[Secure-testing-commits] r53559 - data/CVE

[Moritz Muehlenhoff]

Author: jmm
Date: 2017-07-16 21:38:15 +0000 (Sun, 16 Jul 2017)
New Revision: 53559

Modified:
   data/CVE/list
Log:
new tt-rss issue
exiv2 bug


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2017-07-16 21:10:15 UTC (rev 53558)
+++ data/CVE/list	2017-07-16 21:38:15 UTC (rev 53559)
@@ -10,27 +10,27 @@
 	[stretch] - libsass <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1470714
 CVE-2017-11340 (There is a Segmentation fault in the XmpParser::terminate() function in ...)
-	- exiv2 <unfixed>
+	- exiv2 <unfixed> (bug #868578)
 	[stretch] - exiv2 <no-dsa> (Minor issue)
 	[jessie] - exiv2 <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1470950
 CVE-2017-11339 (There is a heap-based buffer overflow in the Image::printIFDStructure ...)
-	- exiv2 <unfixed>
+	- exiv2 <unfixed> (bug #868578)
 	[stretch] - exiv2 <no-dsa> (Minor issue)
 	[jessie] - exiv2 <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1470946
 CVE-2017-11338 (There is an infinite loop in the Exiv2::Image::printIFDStructure ...)
-	- exiv2 <unfixed>
+	- exiv2 <unfixed> (bug #868578)
 	[stretch] - exiv2 <no-dsa> (Minor issue)
 	[jessie] - exiv2 <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1470913
 CVE-2017-11337 (There is an invalid free in the Action::TaskFactory::cleanup function ...)
-	- exiv2 <unfixed>
+	- exiv2 <unfixed> (bug #868578)
 	[stretch] - exiv2 <no-dsa> (Minor issue)
 	[jessie] - exiv2 <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1470737
 CVE-2017-11336 (There is a heap-based buffer over-read in the Image::printIFDStructure ...)
-	- exiv2 <unfixed>
+	- exiv2 <unfixed> (bug #868578)
 	[stretch] - exiv2 <no-dsa> (Minor issue)
 	[jessie] - exiv2 <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1470729
@@ -639,7 +639,8 @@
 CVE-2017-1000036 (All versions of Candy Chat are vulnerable to an XSS attack by message ...)
 	TODO: check
 CVE-2017-1000035 (Tiny Tiny RSS before 829d478f is vulnerable to XSS window.opener ...)
-	TODO: check
+	- tt-rss 17.1+git20170410+dfsg-1
+	NOTE: https://git.tt-rss.org/git/tt-rss/commit/829d478f1b054c8ce1eeb4f15170dc4a1abb3e47
 CVE-2017-1000034 (Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java ...)
 	TODO: check
 CVE-2017-1000033 (Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a ...)