[Git][security-tracker-team/security-tracker][master] bulleye triage

Moritz Muehlenhoff (@jmm) jmm at debian.org
Wed Nov 2 12:37:33 GMT 2022



Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
3edb5343 by Moritz Muehlenhoff at 2022-11-02T13:37:19+01:00
bulleye triage

- - - - -


2 changed files:

- data/CVE/list
- data/dsa-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -5159,17 +5159,21 @@ CVE-2022-43285 (Nginx NJS v0.7.4 was discovered to contain a segmentation violat
 CVE-2022-43284 (Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation vi ...)
 	NOT-FOR-US: njs
 CVE-2022-43283 (wasm2c v1.0.29 was discovered to contain an abort in CWriter::Write. ...)
-	- wabt <unfixed>
+	- wabt <unfixed> (unimportant)
 	NOTE: https://github.com/WebAssembly/wabt/issues/1985
+	NOTE: Crash in CLI tool, no security impact
 CVE-2022-43282 (wasm-interp v1.0.29 was discovered to contain an out-of-bounds read vi ...)
-	- wabt <unfixed>
+	- wabt <unfixed> (unimportant)
 	NOTE: https://github.com/WebAssembly/wabt/issues/1983
+	NOTE: Crash in CLI tool, no security impact
 CVE-2022-43281 (wasm-interp v1.0.29 was discovered to contain a heap overflow via the  ...)
-	- wabt <unfixed>
+	- wabt <unfixed> (unimportant)
 	NOTE: https://github.com/WebAssembly/wabt/issues/1981
+	NOTE: Crash in CLI tool, no security impact
 CVE-2022-43280 (wasm-interp v1.0.29 was discovered to contain an out-of-bounds read vi ...)
-	- wabt <unfixed>
+	- wabt <unfixed> (unimportant)
 	NOTE: https://github.com/WebAssembly/wabt/issues/1982
+	NOTE: Crash in CLI tool, no security impact
 CVE-2022-43279
 	RESERVED
 CVE-2022-43278
@@ -5427,9 +5431,10 @@ CVE-2022-43153
 CVE-2022-43152 (tsMuxer v2.6.16 was discovered to contain a heap overflow via the func ...)
 	NOT-FOR-US: tsMuxer
 CVE-2022-43151 (timg v1.4.4 was discovered to contain a memory leak via the function t ...)
-	- timg <unfixed>
+	- timg <unfixed> (unimportant)
 	NOTE: https://github.com/hzeller/timg/issues/92
 	NOTE: https://github.com/hzeller/timg/commit/e9667ea2c811aa9eb399b631aef9bba0d3711834
+	NOTE: Memory leak in terminal application, no security impact
 CVE-2022-43150
 	RESERVED
 CVE-2022-43149
@@ -7807,13 +7812,12 @@ CVE-2022-42253
 	RESERVED
 CVE-2022-42252 (If Apache Tomcat 8.5.0 to 8.5.52, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10. ...)
 	- tomcat9 9.0.68-1
+	[bullseye] - tomcat9 <postponed> (Minor issue, fix along in future update)
 	[buster] - tomcat9 <no-dsa> (Minor issue, occurs when system is explicitly configured in an insecure way)
 	- tomcat8 <removed>
 	NOTE: https://lists.apache.org/thread/zzcxzvqfdqn515zfs3dxb7n8gty589sq
 	NOTE: https://github.com/apache/tomcat/commit/4c7f4fd09d2cc1692112ef70b8ee23a7a037ae77 (9.0.68)
 	NOTE: https://github.com/apache/tomcat/commit/a1c07906d8dcaf7957e5cc97f5cdbac7d18a205a (8.5.83)
-	NOTE: One could consider this security issue as expected behavior because the problem described is that
-	NOTE: a specific invalid header is accepted when tomcat is configured to accept invalid headers.
 CVE-2022-3406
 	RESERVED
 CVE-2022-3405
