[Git][security-tracker-team/security-tracker][master] Reserve DLA-2772-1 for taglib

[Adrian Bunk (@bunk)]

Adrian Bunk pushed to branch master at Debian Security Tracker / security-tracker


Commits:
0d92c542 by Adrian Bunk at 2021-09-30T23:14:23+03:00
Reserve DLA-2772-1 for taglib

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -213536,7 +213536,6 @@ CVE-2018-11440 (Liblouis 3.5.0 has a stack-based Buffer Overflow in the function
 CVE-2018-11439 (The TagLib::Ogg::FLAC::File::scan function in oggflacfile.cpp in TagLi ...)
 	{DLA-1430-1}
 	- taglib 1.11.1+dfsg.1-0.3 (bug #903847)
-	[stretch] - taglib <no-dsa> (Minor issue)
 	NOTE: PoC: http://seclists.org/fulldisclosure/2018/May/49
 	NOTE: Upstream issue: https://github.com/taglib/taglib/issues/868
 	NOTE: Pull request: https://github.com/taglib/taglib/pull/869
@@ -260259,7 +260258,6 @@ CVE-2017-12679 (SQL Injection exists in NexusPHP 1.5.beta5.20120707 via the delc
 	NOT-FOR-US: NexusPHP
 CVE-2017-12678 (In TagLib 1.11.1, the rebuildAggregateFrames function in id3v2framefac ...)
 	- taglib 1.11.1+dfsg.1-0.2 (bug #871511)
-	[stretch] - taglib <no-dsa> (Minor issue)
 	[jessie] - taglib <not-affected> (Vulnerable code not present)
 	[wheezy] - taglib <not-affected> (Vulnerable code not present)
 	- silverjuke <not-affected> (Vulnerable code not present, based on older taglib version)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[30 Sep 2021] DLA-2772-1 taglib - security update
+	{CVE-2017-12678 CVE-2018-11439}
+	[stretch] - taglib 1.11.1+dfsg.1-0.3+deb9u1
 [30 Sep 2021] DLA-2771-1 krb5 - security update
 	{CVE-2018-5729 CVE-2018-5730 CVE-2018-20217 CVE-2021-37750}
 	[stretch] - krb5 1.15-1+deb9u3


=====================================
data/dla-needed.txt
=====================================
@@ -103,7 +103,5 @@ smarty3
 squashfs-tools (Thorsten Alteholz)
   NOTE: 20210926: coordinate with upload to other releases
 --
-taglib (Adrian Bunk)
---
 tiff (Utkarsh)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0d92c542f63f84d922fd1f89cc5ae7f669c029ab

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/0d92c542f63f84d922fd1f89cc5ae7f669c029ab
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20210930/16cbaf33/attachment.htm>