[Git][security-tracker-team/security-tracker][master] 5 commits: add gupnp

[Thorsten Alteholz]

Thorsten Alteholz pushed to branch master at Debian Security Tracker / security-tracker


Commits:
dc05c308 by Thorsten Alteholz at 2020-06-28T17:22:18+02:00
add gupnp

- - - - -
dbe05ae3 by Thorsten Alteholz at 2020-06-28T17:25:44+02:00
mark three CVEs of openexr as no-dsa

- - - - -
c4e63057 by Thorsten Alteholz at 2020-06-28T17:26:48+02:00
add tomcat8

- - - - -
3da4b44d by Thorsten Alteholz at 2020-06-28T17:30:33+02:00
add shiro

- - - - -
816c1084 by Thorsten Alteholz at 2020-06-28T17:32:08+02:00
mark several CVEs of pillow as no-dsa for Jessie

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -118,12 +118,15 @@ CVE-2020-15307
 	RESERVED
 CVE-2020-15306 (An issue was discovered in OpenEXR before v2.5.2. Invalid chunkCount a ...)
 	- openexr <unfixed>
+	[jessie] - openexr <no-dsa> (Minor issue)
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/738
 CVE-2020-15305 (An issue was discovered in OpenEXR before 2.5.2. Invalid input could c ...)
 	- openexr <unfixed>
+	[jessie] - openexr <no-dsa> (Minor issue)
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/730
 CVE-2020-15304 (An issue was discovered in OpenEXR before 2.5.2. An invalid tiled inpu ...)
 	- openexr <unfixed>
+	[jessie] - openexr <no-dsa> (Minor issue)
 	NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/727
 CVE-2020-15303
 	RESERVED
@@ -10471,6 +10474,7 @@ CVE-2020-11539 (An issue was discovered on Tata Sonata Smart SF Rush 1.12 device
 	NOT-FOR-US: Tata Sonata Smart SF Rush 1.12 devices
 CVE-2020-11538 (In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out- ...)
 	- pillow <unfixed>
+	[jessie] - pillow <no-dsa> (Minor issue)
 	NOTE: https://github.com/python-pillow/Pillow/pull/4504
 	NOTE: https://github.com/python-pillow/Pillow/pull/4538
 	NOTE: Fixed in 7.1.0
@@ -11874,6 +11878,7 @@ CVE-2020-10995 (PowerDNS Recursor from 4.1.0 up to and including 4.3.0 does not
 	NOTE: https://www.openwall.com/lists/oss-security/2020/05/19/3
 CVE-2020-10994 (In libImaging/Jpeg2KDecode.c in Pillow before 7.0.0, there are multipl ...)
 	- pillow <unfixed>
+	[jessie] - pillow <no-dsa> (Minor issue)
 	NOTE: https://github.com/python-pillow/Pillow/pull/4505
 	NOTE: https://github.com/python-pillow/Pillow/pull/4538
 	NOTE: Fixed in 7.1.0
@@ -13772,10 +13777,12 @@ CVE-2020-10380 (RMySQL through 0.10.19 allows SQL Injection. ...)
 	NOTE: Test: https://github.com/r-dbi/RMySQL/commit/6137ce887c1e36b278f11656a9a9fc1cae6a5f40
 CVE-2020-10379 (In Pillow before 6.2.3 and 7.x before 7.0.1, there are two Buffer Over ...)
 	- pillow <unfixed>
+	[jessie] - pillow <no-dsa> (Minor issue)
 	NOTE: https://github.com/python-pillow/Pillow/pull/4538
 	NOTE: Fixed in 6.2.3 and 7.1.0
 CVE-2020-10378 (In libImaging/PcxDecode.c in Pillow before 6.2.3 and 7.x before 7.0.1, ...)
 	- pillow <unfixed>
+	[jessie] - pillow <no-dsa> (Minor issue)
 	NOTE: https://github.com/python-pillow/Pillow/pull/4538
 	NOTE: Fixed in 6.2.3 and 7.1.0
 CVE-2020-10377 (A weak encryption vulnerability in Mitel MiVoice Connect Client before ...)
@@ -14241,6 +14248,7 @@ CVE-2020-10178
 	REJECTED
 CVE-2020-10177 (Pillow before 6.2.3 and 7.x before 7.0.1 has multiple out-of-bounds re ...)
 	- pillow <unfixed>
+	[jessie] - pillow <no-dsa> (Minor issue)
 	NOTE: https://github.com/python-pillow/Pillow/pull/4503
 	NOTE: https://github.com/python-pillow/Pillow/pull/4538
 	NOTE: Fixed in 6.2.3 and 7.1.0


=====================================
data/dla-needed.txt
=====================================
@@ -51,6 +51,8 @@ freerdp
 --
 glib-networking
 --
+gupnp
+--
 imagemagick (Markus Koschany)
   NOTE: 20200622: Ongoing work
 --
@@ -119,6 +121,8 @@ rails (Sylvain Beucler)
 ruby-rack
   NOTE: probably not affected (parse_cookies_header() is not available in Jessie, but code might hide somewhere else) (thorsten)
 --
+shiro
+--
 sqlite3 (Abhijith PA)
   NOTE: 20200620: WIP (abhijith)
 --
@@ -140,6 +144,8 @@ sympa
   NOTE: 20200604: the non-public patch is being discussed internally. (utkarsh)
   NOTE: 20200604: shall process the upload once the confirmation is given. (utkarsh)
 --
+tomcat8
+--
 tzdata
   NOTE: 20200514: LTS update must wait on oldstable update first (via point release) to prevent newer version in LTS (roberto)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e87981c831d55f748ec99db9e691211c076f6359...816c1084a77d04c3faa99e70302383518de5a339

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/e87981c831d55f748ec99db9e691211c076f6359...816c1084a77d04c3faa99e70302383518de5a339
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200628/dc3a34ae/attachment-0001.html>