[Git][security-tracker-team/security-tracker][master] new libmediainfo issues

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3c1a7a14 by Moritz Muehlenhoff at 2019-04-20T21:59:00Z
new libmediainfo issues
new bwa non-issue
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,19 +1,25 @@
 CVE-2019-11378 (An issue was discovered in ProjectSend r1053. upload-process-form.php  ...)
-	TODO: check
+	NOT-FOR-US: ProjectSend
 CVE-2019-11377 (wcms/wex/finder/action.php in WCMS v0.3.2 has a Arbitrary File Upload  ...)
-	TODO: check
+	NOT-FOR-US: WCMS
 CVE-2019-11376 (** DISPUTED ** SOY CMS v3.0.2 allows remote attackers to execute arbit ...)
-	TODO: check
+	NOT-FOR-US: SOY CMS
 CVE-2019-11375 (Msvod v10 has a CSRF vulnerability to change user information via the  ...)
-	TODO: check
+	NOT-FOR-US: Msvod
 CVE-2019-11374 (74CMS v5.0.1 has a CSRF vulnerability to add a new admin user via the  ...)
-	TODO: check
+	NOT-FOR-US: 74CMS
 CVE-2019-11373 (An out-of-bounds read in File__Analyze::Get_L8 in File__Analyze_Buffer ...)
-	TODO: check
+	- libmediainfo <unfixed> (low)
+	NOTE: https://github.com/MediaArea/MediaInfoLib/pull/1111
+	NOTE: https://sourceforge.net/p/mediainfo/bugs/1101/
 CVE-2019-11372 (An out-of-bounds read in MediaInfoLib::File__Tags_Helper::Synched_Test ...)
-	TODO: check
+	- libmediainfo <unfixed> (low)
+	NOTE: https://github.com/MediaArea/MediaInfoLib/pull/1111
+	NOTE: https://sourceforge.net/p/mediainfo/bugs/1101/
 CVE-2019-11371 (BWA (aka Burrow-Wheeler Aligner) 0.7.17 r1198 has a Buffer Overflow vi ...)
-	TODO: check
+	- bwa <unfixed> (unimportant)
+	NOTE: https://github.com/lh3/bwa/issues/239
+	NOTE: Neutralised by toolchain hardening
 CVE-2019-11370
 	RESERVED
 CVE-2019-11369
@@ -27,7 +33,7 @@ CVE-2019-11364
 CVE-2019-11363
 	RESERVED
 CVE-2019-11362 (app/controllers/frontend/PostController.php in ROCBOSS V2.2.1 has SQL  ...)
-	TODO: check
+	NOT-FOR-US: ROCBOSS
 CVE-2019-11361
 	RESERVED
 CVE-2016-10748
@@ -69,7 +75,7 @@ CVE-2019-11348
 CVE-2019-11347
 	RESERVED
 CVE-2018-20817 (SV_SteamAuthClient in various Activision Infinity Ward Call of Duty ga ...)
-	TODO: check
+	NOT-FOR-US: Activision
 CVE-2019-XXXX [EAP-pwd message reassembly issue with unexpected fragment]
 	- wpa <unfixed> (bug #927439)
 	NOTE: https://w1.fi/security/2019-5/eap-pwd-message-reassembly-issue-with-unexpected-fragment.txt



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/3c1a7a147707d2177bbdad47e510210f3f3ad37c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/3c1a7a147707d2177bbdad47e510210f3f3ad37c
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190420/35f62356/attachment.html>