[Git][security-tracker-team/security-tracker][master] bugnums

Moritz Muehlenhoff (@jmm) jmm at debian.org
Thu Jul 7 16:49:22 BST 2022



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
383259b1 by Moritz Muehlenhoff at 2022-07-07T17:48:52+02:00
bugnums

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -1155,7 +1155,7 @@ CVE-2022-2261
 CVE-2022-2260
 	RESERVED
 CVE-2022-34835 (In Das U-Boot through 2022.07-rc5, an integer signedness error and res ...)
-	- u-boot <unfixed>
+	- u-boot <unfixed> (bug #1014529)
 	[bullseye] - u-boot <no-dsa> (Minor issue)
 	[buster] - u-boot <no-dsa> (Minor issue)
 	NOTE: https://lists.denx.de/pipermail/u-boot/2022-June/486113.html
@@ -5512,7 +5512,7 @@ CVE-2022-33105 (Redis v7.0 was discovered to contain a memory leak via the compo
 CVE-2022-33104
 	RESERVED
 CVE-2022-33103 (Das U-Boot from v2020.10 to v2022.07-rc3 was discovered to contain an  ...)
-	- u-boot <unfixed>
+	- u-boot <unfixed> (bug #1014528)
 	[bullseye] - u-boot <no-dsa> (Minor issue)
 	[buster] - u-boot <no-dsa> (Minor issue)
 	NOTE: https://lore.kernel.org/all/CALO=DHFB+yBoXxVr5KcsK0iFdg+e7ywko4-e+72kjbcS8JBfPw@mail.gmail.com/
@@ -9449,7 +9449,7 @@ CVE-2022-31628
 CVE-2022-31627
 	RESERVED
 CVE-2022-31626 (In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x belo ...)
-	- php8.1 <unfixed>
+	- php8.1 <unfixed> (bug #1014533)
 	- php7.4 <removed>
 	[bullseye] - php7.4 <postponed> (Minor issue, fix along with next security release)
 	- php7.3 <removed>
@@ -9459,7 +9459,7 @@ CVE-2022-31626 (In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.
 	NOTE: Fixed in 7.4.30, 8.0.20, 8.1.7
 	NOTE: PHP Bug: https://bugs.php.net/bug.php?id=81719
 CVE-2022-31625 (In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x belo ...)
-	- php8.1 <unfixed>
+	- php8.1 <unfixed> (bug #1014533)
 	- php7.4 <removed>
 	[bullseye] - php7.4 <postponed> (Minor issue, fix along with next security release)
 	- php7.3 <removed>
@@ -14229,14 +14229,14 @@ CVE-2022-29980 (Simple Client Management System 1.0 is vulnerable to SQL Injecti
 CVE-2022-29979 (Simple Client Management System 1.0 is vulnerable to SQL Injection via ...)
 	NOT-FOR-US: Sourcecodester Simple Client Management System
 CVE-2022-29978 (There is a floating point exception error in sixel_encoder_do_resize,  ...)
-	- libsixel <unfixed>
+	- libsixel <unfixed> (bug #1014527)
 	[bullseye] - libsixel <no-dsa> (Minor issue)
 	[buster] - libsixel <no-dsa> (Minor issue)
 	[stretch] - libsixel <no-dsa> (Minor issue)
 	NOTE: https://github.com/libsixel/libsixel/issues/63
 	NOTE: Previously also reported in https://github.com/saitoha/libsixel/issues/166
 CVE-2022-29977 (There is an assertion failure error in stbi__jpeg_huff_decode, stb_ima ...)
-	- libsixel <unfixed>
+	- libsixel <unfixed> (bug #1014526)
 	[bullseye] - libsixel <no-dsa> (Minor issue)
 	[buster] - libsixel <no-dsa> (Minor issue)
 	[stretch] - libsixel <no-dsa> (Minor issue)
@@ -20206,13 +20206,13 @@ CVE-2022-28044 (Irzip v0.640 was discovered to contain a heap memory corruption
 CVE-2022-28043
 	RESERVED
 CVE-2022-28042 (stb_image.h v2.27 was discovered to contain an heap-based use-after-fr ...)
