[Git][security-tracker-team/security-tracker][master] Process some NFUs

Salvatore Bonaccorso (@carnil) carnil at debian.org
Wed Oct 19 20:39:01 BST 2022 


Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b9ef7bb0 by Salvatore Bonaccorso at 2022-10-19T21:38:33+02:00
Process some NFUs

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -9615,13 +9615,13 @@ CVE-2022-39421 (Vulnerability in the Oracle VM VirtualBox product of Oracle Virt
 	- virtualbox 6.1.40-dfsg-1
 	NOTE: https://www.oracle.com/security-alerts/cpuoct2022.html#AppendixOVIR
 CVE-2022-39420 (Vulnerability in the Oracle Transportation Management product of Oracl ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39419 (Vulnerability in the Java VM component of Oracle Database Server. Supp ...)
 	TODO: check
 CVE-2022-39418
 	RESERVED
 CVE-2022-39417 (Vulnerability in the Oracle Solaris product of Oracle Systems (compone ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39416
 	RESERVED
 CVE-2022-39415
@@ -9631,30 +9631,30 @@ CVE-2022-39414
 CVE-2022-39413
 	RESERVED
 CVE-2022-39412 (Vulnerability in the Oracle Access Manager product of Oracle Fusion Mi ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39411 (Vulnerability in the Oracle Transportation Management product of Oracl ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39410 (Vulnerability in the MySQL Server product of Oracle MySQL (component:  ...)
 	- mysql-8.0 <unfixed>
 CVE-2022-39409 (Vulnerability in the Oracle Transportation Management product of Oracl ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39408 (Vulnerability in the MySQL Server product of Oracle MySQL (component:  ...)
 	- mysql-8.0 <unfixed>
 CVE-2022-39407 (Vulnerability in the PeopleSoft Enterprise PeopleTools product of Orac ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39406 (Vulnerability in the PeopleSoft Enterprise Common Components product o ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39405 (Vulnerability in the Oracle Access Manager product of Oracle Fusion Mi ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39404 (Vulnerability in the MySQL Installer product of Oracle MySQL (componen ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39403 (Vulnerability in the MySQL Shell product of Oracle MySQL (component: S ...)
 	- mysql-8.0 <unfixed>
 	TODO: check, component "MySQL Shell", unclear if in src:mysql-8.0
 CVE-2022-39402 (Vulnerability in the MySQL Shell product of Oracle MySQL (component: S ...)
 	- mysql-8.0 <unfixed>
 CVE-2022-39401 (Vulnerability in the Oracle Solaris product of Oracle Systems (compone ...)
-	TODO: check
+	NOT-FOR-US: Oracle
 CVE-2022-39400 (Vulnerability in the MySQL Server product of Oracle MySQL (component:  ...)
 	- mysql-8.0 <unfixed>
 CVE-2022-39399 (Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition ...)
@@ -10539,13 +10539,13 @@ CVE-2022-39060
 CVE-2022-39059
 	RESERVED
 CVE-2022-39058 (RAVA certification validation system has a path traversal vulnerabilit ...)
-	TODO: check
+	NOT-FOR-US: RAVA certification validation system
 CVE-2022-39057 (RAVA certificate validation system has insufficient filtering for spec ...)
-	TODO: check
+	NOT-FOR-US: RAVA certification validation system
 CVE-2022-39056 (RAVA certificate validation system has insufficient validation for use ...)
-	TODO: check
+	NOT-FOR-US: RAVA certification validation system
 CVE-2022-39055 (RAVA certificate validation system has inadequate filtering for URL pa ...)
-	TODO: check
+	NOT-FOR-US: RAVA certification validation system
