[Git][security-tracker-team/security-tracker][master] automatic update

Sat Aug 27 21:10:35 BST 2022


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
82c8e1fa by security tracker role at 2022-08-27T20:10:25+00:00
automatic update

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1,3 +1,15 @@
+CVE-2022-3017
+	RESERVED
+CVE-2022-3016
+	RESERVED
+CVE-2022-3015 (A vulnerability, which was classified as problematic, has been found i ...)
+	TODO: check
+CVE-2022-3014 (A vulnerability classified as problematic was found in SourceCodester  ...)
+	TODO: check
+CVE-2022-3013 (A vulnerability classified as critical has been found in SourceCodeste ...)
+	TODO: check
+CVE-2022-3012 (A vulnerability was found in oretnom23 Fast Food Ordering System. It h ...)
+	TODO: check
 CVE-2022-38065
 	RESERVED
 CVE-2022-3011
@@ -1900,8 +1912,7 @@ CVE-2022-2789 (Emerson Electric's Proficy Machine Edition Version 9.00 and prior
 	NOT-FOR-US: Emerson
 CVE-2022-2788 (Emerson Electric's Proficy Machine Edition Version 9.80 and prior is v ...)
 	NOT-FOR-US: Emerson
-CVE-2022-2787
-	RESERVED
+CVE-2022-2787 (Schroot before 1.6.13 had too permissive rules on chroot or session na ...)
 	{DSA-5213-1 DLA-3075-1}
 	- schroot 1.6.12-2
 	NOTE: https://codeberg.org/shelter/reschroot/commit/6f7166a285e1e97aea390be633591f9791b29a6d
@@ -3568,6 +3579,7 @@ CVE-2022-2689 (A vulnerability classified as problematic has been found in Sourc
 CVE-2022-2688 (A vulnerability was found in SourceCodester Expense Management System. ...)
 	NOT-FOR-US: SourceCodester Expense Management System
 CVE-2022-37452 (Exim before 4.95 has a heap-based buffer overflow for the alias list i ...)
+	{DLA-3082-1}
 	- exim4 4.94.2-5
 	NOTE: https://www.openwall.com/lists/oss-security/2022/08/06/8
 	NOTE: https://github.com/ivd38/exim_overflow
@@ -15358,6 +15370,7 @@ CVE-2022-32895
 CVE-2022-32894 (An out-of-bounds write issue was addressed with improved bounds checki ...)
 	TODO: check
 CVE-2022-32893 (An out-of-bounds write issue was addressed with improved bounds checki ...)
+	{DSA-5220-1 DSA-5219-1}
 	- webkit2gtk 2.36.7-1
 	- wpewebkit 2.36.7-1
 	NOTE: https://wpewebkit.org/security/WSA-2022-0008.html
@@ -38920,7 +38933,7 @@ CVE-2022-24792 (PJSIP is a free and open source multimedia communication library
 CVE-2022-24791 (Wasmtime is a standalone JIT-style runtime for WebAssembly, using Cran ...)
 	NOT-FOR-US: wasmtime
 CVE-2022-24790 (Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for R ...)
-	{DSA-5146-1}
+	{DSA-5146-1 DLA-3083-1}
 	- puma 5.6.4-1 (bug #1008723)
 	[stretch] - puma <no-dsa> (possibly introduces regressions)
 	NOTE: https://github.com/puma/puma/security/advisories/GHSA-h99w-9q5r-gjq9
@@ -43249,7 +43262,7 @@ CVE-2022-23636 (Wasmtime is an open source runtime for WebAssembly & WASI. P
 CVE-2022-23635 (Istio is an open platform to connect, manage, and secure microservices ...)
 	NOT-FOR-US: Istio
 CVE-2022-23634 (Puma is a Ruby/Rack web server built for parallelism. Prior to `puma`  ...)
-	{DSA-5146-1 DLA-3023-1}
+	{DSA-5146-1 DLA-3083-1 DLA-3023-1}
 	- puma 5.6.4-1 (bug #1005391)
 	NOTE: https://github.com/puma/puma/security/advisories/GHSA-rmj8-8hhh-gv5h
 	NOTE: https://github.com/puma/puma/commit/b70f451fe8abc0cff192c065d549778452e155bb (v5.6.3)
@@ -66428,7 +66441,7 @@ CVE-2021-41138 (Frontier is Substrate's Ethereum compatibility layer. In the new
 CVE-2021-41137 (Minio is a Kubernetes native application for cloud storage. All users  ...)
 	NOT-FOR-US: Minio
 CVE-2021-41136 (Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to version ...)
-	{DSA-5146-1}
+	{DSA-5146-1 DLA-3083-1}
 	- puma 5.5.2-1
 	[stretch] - puma <no-dsa> (Minor issue)
 	NOTE: https://github.com/puma/puma/security/advisories/GHSA-48w2-rm65-62xx
@@ -96082,6 +96095,7 @@ CVE-2021-29510 (Pydantic is a data validation and settings management using Pyth
 	NOTE: https://github.com/samuelcolvin/pydantic/security/advisories/GHSA-5jqp-qgf6-3pvh
 	NOTE: https://github.com/samuelcolvin/pydantic/commit/7e83fdd2563ffac081db7ecdf1affa65ef38c468
 CVE-2021-29509 (Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The f ...)
+	{DLA-3083-1}
 	- puma 4.3.8-1 (bug #989054)
 	[stretch] - puma <not-affected> (Incomplete fix for CVE-2019-16770 not applied)
 	NOTE: https://github.com/puma/puma/security/advisories/GHSA-q28m-8xjw-8vr5



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/82c8e1fa2bbec0af3d47b8b1f90d29009c99ac3a

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/82c8e1fa2bbec0af3d47b8b1f90d29009c99ac3a
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220827/6604993a/attachment-0001.htm>
