[Git][security-tracker-team/security-tracker][master] buster triage

[Moritz Muehlenhoff]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2576ab77 by Moritz Muehlenhoff at 2019-03-30T15:25:17Z
buster triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -2941,7 +2941,9 @@ CVE-2019-9660 (Stored XSS exists in YzmCMS 5.2 via the admin/category/edit.html
 CVE-2019-9659 (The Chuango 433 MHz burglar-alarm product line uses static codes in th ...)
 	NOT-FOR-US: Chuango
 CVE-2019-9658 (Checkstyle before 8.18 loads external DTDs by default. ...)
-	- checkstyle <unfixed> (bug #924598)
+	- checkstyle <unfixed> (low; bug #924598)
+	[buster] - checkstyle <no-dsa> (Minor issue)
+	[stretch] - checkstyle <no-dsa> (Minor issue)
 	NOTE: https://github.com/checkstyle/checkstyle/issues/6474
 	NOTE: https://github.com/checkstyle/checkstyle/issues/6478
 	NOTE: https://github.com/checkstyle/checkstyle/pull/6476
@@ -8265,6 +8267,7 @@ CVE-2019-7443 [Insecure handling of arguments in helpers]
 	- kauth 5.54.0-2 (bug #921995)
 	[stretch] - kauth <no-dsa> (Minor issue, will be fixed in a point release)
 	- kde4libs <unfixed> (bug #922727)
+	[buster] - kde4libs <no-dsa> (Minor issue)
 	[stretch] - kde4libs <no-dsa> (Minor issue)
 	[jessie] - kde4libs <no-dsa> (Minor issue)
 	NOTE: https://mail.kde.org/pipermail/kde-announce/2019-February/000011.html
@@ -60298,7 +60301,7 @@ CVE-2018-1000078 (RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3
 	- ruby2.1 <removed>
 	- ruby1.9.1 <removed>
 	- rubygems <removed>
-	- jruby <unfixed> (bug #895778)
+	- jruby 9.1.17.0-1 (bug #895778)
 	[jessie] - jruby <end-of-life> (See DSA-4219-1)
 	NOTE: https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb
 	NOTE: https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
@@ -162278,7 +162281,8 @@ CVE-2015-8567 (Memory leak in net/vmxnet3.c in QEMU allows remote attackers to c
 	NOTE: https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html
 	NOTE: http://www.openwall.com/lists/oss-security/2015/12/15/4
 CVE-2015-8559 (The knife bootstrap command in chef leaks the validator.pem private RS ...)
-	- chef <unfixed> (bug #809670)
+	- chef <unfixed> (low; bug #809670)
+	[buster] - chef <ignored> (Minor issue; workaround using validatorless bootstrapping)
 	[stretch] - chef <ignored> (Minor issue; workaround using validatorless bootstrapping)
 	[jessie] - chef <ignored> (Minor issue; workaround using validatorless bootstrapping)
 	[wheezy] - chef <ignored> (Minor issue; workaround using validatorless bootstrapping)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/2576ab770ee0c87cc0bc4a2da3be92d336970e6f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/2576ab770ee0c87cc0bc4a2da3be92d336970e6f
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190330/8577b7aa/attachment.html>