[Git][security-tracker-team/security-tracker][master] 2 commits: Process more NFUs
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Tue Apr 19 09:57:36 BST 2022
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
27be1841 by Salvatore Bonaccorso at 2022-04-19T10:56:20+02:00
Process more NFUs
- - - - -
5f44e41b by Salvatore Bonaccorso at 2022-04-19T10:57:15+02:00
Add two new libsixel issues
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1703,7 +1703,7 @@ CVE-2022-28812
CVE-2022-28811
RESERVED
CVE-2022-28810 (Zoho ManageEngine ADSelfService Plus before 6122 allows an authenticat ...)
- TODO: check
+ NOT-FOR-US: Zoho ManageEngine
CVE-2022-28809
RESERVED
CVE-2022-28808
@@ -4287,7 +4287,7 @@ CVE-2022-27910
CVE-2022-27909
RESERVED
CVE-2022-27908 (Zoho ManageEngine OpManager before 125588 (and before 125603) is vulne ...)
- TODO: check
+ NOT-FOR-US: Zoho ManageEngine
CVE-2022-27907 (Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. ...)
NOT-FOR-US: Sonatype Nexus Repository Manager
CVE-2022-27906 (Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To ...)
@@ -5230,17 +5230,17 @@ CVE-2022-27532
CVE-2022-27531
RESERVED
CVE-2022-27530 (A maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022, 2021, ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27529 (A maliciously crafted PICT, BMP, PSD or TIF file in Autodesk AutoCAD 2 ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27528 (A maliciously crafted DWFX and SKP files in Autodesk Navisworks 2022 c ...)
NOT-FOR-US: Autodesk
CVE-2022-27527
RESERVED
CVE-2022-27526 (A malicious crafted TGA file when consumed through DesignReview.exe ap ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27525 (A malicious crafted .dwf file when consumed through DesignReview.exe a ...)
- TODO: check
+ NOT-FOR-US: Autodesk
CVE-2022-27524 (An out-of-bounds read can be exploited in Autodesk TrueView 2022 may l ...)
NOT-FOR-US: Autodesk
CVE-2022-27523 (A buffer over-read can be exploited in Autodesk TrueView 2022 may lead ...)
@@ -6676,11 +6676,19 @@ CVE-2022-27048 (A vulnerability has been discovered in Moxa MGate which allows a
CVE-2022-27047 (mogu_blog_cms 5.2 suffers from upload arbitrary files without any limi ...)
NOT-FOR-US: mogu_blog_cms
CVE-2022-27046 (libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in ...)
- TODO: check
+ - libsixel 1.10.3-1
+ NOTE: https://github.com/saitoha/libsixel/issues/157
+ NOTE: https://github.com/libsixel/libsixel/issues/27
+ NOTE: https://github.com/libsixel/libsixel/pull/28
+ NOTE: Fixed by: https://github.com/libsixel/libsixel/commit/d299d67c532a5133a57aade5c35ff8e612c73dd8 (v1.10.1)
CVE-2022-27045
RESERVED
CVE-2022-27044 (libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c: ...)
- TODO: check
+ - libsixel 1.10.3-1
+ NOTE: https://github.com/saitoha/libsixel/issues/156
+ NOTE: https://github.com/libsixel/libsixel/issues/25
+ NOTE: https://github.com/libsixel/libsixel/pull/26
+ NOTE: Fixed by: https://github.com/libsixel/libsixel/commit/dc96cdc27fb53e8595af67aaf68001033c808e42 (v1.10.0)
CVE-2022-27043 (Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Ne ...)
TODO: check
CVE-2022-27042
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c9a0c5f1f0268f42e827a2902c4b84496b745082...5f44e41b5a6ac979c0c65cc5733e663a40e97fa1
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c9a0c5f1f0268f42e827a2902c4b84496b745082...5f44e41b5a6ac979c0c65cc5733e663a40e97fa1
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220419/908027b3/attachment.htm>
More information about the debian-security-tracker-commits
mailing list