[Git][security-tracker-team/security-tracker][master] bullseye triage
Moritz Muehlenhoff
jmm at debian.org
Fri May 7 20:06:48 BST 2021
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
5f371790 by Moritz Muehlenhoff at 2021-05-07T21:06:20+02:00
bullseye triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2468,6 +2468,8 @@ CVE-2021-3502 [reachable assertion in avahi_s_host_name_resolver_start when tryi
CVE-2021-3500
RESERVED
- djvulibre <unfixed>
+ [bullseye] - djvulibre <no-dsa> (Minor issue)
+ [buster] - djvulibre <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1943685
CVE-2021-31402 (The dio package 4.0.0 for Dart allows CRLF injection if the attacker c ...)
NOT-FOR-US: dio package for Dart
@@ -4416,12 +4418,14 @@ CVE-2021-30500
CVE-2021-30499
RESERVED
- libcaca <unfixed> (bug #987278)
+ [bullseye] - libcaca <no-dsa> (Minor issue)
[buster] - libcaca <no-dsa> (Minor issue)
[stretch] - libcaca <postponed> (Minor issue; can be fixed in next update)
NOTE: https://github.com/cacalabs/libcaca/issues/54
CVE-2021-30498
RESERVED
- libcaca <unfixed> (bug #987278)
+ [bullseye] - libcaca <no-dsa> (Minor issue)
[buster] - libcaca <no-dsa> (Minor issue)
[stretch] - libcaca <postponed> (Minor issue; can be fixed in next update)
NOTE: https://github.com/cacalabs/libcaca/issues/53
@@ -5291,6 +5295,7 @@ CVE-2021-30147 (DMA Softlab Radius Manager 4.4.0 allows CSRF with impacts such a
NOT-FOR-US: DMA Softlab Radius Manager
CVE-2021-30146 (Seafile 7.0.5 (2019) allows Persistent XSS via the "share of library f ...)
- seafile-client <unfixed> (bug #987282)
+ [bullseye] - seafile-client <no-dsa> (Minor issue)
[buster] - seafile-client <no-dsa> (Minor issue)
NOTE: https://github.com/Security-AVS/CVE-2021-30146
CVE-2021-30145
@@ -7212,6 +7217,7 @@ CVE-2021-29339
RESERVED
CVE-2021-29338 (Integer Overflow in OpenJPEG v2.4.0 allows remote attackers to crash t ...)
- openjpeg2 <unfixed> (bug #987276)
+ [bullseye] - openjpeg2 <no-dsa> (Minor issue)
[buster] - openjpeg2 <no-dsa> (Minor issue)
[stretch] - openjpeg2 <no-dsa> (Minor issue)
NOTE: https://github.com/uclouvain/openjpeg/issues/1338
@@ -8357,6 +8363,7 @@ CVE-2021-28832 (VSCodeVim before 1.19.0 allows attackers to execute arbitrary co
CVE-2021-28831 (decompress_gunzip.c in BusyBox through 1.32.1 mishandles the error bit ...)
{DLA-2614-1}
- busybox <unfixed> (bug #985674)
+ [bullseye] - busybox <no-dsa> (Minor issue)
[buster] - busybox <no-dsa> (Minor issue)
NOTE: https://git.busybox.net/busybox/commit/?id=f25d254dfd4243698c31a4f3153d4ac72aa9e9bd
CVE-2021-27851 (A security vulnerability that can lead to local privilege escalation h ...)
@@ -10592,9 +10599,10 @@ CVE-2021-27906 (A carefully crafted PDF file can trigger an OutOfMemory-Exceptio
NOTE: https://www.openwall.com/lists/oss-security/2021/03/19/10
NOTE: https://issues.apache.org/jira/browse/PDFBOX-5112
CVE-2021-27905 (The ReplicationHandler (normally registered at "/replication" under a ...)
- - lucene-solr <unfixed>
+ - lucene-solr 3.6.2+dfsg-23
[buster] - lucene-solr <ignored> (Minor issue)
NOTE: https://lists.apache.org/thread.html/r0ddc3a82bd7523b1453cb7a5e09eb5559517145425074a42eb326b10%40%3Cannounce.apache.org%3E
+ NOTE: Server components disabled in 3.6.2+dfsg-23, using that as the fixed version
CVE-2021-27904 (An issue was discovered in app/Model/SharingGroupServer.php in MISP 2. ...)
