[Git][security-tracker-team/security-tracker][master] stretch triage

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
40308adb by Moritz Muehlenhoff at 2018-08-01T16:32:05Z
stretch triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -564,6 +564,7 @@ CVE-2018-1999008 (October CMS version prior to build 437 contains a Cross Site S
 	NOT-FOR-US: October CMS
 CVE-2018-14568 (Suricata before 4.0.5 stops TCP stream inspection upon a TCP RST from a ...)
 	- suricata 1:4.0.5-1
+	[stretch] - suricata <no-dsa> (Minor issue)
 	NOTE: https://github.com/OISF/suricata/pull/3428/commits/843d0b7a10bb45627f94764a6c5d468a24143345
 	NOTE: https://redmine.openinfosecfoundation.org/issues/2501
 CVE-2018-14567
@@ -608,6 +609,7 @@ CVE-2018-14552
 	RESERVED
 CVE-2018-14551 (The ReadMATImageV4 function in coders/mat.c in ImageMagick 7.0.8-7 uses ...)
 	- imagemagick 8:6.9.10.8+dfsg-1 (bug #904713)
+	[stretch] - imagemagick <postponed> (Can be fixed along in a future DSA)
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/1221
 	NOTE: https://github.com/ImageMagick/ImageMagick/commit/389ecc365a7c61404ba078a72c3fa5a3cf1b4101
 	NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/db7a4be592328af06d776ce3bab24b8c6de5be20
@@ -731,6 +733,7 @@ CVE-2018-1999023 (The Battle for Wesnoth Project version 1.7.0 through 1.14.3 co
 	NOTE: https://github.com/wesnoth/wesnoth/commit/d911268a783467842d38eae7ac1630f1fea41318 (1.14.x)
 CVE-2018-14505 (mitmweb in mitmproxy v4.0.3 allows DNS Rebinding attacks, related to ...)
 	- mitmproxy <unfixed> (bug #904293)
+	[stretch] - mitmproxy <no-dsa> (Minor issue)
 	NOTE: https://github.com/mitmproxy/mitmproxy/issues/3234
 	NOTE: https://github.com/mitmproxy/mitmproxy/pull/3243
 CVE-2018-14499
@@ -2046,7 +2049,8 @@ CVE-2018-13990
 CVE-2018-13989 (Grundig Smart Inter at ctive TV 3.0 devices allow CSRF attacks via a POST ...)
 	NOT-FOR-US: Grundig Smart Inter at ctive TV 3.0 devices
 CVE-2018-13988 (Poppler through 0.62 contains a Buffer Overflow vulnerability due to ...)
-	- poppler <unfixed> (bug #904922)
+	- poppler <unfixed> (low; bug #904922)
+	[stretch] - poppler <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1602838
 	NOTE: https://cgit.freedesktop.org/poppler/poppler/commit/?id=004e3c10df0abda214f0c293f9e269fdd979c5ee (poppler-0.67.0)
 CVE-2018-13987


=====================================
data/dsa-needed.txt
=====================================
--- a/data/dsa-needed.txt
+++ b/data/dsa-needed.txt
@@ -77,6 +77,8 @@ passenger
 php-horde-image
   Chris Lamb proposed debdiff adressing CVE-2017-9773, CVE-2017-9774 and CVE-2017-14650
 --
+python-django
+--
 sssd
   Maintainer prepared an update and proposed debdiff, acked for upload, but update needs further testing before release.
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/40308adb3ab2814985621ae5b3053d4832cc2284

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/40308adb3ab2814985621ae5b3053d4832cc2284
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20180801/a2595973/attachment.html>