[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso
carnil at debian.org
Fri Nov 1 08:10:28 GMT 2019
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
57e21f6b by security tracker role at 2019-11-01T08:10:12Z
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,5 @@
+CVE-2019-18658
+ RESERVED
CVE-2019-18657 (ClickHouse before 19.13.5.44 allows HTTP header injection via the url ...)
NOT-FOR-US: ClickHouse
CVE-2019-18656 (Pimcore 6.2.3 has XSS in the translations grid because bundles/AdminBu ...)
@@ -771,7 +773,7 @@ CVE-2019-18410
CVE-2019-18409 (The ruby_parser-legacy (aka legacy) gem 1.0.0 for Ruby allows local pr ...)
NOT-FOR-US: ruby_parser-legacy packaging issue
CVE-2019-18408 (archive_read_format_rar_read_data in archive_read_support_format_rar.c ...)
- {DLA-1971-1}
+ {DSA-4557-1 DLA-1971-1}
- libarchive 3.4.0-1
NOTE: https://github.com/libarchive/libarchive/commit/b8592ecba2f9e451e1f5cb7ab6dcee8b8e7b3f60
NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=14689
@@ -797,8 +799,8 @@ CVE-2019-18398
RESERVED
CVE-2019-18397
RESERVED
-CVE-2019-18396
- RESERVED
+CVE-2019-18396 (An issue was discovered in certain Oi third-party firmware that may be ...)
+ TODO: check
CVE-2019-18395
RESERVED
CVE-2019-18394 (A Server Side Request Forgery (SSRF) vulnerability in FaviconServlet.j ...)
@@ -1036,6 +1038,7 @@ CVE-2019-18283
CVE-2019-18282
RESERVED
CVE-2019-18281 (An out-of-bounds memory access in the generateDirectionalRuns() functi ...)
+ {DSA-4556-1}
- qtbase-opensource-src-gles 5.12.5+dfsg-1
- qtbase-opensource-src 5.12.5+dfsg-2
[buster] - qtbase-opensource-src <no-dsa> (Minor issue)
@@ -1148,16 +1151,16 @@ CVE-2019-18232
RESERVED
CVE-2019-18231
RESERVED
-CVE-2019-18230
- RESERVED
-CVE-2019-18229
- RESERVED
-CVE-2019-18228
- RESERVED
-CVE-2019-18227
- RESERVED
-CVE-2019-18226
- RESERVED
+CVE-2019-18230 (Honeywell equIP and Performance series IP cameras, multiple versions, ...)
+ TODO: check
+CVE-2019-18229 (Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Lack of sanitizati ...)
+ TODO: check
+CVE-2019-18228 (Honeywell equIP series IP cameras Multiple equIP Series Cameras, A vul ...)
+ TODO: check
+CVE-2019-18227 (Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. XXE vulnerabilitie ...)
+ TODO: check
+CVE-2019-18226 (Honeywell equIP series and Performance series IP cameras and recorders ...)
+ TODO: check
CVE-2019-18225 (An issue was discovered in Citrix Application Delivery Controller (ADC ...)
NOT-FOR-US: Citrix
CVE-2019-18224 (idn2_to_ascii_4i in lib/lookup.c in GNU libidn2 before 2.1.1 has a hea ...)
@@ -5240,10 +5243,10 @@ CVE-2019-16909
RESERVED
CVE-2019-16908
RESERVED
-CVE-2019-16907
- RESERVED
-CVE-2019-16906
- RESERVED
+CVE-2019-16907 (An issue was discovered in the Infosysta "In-App & Desktop Notific ...)
+ TODO: check
+CVE-2019-16906 (An issue was discovered in the Infosysta "In-App & Desktop Notific ...)
+ TODO: check
CVE-2019-16905 (OpenSSH 7.7 through 7.9 and 8.x before 8.1, when compiled with an expe ...)
- openssh 1:8.1p1-1 (unimportant)
[stretch] - openssh <not-affected> (Vulnerable code introduced later)
@@ -5881,8 +5884,8 @@ CVE-2019-16676 (Plataformatec Simple Form has Incorrect Access Control in file_m
NOTE: http://blog.plataformatec.com.br/2019/09/incorrect-access-control-in-simple-form-cve-2019-16676/
NOTE: https://github.com/plataformatec/simple_form/commit/8c91bd76a5052ddf3e3ab9fd8333f9aa7b2e2dd6
NOTE: https://github.com/plataformatec/simple_form/security/advisories/GHSA-r74q-gxcg-73hx
-CVE-2019-16675
- RESERVED
+CVE-2019-16675 (An issue was discovered in PHOENIX CONTACT PC Worx through 1.86, PC Wo ...)
