[Git][security-tracker-team/security-tracker][master] 3 commits: mark CVE-2021-36976 as not-affected for Stretch

[Thorsten Alteholz (@alteholz)]

Thorsten Alteholz pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b427d65e by Thorsten Alteholz at 2021-07-25T19:03:14+02:00
mark CVE-2021-36976 as not-affected for Stretch

- - - - -
f2f8a18e by Thorsten Alteholz at 2021-07-25T19:39:09+02:00
mark CVE-2020-36430 as not-affected

- - - - -
8eab5399 by Thorsten Alteholz at 2021-07-25T19:42:43+02:00
mark several CVEs for libcommons-compress-java as no-dsa in Stretch

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -969,6 +969,7 @@ CVE-2021-36976 (libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_stri
 	- libarchive <unfixed> (bug #991442)
 	[bullseye] - libarchive <no-dsa> (Minor issue)
 	[buster] - libarchive <no-dsa> (Minor issue)
+	[stretch] - libarchive <not-affected> (Vulnerable code introduced by 47bb818 in version 3.4.1)
 	NOTE: https://github.com/libarchive/libarchive/issues/1554
 	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=32375
 	NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libarchive/OSV-2021-557.yaml
@@ -1316,6 +1317,7 @@ CVE-2020-36431 (Unicorn Engine 1.0.2 has an out-of-bounds write in helper_wfe_ar
 	NOT-FOR-US: Unicorn Engine
 CVE-2020-36430 (libass 0.15.x before 0.15.1 has a heap-based buffer overflow in decode ...)
 	- libass 1:0.15.0-2
+	[stretch] - libass <not-affected> (Vulnerable code not present)
 	NOTE: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=26674
 	NOTE: https://github.com/google/oss-fuzz-vulns/blob/main/vulns/libass/OSV-2020-2099.yaml
 	NOTE: Introduced by: https://github.com/libass/libass/commit/910211f1c0078e37546f73e95306724358b89be2 (0.15.0)
@@ -2907,6 +2909,7 @@ CVE-2021-36090 (When reading a specially crafted ZIP archive, Compress can be ma
 	- libcommons-compress-java <unfixed> (bug #991041)
 	[bullseye] - libcommons-compress-java <no-dsa> (Minor issue)
 	[buster] - libcommons-compress-java <no-dsa> (Minor issue)
+	[stretch] - libcommons-compress-java <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2021/07/13/4
 CVE-2020-36416 (A stored cross scripting (XSS) vulnerability in CMS Made Simple 2.2.14 ...)
 	NOT-FOR-US: CMS Made Simple
@@ -4244,16 +4247,19 @@ CVE-2021-35517 (When reading a specially crafted TAR archive, Compress can be ma
 	- libcommons-compress-java <unfixed> (bug #991041)
 	[bullseye] - libcommons-compress-java <no-dsa> (Minor issue)
 	[buster] - libcommons-compress-java <no-dsa> (Minor issue)
+	[stretch] - libcommons-compress-java <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2021/07/13/3
 CVE-2021-35516 (When reading a specially crafted 7Z archive, Compress can be made to a ...)
 	- libcommons-compress-java <unfixed> (bug #991041)
 	[bullseye] - libcommons-compress-java <no-dsa> (Minor issue)
 	[buster] - libcommons-compress-java <no-dsa> (Minor issue)
+	[stretch] - libcommons-compress-java <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2021/07/13/2
 CVE-2021-35515 (When reading a specially crafted 7Z archive, the construction of the l ...)
 	- libcommons-compress-java <unfixed> (bug #991041)
 	[bullseye] - libcommons-compress-java <no-dsa> (Minor issue)
 	[buster] - libcommons-compress-java <no-dsa> (Minor issue)
+	[stretch] - libcommons-compress-java <no-dsa> (Minor issue)
 	NOTE: https://www.openwall.com/lists/oss-security/2021/07/13/1
 CVE-2021-35514 (Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the t ...)
 	NOT-FOR-US: Narou



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/da17668693c6435bfe809d112efd79f7f3daa851...8eab5399cc80d013f3579569826c7e72055f25b3

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/da17668693c6435bfe809d112efd79f7f3daa851...8eab5399cc80d013f3579569826c7e72055f25b3
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210725/40381045/attachment.htm>