[Git][security-tracker-team/security-tracker][master] stretch triage

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c3f166c6 by Moritz Muehlenhoff at 2018-07-09T22:09:54+02:00
stretch triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -689,7 +689,8 @@ CVE-2018-13442
 CVE-2018-13441
 	RESERVED
 CVE-2018-13440 (The audiofile Audio File Library 0.3.6 has a NULL pointer dereference ...)
-	- audiofile <unfixed>
+	- audiofile <unfixed> (low)
+	[stretch] - audiofile <no-dsa> (Minor issue)
 	NOTE: https://github.com/mpruett/audiofile/issues/49
 CVE-2018-13439 (WXPayUtil in WeChat Pay Java SDK allows XXE attacks involving a ...)
 	NOT-FOR-US: WeChat Pay Java SDK
@@ -728,14 +729,16 @@ CVE-2018-13423 (admin/themes/default/items/tag-form.php in Omeka before 2.6.1 al
 CVE-2018-13422 (TCExam before 14.1.2 has XSS via an ff_ or xl_ field. ...)
 	NOT-FOR-US: TCExam
 CVE-2018-13421 (Fast C++ CSV Parser (aka fast-cpp-csv-parser) before 2018-07-06 has a ...)
-	- fast-cpp-csv-parser 0.0+git20160525~9bf299c-2 (bug #903247)
+	- fast-cpp-csv-parser 0.0+git20160525~9bf299c-2 (low; bug #903247)
+	[stretch] - fast-cpp-csv-parser <no-dsa> (Minor issue)
 	NOTE: https://github.com/ben-strasser/fast-cpp-csv-parser/issues/67
 	NOTE: https://github.com/ben-strasser/fast-cpp-csv-parser/commit/8cf591aa7397f4372778cc927e184d28ee591093
 CVE-2018-13420 (** DISPUTED ** Google gperftools 2.7 has a memory leak in ...)
-	- google-perftools <unfixed> (low; bug #903248)
+	- google-perftools <unfixed> (unimportant; bug #903248)
 	NOTE: https://github.com/gperftools/gperftools/issues/1013
 CVE-2018-13419 (An issue has been found in libsndfile 1.0.28. There is a memory leak in ...)
 	- libsndfile <unfixed> (low)
+	[stretch] - libsndfile <no-dsa> (Minor issue)
 	NOTE: https://github.com/erikd/libsndfile/issues/398
 CVE-2018-13418
 	RESERVED
@@ -2544,7 +2547,8 @@ CVE-2018-1000534 (Joplin version prior to 1.0.90 contains a XSS evolving into co
 CVE-2018-1000533 (klaussilveira GitList version <= 0.6 contains a Passing incorrectly ...)
 	NOT-FOR-US: klaussilveira GitList
 CVE-2018-1000532 (beep version 1.3 and up contains a External Control of File Name or ...)
-	- beep <unfixed> (bug #902722)
+	- beep <unfixed> (low; bug #902722)
+	[stretch] - beep <no-dsa> (Minor issue)
 	NOTE: https://github.com/johnath/beep/issues/11#issuecomment-379514298
 CVE-2018-1000531 (inversoft prime-jwt version prior to commit ...)
 	NOT-FOR-US: prime-jwt
@@ -2944,6 +2948,7 @@ CVE-2018-12521
 	RESERVED
 CVE-2018-12520 (An issue was discovered in ntopng 3.4 before 3.4.180617. The PRNG ...)
 	- ntopng <unfixed> (bug #903154)
+	[stretch] - ntopng <no-dsa> (Minor issue)
 	NOTE: http://seclists.org/fulldisclosure/2018/Jul/14
 	NOTE: https://gist.github.com/Psychotropos/3e8c047cada9b1fb716e6a014a428b7f
 	NOTE: https://github.com/ntop/ntopng/commit/30610bda60cbfc058f90a1c0a17d0e8f4516221a
@@ -6814,6 +6819,7 @@ CVE-2018-11038
 	RESERVED
 CVE-2018-11037 (In Exiv2 0.26, the Exiv2::PngImage::printStructure function in ...)
 	- exiv2 <unfixed>
+	[stretch] - exiv2 <postponed> (Revisit when fixed upstream)
 	[jessie] - exiv2 <postponed> (Minor issue, wait for more issues)
 	NOTE: https://github.com/Exiv2/exiv2/issues/307
 CVE-2018-11036 (Ruckus SmartZone (formerly Virtual SmartCell Gateway or vSCG) 3.5.0, ...)
@@ -7268,6 +7274,7 @@ CVE-2018-10860 (perl-archive-zip is vulnerable to a directory traversal in ...)
 CVE-2018-10859
 	RESERVED
 	- git-annex 6.20180626-1
+	[stretch] - git-annex <no-dsa> (Will be fixed via next point release)
 	NOTE: http://www.openwall.com/lists/oss-security/2018/06/26/4
 	NOTE: https://git-annex.branchable.com/security/CVE-2018-10857_and_CVE-2018-10859/
 CVE-2018-10858
@@ -7275,6 +7282,7 @@ CVE-2018-10858
 CVE-2018-10857
 	RESERVED
 	- git-annex 6.20180626-1
+	[stretch] - git-annex <no-dsa> (Will be fixed via next point release)
 	NOTE: http://www.openwall.com/lists/oss-security/2018/06/26/4
 	NOTE: https://git-annex.branchable.com/security/CVE-2018-10857_and_CVE-2018-10859/
 CVE-2018-10856 (It has been discovered that podman before version 0.6.1 does not drop ...)


=====================================
data/dsa-needed.txt
=====================================
--- a/data/dsa-needed.txt
+++ b/data/dsa-needed.txt
@@ -22,6 +22,8 @@ enigmail
 ffmpeg
   Wait for next 3.2.x release
 --
+gitlab
+--
 glusterfs
 --
 graphicsmagick



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/c3f166c6a47cd66a9361078f81ae78ff663027d5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/c3f166c6a47cd66a9361078f81ae78ff663027d5
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20180709/9e889925/attachment-0001.html>