+ TODO: check
CVE-2019-16674
RESERVED
CVE-2019-16673
@@ -6843,8 +6846,8 @@ CVE-2019-16297
RESERVED
CVE-2019-16296
RESERVED
-CVE-2019-16295
- RESERVED
+CVE-2019-16295 (Stored XSS in filemanager2.php in CentOS-WebPanel.com (aka CWP) CentOS ...)
+ TODO: check
CVE-2019-16294 (SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote ...)
NOT-FOR-US: Notepad++
CVE-2019-16293 (The Create Discoveries feature of Open-AudIT before 3.2.0 allows an au ...)
@@ -8601,8 +8604,8 @@ CVE-2019-15712
RESERVED
CVE-2019-15711
RESERVED
-CVE-2019-15710
- RESERVED
+CVE-2019-15710 (An OS command injection vulnerability in FortiExtender 4.1.1 and below ...)
+ TODO: check
CVE-2019-15709
RESERVED
CVE-2019-15708
@@ -16304,16 +16307,16 @@ CVE-2019-13553 (Rittal Chiller SK 3232-Series web interface as built upon Carel
NOT-FOR-US: Rittal Chiller SK 3232-Series
CVE-2019-13552 (In WebAccess versions 8.4.1 and prior, multiple command injection vuln ...)
NOT-FOR-US: WebAccess
-CVE-2019-13551
- RESERVED
+CVE-2019-13551 (Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vul ...)
+ TODO: check
CVE-2019-13550 (In WebAccess, versions 8.4.1 and prior, an improper authorization vuln ...)
NOT-FOR-US: WebAccess
CVE-2019-13549 (Rittal Chiller SK 3232-Series web interface as built upon Carel pCOWeb ...)
NOT-FOR-US: Rittal Chiller SK 3232-Series
CVE-2019-13548 (CODESYS V3 web server, all versions prior to 3.5.14.10, allows an atta ...)
NOT-FOR-US: CODESYS
-CVE-2019-13547
- RESERVED
+CVE-2019-13547 (Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. There is an unsecu ...)
+ TODO: check
CVE-2019-13546 (In IntelliSpace Perinatal, Versions K and prior, a vulnerability withi ...)
NOT-FOR-US: IntelliSpace Perinatal
CVE-2019-13545 (In Horner Automation Cscape 9.90 and prior, improper validation of dat ...)
@@ -16391,8 +16394,8 @@ CVE-2019-13510 (Rockwell Automation Arena Simulation Software versions 16.00.00
CVE-2019-13509 (In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06. ...)
{DSA-4521-1}
- docker.io 18.09.1+dfsg1-8 (bug #932673)
-CVE-2019-13508
- RESERVED
+CVE-2019-13508 (FreeTDS through 1.1.11 has a Buffer Overflow. ...)
+ TODO: check
CVE-2019-13507 (hidea.com AZ Admin 1.0 has news_det.php?cod= SQL Injection. ...)
NOT-FOR-US: hidea.com AZ Admin
CVE-2019-13506 (@nuxt/devalue before 1.2.3, as used in Nuxt.js before 2.6.2, mishandle ...)
@@ -39616,10 +39619,10 @@ CVE-2019-5153
RESERVED
CVE-2019-5152
RESERVED
-CVE-2019-5151
- RESERVED
-CVE-2019-5150
- RESERVED
+CVE-2019-5151 (An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. A ...)
+ TODO: check
+CVE-2019-5150 (An exploitable SQL injection vulnerability exist in YouPHPTube 7.7. Wh ...)
+ TODO: check
CVE-2019-5149
RESERVED
CVE-2019-5148
@@ -39728,8 +39731,8 @@ CVE-2019-5097
RESERVED
CVE-2019-5096
RESERVED
-CVE-2019-5095
- RESERVED
+CVE-2019-5095 (An issue summary information disclosure vulnerability exists in Atlass ...)
+ TODO: check
CVE-2019-5094 (An exploitable code execution vulnerability exists in the quota file f ...)