NOT-FOR-US: MISP
CVE-2021-27903
@@ -68156,7 +68164,8 @@ CVE-2020-15470 (ffjpeg through 2020-02-24 has a heap-based buffer overflow in jf
CVE-2020-15469 (In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback m ...)
{DLA-2560-1}
- qemu <unfixed> (low; bug #970253)
- [buster] - qemu <postponed> (Minor issue, fix along in next DSA)
+ [bullseye] - qemu <ignored> (Minor issue, too intrusive to backport)
+ [buster] - qemu <ignored> (Minor issue, too intrusive to backport)
NOTE: https://www.openwall.com/lists/oss-security/2020/07/02/1
NOTE: https://lists.gnu.org/archive/html/qemu-devel/2020-06/msg09961.html
NOTE: https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg00674.html
@@ -86121,12 +86130,13 @@ CVE-2019-20476
CVE-2019-20475
RESERVED
CVE-2015-9543 (An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 1 ...)
- - nova <unfixed> (bug #951635)
+ - nova 2:20.1.1-1 (bug #951635)
[buster] - nova <no-dsa> (Minor issue)
[stretch] - nova <no-dsa> (Minor issue)
[jessie] - nova <no-dsa> (Minor issue)
NOTE: https://launchpad.net/bugs/1492140
NOTE: https://review.opendev.org/220622
+ NOTE: https://www.openwall.com/lists/oss-security/2020/02/19/2
CVE-2020-9271 (ICE Hrm 26.2.0 is vulnerable to CSRF that leads to user creation via s ...)
NOT-FOR-US: ICE Hrm
CVE-2020-9270 (ICE Hrm 26.2.0 is vulnerable to CSRF that leads to password reset via ...)
@@ -131618,11 +131628,9 @@ CVE-2019-12417 (A malicious admin user could edit the state of objects in the Ai
CVE-2019-12416 (we got reports for 2 injection attacks against the DeltaSpike windowha ...)
NOT-FOR-US: DeltaSpike
CVE-2019-12415 (In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to conv ...)
- - libapache-poi-java <unfixed> (bug #943565)
- [buster] - libapache-poi-java <no-dsa> (Minor issue)
- [stretch] - libapache-poi-java <no-dsa> (Minor issue)
- [jessie] - libapache-poi-java <no-dsa> (Minor issue)
+ - libapache-poi-java <unfixed> (unimportant; bug #943565)
NOTE: https://www.openwall.com/lists/oss-security/2019/10/23/1
+ NOTE: Vulnerable tool not shipped in binary package
CVE-2019-12414 (In Apache Incubator Superset before 0.32, a user can view database nam ...)
NOT-FOR-US: Apache Superset
CVE-2019-12413 (In Apache Incubator Superset before 0.31 user could query database met ...)
@@ -131668,6 +131676,7 @@ CVE-2019-12400 (In version 2.0.3 Apache Santuario XML Security for Java, a cachi
[stretch] - libxml-security-java <not-affected> (Vulnerable code introduced in 2.0.3)
[jessie] - libxml-security-java <not-affected> (Vulnerable code introduced in 2.0.3)
NOTE: http://santuario.apache.org/secadv.data/CVE-2019-12400.asc
+ NOTE: https://github.com/apache/santuario-xml-security-java/commit/8c88bbe449d073d5bc0626c1719e81e81c2ad9b4 (likely fix)
CVE-2019-12399 (When Connect workers in Apache Kafka 2.0.0, 2.0.1, 2.1.0, 2.1.1, 2.2.0 ...)
- kafka <itp> (bug #786460)
CVE-2019-12398 (In Apache Airflow before 1.10.5 when running with the "classic" UI, a ...)
@@ -167496,6 +167505,7 @@ CVE-2019-0188 (Apache Camel prior to 2.24.0 contains an XML external entity inje
NOT-FOR-US: Apache Camel
CVE-2019-0187 (Unauthenticated RCE is possible when JMeter is used in distributed mod ...)
- jakarta-jmeter <unfixed>
+ [bullseye] - jakarta-jmeter <no-dsa> (Minor issue)
[buster] - jakarta-jmeter <no-dsa> (Minor issue)
[stretch] - jakarta-jmeter <no-dsa> (Minor issue)
[jessie] - jakarta-jmeter <no-dsa> (Minor issue)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5f3717909d03456f784e7de3c3028b7f14532f19
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5f3717909d03456f784e7de3c3028b7f14532f19
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210507/2452f9e2/attachment.htm>
More information about the debian-security-tracker-commits
mailing list