[Git][security-tracker-team/security-tracker][master] buster/stretch triage
Moritz Muehlenhoff
jmm at debian.org
Wed May 27 21:37:21 BST 2020
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c2e9bdff by Moritz Muehlenhoff at 2020-05-27T22:36:54+02:00
buster/stretch triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -50,6 +50,8 @@ CVE-2020-13615 (lib/QoreSocket.cpp in Qore before 0.9.4.2 lacks hostname verific
NOT-FOR-US: Qore
CVE-2020-13614 (An issue was discovered in ssl.c in Axel before 2.17.8. The TLS implem ...)
- axel 2.17.8-1
+ [buster] - axel <no-dsa> (Minor issue)
+ [stretch] - axel <no-dsa> (Minor issue)
NOTE: https://github.com/axel-download-accelerator/axel/issues/262
CVE-2020-13613
RESERVED
@@ -5165,7 +5167,7 @@ CVE-2020-11763 (An issue was discovered in OpenEXR before 2.4.1. There is an std
- openexr <unfixed> (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
- TODO: check fixing commit
+ NOTE: https://github.com/AcademySoftwareFoundation/openexr/pull/643/commits/d0303d1785d2a8cb994efee9efa81f8ee4be4c17
CVE-2020-11762 (An issue was discovered in OpenEXR before 2.4.1. There is an out-of-bo ...)
[experimental] - openexr 2.5.0-1
- openexr <unfixed> (bug #959444)
@@ -5198,7 +5200,7 @@ CVE-2020-11758 (An issue was discovered in OpenEXR before 2.4.1. There is an out
- openexr <unfixed> (bug #959444)
[jessie] - openexr <no-dsa> (Minor issue)
NOTE: https://bugs.chromium.org/p/project-zero/issues/detail?id=1987
- TODO: check isolated commit to fix issue
+ NOTE: https://github.com/AcademySoftwareFoundation/openexr/commit/7a52d40ae23c148f27116cb1f6e897b9143b372c
CVE-2020-11757
RESERVED
CVE-2020-11756
@@ -5475,6 +5477,7 @@ CVE-2020-11654
RESERVED
CVE-2020-11653 (An issue was discovered in Varnish Cache before 6.0.6 LTS, 6.1.x and 6 ...)
- varnish 6.4.0-1 (bug #956307)
+ [buster] - varnish <postponed> (Can be fixed along in next DSA)
[stretch] - varnish <not-affected> (Only affects 6.x)
[jessie] - varnish <not-affected> (Only affects 6.x)
NOTE: https://varnish-cache.org/security/VSV00005.html#vsv00005
@@ -6076,33 +6079,45 @@ CVE-2020-11527 (In Zoho ManageEngine OpManager before 12.4.181, an unauthenticat
NOT-FOR-US: Zoho
CVE-2020-11526 (libfreerdp/core/update.c in FreeRDP versions > 1.1 through 2.0.0-rc ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-97jw-m5w5-xvf9
NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/192856cb59974ee4d7d3e72cbeafa676aa7565cf
NOTE: https://github.com/FreeRDP/FreeRDP/issues/6012
CVE-2020-11525 (libfreerdp/cache/bitmap.c in FreeRDP versions > 1.0 through 2.0.0-r ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9755-fphh-gmjg
NOTE: https://github.com/FreeRDP/FreeRDP/commit/0b6b92a25a77d533b8a92d6acc840a81e103684e
CVE-2020-11524 (libfreerdp/codec/interleaved.c in FreeRDP versions > 1.0 through 2. ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgw8-3mp2-p5qw
NOTE: https://github.com/FreeRDP/FreeRDP/commit/7b1d4b49391b4512402840431757703a96946820
CVE-2020-11523 (libfreerdp/gdi/region.c in FreeRDP versions > 1.0 through 2.0.0-rc4 ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4qrh-8cp8-4x42
NOTE: https://github.com/FreeRDP/FreeRDP/commit/ce21b9d7ecd967e0bc98ed31a6b3757848aa6c9e
CVE-2020-11522 (libfreerdp/gdi/gdi.c in FreeRDP > 1.0 through 2.0.0-rc4 has an Out- ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-48wx-7vgj-fffh
NOTE: https://github.com/FreeRDP/FreeRDP/commit/907640a924fa7a9a99c80a48ac225e9d8e41548b
CVE-2020-11521 (libfreerdp/codec/planar.c in FreeRDP version > 1.0 through 2.0.0-rc ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5cwc-6wc9-255w
NOTE: https://github.com/FreeRDP/FreeRDP/commit/17f547ae11835bb11baa3d045245dc1694866845
CVE-2020-11520
@@ -7095,7 +7110,9 @@ CVE-2020-11059
RESERVED
CVE-2020-11058 (In FreeRDP after 1.1 and before 2.0.0, a stream out-of-bounds seek in ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wjg2-2f82-466g