{DSA-4535-1 DLA-1935-1}
- e2fsprogs 1.45.4-1 (bug #941139)
@@ -39876,8 +39879,8 @@ CVE-2019-5051 (An exploitable heap-based buffer overflow vulnerability exists wh
NOTE: https://hg.libsdl.org/SDL_image/rev/e7e9786a1a34
CVE-2019-5050 (A specifically crafted PDF file can lead to a heap corruption when ope ...)
NOT-FOR-US: NitroPDF
-CVE-2019-5049
- RESERVED
+CVE-2019-5049 (An exploitable memory corruption vulnerability exists in AMD ATIDXX64. ...)
+ TODO: check
CVE-2019-5048 (A specifically crafted PDF file can lead to a heap corruption when ope ...)
NOT-FOR-US: NitroPDF
CVE-2019-5047 (An exploitable Use After Free vulnerability exists in the CharProcs pa ...)
@@ -39888,8 +39891,8 @@ CVE-2019-5045 (A specifically crafted jpeg2000 file embedded in a PDF file can l
NOT-FOR-US: NitroPDF
CVE-2019-5044
REJECTED
-CVE-2019-5043
- RESERVED
+CVE-2019-5043 (An exploitable denial-of-service vulnerability exists in the Weave dae ...)
+ TODO: check
CVE-2019-5042 (An exploitable Use-After-Free vulnerability exists in the way Function ...)
NOT-FOR-US: Aspose
CVE-2019-5041 (An exploitable Stack Based Buffer Overflow vulnerability exists in the ...)
@@ -39914,8 +39917,8 @@ CVE-2019-5032 (An exploitable out-of-bounds read vulnerability exists in the Lab
NOT-FOR-US: Aspose
CVE-2019-5031 (An exploitable memory corruption vulnerability exists in the JavaScrip ...)
NOT-FOR-US: Foxit PDF Reader
-CVE-2019-5030
- RESERVED
+CVE-2019-5030 (A buffer overflow vulnerability exists in the PowerPoint document conv ...)
+ TODO: check
CVE-2019-5029
RESERVED
CVE-2019-5028
@@ -39928,8 +39931,8 @@ CVE-2019-5025
REJECTED
CVE-2019-5024 (A restricted environment escape vulnerability exists in the "kiosk mod ...)
NOT-FOR-US: Capsule Technologies SmartLinx Neuron
-CVE-2019-5023
- RESERVED
+CVE-2019-5023 (An exploitable vulnerability exists in the grsecurity PaX patch for th ...)
+ TODO: check
CVE-2019-5022
REJECTED
CVE-2019-5021 (Versions of the Official Alpine Linux Docker images (since v3.3) conta ...)
@@ -39963,8 +39966,7 @@ CVE-2019-5012 (An exploitable privilege escalation vulnerability exists in the W
NOT-FOR-US: Wacom MacOS driver
CVE-2019-5011 (An exploitable privilege escalation vulnerability exists in the helper ...)
NOT-FOR-US: CleanMyMac
-CVE-2019-5010 [NULL pointer dereference using a specially crafted X509 certificate]
- RESERVED
+CVE-2019-5010 (An exploitable denial-of-service vulnerability exists in the X509 cert ...)
{DLA-1834-1 DLA-1663-1}
- python3.7 3.7.2-2 (bug #921064)
- python3.6 <removed> (bug #921063)
@@ -96327,8 +96329,8 @@ CVE-2018-4066 (An exploitable cross-site request forgery vulnerability exists in
NOT-FOR-US: Sierra Wireless AirLink ES450 firmware
CVE-2018-4065 (An exploitable cross-site scripting vulnerability exists in the ACEMan ...)
NOT-FOR-US: Sierra Wireless AirLink ES450 firmware
-CVE-2018-4064
- RESERVED
+CVE-2018-4064 (An exploitable unverified password change vulnerability exists in the ...)
+ TODO: check
CVE-2018-4063 (An exploitable remote code execution vulnerability exists in the uploa ...)
NOT-FOR-US: Sierra Wireless AirLink ES450 firmware
CVE-2018-4062 (A hard-coded credentials vulnerability exists in the snmpd function of ...)
@@ -96396,8 +96398,8 @@ CVE-2018-4033 (The CleanMyMac X software contains an exploitable privilege escal
NOT-FOR-US: Clean My Mac X
CVE-2018-4032 (An exploitable privilege escalation vulnerability exists in the way th ...)
