[Secure-testing-commits] r44326 - data/CVE
security tracker role
sectracker at moszumanska.debian.org
Sun Sep 4 21:10:12 UTC 2016
Author: sectracker
Date: 2016-09-04 21:10:12 +0000 (Sun, 04 Sep 2016)
New Revision: 44326
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2016-09-04 21:08:27 UTC (rev 44325)
+++ data/CVE/list 2016-09-04 21:10:12 UTC (rev 44326)
@@ -787,7 +787,7 @@
NOTE: http://bugs.call-cc.org/ticket/1308
CVE-2016-6828 [Linux tcp_xmit_retransmit_queue use after free]
RESERVED
- {DLA-609-1}
+ {DSA-3659-1 DLA-609-1}
- linux 4.7.2-1
CVE-2016-6822
RESERVED
@@ -1993,7 +1993,7 @@
- redis 2:3.2.1-4 (bug #832460)
NOTE: http://www.openwall.com/lists/oss-security/2016/07/28/1
CVE-2016-6480 (Race condition in the ioctl_send_fib function in ...)
- {DLA-609-1}
+ {DSA-3659-1 DLA-609-1}
- linux 4.7.2-1
CVE-2016-6478
RESERVED
@@ -2444,7 +2444,7 @@
TODO: check, possibly n/a since method not implemented, but needs double-check
CVE-2016-6354 [Buffer overflow in generated code (yy_get_next_buffer); related to num_to_read]
RESERVED
- {DSA-3653-1}
+ {DSA-3653-2 DSA-3653-1}
- flex 2.6.1-1 (bug #832768)
[wheezy] - flex <not-affected> (Issue introduced with 2.5.36)
NOTE: Intorduced by: https://github.com/westes/flex/commit/9ba3187a537d6a58d345f2874d06087fd4050399 (flex-2-5-36)
@@ -3188,6 +3188,7 @@
NOTE: http://www.openwall.com/lists/oss-security/2016/07/13/5
CVE-2016-6223 [tiff: information leak in libtiff/tif_read.c]
RESERVED
+ {DLA-610-1}
- tiff 4.0.6-2
- tiff3 <removed>
NOTE: http://www.openwall.com/lists/oss-security/2016/07/13/3
@@ -3405,7 +3406,7 @@
CVE-2016-6137
RESERVED
CVE-2016-6136 (Race condition in the audit_log_single_execve_arg function in ...)
- {DLA-609-1}
+ {DSA-3659-1 DLA-609-1}
- linux 4.7.2-1
NOTE: https://bugzilla.kernel.org/show_bug.cgi?id=120681
NOTE: https://github.com/linux-audit/audit-kernel/issues/18
@@ -3997,7 +3998,7 @@
RESERVED
CVE-2016-5875 [tiff: heap-based buffer overflow when using the PixarLog compression format]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff 4.0.6-2 (bug #830700)
- tiff3 <removed>
NOTE: Upstream fix: https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2
@@ -5397,7 +5398,7 @@
CVE-2016-5390 (Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote ...)
- foreman <itp> (bug #663101)
CVE-2016-5696 (net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly ...)
