[Git][security-tracker-team/security-tracker][master] data/CVE/list: add detailled information to CVE-2019-14466(/gosa)

[Mike Gabriel]

Mike Gabriel pushed to branch master at Debian Security Tracker / security-tracker


Commits:
7e01b387 by Mike Gabriel at 2019-08-30T14:08:21Z
data/CVE/list: add detailled information to CVE-2019-14466(/gosa)

 See comment in another gosa-core security bug, unrelated to this:
 https://github.com/gosa-project/gosa-core/pull/30#issuecomment-521975100

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -3812,8 +3812,11 @@ CVE-2019-14468 (GnuCOBOL 2.2 has a buffer overflow in cb_push_op in cobc/field.c
 	NOTE: https://sourceforge.net/p/open-cobol/bugs/581/
 CVE-2019-14467
 	RESERVED
-CVE-2019-14466
-	RESERVED
+CVE-2019-14466 (GOsa <= 2.7.5.2 uses unserialize to restore filter settings from a cookie. Since this cookie is supplied by the client, authenticated users can pass arbitrary content to unserialized, which opens GOsa up to a potential PHP object injection.)
+	- gosa <unfixed>
+	NOTE: https://github.com/gosa-project/gosa-core/commit/e1504e9765db2adde8b4685b5c93fbba57df868b (fix)
+	NOTE: https://github.com/gosa-project/gosa-core/commit/90b674960335d888c76ca5e99027df8e7fa66f3a (fixing the prev commit)
+	NOTE: https://github.com/gosa-project/gosa-core/pull/30#issuecomment-521975100 (unofficially made public here)
 CVE-2019-14465 (fmt_mtm_load_song in fmt/mtm.c in Schism Tracker 20190722 has a heap-b ...)
 	- schism 2:20190805-1 (bug #933807)
 	[buster] - schism <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/7e01b3874b70fea405df48bb399a41195ab2bca1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/7e01b3874b70fea405df48bb399a41195ab2bca1
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190830/8ae28870/attachment.html>