[Git][security-tracker-team/security-tracker][master] Mark all Apport related entries as NFU
Salvatore Bonaccorso
carnil at debian.org
Wed May 1 13:08:58 BST 2019
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
62dc2699 by Salvatore Bonaccorso at 2019-05-01T12:06:26Z
Mark all Apport related entries as NFU
src:apport itself was ever only in experimental and never migrated to
unstable as it needed extra services to actually function.
Maintainer recently asked for complete removal of Apport, tracked as
https://bugs.debian.org/924960 .
As it was never in unstable or any other supported suites, we can mark
it safely as NFU considering it was never in Debian.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -65564,9 +65564,7 @@ CVE-2018-6553 (The CUPS AppArmor profile incorrectly confined the dnssd backend
{DSA-4243-1 DLA-1426-1}
- cups 2.2.8-5 (bug #903605)
CVE-2018-6552 (Apport does not properly handle crashes originating from a PID namespa ...)
- [experimental] - apport <unfixed>
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, to have an explicit reference for apport if it ever enters unstable
+ NOT-FOR-US: Apport
CVE-2018-6551 (The malloc implementation in the GNU C Library (aka glibc or libc6), f ...)
[experimental] - glibc 2.26.9000+20180127.7e23a7dd-0experimental0
- glibc 2.27-1
@@ -93998,21 +93996,15 @@ CVE-2017-14183
CVE-2017-14182 (A Denial of Service (DoS) vulnerability in Fortinet FortiOS 5.4.0 to 5 ...)
NOT-FOR-US: Fortinet
CVE-2017-14180 (Apport 2.13 through 2.20.7 does not properly handle crashes originatin ...)
- [experimental] - apport <unfixed>
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, to have an explicit reference for apport if it ever enters unstable
+ NOT-FOR-US: Apport
CVE-2017-14179 (Apport before 2.13 does not properly handle crashes originating from a ...)
- [experimental] - apport <unfixed>
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, to have an explicit reference for apport if it ever enters unstable
+ NOT-FOR-US: Apport
CVE-2017-14178 (In snapd 2.27 through 2.29.2 the 'snap logs' command could be made to ...)
- snapd 2.30-1
[stretch] - snapd <not-affected> (Issue introduced in 2.27)
NOTE: https://launchpad.net/bugs/1730255
CVE-2017-14177 (Apport through 2.20.7 does not properly handle core dumps from setuid ...)
- [experimental] - apport <unfixed>
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, to have an explicit reference for apport if it ever enters unstable
+ NOT-FOR-US: Apport
CVE-2017-14181 (DeleteBitBuffer in libbitbuf/bitbuffer.c in mp4tools aacplusenc 0.17.5 ...)
NOT-FOR-US: aacplusenc
CVE-2017-14175 (In coders/xbm.c in ImageMagick 7.0.6-1 Q16, a DoS in ReadXBMImage() du ...)
@@ -104525,8 +104517,7 @@ CVE-2017-10710
CVE-2017-10709 (The lockscreen on Elephone P9000 devices (running Android 6.0) allows ...)
NOT-FOR-US: Elephone P9000 devices
CVE-2017-10708 (An issue was discovered in Apport through 2.20.x. In apport/report.py, ...)
- [experimental] - apport 2.20.4-2 (bug #868831)
- NOTE: apport only in experimental, so we cannot track this in security-tracker
+ NOT-FOR-US: Apport
CVE-2017-10707
RESERVED
CVE-2017-10706 (When Antiy Antivirus Engine before 5.0.0.05171547 scans a special ZIP ...)
@@ -126233,23 +126224,11 @@ CVE-2016-9956 (The route manager in FlightGear before 2016.4.4 allows remote att
- flightgear 1:2016.4.3+dfsg-1 (bug #848114)
NOTE: http://www.openwall.com/lists/oss-security/2016/12/14/11
CVE-2016-9951 (An issue was discovered in Apport before 2.20.4. A malicious Apport cr ...)
- [experimental] - apport 2.20.4-1 (bug #848213)
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, as we have an explicit (bug) reference for apport
- NOTE: https://bugs.launchpad.net/apport/+bug/1648806
- NOTE: https://donncha.is/2016/12/compromising-ubuntu-desktop/
+ NOT-FOR-US: Apport
CVE-2016-9950 (An issue was discovered in Apport before 2.20.4. There is a path trave ...)
- [experimental] - apport 2.20.4-1 (bug #848213)
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, as we have an explicit (bug) reference for apport
- NOTE: https://bugs.launchpad.net/apport/+bug/1648806
- NOTE: https://donncha.is/2016/12/compromising-ubuntu-desktop/
+ NOT-FOR-US: Apport
CVE-2016-9949 (An issue was discovered in Apport before 2.20.4. In apport/ui.py, Appo ...)
