[Secure-testing-commits] r41585 - data/CVE
security tracker role
sectracker at moszumanska.debian.org
Mon May 9 21:10:11 UTC 2016
Author: sectracker
Date: 2016-05-09 21:10:11 +0000 (Mon, 09 May 2016)
New Revision: 41585
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2016-05-09 20:05:36 UTC (rev 41584)
+++ data/CVE/list 2016-05-09 21:10:11 UTC (rev 41585)
@@ -1,3 +1,15 @@
+CVE-2016-4564
+ RESERVED
+CVE-2016-4563
+ RESERVED
+CVE-2016-4562
+ RESERVED
+CVE-2016-4560
+ RESERVED
+CVE-2016-4559
+ RESERVED
+CVE-2016-4552
+ RESERVED
CVE-2016-XXXX [Multiple security problems]
- imagemagick <unfixed> (bug #823750)
NOTE: This really should be split up in individual cases otherwise hard to act on
@@ -2,2 +14,3 @@
CVE-2016-4567 [XSS]
+ RESERVED
- mediaelement <unfixed> (unimportant; bug #823649)
@@ -9,6 +22,7 @@
NOTE: See 0004-Deactivate-Flash-and-Silverlight.patch
NOTE: http://www.openwall.com/lists/oss-security/2016/05/07/2
CVE-2016-4566 [XSS]
+ RESERVED
- wordpress 4.5.2+dfsg-1 (bug #823640)
[jessie] - wordpress <not-affected> (Vulnerable code not present)
[wheezy] - wordpress <not-affected> (Vulnerable code not present)
@@ -16,12 +30,14 @@
NOTE: Fixed by: https://core.trac.wordpress.org/changeset/37382
NOTE: http://www.openwall.com/lists/oss-security/2016/05/07/2
CVE-2016-4568 [videobuf2-v4l2: Verify planes array in buffer dequeueing]
+ RESERVED
- linux 4.5.3-1
[jessie] - linux <not-affected> (Vulnerable code introduced in 4.4)
[wheezy] - linux <not-affected> (Vulnerable code introduced in 4.4)
NOTE: Fixed by: https://git.kernel.org/linus/2c1f6951a8a82e6de0d82b1158b5e493fc6c54ab (v4.6-rc6)
NOTE: Introduced by: https://git.kernel.org/linus/b0e0e1f83de31aa0428c38b692c590cc0ecd3f03 (v4.4-rc1)
CVE-2016-4565 [IB/security: Restrict use of the write() interface]
+ RESERVED
- linux 4.5.3-1
NOTE: Fixed by: https://git.kernel.org/linus/e6bd18f57aad1a2d1ef40e646d03ed0f2515c9e3 (v4.6-rc6)
CVE-2016-4551
@@ -35,6 +51,7 @@
CVE-2016-4545
RESERVED
CVE-2016-4561 [HTML-escape error messages, in one case avoiding potential cross-site scripting]
+ RESERVED
{DSA-3571-1}
- ikiwiki 3.20160506
NOTE: http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=32ef584dc5abb6ddb9f794f94ea0b2934967bba7
@@ -54,11 +71,13 @@
NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2016/05/06/6
TODO: check
CVE-2016-4558 [bpf: fix refcnt overflow]
+ RESERVED
- linux 4.5.3-1
NOTE: Fixed by: https://git.kernel.org/linus/92117d8443bc5afacc8d5ba82e541946310f106e
NOTE: Introduced by: https://git.kernel.org/linus/1be7f75d1668d6296b80bf35dcf6762393530afc(v4.4-rc1)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=809
CVE-2016-4557 [UAF via double-fdput() in bpf(BPF_PROG_LOAD) error path]
+ RESERVED
- linux 4.5.3-1 (bug #823603)
[jessie] - linux <not-affected> (Issue introduced later)
[wheezy] - linux <not-affected> (Issue introduced later)
@@ -68,18 +87,21 @@
NOTE: Exploitable since: https://git.kernel.org/linus/1be7f75d1668d6296b80bf35dcf6762393530afc (v4.4-rc1)
NOTE: http://www.openwall.com/lists/oss-security/2016/05/06/4
CVE-2016-4556
+ RESERVED
- squid3 <unfixed>
- squid <not-affected> (Does not affect 2.x)
