[Secure-testing-commits] r50807 - in data: . CVE

Moritz Muehlenhoff jmm at moszumanska.debian.org
Wed Apr 19 18:09:17 UTC 2017 

Author: jmm
Date: 2017-04-19 18:09:17 +0000 (Wed, 19 Apr 2017)
New Revision: 50807

Modified:
   data/CVE/list
   data/next-point-update.txt
Log:
kernel issues lined up for spu
vbox fixed


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2017-04-19 15:04:40 UTC (rev 50806)
+++ data/CVE/list	2017-04-19 18:09:17 UTC (rev 50807)
@@ -927,9 +927,11 @@
 	RESERVED
 CVE-2017-7618 (crypto/ahash.c in the Linux kernel through 4.10.9 allows attackers to ...)
 	- linux <unfixed>
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: http://marc.info/?l=linux-crypto-vger&m=149181655623850&w=2
 CVE-2017-7616 (Incorrect error handling in the set_mempolicy and mbind compat syscalls ...)
 	- linux <unfixed>
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: Fixed by: https://git.kernel.org/linus/cf01fb9985e8deb25ccf0ea54d916b8871ae0e62 (4.11-rc6)
 CVE-2016-10323 (Synology Photo Station before 6.3-2958 allows local users to gain ...)
 	NOT-FOR-US: Synology Photo Station
@@ -1819,6 +1821,7 @@
 	NOT-FOR-US: SAP
 CVE-2017-7308 (The packet_set_ring function in net/packet/af_packet.c in the Linux ...)
 	- linux 4.9.18-1
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: Fixed by: https://git.kernel.org/linus/2b6867c2ce76c596676bec7d2d525af525fdc6e2
 	NOTE: Fixed by: https://git.kernel.org/linus/8f8d28e4d6d815a391285e121c3a53a0b6cb9e7b
 	NOTE: Fixed by: https://git.kernel.org/linus/bcc5364bdcfe131e6379363f089e7b4108d35b70
@@ -1838,6 +1841,7 @@
 	RESERVED
 CVE-2017-7294 (The vmw_surface_define_ioctl function in ...)
 	- linux 4.9.18-1
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: Fixed by: https://git.kernel.org/linus/e7e11f99564222d82f0ce84bd521e57d78a6b678
 CVE-2017-7292
 	RESERVED
@@ -2023,6 +2027,7 @@
 	RESERVED
 CVE-2017-7273 (The cp_report_fixup function in drivers/hid/hid-cypress.c in the Linux ...)
 	- linux 4.9.6-1
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: Fixed by: https://git.kernel.org/linus/1ebb71143758f45dc0fa76e2f48429e13b16d110
 CVE-2017-7272 (PHP through 7.1.3 enables potential SSRF in applications that accept an ...)
 	{DLA-875-1}
@@ -2063,6 +2068,7 @@
 	NOT-FOR-US: Hardware bug in AMD Ryzen CPUs, cannot be fixed via micro code updates, but only BIOS updates
 CVE-2017-7261 (The vmw_surface_define_ioctl function in ...)
 	- linux 4.9.18-1
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: Fixed by: https://git.kernel.org/linus/36274ab8c596f1240c606bb514da329add2a1bcd
 CVE-2017-7260
 	RESERVED
@@ -2401,6 +2407,7 @@
 	NOTE: https://github.com/erlang/otp/pull/1108
 CVE-2017-7184 (The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the ...)
 	- linux 4.9.18-1 (low)
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: Unprivileged user namespaces are disabled in Debian, this only affects
 	NOTE: non-standard setups
 CVE-2017-7186 (libpcre1 in PCRE 8.40 and libpcre2 in PCRE2 10.23 allow remote ...)
@@ -2909,6 +2916,7 @@
 	REJECTED
 CVE-2017-6951 (The keyring_search_aux function in security/keys/keyring.c in the Linux ...)
 	- linux 4.0.2-1
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 CVE-2017-6950 (SAP GUI 7.2 through 7.5 allows remote attackers to bypass intended ...)
 	NOT-FOR-US: SAP
 CVE-2017-6949 (An issue was discovered in CHICKEN Scheme through 4.12.0. When using a ...)
@@ -12594,7 +12602,7 @@
 	RESERVED
 CVE-2017-3587
 	RESERVED
-	- virtualbox <unfixed>
+	- virtualbox 5.1.20-dfsg-1
 	[jessie] - virtualbox <end-of-life> (DSA-3699-1)
 	[wheezy] - virtualbox <end-of-life> (DSA 3454)
 CVE-2017-3586
@@ -12625,12 +12633,12 @@
 	RESERVED
 CVE-2017-3576
 	RESERVED
-	- virtualbox <unfixed>
+	- virtualbox 5.1.20-dfsg-1
 	[jessie] - virtualbox <end-of-life> (DSA-3699-1)
 	[wheezy] - virtualbox <end-of-life> (DSA 3454)
 CVE-2017-3575
 	RESERVED
-	- virtualbox <unfixed>
+	- virtualbox 5.1.20-dfsg-1
 	[jessie] - virtualbox <end-of-life> (DSA-3699-1)
 	[wheezy] - virtualbox <end-of-life> (DSA 3454)
 CVE-2017-3574
@@ -12659,26 +12667,26 @@
 	NOT-FOR-US: Solaris
 CVE-2017-3563
 	RESERVED
-	- virtualbox <unfixed>
+	- virtualbox 5.1.20-dfsg-1
 	[jessie] - virtualbox <end-of-life> (DSA-3699-1)
 	[wheezy] - virtualbox <end-of-life> (DSA 3454)
 CVE-2017-3562
 	RESERVED
 CVE-2017-3561
 	RESERVED
-	- virtualbox <unfixed>
+	- virtualbox 5.1.20-dfsg-1
 	[jessie] - virtualbox <end-of-life> (DSA-3699-1)
 	[wheezy] - virtualbox <end-of-life> (DSA 3454)
 CVE-2017-3560
 	RESERVED
 CVE-2017-3559
 	RESERVED
-	- virtualbox <unfixed>
+	- virtualbox 5.1.20-dfsg-1
 	[jessie] - virtualbox <end-of-life> (DSA-3699-1)
 	[wheezy] - virtualbox <end-of-life> (DSA 3454)
 CVE-2017-3558
 	RESERVED
-	- virtualbox <unfixed>
+	- virtualbox 5.1.20-dfsg-1
 	[jessie] - virtualbox <end-of-life> (DSA-3699-1)
 	[wheezy] - virtualbox <end-of-life> (DSA 3454)
 CVE-2017-3557
@@ -12794,7 +12802,7 @@
 	- openjdk-7 <removed>
 CVE-2017-3513
 	RESERVED
-	- virtualbox <unfixed>
+	- virtualbox 5.1.20-dfsg-1
 	[jessie] - virtualbox <end-of-life> (DSA-3699-1)
 	[wheezy] - virtualbox <end-of-life> (DSA 3454)
 CVE-2017-3512
@@ -15121,6 +15129,7 @@
 	- foreman <itp> (bug #663101)
 CVE-2017-2671 (The ping_unhash function in net/ipv4/ping.c in the Linux kernel ...)
 	- linux <unfixed>
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/24/6
 	NOTE: Fixed by: https://git.kernel.org/linus/43a6684519ab0a6c52024b5e25322476cabad893
 CVE-2017-2670
@@ -15191,6 +15200,7 @@
 	NOT-FOR-US: jenkins-ssh-slaves-plugin
 CVE-2017-2647 (The KEYS subsystem in the Linux kernel before 3.18 allows local users ...)
 	- linux 4.0.2-1
+	[jessie] - linux <no-dsa> (Will be fixed in point release)
 	NOTE: Fixed by: https://git.kernel.org/linus/c06cfb08b88dfbe13be44a69ae2fdc3a7c902d81 (v3.18-rc1)
 CVE-2017-2646
 	RESERVED

