[Git][security-tracker-team/security-tracker][master] 2 commits: Slightly annotate upstream commit for CVE-2021-36978

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
118b687d by Salvatore Bonaccorso at 2021-07-23T20:46:49+02:00
Slightly annotate upstream commit for CVE-2021-36978

- - - - -
326a4c9a by Salvatore Bonaccorso at 2021-07-23T20:47:43+02:00
Mark CVE-2021-36978/qpdf as no-dsa for buster

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -896,9 +896,10 @@ CVE-2021-36979 (Unicorn Engine 1.0.2 has an out-of-bounds write in tb_flush_arme
 	NOT-FOR-US: Unicorn Engine
 CVE-2021-36978 (QPDF 9.x through 9.1.1 and 10.x through 10.0.4 has a heap-based buffer ...)
 	- qpdf 10.1.0-1
+	[buster] - qpdf <no-dsa> (Minor issue)
 	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=28262
 	NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/qpdf/OSV-2020-2245.yaml
-	NOTE: https://github.com/qpdf/qpdf/commit/dc92574c10f3e2516ec6445b88c5d584f40df4e5
+	NOTE: Fixed by: https://github.com/qpdf/qpdf/commit/dc92574c10f3e2516ec6445b88c5d584f40df4e5 (release-qpdf-10.1.0)
 CVE-2021-36977 (matio (aka MAT File I/O Library) 1.5.20 and 1.5.21 has a heap-based bu ...)
 	- libmatio <not-affected> (Vulnerable code not yet present)
 	NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/matio/OSV-2021-440.yaml



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a0ac1fc26e82b74fe383df6e110063b00a6f13fc...326a4c9a88c52a731c1c95b4861e9d1d9a7de16a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/a0ac1fc26e82b74fe383df6e110063b00a6f13fc...326a4c9a88c52a731c1c95b4861e9d1d9a7de16a
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210723/140daeea/attachment.htm>