NOTE: http://www.squid-cache.org/Advisories/SQUID-2016_9.txt
NOTE: http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-2016_9.patch
NOTE: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_9.patch
CVE-2016-4555
+ RESERVED
- squid3 <unfixed>
- squid <not-affected> (Does not affect 2.x)
NOTE: http://www.squid-cache.org/Advisories/SQUID-2016_9.txt
NOTE: http://www.squid-cache.org/Versions/v3/3.4/changesets/SQUID-2016_9.patch
NOTE: http://www.squid-cache.org/Versions/v3/3.5/changesets/SQUID-2016_9.patch
CVE-2016-4554 [Header Smuggling issue in HTTP Request processing]
+ RESERVED
- squid3 <unfixed>
- squid <removed>
NOTE: http://www.squid-cache.org/Advisories/SQUID-2016_8.txt
@@ -89,6 +111,7 @@
NOTE: http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13236.patch
NOTE: http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-14038.patch
CVE-2016-4553 [Cache Poisoning issue in HTTP Request handling]
+ RESERVED
- squid3 <unfixed>
- squid <not-affected> (Does not affect 2.x)
NOTE: http://www.squid-cache.org/Advisories/SQUID-2016_7.txt
@@ -484,8 +507,7 @@
RESERVED
CVE-2015-8870
RESERVED
-CVE-2013-7455
- RESERVED
+CVE-2013-7455 (Double free vulnerability in the DefaultICCintents function in ...)
- lcms2 2.6-1
[wheezy] - lcms2 <not-affected> (vulnerable code not present, no cmsPipelineFree(Lut); in Error:-part)
NOTE: https://www.kb.cert.org/vuls/id/369800
@@ -501,12 +523,10 @@
CVE-2016-4483
RESERVED
- libxml2 <unfixed> (bug #823405)
-CVE-2016-4477
- RESERVED
+CVE-2016-4477 (wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters ...)
- wpa <unfixed> (bug #823411)
NOTE: http://w1.fi/security/2016-1/
-CVE-2016-4476
- RESERVED
+CVE-2016-4476 (hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not ...)
- wpa <unfixed> (bug #823411)
NOTE: http://w1.fi/security/2016-1/
CVE-2016-4413
@@ -646,8 +666,7 @@
NOTE: https://github.com/akheron/jansson/issues/282
NOTE: https://github.com/akheron/jansson/pull/284
NOTE: http://www.openwall.com/lists/oss-security/2016/05/01/5
-CVE-2016-4422 [local root privilege escalation]
- RESERVED
+CVE-2016-4422 (The pam_sm_authenticate function in pam_sshauth.c in libpam-sshauth ...)
{DSA-3567-1}
- libpam-sshauth 0.4.1-2
NOTE: Introduced in: https://bazaar.launchpad.net/~ltsp-upstream/ltsp/libpam-sshauth/revision/93/src/pam_sshauth.c
@@ -1215,8 +1234,7 @@
NOT-FOR-US: Foxit
CVE-2016-4059 (Use-after-free vulnerability in Foxit Reader and PhantomPDF before ...)
NOT-FOR-US: Foxit
-CVE-2016-4074 [Stack exhaustion parsing a JSON file]
- RESERVED
+CVE-2016-4074 (The jv_dump_term function in jq 1.5 allows remote attackers to cause a ...)
- jq <unfixed> (bug #822456)
NOTE: https://github.com/stedolan/jq/issues/1136
NOTE: http://www.openwall.com/lists/oss-security/2016/04/24/3
@@ -1430,8 +1448,7 @@
NOTE: https://rt.perl.org/Public/Bug/Display.html?id=123562
NOTE: http://perl5.git.perl.org/perl.git/commitdiff/22b433eff9a1ffa2454e18405a56650f07b385b5
NOTE: http://www.openwall.com/lists/oss-security/2016/04/20/5
-CVE-2015-8863 [off-by-one error that leads to a heap-based buffer overflow]
- RESERVED
+CVE-2015-8863 (Off-by-one error in the tokenadd function in jv_parse.c in jq allows ...)