NOT-FOR-US: Clean My Mac X
-CVE-2018-4031
- RESERVED
+CVE-2018-4031 (An exploitable vulnerability exists in the safe browsing function of t ...)
+ TODO: check
CVE-2018-4030 (An exploitable vulnerability exists the safe browsing function of the ...)
NOT-FOR-US: CUJO Smart Firewall
CVE-2018-4029 (An exploitable code execution vulnerability exists in the HTTP request ...)
@@ -96461,8 +96463,8 @@ CVE-2018-4004 (An exploitable privilege escalation vulnerability exists in the S
NOT-FOR-US: Shimo VPN
CVE-2018-4003 (An exploitable heap overflow vulnerability exists in the mdnscap binar ...)
NOT-FOR-US: CUJO Smart Firewall
-CVE-2018-4002
- RESERVED
+CVE-2018-4002 (An exploitable denial-of-service vulnerability exists in the mdnscap b ...)
+ TODO: check
CVE-2018-4001 (An exploitable uninitialized pointer vulnerability exists in the Offic ...)
NOT-FOR-US: Atlantis Word Processor
CVE-2018-4000 (An exploitable double-free vulnerability exists in the Office Open XML ...)
@@ -96499,8 +96501,8 @@ CVE-2018-3985 (An exploitable double free vulnerability exists in the mdnscap bi
NOT-FOR-US: CUJO Smart Firewall
CVE-2018-3984 (An exploitable uninitialized length vulnerability exists within the Wo ...)
NOT-FOR-US: Atlantis Word Processor
-CVE-2018-3983
- RESERVED
+CVE-2018-3983 (An exploitable uninitialized pointer vulnerability exists in the Word ...)
+ TODO: check
CVE-2018-3982 (An exploitable arbitrary write vulnerability exists in the Word docume ...)
NOT-FOR-US: Atlantis Word Processor
CVE-2018-3981 (An exploitable out-of-bounds write exists in the TIFF-parsing function ...)
@@ -254842,8 +254844,7 @@ CVE-2013-2076 (Xen 4.0.x, 4.1.x, and 4.2.x, when running on AMD64 processors, on
- xen 4.2.2-1
[squeeze] - xen <end-of-life> (Unsupported in squeeze-lts)
NOTE: http://lists.xen.org/archives/html/xen-announce/2013-06/msg00002.html
-CVE-2013-2075
- RESERVED
+CVE-2013-2075 (Multiple buffer overflows in the (1) R5RS char-ready, (2) tcp-accept-r ...)
- chicken <not-affected> (Incomplete fix was never applied)
CVE-2013-2074 (kioslave/http/http.cpp in KIO in kdelibs 4.10.3 and earlier allows att ...)
{DLA-952-1}
@@ -255009,8 +255010,7 @@ CVE-2013-2026
REJECTED
CVE-2013-2025 (Cross-site scripting (XSS) vulnerability in Ushahidi Platform 2.5.x th ...)
NOT-FOR-US: Ushahidi
-CVE-2013-2024 [OS command injection vulnerability in Chicken Scheme]
- RESERVED
+CVE-2013-2024 (OS command injection vulnerability in the "qs" procedure from the "uti ...)
- chicken 4.8.0.3-1 (bug #706525)
[wheezy] - chicken <no-dsa> (Minor issue)
[squeeze] - chicken <no-dsa> (Minor issue)
@@ -255069,8 +255069,7 @@ CVE-2013-2013 (The user-password-update command in python-keystoneclient before
[wheezy] - python-keystoneclient 2012.1-3+deb7u1
NOTE: https://bugs.launchpad.net/python-keystoneclient/+bug/938315
NOTE: https://review.openstack.org/28702
-CVE-2013-2012 [autojump profile will load random stuff from a directory called custom_install]
- RESERVED
+CVE-2013-2012 (autojump before 21.5.8 allows local users to gain privileges via a Tro ...)
- autojump <not-affected> (vulnerable code not present for unstable)
NOTE: experimental affected as per 21.5.1-1, see #706252
NOTE: experimental fixed as 21.5.1-2
@@ -255267,8 +255266,7 @@ CVE-2013-1953 (Integer underflow in the input_bmp_reader function in input-bmp.c
CVE-2013-1952 (Xen 4.x, when using Intel VT-d for a bus mastering capable PCI device, ...)
