[Git][security-tracker-team/security-tracker][master] NFUs

Wed Jan 22 22:54:47 GMT 2020


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d51e2549 by Moritz Muehlenhoff at 2020-01-22T23:54:21+01:00
NFUs
bugs for roundcube, libstb

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1345,7 +1345,7 @@ CVE-2019-20386 (An issue was discovered in button_open in login/logind-button.c
 CVE-2019-20385 (The CSV upload feature in /supervisor/procesa_carga.php on Logaritmo A ...)
 	NOT-FOR-US: Logaritmo Aware CallManager 2012 devices
 CVE-2019-20384 (Gentoo Portage through 2.3.84 allows local users to place a Trojan hor ...)
-	TODO: check
+	NOT-FOR-US: Portage
 CVE-2019-20383
 	RESERVED
 CVE-2019-20382
@@ -1369,13 +1369,13 @@ CVE-2020-7232 (Evoko Home 1.31 devices allow remote attackers to obtain sensitiv
 CVE-2020-7231 (Evoko Home 1.31 devices provide different error messages for failed lo ...)
 	NOT-FOR-US: Evoko Home devices
 CVE-2019-20381 (TestLink before 1.9.20 allows XSS via non-lowercase javascript: in the ...)
-	TODO: check
+	NOT-FOR-US: TestLink
 CVE-2016-11018 (An issue was discovered in the Huge-IT gallery-images plugin before 1. ...)
 	NOT-FOR-US: Huge-IT gallery-images plugin for WordPress
 CVE-2020-7230
 	RESERVED
 CVE-2020-7229 (An issue was discovered in Simplejobscript.com SJS before 1.65. There  ...)
-	TODO: check
+	NOT-FOR-US: Simplejobscript.com SJS
 CVE-2020-7228 (The Calculated Fields Form plugin through 1.0.353 for WordPress suffer ...)
 	NOT-FOR-US: Calculated Fields Form plugin for WordPress
 CVE-2020-7227 (Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosur ...)
@@ -1407,7 +1407,7 @@ CVE-2020-7215 (An issue was discovered in Gallagher Command Centre 7.x before 7.
 CVE-2020-7214
 	RESERVED
 CVE-2020-7213 (Parallels 13 uses cleartext HTTP as part of the update process, allowi ...)
-	TODO: check
+	NOT-FOR-US: Parallels
 CVE-2020-7212
 	RESERVED
 CVE-2020-7211 (tftp.c in libslirp 4.1.0, as used in QEMU 4.2.0, does not prevent ..\  ...)
@@ -2691,7 +2691,7 @@ CVE-2020-6624 (jhead through 3.04 has a heap-based buffer over-read in process_D
 	NOTE: https://bugs.launchpad.net/ubuntu/+source/jhead/+bug/1858744
 	NOTE: Crash in CLI tool, no security impact
 CVE-2020-6623 (stb stb_truetype.h through 1.22 has an assertion failure in stbtt__cff ...)
-	- libstb <unfixed> (low)
+	- libstb <unfixed> (low; bug #949560)
 	[buster] - libstb <no-dsa> (Minor issue)
 	NOTE: https://github.com/nothings/stb/issues/865
 	NOTE: Potentially affects mame, embree, libtcod, sumo, goxel, mesa, godot, dart
@@ -13085,9 +13085,8 @@ CVE-2019-19603 (SQLite 3.30.1 mishandles certain SELECT statements with a nonexi
 	[stretch] - sqlite3 <no-dsa> (Minor issue)
 	NOTE: https://github.com/sqlite/sqlite/commit/527cbd4a104cb93bf3994b3dd3619a6299a78b13
 CVE-2019-19601 (OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of ...)
-	- texlive-bin <undetermined>
+	- texlive-bin <unfixed> (bug #949630)
 	NOTE: https://github.com/pkubowicz/opendetex/issues/60
-	TODO: check affected, detex is embedded in src:texlive-bin but unclear which versions affected.
 CVE-2019-19600
 	RESERVED
 CVE-2019-19599
@@ -20065,7 +20064,7 @@ CVE-2019-18428
 CVE-2019-18427
 	RESERVED
 CVE-2019-18426 (A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when pa ...)
-	TODO: check
+	NOT-FOR-US: WhatsApp Desktop
 CVE-2019-18425 (An issue was discovered in Xen through 4.12.x allowing 32-bit PV guest ...)
 	{DSA-4602-1}
 	- xen 4.11.3+24-g14b62ab3e5-1 (bug #947944)
@@ -22732,9 +22731,9 @@ CVE-2019-17637
 CVE-2019-17636
 	RESERVED
 CVE-2019-17635 (Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a dese ...)
-	TODO: check
+	NOT-FOR-US: Eclipse Memory Analyzer
 CVE-2019-17634 (Eclipse Memory Analyzer version 1.9.1 and earlier is subject to a cros ...)
-	TODO: check
+	NOT-FOR-US: Eclipse Memory Analyzer
 CVE-2019-17633 (For Eclipse Che versions 6.16 to 7.3.0, with both authentication and T ...)
 	NOT-FOR-US: Eclipse Che
 CVE-2019-17632 (In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4. ...)
@@ -29608,7 +29607,7 @@ CVE-2019-15239 (In the Linux kernel, a certain net/ipv4/tcp_output.c change, whi
 CVE-2019-15238 (The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the ...)
 	NOT-FOR-US: Wordpress plugin
 CVE-2019-15237 (Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, ...)
-	- roundcube <unfixed> (low)
+	- roundcube <unfixed> (low; bug #949629)
 	[buster] - roundcube <no-dsa> (Minor issue)
 	[stretch] - roundcube <no-dsa> (Minor issue)
 	NOTE: https://github.com/roundcube/roundcubemail/issues/6891



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/d51e25494da963f8543ce92d6666923f79af8e70

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/d51e25494da963f8543ce92d6666923f79af8e70
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200122/ba2f489a/attachment.html>