- jq <unfixed> (bug #802231)
NOTE: https://github.com/stedolan/jq/issues/995
NOTE: https://github.com/stedolan/jq/commit/8eb1367ca44e772963e704a700ef72ae2e12babd
@@ -1593,8 +1610,7 @@
NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2016/04/12/4
NOTE: Introduced in: https://github.com/brltty/brltty/commit/e62b3c925d03239a372d425fb87b2cac65d8ef19
NOTE: Fixed by: https://github.com/brltty/brltty/commit/74affe7d1401f2b43ad32e18cb78704d22604ad7
-CVE-2015-8868 [heap overflow]
- RESERVED
+CVE-2015-8868 (Heap-based buffer overflow in the ...)
{DSA-3563-1 DLA-446-1}
- poppler 0.38.0-3 (bug #822578)
NOTE: https://cgit.freedesktop.org/poppler/poppler/commit/?id=b3425dd3261679958cd56c0f71995c15d2124433
@@ -2369,6 +2385,7 @@
RESERVED
CVE-2016-3712 [Out-of-bounds read when creating weird vga screen surface]
RESERVED
+ {DSA-3573-1}
- qemu <unfixed> (bug #823830)
- qemu-kvm <removed>
NOTE: http://xenbits.xen.org/xsa/advisory-179.html
@@ -2379,6 +2396,7 @@
TODO: check
CVE-2016-3710 [incorrect banked access bounds checking in vga module]
RESERVED
+ {DSA-3573-1}
- qemu <unfixed> (bug #823830)
- qemu-kvm <removed>
NOTE: http://xenbits.xen.org/xsa/advisory-179.html
@@ -5854,76 +5872,76 @@
RESERVED
CVE-2016-2463
RESERVED
-CVE-2016-2462
- RESERVED
-CVE-2016-2461
- RESERVED
-CVE-2016-2460
- RESERVED
-CVE-2016-2459
- RESERVED
-CVE-2016-2458
- RESERVED
-CVE-2016-2457
- RESERVED
-CVE-2016-2456
- RESERVED
+CVE-2016-2462 (OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 ...)
+ TODO: check
+CVE-2016-2461 (OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 ...)
+ TODO: check
+CVE-2016-2460 (mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x ...)
+ TODO: check
+CVE-2016-2459 (mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x ...)
+ TODO: check
+CVE-2016-2458 (The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, ...)
+ TODO: check
+CVE-2016-2457 (server/pm/UserManagerService.java in Wi-Fi in Android 5.0.x before ...)
+ TODO: check
+CVE-2016-2456 (The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One ...)
+ TODO: check
CVE-2016-2455
RESERVED
-CVE-2016-2454
- RESERVED
-CVE-2016-2453
- RESERVED
-CVE-2016-2452
- RESERVED
-CVE-2016-2451
- RESERVED
-CVE-2016-2450
- RESERVED
-CVE-2016-2449
- RESERVED
-CVE-2016-2448
- RESERVED
+CVE-2016-2454 (The Qualcomm hardware video codec in Android before 2016-05-01 on ...)
+ TODO: check
+CVE-2016-2453 (The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One ...)
+ TODO: check
+CVE-2016-2452 (codecs/amrnb/dec/SoftAMR.cpp in libstagefright in mediaserver in ...)
+ TODO: check
+CVE-2016-2451 (codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android ...)
+ TODO: check
+CVE-2016-2450 (codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in ...)
+ TODO: check
+CVE-2016-2449 (services/camera/libcameraservice/device3/Camera3Device.cpp in ...)
+ TODO: check
+CVE-2016-2448 (media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in ...)
+ TODO: check
CVE-2016-2447
- RESERVED
-CVE-2016-2446
- RESERVED
-CVE-2016-2445
- RESERVED
-CVE-2016-2444
- RESERVED
-CVE-2016-2443
- RESERVED
-CVE-2016-2442
- RESERVED
-CVE-2016-2441
- RESERVED
-CVE-2016-2440
- RESERVED
-CVE-2016-2439
- RESERVED
+ REJECTED
+CVE-2016-2446 (The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 ...)
+ TODO: check
+CVE-2016-2445 (The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 ...)
+ TODO: check
+CVE-2016-2444 (The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 ...)
+ TODO: check
+CVE-2016-2443 (The Qualcomm MDP driver in Android before 2016-05-01 on Nexus 5 and ...)
+ TODO: check
+CVE-2016-2442 (The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, ...)
