[Git][security-tracker-team/security-tracker][master] buster triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
85f26675 by Moritz Muehlenhoff at 2021-07-23T11:57:48+02:00
buster triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1332,8 +1332,10 @@ CVE-2021-36775
 CVE-2021-3653
 	RESERVED
 CVE-2020-36427 (GNOME gThumb before 3.10.1 allows an application crash via a malformed ...)
-	- gthumb 3:3.11.1-0.1
+	- gthumb 3:3.11.1-0.1 (unimportant)
 	NOTE: https://mail.gnome.org/archives/gthumb-list/2020-September/msg00001.html
+	NOTE: https://github.com/GNOME/gthumb/commit/e79b4519cc6e27388ddd3f095e97d1559cb47616
+	NOTE: Crash in CLI tool, no security impact
 CVE-2020-36426 (An issue was discovered in Arm Mbed TLS before 2.24.0. mbedtls_x509_cr ...)
 	- mbedtls 2.16.9-0.1
 CVE-2020-36425 (An issue was discovered in Arm Mbed TLS before 2.24.0. It incorrectly  ...)
@@ -6353,6 +6355,7 @@ CVE-2021-34553 (Sonatype Nexus Repository Manager 3.x before 3.31.0 allows a rem
 CVE-2021-34552 (Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1. ...)
 	{DLA-2716-1}
 	- pillow 8.1.2+dfsg-0.3 (bug #991293)
+	[buster] - pillow <no-dsa> (Minor issue, mitigated by FORTIFY_SOURCE)
 	NOTE: https://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow
 	NOTE: https://github.com/python-pillow/Pillow/pull/5567
 	NOTE: https://github.com/python-pillow/Pillow/commit/31c473898c29d1b7cb6555ce67d9503a4906b83f (8.3.0)
@@ -148216,6 +148219,7 @@ CVE-2019-11099
 	RESERVED
 CVE-2019-11098 (Insufficient input validation in MdeModulePkg in EDKII may allow an un ...)
 	- edk2 <unfixed>
+	[buster] - edk2 <no-dsa> (Minor issue)
 	NOTE: https://edk2-docs.gitbook.io/security-advisory/bootguard-toctou-vulnerability
 	NOTE: https://bugzilla.tianocore.org/show_bug.cgi?id=1614
 	NOTE: https://bugzilla.tianocore.org/attachment.cgi?id=316



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/85f266758683d334c98eec762039363b55d77a68

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/85f266758683d334c98eec762039363b55d77a68
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210723/27e39c40/attachment.htm>