[Git][security-tracker-team/security-tracker][master] gpac triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
bb441e45 by Moritz Muehlenhoff at 2021-09-15T14:01:00+02:00
gpac triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -17713,29 +17713,44 @@ CVE-2021-33368
 CVE-2021-33367
 	RESERVED
 CVE-2021-33366 (Memory leak in the gf_isom_oinf_read_entry function in MP4Box in GPAC  ...)
-	- gpac <unfixed>
+	- gpac <unfixed> (unimportant)
+	[buster] - gpac <not-affected> (Vulnerable code not present)
+	[stretch] - gpac <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/gpac/gpac/commit/0a85029d694f992f3631e2f249e4999daee15cbf
 	NOTE: https://github.com/gpac/gpac/issues/1785
+	NOTE: Negligible security impact
 CVE-2021-33365 (Memory leak in the gf_isom_get_root_od function in MP4Box in GPAC 1.0. ...)
-	- gpac <unfixed>
+	- gpac <unfixed> (unimportant)
 	NOTE: https://github.com/gpac/gpac/commit/984787de3d414a5f7d43d0b4584d9469dff2a5a5
 	NOTE: https://github.com/gpac/gpac/issues/1784
+	NOTE: Negligible security impact
 CVE-2021-33364 (Memory leak in the def_parent_box_new function in MP4Box in GPAC 1.0.1 ...)
-	- gpac <unfixed>
+	- gpac <unfixed> (unimportant)
+	[buster] - gpac <not-affected> (Vulnerable code not present)
+	[stretch] - gpac <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/gpac/gpac/commit/fe5155cf047252d1c4cb91602048bfa682af0ea7
 	NOTE: https://github.com/gpac/gpac/issues/1783
+	NOTE: Negligible security impact
 CVE-2021-33363 (Memory leak in the infe_box_read function in MP4Box in GPAC 1.0.1 allo ...)
-	- gpac <unfixed>
+	- gpac <unfixed> (unimportant)
+	[buster] - gpac <not-affected> (Vulnerable code not present)
+	[stretch] - gpac <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/gpac/gpac/commit/ec64c7b8966d7e4642d12debb888be5acf18efb9
 	NOTE: https://github.com/gpac/gpac/issues/1786
+	NOTE: Negligible security impact
 CVE-2021-33362 (Stack buffer overflow in the hevc_parse_vps_extension function in MP4B ...)
 	- gpac <unfixed>
+	[bullseye] - gpac <ignored> (Minor issue)
+	[buster] - gpac <ignored> (Minor issue)
 	NOTE: https://github.com/gpac/gpac/commit/1273cdc706eeedf8346d4b9faa5b33435056061d
 	NOTE: https://github.com/gpac/gpac/issues/1780
 CVE-2021-33361 (Memory leak in the afra_box_read function in MP4Box in GPAC 1.0.1 allo ...)
-	- gpac <unfixed>
+	- gpac <unfixed> (unimportant)
+	[buster] - gpac <not-affected> (Vulnerable code not present)
+	[stretch] - gpac <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/gpac/gpac/commit/a51f951b878c2b73c1d8e2f1518c7cdc5fb82c3f
 	NOTE: https://github.com/gpac/gpac/issues/1782
+	NOTE: Negligible security impact
 CVE-2021-33360
 	RESERVED
 CVE-2021-33359 (A vulnerability exists in gowitness < 2.3.6 that allows an unauthen ...)
@@ -20671,32 +20686,48 @@ CVE-2021-32140
 	RESERVED
 CVE-2021-32139 (The gf_isom_vp_config_get function in GPAC 1.0.1 allows attackers to c ...)
 	- gpac <unfixed>
+	[bullseye] - gpac <ignored> (Minor issue)
+	[buster] - gpac <ignored> (Minor issue)
 	NOTE: https://github.com/gpac/gpac/commit/d527325a9b72218612455a534a508f9e1753f76e
 	NOTE: https://github.com/gpac/gpac/issues/1768
 CVE-2021-32138 (The DumpTrackInfo function in GPAC 1.0.1 allows attackers to cause a d ...)
 	- gpac <unfixed>
+	[bullseye] - gpac <ignored> (Minor issue)
+	[buster] - gpac <ignored> (Minor issue)
 	NOTE: https://github.com/gpac/gpac/commit/289ffce3e0d224d314f5f92a744d5fe35999f20b
 	NOTE: https://github.com/gpac/gpac/issues/1767
 CVE-2021-32137 (Heap buffer overflow in the URL_GetProtocolType function in MP4Box in  ...)
 	- gpac <unfixed>
+	[bullseye] - gpac <ignored> (Minor issue)
+	[buster] - gpac <ignored> (Minor issue)
 	NOTE: https://github.com/gpac/gpac/commit/328def7d3b93847d64ecb6e9e0399684e57c3eca
 	NOTE: https://github.com/gpac/gpac/issues/1766
 CVE-2021-32136 (Heap buffer overflow in the print_udta function in MP4Box in GPAC 1.0. ...)
 	- gpac <unfixed>
+	[bullseye] - gpac <ignored> (Minor issue)
+	[buster] - gpac <ignored> (Minor issue)
 	NOTE: https://github.com/gpac/gpac/commit/eb71812fcc10e9c5348a5d1c61bd25b6fa06eaed
 	NOTE: https://github.com/gpac/gpac/issues/1765
 CVE-2021-32135 (The trak_box_size function in GPAC 1.0.1 allows attackers to cause a d ...)
 	- gpac <unfixed>
+	[bullseye] - gpac <ignored> (Minor issue)
+	[buster] - gpac <not-affected> (Vulnerable code not present)
+	[stretch] - gpac <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/gpac/gpac/commit/b8f8b202d4fc23eb0ab4ce71ae96536ca6f5d3f8
 	NOTE: https://github.com/gpac/gpac/issues/1757
 CVE-2021-32134 (The gf_odf_desc_copy function in GPAC 1.0.1 allows attackers to cause  ...)
 	- gpac <unfixed>
+	[bullseye] - gpac <ignored> (Minor issue)
+	[buster] - gpac <ignored> (Minor issue)
 	NOTE: https://github.com/gpac/gpac/commit/328c6d682698fdb9878dbb4f282963d42c538c01
 	NOTE: https://github.com/gpac/gpac/issues/1756
 CVE-2021-32133
 	RESERVED
 CVE-2021-32132 (The abst_box_size function in GPAC 1.0.1 allows attackers to cause a d ...)
 	- gpac <unfixed>
+	[bullseye] - gpac <ignored> (Minor issue)
+	[buster] - gpac <not-affected> (Vulnerable code not present)
+	[stretch] - gpac <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/gpac/gpac/commit/e74be5976a6fee059c638050a237893f7e9a3b23
 	NOTE: https://github.com/gpac/gpac/issues/1753
 CVE-2021-32131



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bb441e456223b3d2123607844f09ef53170f3ff5

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/bb441e456223b3d2123607844f09ef53170f3ff5
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210915/dbb36414/attachment.htm>