[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso
carnil at debian.org
Fri Nov 9 08:10:25 GMT 2018
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
bb4b0558 by security tracker role at 2018-11-09T08:10:15Z
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,8 +1,18 @@
+CVE-2018-19120
+ RESERVED
+CVE-2018-19119
+ RESERVED
+CVE-2018-19118
+ RESERVED
+CVE-2018-19117
+ RESERVED
+CVE-2018-19116
+ RESERVED
CVE-2018-XXXX [XSA-282: guest use of HLE constructs may lock up host]
- xen <unfixed>
[stretch] - xen <postponed> (Hold back until next DSA)
NOTE: https://xenbits.xen.org/xsa/advisory-282.txt
-CVE-2018-19115 [heap-based buffer overflow when parsing HTTP status]
+CVE-2018-19115 (keepalived through 2.0.8 has a heap-based buffer overflow when parsing ...)
- keepalived <unfixed>
NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1015141
NOTE: https://github.com/acassen/keepalived/pull/961
@@ -164,20 +174,17 @@ CVE-2018-19048
RESERVED
CVE-2018-19047 (** DISPUTED ** mPDF through 7.1.6, if deployed as a web application ...)
NOT-FOR-US: mPDF
-CVE-2018-19046 [unsafe handling of /tmp files]
- RESERVED
+CVE-2018-19046 (keepalived 2.0.8 didn't check for existing plain files when writing ...)
- keepalived <unfixed>
NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1015141
NOTE: https://github.com/acassen/keepalived/issues/1048
-CVE-2018-19045 [unsafe modes for temporary files]
- RESERVED
+CVE-2018-19045 (keepalived 2.0.8 used mode 0666 when creating new temporary files upon ...)
- keepalived <unfixed>
NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1015141
NOTE: https://github.com/acassen/keepalived/commit/5241e4d7b177d0b6f073cfc9ed5444bf51ec89d6
NOTE: https://github.com/acassen/keepalived/commit/c6247a9ef2c7b33244ab1d3aa5d629ec49f0a067
NOTE: ttps://github.com/acassen/keepalived/issues/1048
-CVE-2018-19044 [improper check for pathnames with symlinks]
- RESERVED
+CVE-2018-19044 (keepalived 2.0.8 didn't check for pathnames with symlinks when writing ...)
- keepalived <unfixed>
NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1015141
NOTE: https://github.com/acassen/keepalived/commit/04f2d32871bb3b11d7dc024039952f2fe2750306
@@ -5493,19 +5500,21 @@ CVE-2018-16847 (An OOB heap buffer r/w access issue was found in the NVM Express
CVE-2018-16846
RESERVED
CVE-2018-16845 (nginx before versions 1.15.6, 1.14.1 has a vulnerability in the ...)
- {DLA-1572-1}
+ {DSA-4335-1 DLA-1572-1}
- nginx 1.14.1-1 (bug #913090)
NOTE: http://mailman.nginx.org/pipermail/nginx-announce/2018/000221.html
NOTE: https://nginx.org/download/patch.2018.mp4.txt
NOTE: http://hg.nginx.org/nginx/rev/fdc19a3289c1
NOTE: Fixed in 1.15.6, 1.14.1.
CVE-2018-16844 (nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the ...)
+ {DSA-4335-1}
- nginx 1.14.1-1 (bug #913090)
[jessie] - nginx <not-affected> (HTTP 2.0 support added later)
NOTE: http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html
NOTE: http://hg.nginx.org/nginx/rev/9200b41db765
NOTE: Fixed in 1.15.6, 1.14.1.
CVE-2018-16843 (nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the ...)
+ {DSA-4335-1}
- nginx 1.14.1-1 (bug #913090)
[jessie] - nginx <not-affected> (HTTP 2.0 support added later)
NOTE: http://mailman.nginx.org/pipermail/nginx-announce/2018/000220.html
@@ -9106,10 +9115,10 @@ CVE-2018-15453
RESERVED
CVE-2018-15452
RESERVED
-CVE-2018-15451
- RESERVED
-CVE-2018-15450
- RESERVED
+CVE-2018-15451 (A vulnerability in the web-based management interface of Cisco Prime ...)
+ TODO: check
+CVE-2018-15450 (A vulnerability in the web-based UI of Cisco Prime Collaboration ...)
+ TODO: check
CVE-2018-15449 (A vulnerability in the web-based management interface of Cisco Video ...)
NOT-FOR-US: Cisco
CVE-2018-15448 (A vulnerability in the user management functions of Cisco Registered ...)
@@ -29160,8 +29169,8 @@ CVE-2018-7738 (In util-linux before 2.32-rc1, bash-completion/umount allows loca
NOTE: src:util-linux/2.28-1 takes over the umount completion from
NOTE: src:bash-completion (which in turn starting from 1:2.1-4.3
NOTE: does not provide the umount completion in the binary packaage)
-CVE-2018-7718
- RESERVED
+CVE-2018-7718 (An issue was discovered in Telexy QPath 5.4.462. A low privileged ...)
+ TODO: check
CVE-2018-7717 (The htmlImageAddTitleAttribute function in sige.php in the Kubik-Rubik ...)
NOT-FOR-US: Kubik-Rubik Simple Image Gallery Extended (SIGE) extension for Joomla!
CVE-2018-7716 (PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation ...)
