[Git][security-tracker-team/security-tracker][master] Add CVE-2019-5477/ruby-nokogiri

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
95175540 by Salvatore Bonaccorso at 2019-08-15T05:41:49Z
Add CVE-2019-5477/ruby-nokogiri

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -27060,8 +27060,12 @@ CVE-2019-5479
 	RESERVED
 CVE-2019-5478
 	RESERVED
-CVE-2019-5477
+CVE-2019-5477 [Command Injection Vulnerability]
 	RESERVED
+	- ruby-nokogiri <unfixed>
+	NOTE: https://github.com/sparklemotion/nokogiri/issues/1915
+	NOTE: Processes are vulnerable only if the undocumented method Nokogiri::CSS::Tokenizer#load_file
+	NOTE: is being passed untrusted user input.
 CVE-2019-5476 (An SQL Injection in the Nextcloud Lookup-Server < v0.3.0 (running o ...)
 	TODO: check
 CVE-2019-5475



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/951755403ff826f4c6cd3af156cfec5d52d1d978

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/951755403ff826f4c6cd3af156cfec5d52d1d978
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190815/908e6542/attachment-0001.html>