+ TODO: check
+CVE-2016-2441 (The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, ...)
+ TODO: check
+CVE-2016-2440 (libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, ...)
+ TODO: check
+CVE-2016-2439 (Buffer overflow in btif/src/btif_dm.c in Bluetooth in Android 4.x ...)
+ TODO: check
CVE-2016-2438
- RESERVED
-CVE-2016-2437
- RESERVED
-CVE-2016-2436
- RESERVED
-CVE-2016-2435
- RESERVED
-CVE-2016-2434
- RESERVED
+ REJECTED
+CVE-2016-2437 (The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 ...)
+ TODO: check
+CVE-2016-2436 (The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 ...)
+ TODO: check
+CVE-2016-2435 (The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 ...)
+ TODO: check
+CVE-2016-2434 (The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 ...)
+ TODO: check
CVE-2016-2433
RESERVED
-CVE-2016-2432
- RESERVED
-CVE-2016-2431
- RESERVED
-CVE-2016-2430
- RESERVED
-CVE-2016-2429
- RESERVED
-CVE-2016-2428
- RESERVED
+CVE-2016-2432 (The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus ...)
+ TODO: check
+CVE-2016-2431 (The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus ...)
+ TODO: check
+CVE-2016-2430 (libbacktrace/Backtrace.cpp in debuggerd in Android 4.x before 4.4.4, ...)
+ TODO: check
+CVE-2016-2429 (libFLAC/stream_decoder.c in mediaserver in Android 4.x before 4.4.4, ...)
+ TODO: check
+CVE-2016-2428 (libAACdec/src/aacdec_drc.cpp in mediaserver in Android 4.x before ...)
+ TODO: check
CVE-2016-2427 (asn1/cms/GCMParameters.java in the Bouncy Castle Crypto APIs 1.54 for ...)
TODO: check
CVE-2016-2426 (server/content/ContentService.java in the Framework component in ...)
@@ -6157,14 +6175,14 @@
RESERVED
CVE-2016-2354 (The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver ...)
NOT-FOR-US: Lemur Vehicle Monitors BlueDriver
-CVE-2016-2353
- RESERVED
-CVE-2016-2352
- RESERVED
-CVE-2016-2351
- RESERVED
-CVE-2016-2350
- RESERVED
+CVE-2016-2353 (The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows ...)
+ TODO: check
+CVE-2016-2352 (The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows ...)
+ TODO: check
+CVE-2016-2351 (SQL injection vulnerability in home/seos/courier/security_key2.api on ...)
+ TODO: check
+CVE-2016-2350 (Multiple cross-site scripting (XSS) vulnerabilities on the Accellion ...)
+ TODO: check
CVE-2016-2349
RESERVED
CVE-2016-2348
@@ -7123,8 +7141,7 @@
RESERVED
CVE-2016-2095
RESERVED
-CVE-2016-2094
- RESERVED
+CVE-2016-2094 (The HTTPS NIO Connector allows remote attackers to cause a denial of ...)
NOT-FOR-US: JBoss EAP
CVE-2016-2093
RESERVED
@@ -7403,8 +7420,8 @@
TODO: check
CVE-2016-2061
RESERVED
-CVE-2016-2060
- RESERVED
+CVE-2016-2060 (server/TetherController.cpp in the tethering controller in netd, as ...)
+ TODO: check
CVE-2016-2059 (The msm_ipc_router_bind_control_port function in ...)
NOT-FOR-US: Android drivers
CVE-2016-2058 (Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, ...)
@@ -7594,18 +7611,18 @@
RESERVED
CVE-2016-2015
RESERVED
-CVE-2016-2014
- RESERVED
-CVE-2016-2013
- RESERVED
-CVE-2016-2012
- RESERVED
-CVE-2016-2011
- RESERVED
-CVE-2016-2010
- RESERVED
-CVE-2016-2009
- RESERVED
+CVE-2016-2014 (HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and ...)
+ TODO: check
+CVE-2016-2013 (HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and ...)
+ TODO: check
+CVE-2016-2012 (HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and ...)
+ TODO: check
+CVE-2016-2011 (Cross-site scripting (XSS) vulnerability in HPE Network Node Manager i ...)
+ TODO: check
+CVE-2016-2010 (Cross-site scripting (XSS) vulnerability in HPE Network Node Manager i ...)