NOTE: https://github.com/FreeRDP/FreeRDP/commit/3627aaf7d289315b614a584afb388f04abfb5bbf
NOTE: https://github.com/FreeRDP/FreeRDP/issues/6011
@@ -7120,25 +7137,33 @@ CVE-2020-11050 (In Java-WebSocket less than or equal to 1.4.1, there is an Impro
NOT-FOR-US: Java-WebSocket, different from src:websocket-api
CVE-2020-11049 (In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bound read o ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wwh7-r2r8-xjpr
NOTE: Fixed with: https://github.com/FreeRDP/FreeRDP/pull/6019
NOTE: https://github.com/FreeRDP/FreeRDP/issues/6008
CVE-2020-11048 (In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hv8w-f2hx-5gcv
NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/9301bfe730c66180263248b74353daa99f5a969b
NOTE: https://github.com/FreeRDP/FreeRDP/issues/6007
CVE-2020-11047 (In FreeRDP after 1.1 and before 2.0.0, there is an out-of-bounds read ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9fw6-m2q8-h5pw
NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/f5e73cc7c9cd973b516a618da877c87b80950b65
NOTE: https://github.com/FreeRDP/FreeRDP/issues/6009
CVE-2020-11046 (In FreeRDP after 1.0 and before 2.0.0, there is a stream out-of-bounds ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hx48-wmmm-mr5q
NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/ed53cd148f43cbab905eaa0f5308c2bf3c48cc37
NOTE: https://github.com/FreeRDP/FreeRDP/issues/6006
@@ -7150,6 +7175,7 @@ CVE-2020-11045 (In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bound
NOTE: https://github.com/FreeRDP/FreeRDP/issues/6005
CVE-2020-11044 (In FreeRDP greater than 1.2 and before 2.0.0, a double free in update_ ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cgqh-p732-6x2w
NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/67c2aa52b2ae0341d469071d1bc8aab91f8d2ed8
@@ -7158,7 +7184,9 @@ CVE-2020-11043
RESERVED
CVE-2020-11042 (In FreeRDP greater than 1.1 and before 2.0.0, there is an out-of-bound ...)
- freerdp2 <unfixed>
+ [buster] - freerdp2 <no-dsa> (Minor issue)
- freerdp <removed>
+ [stretch] - freerdp <no-dsa> (Minor issue)
NOTE: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9jp6-5vf2-cx2q
NOTE: Fixed by: https://github.com/FreeRDP/FreeRDP/commit/6b2bc41935e53b0034fe5948aeeab4f32e80f30f
NOTE: https://github.com/FreeRDP/FreeRDP/issues/6010
@@ -29960,9 +29988,9 @@ CVE-2020-2027
CVE-2020-2026
RESERVED
CVE-2020-2025 (Kata Containers before 1.11.0 on Cloud Hypervisor persists guest files ...)
- TODO: check
+ NOT-FOR-US: Kata Containers
CVE-2020-2024 (An improper link resolution vulnerability affects Kata Containers vers ...)
- TODO: check
+ NOT-FOR-US: Kata Containers
CVE-2020-2023
RESERVED
CVE-2020-2022
@@ -30577,7 +30605,7 @@ CVE-2020-1899
CVE-2020-1898
RESERVED
CVE-2020-1897 (A use-after-free is possible due to an error in lifetime management in ...)
- TODO: check
+ NOT-FOR-US: Facebook Proxygen
CVE-2020-1896
RESERVED
CVE-2020-1895 (A large heap overflow could occur in Instagram for Android when attemp ...)
@@ -32935,7 +32963,8 @@ CVE-2019-18862 (maidag in GNU Mailutils before 3.8 is installed setuid and allow
CVE-2019-18861
RESERVED
CVE-2019-18860 (Squid before 4.9, when certain web browsers are used, mishandles HTML ...)
- - squid 4.9-1
+ - squid 4.9-1 (low)
+ [buster] - squid <no-dsa> (Minor issue)
- squid3 <removed>
NOTE: https://github.com/squid-cache/squid/pull/504
NOTE: https://github.com/squid-cache/squid/commit/5cc4b155cee1a4968109737f6eba2ef29d51034d (SQUID_5_0_1)
@@ -47589,13 +47618,13 @@ CVE-2019-14877 (In the __mdiff function of the newlib libc library, all versions
[stretch] - newlib <no-dsa> (Minor issue)
[jessie] - newlib <ignored> (Minor issue)
NOTE: https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
- TODO: picolibc might be affected, not yet in the archive
+ TODO: picolibc might be affected
CVE-2019-14876 (In the __lshift function of the newlib libc library, all versions prio ...)
