[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2019-19603/sqlite3: document affected versions

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
eece83d1 by Sylvain Beucler at 2022-07-23T10:53:03+02:00
CVE-2019-19603/sqlite3: document affected versions

- - - - -
8b553135 by Sylvain Beucler at 2022-07-23T10:53:04+02:00
CVE-2019-19645,CVE-2020-13631/sqlite3: fix inconsistent/incorrect lts triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -158586,8 +158586,8 @@ CVE-2020-13632 (ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL point
 CVE-2020-13631 (SQLite before 3.32.0 allows a virtual table to be renamed to the name  ...)
 	- sqlite3 3.32.0-1
 	[buster] - sqlite3 <ignored> (Minor issue, too intrusive to backport)
-	[stretch] - sqlite3 <not-affected> (Vulnerable code not present)
-	[jessie] - sqlite3 <no-dsa> (Too intrusive to backport)
+	[stretch] - sqlite3 <ignored> (Minor issue, too intrusive to backport)
+	[jessie] - sqlite3 <ignored> (Minor issue, too intrusive to backport)
 	NOTE: https://bugs.chromium.org/p/chromium/issues/detail?id=1080459
 	NOTE: https://sqlite.org/src/info/eca0ba2cf4c0fdf7
 CVE-2020-13630 (ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3Ev ...)
@@ -189431,8 +189431,8 @@ CVE-2019-19646 (pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an inte
 CVE-2019-19645 (alter.c in SQLite through 3.30.1 allows attackers to trigger infinite  ...)
 	- sqlite3 3.30.1+fossil191229-1 (bug #946612)
 	[buster] - sqlite3 <ignored> (Minor issue, too intrusive to backport)
-	[stretch] - sqlite3 <not-affected> (Vulnerable code introduced later)
-	[jessie] - sqlite3 <no-dsa> (Minor issue)
+	[stretch] - sqlite3 <ignored> (Minor issue, too intrusive to backport)
+	[jessie] - sqlite3 <ignored> (Minor issue, too intrusive to backport)
 	NOTE: https://github.com/sqlite/sqlite/commit/38096961c7cd109110ac21d3ed7dad7e0cb0ae06
 CVE-2019-19644
 	RESERVED
@@ -189562,8 +189562,9 @@ CVE-2019-19603 (SQLite 3.30.1 mishandles certain SELECT statements with a nonexi
 	- sqlite3 3.30.1+fossil191229-1
 	[buster] - sqlite3 <ignored> (Minor issue, too intrusive to backport)
 	[stretch] - sqlite3 <not-affected> (vulnerable code not present)
-	[jessie] - sqlite3 <no-dsa> (Minor issue)
+	[jessie] - sqlite3 <not-affected> (vulnerable code not present)
 	NOTE: https://github.com/sqlite/sqlite/commit/527cbd4a104cb93bf3994b3dd3619a6299a78b13
+	NOTE: read-only shadow tables introduced in https://github.com/sqlite/sqlite/commit/84c501bac16576916840daffb671b72cf1f75625 (3.26)
 CVE-2019-19601 (OpenDetex 2.8.5 has a Buffer Overflow in TexOpen in detex.l because of ...)
 	- texlive-bin <unfixed> (unimportant; bug #949630)
 	NOTE: https://github.com/pkubowicz/opendetex/issues/60



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/885c9f3ff9f1822d2bd9fda307202ebe9060cdea...8b553135a4689e831812c160d9d959e4c443d582

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/885c9f3ff9f1822d2bd9fda307202ebe9060cdea...8b553135a4689e831812c160d9d959e4c443d582
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20220723/52ef1157/attachment.htm>