+ TODO: check
+CVE-2016-2009 (HPE Network Node Manager i (NNMi) 9.20, 9.23, 9.24, 9.25, 10.00, and ...)
+ TODO: check
CVE-2016-2008 (HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before ...)
NOT-FOR-US: HPE Data Protector
CVE-2016-2007 (HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before ...)
@@ -9163,8 +9180,8 @@
RESERVED
CVE-2016-1542
RESERVED
-CVE-2016-1541
- RESERVED
+CVE-2016-1541 (Heap-based buffer overflow in the zip_read_mac_metadata function in ...)
+ TODO: check
CVE-2016-1540
RESERVED
CVE-2016-1539
@@ -10269,6 +10286,7 @@
RESERVED
CVE-2016-1236 [XSS via directory or file in a repository containing XSS payload]
RESERVED
+ {DSA-3572-1 DLA-462-1}
- websvn <removed>
NOTE: http://www.openwall.com/lists/oss-security/2016/05/05/22
CVE-2016-1235 (The oarsh script in OAR before 2.5.7 allows remote authenticated users ...)
@@ -11287,14 +11305,11 @@
RESERVED
CVE-2016-0903
RESERVED
-CVE-2016-0902
- RESERVED
+CVE-2016-0902 (CRLF injection vulnerability in EMC RSA Authentication Manager before ...)
NOT-FOR-US: RSA Authentication Manager
-CVE-2016-0901
- RESERVED
+CVE-2016-0901 (Cross-site scripting (XSS) vulnerability in EMC RSA Authentication ...)
NOT-FOR-US: RSA Authentication Manager
-CVE-2016-0900
- RESERVED
+CVE-2016-0900 (Cross-site scripting (XSS) vulnerability in EMC RSA Authentication ...)
NOT-FOR-US: RSA Authentication Manager
CVE-2016-0899
RESERVED
@@ -19667,12 +19682,12 @@
TODO: check
CVE-2015-6553
REJECTED
-CVE-2015-6552
- RESERVED
-CVE-2015-6551
- RESERVED
-CVE-2015-6550
- RESERVED
+CVE-2015-6552 (The management-services protocol implementation in Veritas NetBackup ...)
+ TODO: check
+CVE-2015-6551 (Veritas NetBackup 7.x through 7.5.0.7 and 7.6.0.x through 7.6.0.4 and ...)
+ TODO: check
+CVE-2015-6550 (bpcd in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through ...)
+ TODO: check
CVE-2015-6549 (Cross-site scripting (XSS) vulnerability in an application console in ...)
NOT-FOR-US: Symantec NetBackup OpsCenter
CVE-2015-6548 (Multiple SQL injection vulnerabilities in a PHP script in the ...)
@@ -37135,13 +37150,11 @@
{DSA-3405-1}
- smokeping 2.6.11-2
[squeeze] - smokeping <not-affected> (Vulnerable code not present)
-CVE-2015-0858 [/tmp race condition in handling temporary directory]
- RESERVED
+CVE-2015-0858 (Cool Projects TarDiff allows local users to write to arbitrary files ...)
{DSA-3562-1}
- tardiff 0.1-3
NOTE: https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a
-CVE-2015-0857 [shell command injection through file names and tar file name itself]
- RESERVED
+CVE-2015-0857 (Cool Projects TarDiff allows remote attackers to execute arbitrary ...)
{DSA-3562-1}
- tardiff 0.1-5
NOTE: https://anonscm.debian.org/cgit/collab-maint/tardiff.git/commit/?id=9bd6a07bc204472ac27242cea16f89943b43003a
@@ -37883,12 +37896,12 @@
RESERVED
CVE-2015-0572
RESERVED
-CVE-2015-0571
- RESERVED
-CVE-2015-0570
- RESERVED
-CVE-2015-0569
- RESERVED
+CVE-2015-0571 (The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used ...)
+ TODO: check
+CVE-2015-0570 (Stack-based buffer overflow in the SET_WPS_IE IOCTL implementation in ...)
+ TODO: check
+CVE-2015-0569 (Heap-based buffer overflow in the private wireless extensions IOCTL ...)
+ TODO: check
CVE-2015-0568
RESERVED
CVE-2015-0567
More information about the Secure-testing-commits
mailing list