[Git][security-tracker-team/security-tracker][master] CVE-2019-773{2,3}/liblivemedia: add upstream fix

[Hugo Lefeuvre]

Hugo Lefeuvre pushed to branch master at Debian Security Tracker / security-tracker


Commits:
afb381c7 by Hugo Lefeuvre at 2019-05-12T05:44:15Z
CVE-2019-773{2,3}/liblivemedia: add upstream fix

+ upstream fixed CVE-2019-7733 in 2019.05.12. Mark it postponed in
jessie since it might be worth taking a look at for next DLA.

+ upstream rejected CVE-2019-7732, considering it invalid. Add a
note here, I will also ask for CVE rejection.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -10721,13 +10721,15 @@ CVE-2019-7734
 CVE-2019-7733 (In Live555 0.95, there is a buffer overflow via a large integer in a C ...)
 	- liblivemedia <unfixed> (low)
 	[stretch] - liblivemedia <no-dsa> (Minor issue)
-	[jessie] - liblivemedia <no-dsa> (Minor issue)
+	[jessie] - liblivemedia <postponed> (Minor issue)
 	NOTE: https://github.com/rgaufman/live555/issues/21
+	NOTE: fixed in 2019.05.12: http://www.live555.com/liveMedia/public/changelog.txt
 CVE-2019-7732 (In Live555 0.95, a setup packet can cause a memory leak leading to DoS ...)
 	- liblivemedia <unfixed> (low)
 	[stretch] - liblivemedia <no-dsa> (Minor issue)
 	[jessie] - liblivemedia <no-dsa> (Minor issue, unlikely to be exploited in practice)
 	NOTE: https://github.com/rgaufman/live555/issues/20
+	NOTE: upstream considers this issue invalid: http://lists.live555.com/pipermail/live-devel/2019-May/021218.html
 CVE-2019-7731 (MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an  ...)
 	NOT-FOR-US: MyWebSQL
 CVE-2019-7730 (MyWebSQL 3.7 has a Cross-site request forgery (CSRF) vulnerability for ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/afb381c7f41a395dad7c7bff5ed318b7c3d2f948

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/afb381c7f41a395dad7c7bff5ed318b7c3d2f948
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190512/f3280b4e/attachment.html>