@@ -46495,8 +46504,8 @@ CVE-2018-1859
RESERVED
CVE-2018-1858
RESERVED
-CVE-2018-1857
- RESERVED
+CVE-2018-1857 (IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 ...)
+ TODO: check
CVE-2018-1856
RESERVED
CVE-2018-1855
@@ -46525,8 +46534,8 @@ CVE-2018-1844 (IBM FileNet Content Manager 5.2.1 and 5.5.0 is vulnerable to a XM
NOT-FOR-US: IBM
CVE-2018-1843
RESERVED
-CVE-2018-1842
- RESERVED
+CVE-2018-1842 (IBM Cognos Analytics 11 Configuration tool, under certain ...)
+ TODO: check
CVE-2018-1841
RESERVED
CVE-2018-1840
@@ -46541,8 +46550,8 @@ CVE-2018-1836
RESERVED
CVE-2018-1835 (IBM Daeja ViewONE Professional, Standard & Virtual 5 is vulnerable to ...)
NOT-FOR-US: IBM
-CVE-2018-1834
- RESERVED
+CVE-2018-1834 (IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, ...)
+ TODO: check
CVE-2018-1833
RESERVED
CVE-2018-1832
@@ -46605,14 +46614,14 @@ CVE-2018-1804
RESERVED
CVE-2018-1803
RESERVED
-CVE-2018-1802
- RESERVED
+CVE-2018-1802 (IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, ...)
+ TODO: check
CVE-2018-1801
RESERVED
CVE-2018-1800 (IBM Sterling B2B Integrator Standard Edition 5.2.6.0 and 6.2.6.1 could ...)
NOT-FOR-US: IBM
-CVE-2018-1799
- RESERVED
+CVE-2018-1799 (IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, ...)
+ TODO: check
CVE-2018-1798
RESERVED
CVE-2018-1797
@@ -46647,10 +46656,10 @@ CVE-2018-1783 (IBM GPFS (IBM Spectrum Scale 4.1.1.0, 4.1.1.20, 4.2.0.0, 4.2.3.10
NOT-FOR-US: IBM
CVE-2018-1782 (IBM GPFS (IBM Spectrum Scale 5.0.1.0 and 5.0.1.1) allows a local, ...)
NOT-FOR-US: IBM
-CVE-2018-1781
- RESERVED
-CVE-2018-1780
- RESERVED
+CVE-2018-1781 (IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, ...)
+ TODO: check
+CVE-2018-1780 (IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, ...)
+ TODO: check
CVE-2018-1779
RESERVED
CVE-2018-1778
@@ -46661,8 +46670,8 @@ CVE-2018-1776
RESERVED
CVE-2018-1775
RESERVED
-CVE-2018-1774
- RESERVED
+CVE-2018-1774 (IBM API Connect 5.0.0.0, 5.0.8.4, 2018.1 and2018.3.6 is vulnerable to ...)
+ TODO: check
CVE-2018-1773 (IBM Datacap Fastdoc Capture 9.1.1, 9.1.3, and 9.1.4 could allow an ...)
NOT-FOR-US: IBM
CVE-2018-1772
@@ -46841,8 +46850,8 @@ CVE-2018-1686 (IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to ..
NOT-FOR-US: IBM
CVE-2018-1685 (IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, ...)
NOT-FOR-US: IBM
-CVE-2018-1684
- RESERVED
+CVE-2018-1684 (IBM WebSphere MQ 8.0 through 9.1 is vulnerable to a error with MQTT ...)
+ TODO: check
CVE-2018-1683 (IBM WebSphere Application Server Liberty could allow a remote attacker ...)
NOT-FOR-US: IBM
CVE-2018-1682
@@ -100210,8 +100219,8 @@ CVE-2017-1121 (IBM WebSphere Application Server 7.0, 8.0, and 9.0 is vulnerable
NOT-FOR-US: IBM
CVE-2017-1120 (IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site ...)
NOT-FOR-US: IBM
-CVE-2017-1119
- RESERVED
+CVE-2017-1119 (IBM Marketing Operations 9.1.0, 9.1.2, and 10.1 could allow a remote ...)
+ TODO: check
CVE-2017-1118 (IBM WebSphere MQ Internet Pass-Thru 2.0 and 2.1 could allow n attacker ...)
NOT-FOR-US: IBM
CVE-2017-1117 (IBM WebSphere MQ 8.0 and 9.0 could allow an authenticated user to ...)
@@ -100799,8 +100808,8 @@ CVE-2016-9751 (Cross-site scripting (XSS) vulnerability in the search results fr
NOTE: Request to mark the package as unsupported in #779104
CVE-2016-9750 (IBM QRadar 7.2 and 7.3 stores user credentials in plain in clear text ...)
NOT-FOR-US: IBM
-CVE-2016-9749
- RESERVED
+CVE-2016-9749 (IBM Campaign 9.1.0, 9.1.2, 10.0, and 10.1 could allow an authenticated ...)
+ TODO: check
CVE-2016-9748 (IBM Rational DOORS Next Generation 5.0 and 6.0 discloses sensitive ...)
NOT-FOR-US: IBM
CVE-2016-9747 (IBM RELM 4.0, 5.0 and 6.0 is vulnerable to cross-site scripting. This ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/bb4b0558e7fdf8468c4ca04369b6971c0fab12d3
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/bb4b0558e7fdf8468c4ca04369b6971c0fab12d3
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181109/377b1aa2/attachment.html>
More information about the debian-security-tracker-commits
mailing list