- {DLA-609-1}
+ {DSA-3659-1 DLA-609-1}
- linux 4.7.2-1
NOTE: Introduced by: https://github.com/torvalds/linux/commit/282f23c6ee343126156dd41218b22ece96d747e3
NOTE: Fixed by: https://github.com/torvalds/linux/commit/75ff39ccc1bd5d3c455b6822ab09e533c551f758
@@ -5652,7 +5653,7 @@
RESERVED
CVE-2016-5323 [tiffcrop _TIFFFax3fillruns(): NULL pointer dereference]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff 4.0.6-2
[jessie] - tiff <no-dsa> (Minor issue)
- tiff3 <removed>
@@ -5661,7 +5662,7 @@
NOTE: Reproducer http://bugzilla.maptools.org/attachment.cgi?id=659
CVE-2016-5322 [extractContigSamplesBytes: out-of-bounds read]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff <unfixed>
[jessie] - tiff <no-dsa> (Minor issue)
- tiff3 <removed> (unimportant)
@@ -5670,7 +5671,7 @@
NOTE: Reproducer http://bugzilla.maptools.org/attachment.cgi?id=658
CVE-2016-5321 [DumpModeDecode(): Ddos]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff 4.0.6-2
- tiff3 <removed>
NOTE: Upstream fix http://bugzilla.maptools.org/show_bug.cgi?id=2558#c2
@@ -5678,13 +5679,13 @@
NOTE: Reproducer http://bugzilla.maptools.org/attachment.cgi?id=657
CVE-2016-5320 [rgb2ycbcr: command excution]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff 4.0.6-2 (bug #830700)
- tiff3 <removed>
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2554#c1
CVE-2016-5317 [GNOME nautilus: crash occurs when generating a thumbnail for a crafted TIFF image]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff <unfixed>
- tiff3 <removed>
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2557
@@ -5692,7 +5693,7 @@
NOTE: Upstream marked this duplicate of bug 2554
CVE-2016-5316 [tif_pixarlog.c: PixarLogCleanup() Segmentation fault]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff 4.0.6-2 (bug #830700)
- tiff3 <removed>
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2556
@@ -5700,7 +5701,7 @@
NOTE: Upstream fix https://github.com/vadz/libtiff/commit/391e77fcd217e78b2c51342ac3ddb7100ecacdd2
CVE-2016-5315 [tif_dir.c: setByteArray() Read access violation]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff <unfixed>
- tiff3 <removed>
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2555
@@ -5710,7 +5711,7 @@
NOTE: Upstream marked this duplicate of bug 2554
CVE-2016-5314 [PixarLogDecode() out-of-bound writes]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff 4.0.6-2 (bug #830700)
- tiff3 <removed>
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2554
@@ -10209,7 +10210,7 @@
RESERVED
CVE-2016-3991 [tiffcrop: out-of-bounds write in loadImage()]
RESERVED
- {DLA-606-1}
+ {DLA-610-1 DLA-606-1}
- tiff <unfixed>
[jessie] - tiff <no-dsa> (Minor issue)
- tiff3 <removed> (unimportant)
@@ -10218,6 +10219,7 @@
NOTE: Reproducer http://bugs.fi/media/afl/libtiff/CVE-2016-3991.tif
CVE-2016-3990 [tiffcp: out-of-bounds write in horizontalDifference8()]
RESERVED
+ {DLA-610-1}
- tiff <unfixed> (bug #836570)
[jessie] - tiff <no-dsa> (Minor issue)
[wheezy] - tiff <no-dsa> (Minor issue)
@@ -10439,6 +10441,7 @@
RESERVED
CVE-2016-3945 [Out-of-bounds Write in the tiff2rgba tool]
RESERVED
+ {DLA-610-1}
- tiff <unfixed>
[jessie] - tiff <no-dsa> (Minor issue)
[wheezy] - tiff <no-dsa> (Minor issue)
@@ -11310,6 +11313,7 @@
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2568
CVE-2016-3623 [Divide By Zero in the rgb2ycbcr tool]
RESERVED
+ {DLA-610-1}
- tiff <unfixed>
[jessie] - tiff <no-dsa> (Minor issue)
[wheezy] - tiff <no-dsa> (Minor issue)
@@ -12321,6 +12325,7 @@
CVE-2016-3187 (The Prepopulate module 7.x-2.x before 7.x-2.1 for Drupal allows remote ...)
NOT-FOR-US: Prepopulate module for Drupal
CVE-2016-3186 (Buffer overflow in the readextension function in gif2tiff.c in LibTIFF ...)
+ {DLA-610-1}
- tiff <unfixed> (bug #819972)
[jessie] - tiff <no-dsa> (Minor issue)
[wheezy] - tiff <no-dsa> (Minor issue)
@@ -19864,13 +19869,13 @@
NOTE: Red Hat's patch is partially incorrect according to upstream. Issue was also marked as wontfix.
NOTE: http://bugzilla.maptools.org/show_bug.cgi?id=2563#c4
CVE-2015-8683 (The putcontig8bitCIELab function in tif_getimage.c in LibTIFF 4.0.6 ...)
