[Git][security-tracker-team/security-tracker][master] Add CVE-2020-7040/storebackup

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
61cdcd7d by Salvatore Bonaccorso at 2020-01-20T17:21:53+01:00
Add CVE-2020-7040/storebackup

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -424,8 +424,12 @@ CVE-2020-7042
 	RESERVED
 CVE-2020-7041
 	RESERVED
-CVE-2020-7040
+CVE-2020-7040 [storeBackup: denial of service and symlink attack vector via fixed lockfile path /tmp/storeBackup.lock]
 	RESERVED
+	- storebackup <unfixed>
+	NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1156767
+	NOTE: https://www.openwall.com/lists/oss-security/2020/01/20/3
+	NOTE: SuSE provided patch: https://www.openwall.com/lists/oss-security/2020/01/20/3/1
 CVE-2020-7039 (tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, misman ...)
 	- libslirp 4.1.0-2 (bug #949084)
 	- qemu 1:4.1-2



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/61cdcd7dca1e1f69e76559aac333d02411f4581e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/61cdcd7dca1e1f69e76559aac333d02411f4581e
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200120/a3096b8d/attachment.html>