[Git][security-tracker-team/security-tracker][master] new modsecurity-crs issue

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
499e83f7 by Moritz Muehlenhoff at 2018-09-04T15:04:15Z
new modsecurity-crs issue
bluez, elfutils no-dsa

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -107,11 +107,13 @@ CVE-2018-16405 (An issue was discovered in Mayan EDMS before 3.0.2. The Appearan
 CVE-2018-16404
 	RESERVED
 CVE-2018-16403 (libdw in elfutils 0.173 checks the end of the attributes list ...)
-	- elfutils <unfixed>
+	- elfutils <unfixed> (low)
+	[stretch] - elfutils <no-dsa> (Minor issue)
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=23529
 	NOTE: https://sourceware.org/git/?p=elfutils.git;a=commit;h=6983e59b727458a6c64d9659c85f08218bc4fcda
 CVE-2018-16402 (libelf/elf_end.c in elfutils 0.173 allows remote attackers to cause a ...)
-	- elfutils <unfixed>
+	- elfutils <unfixed> (low)
+	[stretch] - elfutils <no-dsa> (Minor issue)
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=23528
 	NOTE: https://sourceware.org/git/?p=elfutils.git;a=commit;h=56b18521fb8d46d40fc090c0de9d11a08bc982fa
 CVE-2018-16401
@@ -149,7 +151,9 @@ CVE-2018-16386
 CVE-2018-16385 (ThinkPHP before 5.1.23 allows SQL Injection via the ...)
 	NOT-FOR-US: ThinkPHP
 CVE-2018-16384 (A SQL injection bypass (aka PL1 bypass) exists in OWASP ModSecurity ...)
-	TODO: check
+	- modsecurity-crs <unfixed> (low)
+	[stretch] - modsecurity-crs <no-dsa> (Minor issue)
+	NOTE: https://github.com/SpiderLabs/owasp-modsecurity-crs/issues/1167
 CVE-2018-16383
 	RESERVED
 CVE-2018-16382 (Netwide Assembler (NASM) 2.14rc15 has a buffer over-read in ...)
@@ -13817,12 +13821,12 @@ CVE-2018-10911
 CVE-2018-10910 [ailure in disabling Bluetooth discoverability in certain cases may lead to the unauthorized pairing of Bluetooth devices]
 	RESERVED
 	- bluez <unfixed>
+	[stretch] - bluez <ignored> (Minor issue, does not affected Gnome Bluetooth in stretch)
 	[jessie] - bluez <no-dsa> (Minor issue because in gnome-bluetooth <= 3.26 the D-Bus calls were synchronous and thus the issue in bluez will have no actual affect)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1606203
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1602985
 	NOTE: Bug in src:bluez itself and would need fixing there, but it is workaroundable in
 	NOTE: gnome-bluetooth: https://gitlab.gnome.org/GNOME/gnome-bluetooth/commit/6b5086d42ea64d46277f3c93b43984f331d12f89
-	TODO: check, might not be a problem with Gnome <= 3.26, i.e. no-dsa for those suites
 CVE-2018-10909
 	RESERVED
 CVE-2018-10908 (It was found that vdsm before version 4.20.37 invokes qemu-img on ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/499e83f71ca41aee4a069c0649fa73c48e358fe8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/499e83f71ca41aee4a069c0649fa73c48e358fe8
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20180904/807a9705/attachment.html>