[Git][security-tracker-team/security-tracker][master] exiv2 fixed in sid

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a0237518 by Moritz Muehlenhoff at 2022-07-10T23:40:33+02:00
exiv2 fixed in sid
materialize bug

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -26441,12 +26441,11 @@ CVE-2022-25351
 CVE-2022-25350
 	RESERVED
 CVE-2022-25349 (All versions of package materialize-css are vulnerable to Cross-site S ...)
-	- materialize <undetermined>
+	- materialize <unfixed> (bug #1014727)
 	NOTE: https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2766498
 	NOTE: https://security.snyk.io/vuln/SNYK-JS-MATERIALIZECSS-2324800
 	NOTE: https://github.com/materializecss/materialize/blob/main/js/autocomplete.js#L310
 	NOTE: https://github.com/Dogfalo/materialize/blob/v1-dev/js/autocomplete.js#L285
-	TODO: check if affected, CVE reported against the upstream fork
 CVE-2022-25346
 	RESERVED
 CVE-2022-25345 (All versions of package @discordjs/opus are vulnerable to Denial of Se ...)
@@ -30208,12 +30207,12 @@ CVE-2022-0530 (A flaw was found in Unzip. The vulnerability occurs during the co
 	- unzip <unfixed> (bug #1010355)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2051395
 	NOTE: https://github.com/ByteHackr/unzip_poc
-	TODO: check details
+	NOTE: Unclear status, checking with upstream
 CVE-2022-0529 (A flaw was found in Unzip. The vulnerability occurs during the convers ...)
-	- unzip <unfixed>
+	- unzip <unfixed> (bug #1010355)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2051402
 	NOTE: https://github.com/ByteHackr/unzip_poc
-	TODO: check details
+	NOTE: Unclear status, checking with upstream
 CVE-2021-46681
 	RESERVED
 CVE-2021-46680
@@ -141179,9 +141178,9 @@ CVE-2020-19718 (An unhandled memory allocation failure in Core/Ap4Atom.cpp of Be
 CVE-2020-19717 (An unhandled memory allocation failure in Core/Ap48bdlAtom.cpp of Bent ...)
 	NOT-FOR-US: Bento4
 CVE-2020-19716 (A buffer overflow vulnerability in the Databuf function in types.cpp o ...)
-	- exiv2 <undetermined>
+	- exiv2 0.27.2-6
 	NOTE: https://github.com/Exiv2/exiv2/issues/980
-	TODO: check, unclear if fixed or not, upstream cannot reproduce as well in 0.27.1 as reported
+	NOTE: https://github.com/Exiv2/exiv2/commit/109d5df7abd329f141b500c92a00178d35a6bef3
 CVE-2020-19715
 	REJECTED
 CVE-2020-19714



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a0237518c6e893492575eb9e0e61cf75035de47c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/a0237518c6e893492575eb9e0e61cf75035de47c
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220710/fadbf9fe/attachment.htm>