- {DSA-3467-1 DLA-402-1}
+ {DSA-3467-1 DLA-610-1 DLA-402-1}
- tiff 4.0.6-1 (bug #809021)
- tiff3 <removed>
NOTE: http://www.openwall.com/lists/oss-security/2015/12/25/1
NOTE: https://github.com/vadz/libtiff/commit/f94a29a822f5528d2334592760fbb7938f15eb55
CVE-2015-8665 (tif_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a ...)
- {DSA-3467-1 DLA-402-1}
+ {DSA-3467-1 DLA-610-1 DLA-402-1}
- tiff 4.0.6-1 (bug #808968)
- tiff3 <removed>
NOTE: http://www.openwall.com/lists/oss-security/2015/12/24/2
@@ -43910,7 +43915,7 @@
- lynx-cur 2.8.8dev.4-1
NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/02/07/2
CVE-2015-1547 (The NeXTDecode function in tif_next.c in LibTIFF allows remote ...)
- {DSA-3273-1 DLA-221-1}
+ {DSA-3273-1 DLA-610-1 DLA-221-1}
- tiff 4.0.3-12.1 (bug #777390)
- tiff3 <removed>
NOTE: http://lcamtuf.coredump.cx/afl/vulns/libtiff5.tif
@@ -44051,7 +44056,7 @@
NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/02/03/12
NOTE: Starting with 1.4-5 cabextract uses the mspack system library
CVE-2014-9655 (The (1) putcontig8bitYCbCr21tile function in tif_getimage.c or (2) ...)
- {DSA-3273-1 DLA-221-1}
+ {DSA-3273-1 DLA-610-1 DLA-221-1}
- tiff 4.0.3-12.1 (bug #777390)
- tiff3 <removed>
NOTE: http://lcamtuf.coredump.cx/afl/vulns/libtiff-cvs-1.tif
@@ -52826,7 +52831,7 @@
NOTE: Crash in a frontend tool w/o potential for code injection, marked as unimportant
CVE-2014-8129 [out-of-bound read and write]
RESERVED
- {DSA-3273-1 DLA-221-1}
+ {DSA-3273-1 DLA-610-1 DLA-221-1}
- tiff 4.0.3-12.1 (bug #776185)
- tiff3 <removed>
NOTE: Advisory: http://www.conostix.com/pub/adv/CVE-2014-8129-LibTIFF-Out-of-bounds_Reads_and_Writes.txt
@@ -52835,7 +52840,7 @@
NOTE: The tiff3 source package doesn't build the TIFF tools, but most of these bugs are in the library
CVE-2014-8128 [out-of-bounds write]
RESERVED
- {DSA-3273-1 DLA-221-1}
+ {DSA-3273-1 DLA-610-1 DLA-221-1}
- tiff 4.0.3-12.3 (bug #776185)
- tiff3 <removed>
NOTE: Advisory: http://www.conostix.com/pub/adv/CVE-2014-8128-LibTIFF-Out-of-bounds_Writes.txt
@@ -88013,7 +88018,7 @@
- libvirt <not-affected> (Vulnerable code not present)
NOTE: http://libvirt.org/git/?p=libvirt.git;a=commitdiff;h=ca697e90d5bd6a6dfb94bfb6d4438bdf9a44b739
CVE-2013-1961 (Stack-based buffer overflow in the t2p_write_pdf_page function in ...)
- {DSA-2698-1}
+ {DSA-2698-1 DLA-610-1}
- tiff 4.0.2-6+nmu1 (bug #706674)
- tiff3 3.9.7-1 (bug #712840)
CVE-2013-1960 (Heap-based buffer overflow in the t2p_process_jpeg_strip function in ...)
@@ -131597,6 +131602,7 @@
- tiff3 3.9.6-1
NOTE: may have been fixed earlier
CVE-2010-2596 (The OJPEGPostDecode function in tif_ojpeg.c in LibTIFF 3.9.0 and ...)
+ {DLA-610-1}
- tiff 4.0.6-1 (unimportant)
- tiff3 <removed> (unimportant)
NOTE: fixed by http://bugzilla.maptools.org/show_bug.cgi?id=2209
More information about the Secure-testing-commits
mailing list