-	- libstb <unfixed>
+	- libstb <unfixed> (bug #1014531)
 	[bullseye] - libstb <no-dsa> (Minor issue)
 	[buster] - libstb <no-dsa> (Minor issue)
 	NOTE: https://github.com/nothings/stb/issues/1289
 	NOTE: https://github.com/nothings/stb/pull/1297
 CVE-2022-28041 (stb_image.h v2.27 was discovered to contain an integer overflow via th ...)
-	- libstb <unfixed>
+	- libstb <unfixed> (bug #1014531)
 	[bullseye] - libstb <no-dsa> (Minor issue)
 	[buster] - libstb <no-dsa> (Minor issue)
 	NOTE: https://github.com/nothings/stb/issues/1292
@@ -51512,14 +51512,14 @@ CVE-2021-42717 (ModSecurity 3.x through 3.0.5 mishandles excessively nested JSON
 	NOTE: Fixed by: https://github.com/SpiderLabs/ModSecurity/commit/41918335fa4c74fba46a986771a5a6cb457070c4 (v2.9.5)
 	NOTE: Fixed by: https://github.com/SpiderLabs/ModSecurity/commit/ac79c1c29b7e6323e26cc984ad4f76ef62c731cd (v3.0.6)
 CVE-2021-42716 (An issue was discovered in stb stb_image.h 2.27. The PNM loader incorr ...)
-	- libstb <unfixed>
+	- libstb <unfixed> (bug #1014532)
 	[bullseye] - libstb <no-dsa> (Minor issue)
 	[buster] - libstb <no-dsa> (Minor issue)
 	NOTE: https://github.com/nothings/stb/issues/1166
 	NOTE: https://github.com/nothings/stb/issues/1225
 	NOTE: https://github.com/nothings/stb/pull/1223
 CVE-2021-42715 (An issue was discovered in stb stb_image.h 1.33 through 2.27. The HDR  ...)
-	- libstb <unfixed>
+	- libstb <unfixed> (bug #1014532)
 	[bullseye] - libstb <no-dsa> (Minor issue)
 	[buster] - libstb <no-dsa> (Minor issue)
 	NOTE: https://github.com/nothings/stb/issues/1224
@@ -90202,10 +90202,9 @@ CVE-2021-28023 (Arbitrary file upload in Service import feature in ServiceTonic
 CVE-2021-28022 (Blind SQL injection in the login form in ServiceTonic Helpdesk softwar ...)
 	NOT-FOR-US: ServiceTonic
 CVE-2021-28021 (Buffer overflow vulnerability in function stbi__extend_receive in stb_ ...)
-	- libstb <undetermined>
+	- libstb <unfixed> (bug #1014530)
 	NOTE: https://github.com/nothings/stb/issues/1108
 	NOTE: https://github.com/nothings/stb/commit/86b7570cfba845e8209c6aec2d15e487bb1d8bb4
-	TODO: check libstb itself, and various packages embedd a copy
 CVE-2021-28020
 	RESERVED
 CVE-2021-28019
@@ -106074,9 +106073,7 @@ CVE-2020-36125 (Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affec
 CVE-2020-36124 (Pax Technology PAXSTORE v7.0.8_20200511171508 and lower is affected by ...)
 	NOT-FOR-US: Pax Technology PAXSTORE
 CVE-2020-36123 (saitoha libsixel v1.8.6 was discovered to contain a double free via th ...)
-	- libsixel <undetermined>
-	NOTE: https://github.com/saitoha/libsixel/issues/144
-	TODO: check, unclear why reporter did close the issue again
+	NOTE: Bogus report for libsixel
 CVE-2020-36122
 	RESERVED
 CVE-2020-36121



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/383259b140153fa407587bcb31f455d622a5d7c6

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/383259b140153fa407587bcb31f455d622a5d7c6
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220707/d95dd26d/attachment.htm>


More information about the debian-security-tracker-commits mailing list