- newlib 3.3.0-1
[buster] - newlib <no-dsa> (Minor issue)
[stretch] - newlib <no-dsa> (Minor issue)
[jessie] - newlib <ignored> (Minor issue)
- - picolibc <unfixed> (low)
+ - picolibc <unfixed> (unimportant)
NOTE: https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
CVE-2019-14875 (In the __multiply function of the newlib libc library, all versions pr ...)
- newlib 3.3.0-1
@@ -47609,7 +47638,7 @@ CVE-2019-14874 (In the __i2b function of the newlib libc library, all versions p
[buster] - newlib <no-dsa> (Minor issue)
[stretch] - newlib <no-dsa> (Minor issue)
[jessie] - newlib <ignored> (Minor issue)
- - picolibc <unfixed> (low)
+ - picolibc <unfixed> (unimportant)
NOTE: https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
CVE-2019-14873 (In the __multadd function of the newlib libc library, prior to version ...)
- newlib 3.3.0-1
@@ -47617,21 +47646,21 @@ CVE-2019-14873 (In the __multadd function of the newlib libc library, prior to v
[stretch] - newlib <no-dsa> (Minor issue)
[jessie] - newlib <ignored> (Minor issue)
NOTE: https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
- TODO: picolibc might be affected, not yet in the archive
+ TODO: picolibc might be affected
CVE-2019-14872 (The _dtoa_r function of the newlib libc library, prior to version 3.3. ...)
- newlib 3.3.0-1
[buster] - newlib <no-dsa> (Minor issue)
[stretch] - newlib <no-dsa> (Minor issue)
[jessie] - newlib <ignored> (Minor issue)
NOTE: https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
- TODO: picolibc might be affected, not yet in the archive
+ TODO: picolibc might be affected
CVE-2019-14871 (The REENT_CHECK macro (see newlib/libc/include/sys/reent.h) as used by ...)
- newlib 3.3.0-1
[buster] - newlib <no-dsa> (Minor issue)
[stretch] - newlib <no-dsa> (Minor issue)
[jessie] - newlib <ignored> (Minor issue)
NOTE: https://census-labs.com/news/2020/01/31/multiple-null-pointer-dereference-vulnerabilities-in-newlib/
- TODO: picolibc might be affected, not yet in the archive
+ TODO: picolibc might be affected
CVE-2019-14870 (All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11 ...)
- samba 2:4.11.3+dfsg-1
[buster] - samba <no-dsa> (Minor issue)
@@ -62870,6 +62899,7 @@ CVE-2019-10065 (An issue was discovered in Open Ticket Request System (OTRS) 7.0
CVE-2019-10064 (hostapd before 2.6, in EAP mode, makes calls to the rand() and random( ...)
{DLA-2138-1}
- wpa 2:2.6-7
+ [stretch] - wpa <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2020/02/27/1
NOTE: Comment from upstream: https://www.openwall.com/lists/oss-security/2020/02/27/2
NOTE: Issue fixed in conjunction with CVE-2016-10743.
@@ -70607,6 +70637,7 @@ CVE-2019-7548 (SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter c
{DLA-1718-1}
[experimental] - sqlalchemy 1.3.0~b3+ds1-1
- sqlalchemy 1.2.18+ds1-2 (bug #922669)
+ [stretch] - sqlalchemy <no-dsa> (Minor issue)
NOTE: https://github.com/sqlalchemy/sqlalchemy/issues/4481
NOTE: https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
CVE-2019-7547 (An issue was discovered in SIDU 6.0. Because the database name is not ...)
@@ -71685,6 +71716,7 @@ CVE-2019-7164 (SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL In
{DLA-1718-1}
[experimental] - sqlalchemy 1.3.0~b3+ds1-1
- sqlalchemy 1.2.18+ds1-2 (bug #922669)
+ [stretch] - sqlalchemy <no-dsa> (Minor issue)
NOTE: https://github.com/sqlalchemy/sqlalchemy/issues/4481
NOTE: https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
CVE-2019-7163 (The web interface of Alcatel LINKZONE MW40-V-V1.0 MW40_LU_02.00_02 dev ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c2e9bdff2314441ad8dcd1c3f5c0d53ec908709a
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c2e9bdff2314441ad8dcd1c3f5c0d53ec908709a
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20200527/b799e8ea/attachment-0001.html>
More information about the debian-security-tracker-commits
mailing list