[Git][security-tracker-team/security-tracker][master] new bootstrap issues, specific affected versions need to be verified

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
eddf71d8 by Moritz Muehlenhoff at 2018-07-13T23:09:19+02:00
new bootstrap issues, specific affected versions need to be verified

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -21,11 +21,26 @@ CVE-2018-14044 (The RateTransposer::setChannels function in RateTransposer.cpp i
 CVE-2018-14043 (mstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file ...)
 	NOT-FOR-US: mstdlib
 CVE-2018-14042 (In Bootstrap before 4.1.2, XSS is possible in the data-container ...)
-	TODO: check
+	- twitter-bootstrap <unfixed>
+	- twitter-bootstrap3 <unfixed>
+	NOTE: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+	NOTE: https://github.com/twbs/bootstrap/issues/26423
+	NOTE: https://github.com/twbs/bootstrap/issues/26628
+	NOTE: https://github.com/twbs/bootstrap/pull/26630
 CVE-2018-14041 (In Bootstrap before 4.1.2, XSS is possible in the data-target property ...)
-	TODO: check
+	- twitter-bootstrap <unfixed>
+	- twitter-bootstrap3 <unfixed>
+	NOTE: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+	NOTE: https://github.com/twbs/bootstrap/issues/26423
+	NOTE: https://github.com/twbs/bootstrap/issues/26627
+	NOTE: https://github.com/twbs/bootstrap/pull/26630
 CVE-2018-14040 (In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent ...)
-	TODO: check
+	- twitter-bootstrap <unfixed>
+	- twitter-bootstrap3 <unfixed>
+	NOTE: https://blog.getbootstrap.com/2018/07/12/bootstrap-4-1-2/
+	NOTE: https://github.com/twbs/bootstrap/issues/26423
+	NOTE: https://github.com/twbs/bootstrap/issues/26625
+	NOTE: https://github.com/twbs/bootstrap/pull/26630
 CVE-2018-14039
 	RESERVED
 CVE-2018-14038



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/eddf71d8024293186c63cf5528c776930cd3e5c4

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/eddf71d8024293186c63cf5528c776930cd3e5c4
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20180713/0bb429b0/attachment.html>