[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso
carnil at debian.org
Mon Jan 4 08:10:22 GMT 2021
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c3ecf5d9 by security tracker role at 2021-01-04T08:10:14+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,11 @@
+CVE-2021-3007 (Zend Framework 3.0.0 has a deserialization vulnerability that can lead ...)
+ TODO: check
+CVE-2021-21495 (MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the ce ...)
+ TODO: check
+CVE-2021-21494 (MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo ...)
+ TODO: check
+CVE-2020-35965 (decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds ...)
+ TODO: check
CVE-2020-35964 (track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bo ...)
- ffmpeg <unfixed>
NOTE: https://github.com/FFmpeg/FFmpeg/commit/27a99e2c7d450fef15594671eef4465c8a166bd7
@@ -7468,14 +7476,14 @@ CVE-2020-29363 (An issue was discovered in p11-kit 0.23.6 through 0.23.21. A hea
NOTE: https://github.com/p11-glue/p11-kit/commit/2617f3ef888e103324a28811886b99ed0a56346d (0.23.22)
NOTE: Introduced in https://github.com/p11-glue/p11-kit/commit/ba49b85ecf280e7fb6eec96c3ef33c50122e75a6 (0.23.6)
CVE-2020-29362 (An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-base ...)
- {DSA-4822-1}
+ {DSA-4822-1 DLA-2513-1}
- p11-kit 0.23.22-1
NOTE: https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html
NOTE: https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc
NOTE: https://github.com/p11-glue/p11-kit/commit/bda2f543ff8e0195c90e849379ef1585d00677bc (0.23.22)
NOTE: Introduced in https://github.com/p11-glue/p11-kit/commit/c785ab66890ad7b73c556d6afdf2bb8a32dd50e2 (0.21.1)
CVE-2020-29361 (An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple in ...)
- {DSA-4822-1}
+ {DSA-4822-1 DLA-2513-1}
- p11-kit 0.23.22-1
NOTE: https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html
NOTE: https://github.com/p11-glue/p11-kit/security/advisories/GHSA-q4r3-hm6m-mvc2
@@ -19381,6 +19389,7 @@ CVE-2020-25639 [NULL pointer dereference via nouveau ioctl can lead to DoS]
[stretch] - linux <not-affected> (Vulnerable code introduced later)
NOTE: https://lists.freedesktop.org/archives/nouveau/2020-August/036682.html
CVE-2020-25638 (A flaw was found in hibernate-core in versions prior to and including ...)
+ {DLA-2512-1}
- libhibernate3-java 3.6.10.Final-11
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1881353
NOTE: Fixed by https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78
@@ -84889,6 +84898,7 @@ CVE-2019-18193 (In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0
CVE-2020-0500 (In startInputUncheckedLocked of InputMethodManager.java, there is a po ...)
NOT-FOR-US: Android
CVE-2020-0499 (In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a p ...)
+ {DLA-2514-1}
- flac 1.3.3-2 (bug #977764)
[buster] - flac <no-dsa> (Minor issue)
NOTE: https://github.com/xiph/flac/commit/2e7931c27eb15e387da440a37f12437e35b22dd4
@@ -225801,6 +225811,7 @@ CVE-2017-6890 (A boundary error within the "foveon_load_camf()" function (dcraw_
CVE-2017-6889 (An integer overflow error within the "foveon_load_camf()" function (dc ...)
NOT-FOR-US: libraw demosaic extension (not packaged in Debian)
CVE-2017-6888 (An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC ...)
+ {DLA-2514-1}
- flac 1.3.2-2 (low; bug #897015)
[jessie] - flac <no-dsa> (Minor issue)
[wheezy] - flac <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c3ecf5d95650e80a53ad37926226760a6da6fa1b
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c3ecf5d95650e80a53ad37926226760a6da6fa1b
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210104/865fcb1e/attachment.html>
More information about the debian-security-tracker-commits
mailing list