[Git][security-tracker-team/security-tracker][master] buster triage

Moritz Muehlenhoff jmm at debian.org
Tue Feb 19 22:21:45 GMT 2019


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
bd11f797 by Moritz Muehlenhoff at 2019-02-19T22:21:14Z
buster triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -5466,7 +5466,7 @@ CVE-2019-6503 (There is a deserialization vulnerability in Chatopera cosin v3.10
 CVE-2019-6502 (sc_context_create in ctx.c in libopensc in OpenSC 0.19.0 has a memory ...)
 	- opensc <unfixed> (unimportant)
 	NOTE: https://github.com/OpenSC/OpenSC/issues/1586
-	NOTE: Negligable security impact, assigning a CVE seems out of proportion...
+	NOTE: Negligible security impact, assigning a CVE seems out of proportion...
 CVE-2019-1003004 (An improper authorization vulnerability exists in Jenkins 2.158 and ...)
 	NOT-FOR-US: Jenkins
 CVE-2019-1003003 (An improper authorization vulnerability exists in Jenkins 2.158 and ...)
@@ -5632,22 +5632,22 @@ CVE-2019-6461 (An issue was discovered in cairo 1.16.0. There is an assertion pr
 	NOTE: https://gitlab.freedesktop.org/cairo/cairo/issues/352
 CVE-2019-6460 (An issue was discovered in GNU Recutils 1.8. There is a NULL pointer ...)
 	- recutils <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 CVE-2019-6459 (An issue was discovered in GNU Recutils 1.8. There is a memory leak in ...)
 	- recutils <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 CVE-2019-6458 (An issue was discovered in GNU Recutils 1.8. There is a memory leak in ...)
 	- recutils <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 CVE-2019-6457 (An issue was discovered in GNU Recutils 1.8. There is a memory leak in ...)
 	- recutils <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 CVE-2019-6456 (An issue was discovered in GNU Recutils 1.8. There is a NULL pointer ...)
 	- recutils <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 CVE-2019-6455 (An issue was discovered in GNU Recutils 1.8. There is a double-free ...)
 	- recutils <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 CVE-2019-6454 [systemd (PID1) crash with specially crafted D-Bus message]
 	RESERVED
 	{DSA-4393-1 DLA-1684-1}
@@ -5709,17 +5709,14 @@ CVE-2015-9277 (MailEnable before 8.60 allows Directory Traversal for reading the
 CVE-2015-9276 (SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS ...)
 	NOT-FOR-US: SmarterTools SmarterMail
 CVE-2019-6446 (An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle ...)
-	- python-numpy <unfixed>
-	[stretch] - python-numpy <no-dsa> (Minor issue)
+	- python-numpy 1:1.10.4-1
 	[jessie] - python-numpy <no-dsa> (Minor issue)
 	NOTE: https://github.com/numpy/numpy/issues/12759
-	NOTE: For upstream this works as intended and is documented. Proposed
-	NOTE: solution of switching the default might be dangerous for users who rely on
-	NOTE: the current behavior.
+	NOTE: For upstream this works as intended and is documented.
 	NOTE: https://github.com/numpy/numpy/commit/a2bd3a7eabfe053d6d16a2130fdcad9e5211f6bb
-	NOTE: adds already support to disable use of picke in load/save.
-	NOTE: Proposed fix/partial mitigation via:
-	NOTE: https://github.com/numpy/numpy/pull/12889
+	NOTE: added support to disable use of picke in load/save, marking that as the fixed
+	NOTE: version. The use of that is at the discretion of anyone using numpy
+	NOTE: Further discussion at https://github.com/numpy/numpy/pull/12889
 CVE-2019-6445 (An issue was discovered in NTPsec before 1.1.3. An authenticated ...)
 	- ntpsec 1.1.3+dfsg1-1 (bug #919513)
 CVE-2019-6444 (An issue was discovered in NTPsec before 1.1.3. process_control() in ...)
@@ -13191,15 +13188,15 @@ CVE-2018-20377 (Orange Livebox 00.96.320S devices allow remote attackers to disc
 	NOT-FOR-US: Orange Livebox
 CVE-2018-20376 (An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. ...)
 	- tcc <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 	NOTE: https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00013.html
 CVE-2018-20375 (An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. ...)
 	- tcc <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 	NOTE: https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00014.html
 CVE-2018-20374 (An issue was discovered in Tiny C Compiler (aka TinyCC or TCC) 0.9.27. ...)
 	- tcc <unfixed> (unimportant)
-	NOTE: Negligable security impact
+	NOTE: Negligible security impact
 	NOTE: https://lists.nongnu.org/archive/html/tinycc-devel/2018-12/msg00015.html
 CVE-2018-20373 (Tenda ADSL modem routers 1.0.1 allow XSS via the hostname of a DHCP ...)
 	NOT-FOR-US: Tenda ADSL modem routers
@@ -18334,7 +18331,7 @@ CVE-2018-19960 (The debug_mode function in web/web.py in OnionShare through 1.3.
 	- onionshare 1.3.2-1 (bug #915859; unimportant)
 	[jessie] - onionshare <no-dsa> (contrib not supported)
 	NOTE: https://github.com/micahflee/onionshare/issues/837
-	NOTE: Negligable (and disputable) security impact, as the debug mode is not enabled by default
+	NOTE: Negligible (and disputable) security impact, as the debug mode is not enabled by default
