVE-2016-7416 (ext/intl/msgformat/msgformat_format.c in PHP before 5.6.26 and 7.x ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.11-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=73007
 	NOTE: Fixed in 7.0.11, 5.6.26
 	NOTE: https://github.com/php/php-src/commit/6d55ba265637d6adf0ba7e9c9ef11187d1ec2f5b?w=1
 CVE-2016-7415 (Stack-based buffer overflow in the Locale class in common/locid.cpp in ...)
-	{DSA-3725-1}
+	{DSA-3725-1 DLA-744-1}
 	[experimental] - icu 58.1-1
 	- icu 57.1-5 (bug #838694)
 	NOTE: Related code in http://source.icu-project.org/repos/icu/icu/trunk/source/common/locid.cpp file
@@ -15126,28 +15131,28 @@
 	NOTE: PHP fix: https://github.com/php/php-src/commit/6d55ba265637d6adf0ba7e9c9ef11187d1ec2f5b?w=1
 	NOTE: Upstream bug: http://bugs.icu-project.org/trac/ticket/12745
 CVE-2016-7414 (The ZIP signature-verification feature in PHP before 5.6.26 and 7.x ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.11-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72928
 	NOTE: Fixed in 7.0.11, 5.6.26
 	NOTE: https://github.com/php/php-src/commit/0bfb970f43acd1e81d11be1154805f86655f15d5?w=1
 CVE-2016-7413 (Use-after-free vulnerability in the wddx_stack_destroy function in ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.11-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72860
 	NOTE: Fixed in 7.0.11, 5.6.26
 	NOTE: https://github.com/php/php-src/commit/b88393f08a558eec14964a55d3c680fe67407712?w=1
 CVE-2016-7412 (ext/mysqlnd/mysqlnd_wireprotocol.c in PHP before 5.6.26 and 7.x before ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.11-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72293
 	NOTE: Fixed in 7.0.11, 5.6.26
 	NOTE: https://github.com/php/php-src/commit/28f80baf3c53e267c9ce46a2a0fadbb981585132?w=1
 CVE-2016-7411 (ext/standard/var_unserializer.re in PHP before 5.6.26 mishandles ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 <not-affected> (Only affects 5.x)
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=73052
@@ -15979,7 +15984,7 @@
 	NOTE: http://www.openwall.com/lists/oss-security/2016/09/02/5
 	NOTE: https://github.com/php/php-src/commit/c2a13ced4272f2e65d2773e2ea6ca11c1ce4a911?w=1
 CVE-2016-7132 (ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.10-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72799
@@ -15989,7 +15994,7 @@
 	NOTE: 72790 and 72799 are associated with the same commit. Not all of the
 	NOTE: commit is about the pop issue in 72799.
 CVE-2016-7131 (ext/wddx/wddx.c in PHP before 5.6.25 and 7.x before 7.0.10 allows ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.10-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72790
@@ -16000,7 +16005,7 @@
 	NOTE: 72790 and 72799 are associated with the same commit. Not all of the
 	NOTE: commit is about the pop issue in 72799.
 CVE-2016-7130 (The php_wddx_pop_element function in ext/wddx/wddx.c in PHP before ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.10-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72750
@@ -16008,7 +16013,7 @@
 	NOTE: http://www.openwall.com/lists/oss-security/2016/09/02/5
 	NOTE: https://github.com/php/php-src/commit/698a691724c0a949295991e5df091ce16f899e02?w=1
 CVE-2016-7129 (The php_wddx_process_data function in ext/wddx/wddx.c in PHP before ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.10-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72749
@@ -16016,7 +16021,7 @@
 	NOTE: http://www.openwall.com/lists/oss-security/2016/09/02/5
 	NOTE: https://github.com/php/php-src/commit/426aeb2808955ee3d3f52e0cfb102834cdb836a5?w=1
 CVE-2016-7128 (The exif_process_IFD_in_TIFF function in ext/exif/exif.c in PHP before ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.10-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72627
@@ -16052,7 +16057,7 @@
 	NOTE: Scope of CVE also includes the "The similar issue also exist in session php_binary
 	NOTE: handler" part of 72681.
 CVE-2016-7124 (ext/standard/var_unserializer.c in PHP before 5.6.25 and 7.x before ...)
-	{DSA-3689-1}
+	{DSA-3689-1 DLA-749-1}
 	- php7.0 7.0.10-1
 	- php5 5.6.26+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72663
@@ -19330,7 +19335,7 @@
 	NOTE: This is not a vulnerability in Spring itself, just how applications are using it
 CVE-2016-6255 [write files via POST]
 	RESERVED
-	{DLA-597-1}
+	{DSA-3736-1 DLA-597-1}
 	- libupnp 1:1.6.19+git20160116-1.1 (bug #831857)
 	NOTE: https://twitter.com/mjg59/status/755062278513319936
 	NOTE: Proposed fix: https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbd
@@ -21912,7 +21917,7 @@
 	NOTE: No part of Go does set HTTP_PROXY based on a Proxy: header, 1.6.3 and 1.7
 	NOTE: provide hardening to discard HTTP_PROXY
 CVE-2016-5385 (PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 ...)
-	{DSA-3631-1}
+	{DSA-3631-1 DLA-749-1}
 	- php7.0 7.0.9-1
 	- php5 5.6.24+dfsg-1
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=72573
@@ -36297,6 +36302,7 @@
 	RESERVED
 CVE-2016-1253 [shell injection attack using LZMA-compressed files]
 	RESERVED
+	{DLA-745-1}
 	- most 5.0.0a-3 (bug #848132)
 	[jessie] - most <no-dsa> (Minor issue; will be fixed via point release)
 CVE-2016-1252




More information about the Secure-testing-commits mailing list