[Git][security-tracker-team/security-tracker][master] Reserve DLA-2972-1 for libxml2

[Anton Gladky (@gladk)]

Anton Gladky pushed to branch master at Debian Security Tracker / security-tracker


Commits:
5bb2ad15 by Anton Gladky at 2022-04-08T16:22:58+02:00
Reserve DLA-2972-1 for libxml2

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -318504,7 +318504,6 @@ CVE-2017-5970 (The ipv4_pktinfo_prepare function in net/ipv4/ip_sockglue.c in th
 	NOTE: Introduced by: https://github.com/torvalds/linux/commit/f84af32cbca70a3c6d30463dc08c7984af11c277 (v2.6.35-rc1)
 CVE-2017-5969 (** DISPUTED ** libxml2 2.9.4, when used in recover mode, allows remote ...)
 	- libxml2 2.9.4+dfsg1-5.1 (bug #855001)
-	[stretch] - libxml2 <no-dsa> (Minor issue, only a denial-of-service when using recover mode)
 	[jessie] - libxml2 <no-dsa> (Minor issue, only a denial-of-service when using recover mode)
 	[wheezy] - libxml2 <no-dsa> (Minor issue, only a denial-of-service when using recover mode)
 	NOTE: https://www.openwall.com/lists/oss-security/2016/11/05/3
@@ -321681,7 +321680,6 @@ CVE-2017-5131 (An integer overflow in Skia in Google Chrome prior to 62.0.3202.6
 CVE-2017-5130 (An integer overflow in xmlmemory.c in libxml2 before 2.9.5, as used in ...)
 	{DLA-1188-1}
 	- libxml2 2.9.4+dfsg1-5.1 (bug #880000)
-	[stretch] - libxml2 <no-dsa> (Minor issue)
 	[jessie] - libxml2 <no-dsa> (Minor issue)
 	- chromium-browser 62.0.3202.75-1 (unimportant)
 	NOTE: chromium-browser uses system libxml2.


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[08 Apr 2022] DLA-2972-1 libxml2 - security update
+	{CVE-2016-9318 CVE-2017-5130 CVE-2017-5969 CVE-2017-16932 CVE-2022-23308}
+	[stretch] - libxml2 2.9.4+dfsg1-2.2+deb9u6
 [07 Apr 2022] DLA-2971-1 firefox-esr - security update
 	{CVE-2022-1097 CVE-2022-1196 CVE-2022-24713 CVE-2022-28281 CVE-2022-28282 CVE-2022-28285 CVE-2022-28286 CVE-2022-28289}
 	[stretch] - firefox-esr 91.8.0esr-1~deb9u1


=====================================
data/dla-needed.txt
=====================================
@@ -81,9 +81,6 @@ libpgjava
 --
 libvirt (Thorsten Alteholz)
 --
-libxml2 (Anton)
-  NOTE: 20220403: https://salsa.debian.org/lts-team/packages/libxml2
---
 libz-mingw-w64
   NOTE: 20220231: upcoming DSA (Beuc)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5bb2ad15d34da923b5e32476986ffe569f00c892

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5bb2ad15d34da923b5e32476986ffe569f00c892
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220408/991baa2c/attachment.htm>