 CVE-2018-19935 (ext/imap/php_imap.c in PHP 5.x and 7.x before 7.3.0 allows remote ...)
 	{DSA-4353-1 DLA-1608-1}
 	- php7.3 7.3.0-1
@@ -58164,6 +58161,7 @@ CVE-2018-6253 (NVIDIA GPU Display Driver contains a vulnerability in the DirectX
 	[jessie] - nvidia-graphics-drivers <no-dsa> (Non-free not supported)
 	[wheezy] - nvidia-graphics-drivers <end-of-life> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-340xx <unfixed>
+	[buster] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported, no updates provided by Nvidia for 340)
 	[stretch] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-304xx <unfixed>
 	[stretch] - nvidia-graphics-drivers-legacy-304xx <no-dsa> (Non-free not supported)
@@ -58181,6 +58179,7 @@ CVE-2018-6249 (NVIDIA GPU Display Driver contains a vulnerability in kernel mode
 	[jessie] - nvidia-graphics-drivers <no-dsa> (Non-free not supported)
 	[wheezy] - nvidia-graphics-drivers <end-of-life> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-340xx <unfixed>
+	[buster] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported, no updates provided by Nvidia for 340)
 	[stretch] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-304xx <unfixed>
 	[stretch] - nvidia-graphics-drivers-legacy-304xx <no-dsa> (Non-free not supported)
@@ -85724,12 +85723,10 @@ CVE-2017-14159 (slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dr
 	NOTE: http://www.openldap.org/its/index.cgi?findid=8703
 	NOTE: Negligible security impact, but filed #877512
 CVE-2017-14158 (Scrapy 1.4 allows remote attackers to cause a denial of service (memory ...)
-	- python-scrapy <unfixed> (bug #875947)
-	[stretch] - python-scrapy <no-dsa> (Minor issue)
-	[jessie] - python-scrapy <no-dsa> (Minor issue)
-	[wheezy] - python-scrapy <no-dsa> (Minor issue)
+	- python-scrapy <unfixed> (unimportant; bug #875947)
 	NOTE: http://blog.csdn.net/wangtua/article/details/75228728
 	NOTE: https://github.com/scrapy/scrapy/issues/482
+	NOTE: Negligable security impact
 CVE-2017-14157
 	RESERVED
 CVE-2017-14156 (The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the ...)
@@ -89838,11 +89835,9 @@ CVE-2017-12855 (Xen maintains the _GTF_{read,writ}ing bits as appropriate, to in
 CVE-2017-12853 (The RealTime RWR-3G-100 Router Firmware Version : Ver1.0.56 is ...)
 	NOT-FOR-US: RealTime RWR-3G-100 Router Firmware
 CVE-2017-12852 (The numpy.pad function in Numpy 1.13.1 and older versions is missing ...)
-	- python-numpy <unfixed> (bug #872407)
-	[stretch] - python-numpy <no-dsa> (Minor issue)
-	[jessie] - python-numpy <no-dsa> (Minor issue)
-	[wheezy] - python-numpy <no-dsa> (Minor issue)
+	- python-numpy <unfixed> (unimportant; bug #872407)
 	NOTE: https://github.com/numpy/numpy/issues/9560#issuecomment-322395292
+	NOTE: Negligible security impact
 CVE-2017-12851 (An authenticated standard user could reset the password of the admin ...)
 	- kanboard <itp> (bug #790814)
 CVE-2017-12850 (An authenticated standard user could reset the password of other users ...)
@@ -110163,6 +110158,7 @@ CVE-2017-6272 (NVIDIA GPU Display Driver contains a vulnerability in the kernel
 	[jessie] - nvidia-graphics-drivers <no-dsa> (Non-free not supported)
 	[wheezy] - nvidia-graphics-drivers <end-of-life> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-340xx <unfixed>
+	[buster] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported, no updates provided by Nvidia for 340)
 	[stretch] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-304xx <unfixed>
 	[stretch] - nvidia-graphics-drivers-legacy-304xx <no-dsa> (Non-free not supported)
@@ -110183,6 +110179,7 @@ CVE-2017-6267 (NVIDIA GPU Display Driver contains a vulnerability in the kernel
 	[jessie] - nvidia-graphics-drivers <no-dsa> (Non-free not supported)
 	[wheezy] - nvidia-graphics-drivers <end-of-life> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-340xx <unfixed>
+	[buster] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported, no updates provided by Nvidia for 340)
 	[stretch] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-304xx <unfixed>
 	[stretch] - nvidia-graphics-drivers-legacy-304xx <no-dsa> (Non-free not supported)
@@ -110195,6 +110192,7 @@ CVE-2017-6266 (NVIDIA GPU Display Driver contains a vulnerability in the kernel
 	[jessie] - nvidia-graphics-drivers <no-dsa> (Non-free not supported)
 	[wheezy] - nvidia-graphics-drivers <end-of-life> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-340xx <unfixed>
+	[buster] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported, no updates provided by Nvidia for 340)
 	[stretch] - nvidia-graphics-drivers-legacy-340xx <no-dsa> (Non-free not supported)
 	- nvidia-graphics-drivers-legacy-304xx <unfixed>
 	[stretch] - nvidia-graphics-drivers-legacy-304xx <no-dsa> (Non-free not supported)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/bd11f797de3d208fcaf12ebfe200697228bbeadb

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/bd11f797de3d208fcaf12ebfe200697228bbeadb
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190219/180db3a7/attachment.html>


More information about the debian-security-tracker-commits mailing list