[Git][security-tracker-team/security-tracker][master] two poppler issues fixed, one ignored

Mon May 27 22:23:08 BST 2019


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9528980d by Moritz Muehlenhoff at 2019-05-27T21:22:26Z
two poppler issues fixed, one ignored
NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -27,11 +27,11 @@ CVE-2019-12317
 CVE-2019-12316
 	RESERVED
 CVE-2019-12315 (Samsung SCX-824 printers allow a reflected Cross-Site-Scripting (XSS)  ...)
-	TODO: check
+	NOT-FOR-US: Samsung
 CVE-2019-12314 (Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute pa ...)
 	NOT-FOR-US: Deltek Maconomy
 CVE-2019-12313 (XSS exists in Shave before 2.5.3 because output encoding is mishandled ...)
-	TODO: check
+	NOT-FOR-US: Shave
 CVE-2019-12312 (In Libreswan before 3.28, an assertion failure can lead to a pluto IKE ...)
 	- libreswan <unfixed>
 	NOTE: https://github.com/libreswan/libreswan/issues/246
@@ -42,15 +42,15 @@ CVE-2017-18375 (Ampache 3.8.3 allows PHP Object Instantiation via democratic.aja
 	NOTE: https://fenceposterror.github.io/2017/06/16/Hacking-For-Fun-And-Non-Profit.html
 	NOTE: https://github.com/ampache/ampache/issues/1555
 CVE-2016-10759 (The Xinha plugin in Precurio 2.1 allows Directory Traversal, with resu ...)
-	TODO: check
+	NOT-FOR-US: Xinha plugin in Precurio
 CVE-2016-10758 (PHPKIT 1.6.6 allows arbitrary File Upload, as demonstrated by a .php f ...)
 	NOT-FOR-US: PHPKIT
 CVE-2016-10757 (In Redaxo 5.2.0, the cron management of the admin panel suffers from C ...)
-	TODO: check
+	NOT-FOR-US: Redaxo
 CVE-2016-10756 (Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload becaus ...)
-	TODO: check
+	NOT-FOR-US: Kliqqi
 CVE-2016-10755 (AbanteCart 1.2.8 allows SQL Injection via the source_language paramete ...)
-	TODO: check
+	NOT-FOR-US: AbanteCart
 CVE-2016-10754 (modules/Calendar/Activity.php in Vtiger CRM 6.5.0 allows SQL injection ...)
 	NOT-FOR-US: Vtiger CRM
 CVE-2016-10753 (e107 2.1.2 allows PHP Object Injection with resultant SQL injection, b ...)
@@ -58,7 +58,7 @@ CVE-2016-10753 (e107 2.1.2 allows PHP Object Injection with resultant SQL inject
 CVE-2016-10752 (serendipity_moveMediaDirectory in Serendipity 2.0.3 allows remote atta ...)
 	- serendipity <removed>
 CVE-2016-10751 (osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the  ...)
-	TODO: check
+	NOT-FOR-US: osClass
 CVE-2019-12311
 	RESERVED
 CVE-2019-12310
@@ -80,7 +80,7 @@ CVE-2019-12303
 CVE-2019-12302
 	RESERVED
 CVE-2019-12301 (The Percona Server 5.6.44-85.0-1 packages for Debian and Ubuntu suffer ...)
-	TODO: check
+	NOT-FOR-US: Percona server
 CVE-2019-12300 (Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted au ...)
 	TODO: check
 CVE-2019-12299
@@ -100,7 +100,7 @@ CVE-2019-12295 (In Wireshark 3.0.0 to 3.0.1, 2.6.0 to 2.6.8, and 2.4.0 to 2.4.14
 CVE-2019-12294
 	RESERVED
 CVE-2019-12293 (In Poppler through 0.76.1, there is a heap-based buffer over-read in J ...)
-	- poppler <unfixed> (bug #929423)
+	- poppler 0.71.0-5 (bug #929423)
 	NOTE: https://gitlab.freedesktop.org/poppler/poppler/issues/768
 	NOTE: https://gitlab.freedesktop.org/poppler/poppler/commit/89a5367d49b2556a2635dbb6d48d6a6b182a2c6c
 CVE-2019-12292
@@ -3615,7 +3615,7 @@ CVE-2019-10873 (An issue was discovered in Poppler 0.74.0. There is a NULL point
 	NOTE: https://gitlab.freedesktop.org/poppler/poppler/issues/748
 	NOTE: https://gitlab.freedesktop.org/poppler/poppler/commit/8dbe2e6c480405dab9347075cf4be626f90f1d05
 CVE-2019-10872 (An issue was discovered in Poppler 0.74.0. There is a heap-based buffe ...)
-	- poppler <unfixed> (low; bug #926530)
+	- poppler 0.71.0-5 (low; bug #926530)
 	[buster] - poppler <postponed> (Revisit when fixed upstream)
 	[stretch] - poppler <postponed> (Revisit when fixed upstream)
 	NOTE: https://gitlab.freedesktop.org/poppler/poppler/issues/750
@@ -5915,6 +5915,7 @@ CVE-2019-9904 (An issue was discovered in lib\cdt\dttree.c in libcdt.a in graphv
 	NOTE: https://gitlab.com/graphviz/graphviz/issues/1512
 CVE-2019-9903 (PDFDoc::markObject in PDFDoc.cc in Poppler 0.74.0 mishandles dict mark ...)
 	- poppler <unfixed> (low; bug #925264)
+	[buster] - poppler <ignored> (Minor issue)
 	[stretch] - poppler <ignored> (Minor issue)
 	[jessie] - poppler <not-affected> (Vulnerable code not present)
 	NOTE: https://gitlab.freedesktop.org/poppler/poppler/issues/741



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/9528980d3841c5c74283cc60d2c4d5c018624294

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/9528980d3841c5c74283cc60d2c4d5c018624294
You're receiving this email because of your account on salsa.debian.org.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20190527/374693c1/attachment-0001.html>
