[Git][security-tracker-team/security-tracker][master] stretch triage

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
fdf7576b by Moritz Muehlenhoff at 2018-10-19T22:56:33Z
stretch triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -13,11 +13,13 @@ CVE-2018-18523
 CVE-2018-18522
 	RESERVED
 CVE-2018-18521 (Divide-by-zero vulnerabilities in the function arlib_add_symbols() in ...)
-	- elfutils <unfixed> (bug #911413)
+	- elfutils <unfixed> (low; bug #911413)
+	[stretch] - elfutils <no-dsa> (Minor issue)
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=23786
 	NOTE: https://sourceware.org/ml/elfutils-devel/2018-q4/msg00055.html
 CVE-2018-18520 (An Invalid Memory Address Dereference exists in the function elf_end in ...)
-	- elfutils <unfixed> (bug #911414)
+	- elfutils <unfixed> (low; bug #911414)
+	[stretch] - elfutils <no-dsa> (Minor issue)
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=23787
 	NOTE: https://sourceware.org/ml/elfutils-devel/2018-q4/msg00057.html
 CVE-2018-18519
@@ -288,8 +290,9 @@ CVE-2018-18411
 CVE-2018-18410
 	RESERVED
 CVE-2018-18409 (A stack-based buffer over-read exists in setbit() at iptree.h of ...)
-	- tcpflow <unfixed> (bug #911263)
+	- tcpflow <unfixed> (unimportant; bug #911263)
 	NOTE: https://github.com/simsong/tcpflow/issues/195
+	NOTE: Crash in CLI tool, no security impact
 CVE-2018-18408 (A use-after-free was discovered in the tcpbridge binary of Tcpreplay ...)
 	- tcpreplay <unfixed>
 	NOTE: https://github.com/appneta/tcpreplay/issues/489
@@ -342,7 +345,8 @@ CVE-2018-18386 (drivers/tty/n_tty.c in the Linux kernel before 4.14.11 allows lo
 	[jessie] - linux 3.16.56-1
 	NOTE: Fixed by: https://git.kernel.org/linus/966031f340185eddd05affcf72b740549f056348
 CVE-2018-18385 (Asciidoctor v1.5.7.1 allows remote attackers to cause a denial of ...)
-	- asciidoctor <unfixed>
+	- asciidoctor <unfixed> (low)
+	[stretch] - asciidoctor <no-dsa> (Minor issue)
 	NOTE: https://github.com/asciidoctor/asciidoctor/issues/2888
 CVE-2018-18384 (Info-ZIP UnZip 6.0 has a buffer overflow in list.c, when a ZIP archive ...)
 	- unzip 6.0-11 (bug #741384)
@@ -1323,6 +1327,7 @@ CVE-2018-18026
 	RESERVED
 CVE-2018-18025 (In ImageMagick 7.0.8-13 Q16, there is a heap-based buffer over-read in ...)
 	- imagemagick <unfixed>
+	[stretch] - imagemagick <postponed> (Fix along in next DSA)
 	NOTE: https://github.com/ImageMagick/ImageMagick/issues/1335
 CVE-2018-18024 (In ImageMagick 7.0.8-13 Q16, there is an infinite loop in the ...)
 	- imagemagick <unfixed> (low)
@@ -9432,6 +9437,7 @@ CVE-2018-14636 (Live-migrated instances are briefly able to inspect traffic for
 	[jessie] - neutron <ignored> (Minor issue)
 CVE-2018-14635 (When using the Linux bridge ml2 driver, non-privileged tenants are ...)
 	- neutron 2:13.0.0-1
+	[stretch] - neutron <ignored> (Minor issue)
 	[jessie] - neutron <ignored> (Minor issue)
 	NOTE: https://bugs.launchpad.net/neutron/+bug/1757482
 	NOTE: https://git.openstack.org/cgit/openstack/neutron/commit/?id=54aa6e81cb17b33ce4d5d469cc11dec2869c762d


=====================================
data/dsa-needed.txt
=====================================
@@ -17,6 +17,8 @@ If needed, specify the release by adding a slash after the name of the source pa
 --
 ceph
 --
+chromium-browser
+--
 ghostscript (carnil)
   Regression update: #909076, possibly #909929 (but see upstream issue),
   and #909957



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/fdf7576b3ba1ef06ba079bfcc334c7444d223a43

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/fdf7576b3ba1ef06ba079bfcc334c7444d223a43
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181019/7f2f47b0/attachment-0001.html>