[Git][security-tracker-team/security-tracker][master] mp4v2, gpac no-dsa

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
bb15b679 by Moritz Muehlenhoff at 2018-07-15T23:33:57+02:00
mp4v2, gpac no-dsa
ruby-rails-admin bug

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -130,6 +130,7 @@ CVE-2018-1000206 (JFrog Artifactory version since 5.11 contains a Cross ite Requ
 	NOT-FOR-US: JFrog Artifactory
 CVE-2018-14054 (A double free exists in the MP4StringProperty class in mp4property.cpp ...)
 	- mp4v2 <unfixed>
+	[stretch] - mp4v2 <no-dsa> (Minor issue)
 	NOTE: http://www.openwall.com/lists/oss-security/2018/07/13/1
 CVE-2018-14036 (Directory Traversal with ../ sequences occurs in AccountsService before ...)
 	- accountsservice <unfixed> (low; bug #903828)
@@ -2361,9 +2362,11 @@ CVE-2018-13007 (An issue was discovered in gpmf-parser 1.1.2. There is a heap-ba
 	NOT-FOR-US: gpmf-parser
 CVE-2018-13006 (An issue was discovered in MP4Box in GPAC 0.7.1. There is a heap-based ...)
 	- gpac <unfixed> (bug #902782)
+	[stretch] - gpac <no-dsa> (Minor issue)
 	NOTE: https://github.com/gpac/gpac/commit/bceb03fd2be95097a7b409ea59914f332fb6bc86
 CVE-2018-13005 (An issue was discovered in MP4Box in GPAC 0.7.1. The function urn_Read ...)
 	- gpac <unfixed> (bug #902782)
+	[stretch] - gpac <no-dsa> (Minor issue)
 	NOTE: https://github.com/gpac/gpac/issues/1088
 CVE-2018-13004
 	RESERVED
@@ -42056,7 +42059,7 @@ CVE-2016-10523 (MQTT before 3.4.6 and 4.0.x before 4.0.5 allows specifically cra
 	- node-mqtt-packet <not-affected> (Fixed before initial upload to the archive)
 	NOTE: https://nodesecurity.io/advisories/75
 CVE-2016-10522 (rails_admin ruby gem <v1.1.1 is vulnerable to cross-site request ...)
-	- ruby-rails-admin <unfixed>
+	- ruby-rails-admin <unfixed> (bug #903855)
 CVE-2016-10521 (jshamcrest is vulnerable to regular expression denial of service ...)
 	NOT-FOR-US: jshamcrest
 CVE-2016-10520 (jadedown is vulnerable to regular expression denial of service (ReDoS) ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/bb15b67929137fae91570dbeac6899bc775b4dec

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/bb15b67929137fae91570dbeac6899bc775b4dec
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20180715/5ed5a69b/attachment.html>