[Git][security-tracker-team/security-tracker][master] automatic update

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
c3ecf5d9 by security tracker role at 2021-01-04T08:10:14+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,11 @@
+CVE-2021-3007 (Zend Framework 3.0.0 has a deserialization vulnerability that can lead ...)
+	TODO: check
+CVE-2021-21495 (MK-AUTH through 19.01 K4.9 allows CSRF for password changes via the ce ...)
+	TODO: check
+CVE-2021-21494 (MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo ...)
+	TODO: check
+CVE-2020-35965 (decode_frame in libavcodec/exr.c in FFmpeg 4.3.1 has an out-of-bounds  ...)
+	TODO: check
 CVE-2020-35964 (track_header in libavformat/vividas.c in FFmpeg 4.3.1 has an out-of-bo ...)
 	- ffmpeg <unfixed>
 	NOTE: https://github.com/FFmpeg/FFmpeg/commit/27a99e2c7d450fef15594671eef4465c8a166bd7
@@ -7468,14 +7476,14 @@ CVE-2020-29363 (An issue was discovered in p11-kit 0.23.6 through 0.23.21. A hea
 	NOTE: https://github.com/p11-glue/p11-kit/commit/2617f3ef888e103324a28811886b99ed0a56346d (0.23.22)
 	NOTE: Introduced in https://github.com/p11-glue/p11-kit/commit/ba49b85ecf280e7fb6eec96c3ef33c50122e75a6 (0.23.6)
 CVE-2020-29362 (An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-base ...)
-	{DSA-4822-1}
+	{DSA-4822-1 DLA-2513-1}
 	- p11-kit 0.23.22-1
 	NOTE: https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html
 	NOTE: https://github.com/p11-glue/p11-kit/security/advisories/GHSA-5wpq-43j2-6qwc
 	NOTE: https://github.com/p11-glue/p11-kit/commit/bda2f543ff8e0195c90e849379ef1585d00677bc (0.23.22)
 	NOTE: Introduced in https://github.com/p11-glue/p11-kit/commit/c785ab66890ad7b73c556d6afdf2bb8a32dd50e2 (0.21.1)
 CVE-2020-29361 (An issue was discovered in p11-kit 0.21.1 through 0.23.21. Multiple in ...)
-	{DSA-4822-1}
+	{DSA-4822-1 DLA-2513-1}
 	- p11-kit 0.23.22-1
 	NOTE: https://lists.freedesktop.org/archives/p11-glue/2020-December/000712.html
 	NOTE: https://github.com/p11-glue/p11-kit/security/advisories/GHSA-q4r3-hm6m-mvc2
@@ -19381,6 +19389,7 @@ CVE-2020-25639 [NULL pointer dereference via nouveau ioctl can lead to DoS]
 	[stretch] - linux <not-affected> (Vulnerable code introduced later)
 	NOTE: https://lists.freedesktop.org/archives/nouveau/2020-August/036682.html
 CVE-2020-25638 (A flaw was found in hibernate-core in versions prior to and including  ...)
+	{DLA-2512-1}
 	- libhibernate3-java 3.6.10.Final-11
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1881353
 	NOTE: Fixed by https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78
@@ -84889,6 +84898,7 @@ CVE-2019-18193 (In Unisys Stealth (core) 3.4.108.0, 3.4.209.x, 4.0.027.x and 4.0
 CVE-2020-0500 (In startInputUncheckedLocked of InputMethodManager.java, there is a po ...)
 	NOT-FOR-US: Android
 CVE-2020-0499 (In FLAC__bitreader_read_rice_signed_block of bitreader.c, there is a p ...)
+	{DLA-2514-1}
 	- flac 1.3.3-2 (bug #977764)
 	[buster] - flac <no-dsa> (Minor issue)
 	NOTE: https://github.com/xiph/flac/commit/2e7931c27eb15e387da440a37f12437e35b22dd4
@@ -225801,6 +225811,7 @@ CVE-2017-6890 (A boundary error within the "foveon_load_camf()" function (dcraw_
 CVE-2017-6889 (An integer overflow error within the "foveon_load_camf()" function (dc ...)
 	NOT-FOR-US: libraw demosaic extension (not packaged in Debian)
 CVE-2017-6888 (An error in the "read_metadata_vorbiscomment_()" function (src/libFLAC ...)
+	{DLA-2514-1}
 	- flac 1.3.2-2 (low; bug #897015)
 	[jessie] - flac <no-dsa> (Minor issue)
 	[wheezy] - flac <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c3ecf5d95650e80a53ad37926226760a6da6fa1b

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c3ecf5d95650e80a53ad37926226760a6da6fa1b
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210104/865fcb1e/attachment.html>