[Git][security-tracker-team/security-tracker][master] 2 commits: Process more NFUs

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
27be1841 by Salvatore Bonaccorso at 2022-04-19T10:56:20+02:00
Process more NFUs

- - - - -
5f44e41b by Salvatore Bonaccorso at 2022-04-19T10:57:15+02:00
Add two new libsixel issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1703,7 +1703,7 @@ CVE-2022-28812
 CVE-2022-28811
 	RESERVED
 CVE-2022-28810 (Zoho ManageEngine ADSelfService Plus before 6122 allows an authenticat ...)
-	TODO: check
+	NOT-FOR-US: Zoho ManageEngine
 CVE-2022-28809
 	RESERVED
 CVE-2022-28808
@@ -4287,7 +4287,7 @@ CVE-2022-27910
 CVE-2022-27909
 	RESERVED
 CVE-2022-27908 (Zoho ManageEngine OpManager before 125588 (and before 125603) is vulne ...)
-	TODO: check
+	NOT-FOR-US: Zoho ManageEngine
 CVE-2022-27907 (Sonatype Nexus Repository Manager 3.x before 3.38.0 allows SSRF. ...)
 	NOT-FOR-US: Sonatype Nexus Repository Manager
 CVE-2022-27906 (Mendelson OFTP2 before 1.1 b43 is affected by directory traversal. To  ...)
@@ -5230,17 +5230,17 @@ CVE-2022-27532
 CVE-2022-27531
 	RESERVED
 CVE-2022-27530 (A maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022, 2021, ...)
-	TODO: check
+	NOT-FOR-US: Autodesk
 CVE-2022-27529 (A maliciously crafted PICT, BMP, PSD or TIF file in Autodesk AutoCAD 2 ...)
-	TODO: check
+	NOT-FOR-US: Autodesk
 CVE-2022-27528 (A maliciously crafted DWFX and SKP files in Autodesk Navisworks 2022 c ...)
 	NOT-FOR-US: Autodesk
 CVE-2022-27527
 	RESERVED
 CVE-2022-27526 (A malicious crafted TGA file when consumed through DesignReview.exe ap ...)
-	TODO: check
+	NOT-FOR-US: Autodesk
 CVE-2022-27525 (A malicious crafted .dwf file when consumed through DesignReview.exe a ...)
-	TODO: check
+	NOT-FOR-US: Autodesk
 CVE-2022-27524 (An out-of-bounds read can be exploited in Autodesk TrueView 2022 may l ...)
 	NOT-FOR-US: Autodesk
 CVE-2022-27523 (A buffer over-read can be exploited in Autodesk TrueView 2022 may lead ...)
@@ -6676,11 +6676,19 @@ CVE-2022-27048 (A vulnerability has been discovered in Moxa MGate which allows a
 CVE-2022-27047 (mogu_blog_cms 5.2 suffers from upload arbitrary files without any limi ...)
 	NOT-FOR-US: mogu_blog_cms
 CVE-2022-27046 (libsixel 1.8.6 suffers from a Heap Use After Free vulnerability in in  ...)
-	TODO: check
+	- libsixel 1.10.3-1
+	NOTE: https://github.com/saitoha/libsixel/issues/157
+	NOTE: https://github.com/libsixel/libsixel/issues/27
+	NOTE: https://github.com/libsixel/libsixel/pull/28
+	NOTE: Fixed by: https://github.com/libsixel/libsixel/commit/d299d67c532a5133a57aade5c35ff8e612c73dd8 (v1.10.1)
 CVE-2022-27045
 	RESERVED
 CVE-2022-27044 (libsixel 1.8.6 is affected by Buffer Overflow in libsixel/src/quant.c: ...)
-	TODO: check
+	- libsixel 1.10.3-1
+	NOTE: https://github.com/saitoha/libsixel/issues/156
+	NOTE: https://github.com/libsixel/libsixel/issues/25
+	NOTE: https://github.com/libsixel/libsixel/pull/26
+	NOTE: Fixed by: https://github.com/libsixel/libsixel/commit/dc96cdc27fb53e8595af67aaf68001033c808e42 (v1.10.0)
 CVE-2022-27043 (Yearning versions 2.3.1 and 2.3.2 Interstellar GA and 2.3.4 - 2.3.6 Ne ...)
 	TODO: check
 CVE-2022-27042



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c9a0c5f1f0268f42e827a2902c4b84496b745082...5f44e41b5a6ac979c0c65cc5733e663a40e97fa1

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/c9a0c5f1f0268f42e827a2902c4b84496b745082...5f44e41b5a6ac979c0c65cc5733e663a40e97fa1
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220419/908027b3/attachment.htm>