- [experimental] - apport 2.20.4-1 (bug #848213)
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, as we have an explicit (bug) reference for apport
- NOTE: https://bugs.launchpad.net/apport/+bug/1648806
- NOTE: https://donncha.is/2016/12/compromising-ubuntu-desktop/
+ NOT-FOR-US: Apport
CVE-2016-9948
RESERVED
CVE-2016-9947
@@ -188077,9 +188056,7 @@ CVE-2015-1339 (Memory leak in the cuse_channel_release function in fs/fuse/cuse.
NOTE: Introduced in: https://git.kernel.org/linus/cc080e9e9be16ccf26135d366d7d2b65209f1d56 (v4.2-rc1)
NOTE: Fixed in: https://git.kernel.org/linus/2c5816b4beccc8ba709144539f6fdd764f8fa49c (v4.4-rc5)
CVE-2015-1338 (kernel_crashdump in Apport before 2.19 allows local users to cause a d ...)
- [experimental] - apport <unfixed>
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, as we have an explicit (bug) reference for apport
+ NOT-FOR-US: Apport
CVE-2015-1337 (Simple Streams (simplestreams) does not properly verify the GPG signat ...)
NOT-FOR-US: simplestreams
CVE-2015-1336 (The daily mandb cleanup job in Man-db before 2.7.6.1-1 as packaged in ...)
@@ -188134,9 +188111,9 @@ CVE-2015-1326 (python-dbusmock before version 0.15.1 AddTemplate() D-Bus method
[jessie] - python-dbusmock 0.11.4-1+deb8u1
NOTE: https://bugs.launchpad.net/python-dbusmock/+bug/1453815
CVE-2015-1325 (Race condition in Apport before 2.17.2-0ubuntu1.1 as packaged in Ubunt ...)
- [experimental] - apport 2.17.3-1
+ NOT-FOR-US: Apport
CVE-2015-1324 (Apport before 2.17.2-0ubuntu1.1 as packaged in Ubuntu 15.04, before 2. ...)
- [experimental] - apport 2.17.3-1
+ NOT-FOR-US: Apport
CVE-2015-1323 (The simulate dbus method in aptdaemon before 1.1.1+bzr982-0ubuntu3.1 a ...)
{DLA-261-1}
- aptdaemon 1.1.1+bzr982-1 (bug #789162)
@@ -188154,9 +188131,7 @@ CVE-2015-1320 (The SeaMicro provisioning of Ubuntu MAAS logs credentials, includ
CVE-2015-1319 (The Unity Settings Daemon before 14.04.0+14.04.20150825-0ubuntu2 and 1 ...)
- unity <itp> (bug #609278)
CVE-2015-1318 (The crash reporting feature in Apport 2.13 through 2.17.x before 2.17. ...)
- [experimental] - apport <unfixed>
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, as we have an explicit (bug) reference for apport
+ NOT-FOR-US: Apport
CVE-2015-1317 (Use-after-free vulnerability in Oxide before 1.5.6 and 1.6.x before 1. ...)
NOT-FOR-US: Oxide
CVE-2015-1316 (Juju Core's Joyent provider before version 1.25.5 uploads the user's p ...)
@@ -234410,9 +234385,7 @@ CVE-2013-1068 (The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:20
[wheezy] - cinder <not-affected> (Vulnerable code not present)
NOTE: Requires includedir to be defined in /etc/sudoers file
CVE-2013-1067 (Apport 2.12.5 and earlier uses weak permissions for core dump files cr ...)
- [experimental] - apport 2.12.6-1 (bug #727661)
- NOTE: apport only in experimental, so we cannot track this in security-tracker
- NOTE: add it, as we have an explicit (bug) reference for apport
+ NOT-FOR-US: Apport
CVE-2013-1066 (language-selector 0.110.x before 0.110.1, 0.90.x before 0.90.1, and 0. ...)
NOT-FOR-US: language-selector
CVE-2013-1065 (backend.py in Jockey before 0.9.7-0ubuntu7.11 does not properly use D- ...)
@@ -293025,7 +292998,7 @@ CVE-2009-1296 (The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on
NOTE: encrypted home directories with ecryptfs, so no passphrase is stored in the
NOTE: installer logs on disk
CVE-2009-1295 (Apport before 0.108.4 on Ubuntu 8.04 LTS, before 0.119.2 on Ubuntu 8.1 ...)
- [experimental] - apport <not-affected> (Fixed before initial upload into Debian)
+ NOT-FOR-US: Apport
CVE-2009-1294 (Multiple cross-site scripting (XSS) vulnerabilities in web/guest/home ...)
NOT-FOR-US: Novell Teaming
CVE-2009-1293 (The web login functionality (c/portal/login) in Novell Teaming 1.0 thr ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/62dc2699ca7224c9cee5a90bc25f8ea86a2fb4e7
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/62dc2699ca7224c9cee5a90bc25f8ea86a2fb4e7
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190501/75103ef2/attachment-0001.html>
More information about the debian-security-tracker-commits
mailing list