[Git][security-tracker-team/security-tracker][master] Move back some fixed version items back to data/CVE/list

Salvatore Bonaccorso carnil at debian.org
Fri Oct 12 09:48:20 BST 2018


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
8ea75b4e by Salvatore Bonaccorso at 2018-10-12T08:45:57Z
Move back some fixed version items back to data/CVE/list

The reason we had to split these and not list in the respective DSA was
that the DSA did adress issues in jessie and stretch while beeing
supported by the security-team. The set of CVEs though was not
overlapping for the two suites, having some issues affecting stretch but
not jessie. Thus those for beeing fully correct does not be listed in
data/DSA/list otherwise they appear as to be fixed in the respective
version in the jessie upload as well, which would not be completely
correct.

This situation sometimes arise while the security team supports two
suites, but for a source package only one DSA is issued and the set of
CVEs is not overlapping.

- - - - -


2 changed files:

- data/CVE/list
- data/DSA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -9584,6 +9584,7 @@ CVE-2018-14368 (In Wireshark 2.6.0 to 2.6.1, 2.4.0 to 2.4.7, and 2.2.0 to 2.2.15
 	NOTE: https://www.wireshark.org/security/wnpa-sec-2018-40.html
 CVE-2018-14367 (In Wireshark 2.6.0 to 2.6.1 and 2.4.0 to 2.4.7, the CoAP protocol ...)
 	- wireshark 2.6.2-1
+	[stretch] - wireshark <not-affected> (Vulnerable code not present)
 	[jessie] - wireshark <not-affected> (Vulnerable code not present)
 	NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14966
 	NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=81ce5fcb3e37a0aaeb7532f7a2a09366f16fa310
@@ -17308,8 +17309,8 @@ CVE-2018-11361 (In Wireshark 2.6.0, the IEEE 802.11 protocol dissector could cra
 	NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=1b52f9929238ce3948ec924ae4f9456b5e9df558
 	NOTE: https://www.wireshark.org/security/wnpa-sec-2018-32.html
 CVE-2018-11360 (In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the GSM A DTAP ...)
-	{DSA-4217-1}
 	- wireshark 2.6.1-1 (bug #900708)
+	[stretch] - wireshark 2.2.6+g32dac6a-2+deb9u3
 	[jessie] - wireshark <not-affected> (vulnerable code not present (uses static a_bigbuf instead))
 	[wheezy] - wireshark <not-affected> (vulnerable code not present (uses static a_bigbuf instead))
 	NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14688
@@ -22735,8 +22736,8 @@ CVE-2018-9274 (In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ui/failure_messa
 	NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=f38e895dfc0d97bce64f73ce99df706911d9aa07
 	NOTE: https://www.wireshark.org/security/wnpa-sec-2018-24.html
 CVE-2018-9273 (In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ...)
-	{DSA-4217-1}
 	- wireshark 2.4.6-1
+	[stretch] - wireshark 2.2.6+g32dac6a-2+deb9u3
 	[jessie] - wireshark <not-affected> (Vulnerable code not present)
 	[wheezy] - wireshark <not-affected> (Vulnerable code not present)
 	NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14488
@@ -22799,8 +22800,8 @@ CVE-2018-9265 (In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, ...)
 	NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=b12cc581cd4878d74b6116ca02c7dbe650c1f242
 	NOTE: https://www.wireshark.org/security/wnpa-sec-2018-24.html
 CVE-2018-9264 (In Wireshark 2.4.0 to 2.4.5 and 2.2.0 to 2.2.13, the ADB dissector ...)
-	{DSA-4217-1}
 	- wireshark 2.4.6-1
+	[stretch] - wireshark 2.2.6+g32dac6a-2+deb9u3
 	[jessie] - wireshark <not-affected> (Vulnerable code not present (only adb_cs available))
 	[wheezy] - wireshark <not-affected> (Vulnerable code not present (only adb_cs available))
 	NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14460
@@ -28164,8 +28165,8 @@ CVE-2018-7321 (In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, ...)
 	NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=c784d551ad50864de1035ce54e72837301cf6aca
 	NOTE: https://www.wireshark.org/security/wnpa-sec-2018-06.html
 CVE-2018-7320 (In Wireshark 2.4.0 to 2.4.4 and 2.2.0 to 2.2.12, the SIGCOMP protocol ...)
-	{DSA-4217-1}
 	- wireshark 2.4.5-1
+	[stretch] - wireshark 2.2.6+g32dac6a-2+deb9u3
 	[jessie] - wireshark <not-affected> (Vulnerable code introduced later)
 	[wheezy] - wireshark <not-affected> (Vulnerable code introduced later)
 	NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14398
@@ -59965,8 +59966,8 @@ CVE-2017-13767 (In Wireshark 2.4.0, 2.2.0 to 2.2.8, and 2.0.0 to 2.0.14, the MSD
 	NOTE: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=6f18ace2a2683418a9368a8dfd92da6bd8213e15
 	NOTE: https://www.wireshark.org/security/wnpa-sec-2017-38.html
 CVE-2017-13766 (In Wireshark 2.4.0 and 2.2.0 to 2.2.8, the Profinet I/O dissector could ...)
-	{DSA-4060-1}
 	- wireshark 2.4.1-1
+	[stretch] - wireshark 2.2.6+g32dac6a-2+deb9u1
 	[jessie] - wireshark <not-affected> (Vulnerable code not present)
 	[wheezy] - wireshark <not-affected> (Vulnerable code not present)
 	NOTE: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=13847


=====================================
data/DSA/list
=====================================
@@ -302,7 +302,7 @@
 	[jessie] - memcached 1.4.21-1.1+deb8u2
 	[stretch] - memcached 1.4.33-1+deb9u1
 [03 Jun 2018] DSA-4217-1 wireshark - security update
-	{CVE-2018-7334 CVE-2018-7335 CVE-2018-7419 CVE-2018-9261 CVE-2018-11358 CVE-2018-11362 CVE-2018-11360 CVE-2018-9273 CVE-2018-9264 CVE-2018-7320}
+	{CVE-2018-7334 CVE-2018-7335 CVE-2018-7419 CVE-2018-9261 CVE-2018-11358 CVE-2018-11362}
 	[jessie] - wireshark 1.12.1+g01b65bf-4+deb8u14
 	[stretch] - wireshark 2.2.6+g32dac6a-2+deb9u3
 [03 Jun 2018] DSA-4191-2 redmine - regression update
@@ -873,7 +873,7 @@
 	[jessie] - thunderbird 1:52.5.0-1~deb8u1
 	[stretch] - thunderbird 1:52.5.0-1~deb9u1
 [09 Dec 2017] DSA-4060-1 wireshark - security update
-	{CVE-2017-11408 CVE-2017-17083 CVE-2017-17084 CVE-2017-17085 CVE-2017-13766}
+	{CVE-2017-11408 CVE-2017-17083 CVE-2017-17084 CVE-2017-17085}
 	[jessie] - wireshark 1.12.1+g01b65bf-4+deb8u12
 	[stretch] - wireshark 2.2.6+g32dac6a-2+deb9u1
 [08 Dec 2017] DSA-4059-1 libxcursor - security update



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/8ea75b4ea699888205dd8debcd8a844faef243fe

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/8ea75b4ea699888205dd8debcd8a844faef243fe
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181012/09ff0f31/attachment.html>


More information about the debian-security-tracker-commits mailing list