 CVE-2022-39054 (Cowell enterprise travel management system has insufficient filtering  ...)
 	NOT-FOR-US: Cowell enterprise travel management system
 CVE-2022-39053 (Heimavista Rpage has insufficient filtering for platform web URL. An u ...)
@@ -10966,7 +10966,7 @@ CVE-2022-38903
 CVE-2022-38902 (A Cross-site scripting (XSS) vulnerability in the Blog module - add ne ...)
 	NOT-FOR-US: Liferay
 CVE-2022-38901 (A Cross-site scripting (XSS) vulnerability in the Document and Media m ...)
-	TODO: check
+	NOT-FOR-US: Liferay
 CVE-2022-38900
 	RESERVED
 CVE-2022-38899
@@ -11510,7 +11510,7 @@ CVE-2020-36602 (There is an out-of-bounds read and write vulnerability in some h
 CVE-2022-38744
 	RESERVED
 CVE-2022-38743 (Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, ...)
-	TODO: check
+	NOT-FOR-US: Rockwell Automation
 CVE-2022-38742 (Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is ...)
 	NOT-FOR-US: Rockwell Automation
 CVE-2022-38741
@@ -17652,9 +17652,9 @@ CVE-2022-2529 (sflow decode package does not employ sufficient packet sanitisati
 CVE-2022-2528 (In affected versions of Octopus Deploy it is possible to upload a pack ...)
 	NOT-FOR-US: Octopus Deploy
 CVE-2022-36439 (AsusSoftwareManager.exe in ASUS System Control Interface on ASUS perso ...)
-	TODO: check
+	NOT-FOR-US: ASUS
 CVE-2022-36438 (AsusSwitch.exe on ASUS personal computers (running Windows) sets weak  ...)
-	TODO: check
+	NOT-FOR-US: ASUS
 CVE-2022-36437
 	RESERVED
 CVE-2022-36436 (OSU Open Source Lab VNCAuthProxy through 1.1.1 is affected by an vncap ...)
@@ -26367,13 +26367,13 @@ CVE-2022-33219
 CVE-2022-33218
 	RESERVED
 CVE-2022-33217 (Memory corruption in Qualcomm IPC due to buffer copy without checking  ...)
-	TODO: check
+	NOT-FOR-US: Qualcomm
 CVE-2022-33216
 	RESERVED
 CVE-2022-33215
 	RESERVED
 CVE-2022-33214 (Memory corruption in display due to time-of-check time-of-use of metad ...)
-	TODO: check
+	NOT-FOR-US: Snapdragon
 CVE-2022-33213
 	RESERVED
 CVE-2022-33212
@@ -26381,7 +26381,7 @@ CVE-2022-33212
 CVE-2022-33211
 	RESERVED
 CVE-2022-33210 (Memory corruption in automotive multimedia due to use of out-of-range  ...)
-	TODO: check
+	NOT-FOR-US: Snapdragon
 CVE-2022-33146 (Open redirect vulnerability in web2py versions prior to 2.22.5 allows  ...)
 	- web2py <removed>
 CVE-2022-32585 (A command execution vulnerability exists in the clish art2 functionali ...)
@@ -32458,7 +32458,7 @@ CVE-2022-31039 (Greenlight is a simple front-end interface for your BigBlueButto
 CVE-2022-31038 (Gogs is an open source self-hosted Git service. In versions of gogs pr ...)
 	NOT-FOR-US: Go Git Service
 CVE-2022-31037 (OroCommerce is an open-source Business to Business Commerce applicatio ...)
-	TODO: check
+	NOT-FOR-US: OroCommerce
 CVE-2022-31036 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
 	NOT-FOR-US: Argo CD
 CVE-2022-31035 (Argo CD is a declarative, GitOps continuous delivery tool for Kubernet ...)
@@ -48133,7 +48133,7 @@ CVE-2022-25725
 CVE-2022-25724
 	RESERVED
 CVE-2022-25723 (Memory corruption in multimedia due to use after free during callback  ...)
-	TODO: check
+	NOT-FOR-US: Snapdragon
 CVE-2022-25722
 	RESERVED
 CVE-2022-25721



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b9ef7bb069f7eeb14336bd2e6ae2e5c478f44ad9

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b9ef7bb069f7eeb14336bd2e6ae2e5c478f44ad9
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20221019/b17f886c/attachment.htm>

More information about the debian-security-tracker-commits mailing list