Modified: data/next-point-update.txt
===================================================================
--- data/next-point-update.txt	2017-04-19 15:04:40 UTC (rev 50806)
+++ data/next-point-update.txt	2017-04-19 18:09:17 UTC (rev 50807)
@@ -108,3 +108,25 @@
 	[jessie] - glibc 2.19-18+deb8u8
 CVE-2017-5985
 	[jessie] - lxc 1:1.0.6-6+deb8u6
+CVE-2016-2188
+	[jessie] - linux 3.16.43-1
+CVE-2017-2647
+	[jessie] - linux 3.16.43-1
+CVE-2017-2671
+	[jessie] - linux 3.16.43-1
+CVE-2017-6951
+	[jessie] - linux 3.16.43-1
+CVE-2017-7184
+	[jessie] - linux 3.16.43-1
+CVE-2017-7261
+	[jessie] - linux 3.16.43-1
+CVE-2017-7273
+	[jessie] - linux 3.16.43-1
+CVE-2017-7294
+	[jessie] - linux 3.16.43-1
+CVE-2017-7308
+	[jessie] - linux 3.16.43-1
+CVE-2017-7616
+	[jessie] - linux 3.16.43-1
+CVE-2017-7618
+	[jessie] - linux 3.16.43-1

More information about the Secure-testing-commits mailing list