[Git][security-tracker-team/security-tracker][master] icedtea-web bugs

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f1b229cd by Moritz Muehlenhoff at 2019-08-09T16:37:18Z
icedtea-web bugs
sdl, kde4libs no-dsa

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -126,6 +126,8 @@ CVE-2019-14745 (In radare2 before 3.7.0, a command injection vulnerability exist
 CVE-2019-14744 (In KDE Frameworks KConfig before 5.61.0, malicious desktop files and c ...)
 	- kconfig <unfixed> (bug #934267)
 	- kde4libs <unfixed> (bug #934268)
+	[buster] - kde4libs <no-dsa> (Minor issue)
+	[stretch] - kde4libs <no-dsa> (Minor issue)
 	NOTE: https://gist.githubusercontent.com/zeropwn/630832df151029cb8f22d5b6b9efaefb/raw/64aa3d30279acb207f787ce9c135eefd5e52643b/kde-kdesktopfile-command-injection.txt
 	NOTE: https://kde.org/info/security/advisory-20190807-1.txt
 	NOTE: kconfig: https://cgit.kde.org/kconfig.git/commit/?id=5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22
@@ -3347,7 +3349,11 @@ CVE-2019-13627
 	RESERVED
 CVE-2019-13626 (SDL (Simple DirectMedia Layer) 2.x through 2.0.9 has a heap-based buff ...)
 	- libsdl2 <unfixed>
+	[buster] - libsdl2 <no-dsa> (Minor issue)
+	[stretch] - libsdl2 <no-dsa> (Minor issue)
 	- libsdl1.2 <unfixed>
+	[buster] - libsdl1.2 <no-dsa> (Minor issue)
+	[stretch] - libsdl1.2 <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4522
 CVE-2019-13625 (NSA Ghidra before 9.0.1 allows XXE when a project is opened or restore ...)
 	- ghidra <itp> (bug #923851)
@@ -3379,11 +3385,20 @@ CVE-2019-13617 (njs through 0.3.3, used in NGINX, has a heap-based buffer over-r
 	NOT-FOR-US: njs
 CVE-2019-13616 (SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 ha ...)
 	- libsdl2 <unfixed>
+	[buster] - libsdl2 <no-dsa> (Minor issue)
+	[stretch] - libsdl2 <no-dsa> (Minor issue)
 	- libsdl1.2 <unfixed>
+	[buster] - libsdl1.2 <no-dsa> (Minor issue)
+	[stretch] - libsdl1.2 <no-dsa> (Minor issue)
 	- libsdl2-image <unfixed>
+	[buster] - libsdl2-image <no-dsa> (Minor issue)
+	[stretch] - libsdl2-image <no-dsa> (Minor issue)
 	[jessie] - libsdl2-image <postponed> (can be fixed along with more important patches)
 	- sdl-image1.2 <unfixed>
+	[buster] - sdl-image1.2 <no-dsa> (Minor issue)
+	[stretch] - sdl-image1.2 <no-dsa> (Minor issue)
 	[jessie] - sdl-image1.2 <postponed> (can be fixed along with more important patches)
+	- libsdl1.2 <unfixed>
 	NOTE: https://bugzilla.libsdl.org/show_bug.cgi?id=4538
 	NOTE: libsdl2: https://hg.libsdl.org/SDL/rev/e7ba650a643a
 	NOTE: libsdl1.2: https://hg.libsdl.org/SDL/rev/ad1bbfbca760
@@ -13280,7 +13295,7 @@ CVE-2019-10187 (A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7.
 CVE-2019-10186 (A flaw was found in moodle before versions 3.7.1, 3.6.5, 3.5.7. A sess ...)
 	- moodle <removed>
 CVE-2019-10185 (It was found that icedtea-web up to and including 1.7.2 and 1.8.2 was  ...)
-	- icedtea-web <unfixed>
+	- icedtea-web <unfixed> (bug #934319)
 	NOTE: https://www.openwall.com/lists/oss-security/2019/07/31/2
 	NOTE: https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
 CVE-2019-10184 (undertow before version 2.0.23.Final is vulnerable to an information l ...)
@@ -13291,11 +13306,11 @@ CVE-2019-10183 (Virt-install(1) utility used to provision new virtual machines h
 	- virt-manager <not-affected> (Vulnerable code introduced in v2.2.0)
 	NOTE: https://www.redhat.com/archives/virt-tools-list/2019-July/msg00014.html
 CVE-2019-10182 (It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly  ...)
-	- icedtea-web <unfixed>
+	- icedtea-web <unfixed> (bug #934319)
 	NOTE: https://www.openwall.com/lists/oss-security/2019/07/31/2
 	NOTE: https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
 CVE-2019-10181 (It was found that in icedtea-web up to and including 1.7.2 and 1.8.2 e ...)
-	- icedtea-web <unfixed>
+	- icedtea-web <unfixed> (bug #934319)
 	NOTE: https://www.openwall.com/lists/oss-security/2019/07/31/2
 	NOTE: https://github.com/AdoptOpenJDK/IcedTea-Web/pull/344
 CVE-2019-10180



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/f1b229cddcb82621d3f2c31686a6d3d06dff0239

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/f1b229cddcb82621d3f2c31686a6d3d06dff0239
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190809/eb98be4a/attachment-0001.html>