{DSA-2666-1}
- xen 4.1.4-4
-CVE-2013-1951
- RESERVED
+CVE-2013-1951 (A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 ...)
- mediawiki 1:1.19.5-1
[squeeze] - mediawiki <end-of-life>
CVE-2013-1950 (The svc_dg_getargs function in libtirpc 0.2.3 and earlier allows remot ...)
@@ -255284,8 +255282,7 @@ CVE-2013-1947 (kelredd-pruview gem 0.3.8 for Ruby allows context-dependent attac
NOT-FOR-US: Ruby Gem kelredd-pruview
CVE-2013-1946 (The RESTful Web Services (RESTWS) module 7.x-1.x before 7.x-1.3 and 7. ...)
NOT-FOR-US: RESTful Web Services (RESTWS) Drupal cotributed module
-CVE-2013-1945
- RESERVED
+CVE-2013-1945 (ruby193 uses an insecure LD_LIBRARY_PATH setting. ...)
NOT-FOR-US: Red Hat specific packaging flaw of Ruby in Red Hat OpenShift Enterprise
CVE-2013-1944 (The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 d ...)
{DSA-2660-1}
@@ -261529,23 +261526,19 @@ CVE-2012-6127
REJECTED
CVE-2012-6126
REJECTED
-CVE-2012-6125
- RESERVED
+CVE-2012-6125 (Chicken before 4.8.0 is susceptible to algorithmic complexity attacks ...)
- chicken 4.8.0-1 (low; bug #702410)
[wheezy] - chicken <no-dsa> (Minor issue)
[squeeze] - chicken <no-dsa> (Minor issue)
-CVE-2012-6124
- RESERVED
+CVE-2012-6124 (A casting error in Chicken before 4.8.0 on 64-bit platform caused the ...)
- chicken 4.8.0-1 (low; bug #702410)
[wheezy] - chicken <no-dsa> (Minor issue)
[squeeze] - chicken <no-dsa> (Minor issue)
-CVE-2012-6123
- RESERVED
+CVE-2012-6123 (Chicken before 4.8.0 does not properly handle NUL bytes in certain str ...)
- chicken 4.8.0-1 (low; bug #702410)
[wheezy] - chicken <no-dsa> (Minor issue)
[squeeze] - chicken <no-dsa> (Minor issue)
-CVE-2012-6122
- RESERVED
+CVE-2012-6122 (Buffer overflow in the thread scheduler in Chicken before 4.8.0.1 allo ...)
- chicken 4.8.0.3-1 (low; bug #702410)
[wheezy] - chicken <no-dsa> (Minor issue)
[squeeze] - chicken <no-dsa> (Minor issue)
@@ -298105,8 +298098,7 @@ CVE-2010-2784 (The subpage MMIO initialization functionality in the subpage_regi
- qemu-kvm 0.12.5+dfsg-3 (bug #594478)
- kvm <removed>
[lenny] - kvm 72+dfsg-5~lenny6
-CVE-2010-2783
- RESERVED
+CVE-2010-2783 (IcedTea6 before 1.7.4 allow unsigned apps to read and write arbitrary ...)
- openjdk-6 6b18-1.8.1-1
CVE-2009-4957 (Directory traversal vulnerability in loadpanel.php in Interspire Activ ...)
NOT-FOR-US: Interspire ActiveKB
@@ -298835,8 +298827,7 @@ CVE-2010-2550 (The SMB Server in Microsoft Windows XP SP2 and SP3, Windows Serve
NOT-FOR-US: Microsoft
CVE-2010-2549 (Use-after-free vulnerability in the kernel-mode drivers in Microsoft W ...)
NOT-FOR-US: Microsoft
-CVE-2010-2548
- RESERVED
+CVE-2010-2548 (IcedTea6 before 1.7.4 does not properly check property access, which a ...)
- openjdk-6 6b18-1.8.1-1
CVE-2010-2547 (Use-after-free vulnerability in kbx/keybox-blob.c in GPGSM in GnuPG 2. ...)
{DSA-2076-1}
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/57e21f6b626d8371a9ce2e966dde854218274943
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/57e21f6b626d8371a9ce2e966dde854218274943
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20191101/bba57719/attachment.html>
More information about the debian-security-tracker-commits
mailing list