[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] new smplayer issues (sid only)
Moritz Muehlenhoff
jmm at debian.org
Fri Apr 13 16:25:04 BST 2018
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
20711209 by Moritz Muehlenhoff at 2018-04-13T17:24:35+02:00
new smplayer issues (sid only)
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -70852,11 +70852,15 @@ CVE-2017-2923 [Heap-based buffer overflow in the read_biff_next_record function]
NOTE: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0430
NOTE: https://www.gaia-gis.it/fossil/freexl/ci/40c17539ea56f0d8
CVE-2017-2922 (An exploitable memory corruption vulnerability exists in the Websocket ...)
- NOT-FOR-US: Cesanta Mongoose
- TODO: check smplayer, embeds it
+ - smplayer <unfixed>
+ [stretch] - smplayer <not-affected> (Vulnerable code not present)
+ [jessie] - smplayer <not-affected> (Vulnerable code not present)
+ [wheezy] - smplayer <not-affected> (Vulnerable code not present)
CVE-2017-2921 (An exploitable memory corruption vulnerability exists in the Websocket ...)
- NOT-FOR-US: Cesanta Mongoose
- TODO: check smplayer, embeds it
+ - smplayer <unfixed>
+ [stretch] - smplayer <not-affected> (Vulnerable code not present)
+ [jessie] - smplayer <not-affected> (Vulnerable code not present)
+ [wheezy] - smplayer <not-affected> (Vulnerable code not present)
CVE-2017-2920 (An memory corruption vulnerability exists in the .SVG parsing ...)
NOT-FOR-US: Computerinsel Photoline
CVE-2017-2919 (An exploitable stack based buffer overflow vulnerability exists in the ...)
@@ -70881,8 +70885,10 @@ CVE-2017-2911 (An exploitable vulnerability exists in the remote control ...)
CVE-2017-2910
RESERVED
CVE-2017-2909 (An infinite loop programming error exists in the DNS server ...)
- NOT-FOR-US: Cesanta Mongoose
- TODO: check smplayer, embeds it
+ - smplayer <unfixed>
+ [stretch] - smplayer <not-affected> (Vulnerable code not present)
+ [jessie] - smplayer <not-affected> (Vulnerable code not present)
+ [wheezy] - smplayer <not-affected> (Vulnerable code not present)
CVE-2017-2908
RESERVED
CVE-2017-2907
@@ -70912,20 +70918,30 @@ CVE-2017-2896 (An exploitable out-of-bounds write vulnerability exists in the ..
- r-cran-readxl 1.0.0-2 (bug #895564)
NOTE: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0403
CVE-2017-2895 (An exploitable arbitrary memory read vulnerability exists in the MQTT ...)
- NOT-FOR-US: Cesanta Mongoose
- TODO: check smplayer, embeds it
+ - smplayer <unfixed>
+ [stretch] - smplayer <not-affected> (Vulnerable code not present)
+ [jessie] - smplayer <not-affected> (Vulnerable code not present)
+ [wheezy] - smplayer <not-affected> (Vulnerable code not present)
CVE-2017-2894 (An exploitable stack buffer overflow vulnerability exists in the MQTT ...)
- NOT-FOR-US: Cesanta Mongoose
- TODO: check smplayer, embeds it
+ - smplayer <unfixed>
+ [stretch] - smplayer <not-affected> (Vulnerable code not present)
+ [jessie] - smplayer <not-affected> (Vulnerable code not present)
+ [wheezy] - smplayer <not-affected> (Vulnerable code not present)
CVE-2017-2893 (An exploitable NULL pointer dereference vulnerability exists in the ...)
- NOT-FOR-US: Cesanta Mongoose
- TODO: check smplayer, embeds it
+ - smplayer <unfixed>
+ [stretch] - smplayer <not-affected> (Vulnerable code not present)
+ [jessie] - smplayer <not-affected> (Vulnerable code not present)
+ [wheezy] - smplayer <not-affected> (Vulnerable code not present)
CVE-2017-2892 (An exploitable arbitrary memory read vulnerability exists in the MQTT ...)
- NOT-FOR-US: Cesanta Mongoose
- TODO: check smplayer, embeds it
+ - smplayer <unfixed>
+ [stretch] - smplayer <not-affected> (Vulnerable code not present)
+ [jessie] - smplayer <not-affected> (Vulnerable code not present)
+ [wheezy] - smplayer <not-affected> (Vulnerable code not present)
CVE-2017-2891 (An exploitable use-after-free vulnerability exists in the HTTP server ...)
- NOT-FOR-US: Cesanta Mongoose
- TODO: check smplayer, embeds it
+ - smplayer <unfixed>
+ [stretch] - smplayer <not-affected> (Vulnerable code not present)
+ [jessie] - smplayer <not-affected> (Vulnerable code not present)
+ [wheezy] - smplayer <not-affected> (Vulnerable code not present)
CVE-2017-2890 (An exploitable vulnerability exists in the /api/CONFIG/restore ...)
NOT-FOR-US: Circle with Disney
CVE-2017-2889 (An exploitable Denial of Service vulnerability exists in the API ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/207112092feb38f9e312039947eea9c9f7c54d84
---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/207112092feb38f9e312039947eea9c9f7c54d84
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180413/04bb324c/attachment.html>
More information about the debian-security-tracker-commits
mailing list