[Git][security-tracker-team/security-tracker][master] new libmediainfo issues
Moritz Muehlenhoff
jmm at debian.org
Sat Apr 20 22:59:31 BST 2019
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3c1a7a14 by Moritz Muehlenhoff at 2019-04-20T21:59:00Z
new libmediainfo issues
new bwa non-issue
NFUs
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,19 +1,25 @@
CVE-2019-11378 (An issue was discovered in ProjectSend r1053. upload-process-form.php ...)
- TODO: check
+ NOT-FOR-US: ProjectSend
CVE-2019-11377 (wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload ...)
- TODO: check
+ NOT-FOR-US: WCMS
CVE-2019-11376 (** DISPUTED ** SOY CMS v3.0.2 allows remote attackers to execute arbit ...)
- TODO: check
+ NOT-FOR-US: SOY CMS
CVE-2019-11375 (Msvod v10 has a CSRF vulnerability to change user information via the ...)
- TODO: check
+ NOT-FOR-US: Msvod
CVE-2019-11374 (74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the ...)
- TODO: check
+ NOT-FOR-US: 74CMS
CVE-2019-11373 (An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer ...)
- TODO: check
+ - libmediainfo <unfixed> (low)
+ NOTE: https://github.com/MediaArea/MediaInfoLib/pull/1111
+ NOTE: https://sourceforge.net/p/mediainfo/bugs/1101/
CVE-2019-11372 (An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test ...)
- TODO: check
+ - libmediainfo <unfixed> (low)
+ NOTE: https://github.com/MediaArea/MediaInfoLib/pull/1111
+ NOTE: https://sourceforge.net/p/mediainfo/bugs/1101/
CVE-2019-11371 (BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow vi ...)
- TODO: check
+ - bwa <unfixed> (unimportant)
+ NOTE: https://github.com/lh3/bwa/issues/239
+ NOTE: Neutralised by toolchain hardening
CVE-2019-11370
RESERVED
CVE-2019-11369
@@ -27,7 +33,7 @@ CVE-2019-11364
CVE-2019-11363
RESERVED
CVE-2019-11362 (app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL ...)
- TODO: check
+ NOT-FOR-US: ROCBOSS
CVE-2019-11361
RESERVED
CVE-2016-10748
@@ -69,7 +75,7 @@ CVE-2019-11348
CVE-2019-11347
RESERVED
CVE-2018-20817 (SV_SteamAuthClient in various Activision Infinity Ward Call of Duty ga ...)
- TODO: check
+ NOT-FOR-US: Activision
CVE-2019-XXXX [EAP-pwd message reassembly issue with unexpected fragment]
- wpa <unfixed> (bug #927439)
NOTE: https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/3c1a7a147707d2177bbdad47e510210f3f3ad37c
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/3c1a7a147707d2177bbdad47e510210f3f3ad37c
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190420/35f62356/attachment.html>
More information about the debian-security-tracker-commits
mailing list