@@ -14724,6 +14728,7 @@ CVE-2022-39349 (The Tasks.org Android app is an open-source app for to-do lists
 	TODO: check
 CVE-2022-39348 (Twisted is an event-based framework for internet applications. Started ...)
 	- twisted <unfixed>
+	[bullseye] - twisted <no-dsa> (Minor issue)
 	NOTE: https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
 	NOTE: Introduced by: https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4
 	NOTE: Fixed by: https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b (twisted-22.10.0rc1)
@@ -28100,9 +28105,10 @@ CVE-2022-2208 (NULL Pointer Dereference in GitHub repository vim/vim prior to 8.
 	NOTE: https://github.com/vim/vim/commit/cd38bb4d83c942c4bad596835c6766cbf32e5195 (v8.2.5163)
 	NOTE: Crash in CLI tool, no security impact
 CVE-2022-2207 (Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. ...)
-	- vim 2:9.0.0135-1 (bug #1015984)
+	- vim 2:9.0.0135-1 (unimportant; bug #1015984)
 	NOTE: https://huntr.dev/bounties/05bc6051-4dc3-483b-ae56-cf23346b97b9
 	NOTE: https://github.com/vim/vim/commit/0971c7a4e537ea120a6bb2195960be8d0815e97b (v8.2.5162)
+	NOTE: Crash in CLI tool, no security impact
 CVE-2022-34493
 	RESERVED
 CVE-2022-34492
@@ -29549,19 +29555,22 @@ CVE-2022-2127
 	RESERVED
 CVE-2022-2126 (Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. ...)
 	{DLA-3053-1}
-	- vim 2:9.0.0135-1 (bug #1015984)
+	- vim 2:9.0.0135-1 (unimportant; bug #1015984)
 	NOTE: https://huntr.dev/bounties/8d196d9b-3d10-41d2-9f70-8ef0d08c946e
 	NOTE: https://github.com/vim/vim/commit/156d3911952d73b03d7420dc3540215247db0fe8 (v8.2.5123)
+	NOTE: Crash in CLI tool, no security impact
 CVE-2022-2125 (Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. ...)
-	- vim 2:9.0.0135-1 (bug #1015984)
+	- vim 2:9.0.0135-1 (unimportant; bug #1015984)
 	[stretch] - vim <postponed> (Minor issue)
 	NOTE: https://huntr.dev/bounties/17dab24d-beec-464d-9a72-5b6b11283705
 	NOTE: https://github.com/vim/vim/commit/0e8e938d497260dd57be67b4966cb27a5f72376f (v8.2.5122)
+	NOTE: Crash in CLI tool, no security impact
 CVE-2022-2124 (Buffer Over-read in GitHub repository vim/vim prior to 8.2. ...)
 	{DLA-3053-1}
-	- vim 2:9.0.0135-1 (bug #1015984)
+	- vim 2:9.0.0135-1 (unimportant; bug #1015984)
 	NOTE: https://huntr.dev/bounties/8e9e056d-f733-4540-98b6-414bf36e0b42
 	NOTE: https://github.com/vim/vim/commit/2f074f4685897ab7212e25931eeeb0212292829f (v8.2.5120)
+	NOTE: Crash in CLI tool, no security impact
 CVE-2021-46823 (python-ldap before 3.4.0 is vulnerable to a denial of service when lda ...)
 	- python-ldap 3.4.0-1
 	[bullseye] - python-ldap <no-dsa> (Minor issue)


=====================================
data/dsa-needed.txt
=====================================
@@ -68,5 +68,7 @@ sofia-sip
 sox
   patch needed for CVE-2021-40426, check with upstream
 --
+tiff
+--
 xen
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3edb534300d0734b6126c1c5822fc504d325cbf8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3edb534300d0734b6126c1c5822fc504d325cbf8
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20221102/cb291ed2/attachment.htm>


More information about the debian-security-tracker-commits mailing list