[Git][security-tracker-team/security-tracker][master] 2 commits: Added hsqldb to dla-needed for further investigation. It is possibly a...

[Ola Lundqvist (@opal)]

Ola Lundqvist pushed to branch master at Debian Security Tracker / security-tracker


Commits:
a38a497a by Ola Lundqvist at 2022-10-31T14:35:45+01:00
Added hsqldb to dla-needed for further investigation. It is possibly a breaking change. A possible outcome is to ignore the issue.

- - - - -
3fbc4c14 by Ola Lundqvist at 2022-10-31T14:35:45+01:00
Adding jhead to dla-needed. One can argue that you have to trick someone to use some specific command option but arbitrary command execution should be fixed.

- - - - -


1 changed file:

- data/dla-needed.txt


Changes:

=====================================
data/dla-needed.txt
=====================================
@@ -78,6 +78,11 @@ golang-websocket
 graphicsmagick
   NOTE: 20221027: Programming language: C.
 --
+hsqldb
+  NOTE: 20221031: Programming language: Java.
+  NOTE: 20221031: To be investigated further. A possible outcome is to ignore it.
+  NOTE: 20221031: https://lists.debian.org/debian-lts/2022/10/msg00060.html.
+--
 imagemagick (gladk)
   NOTE: 20220904: Programming language: C.
   NOTE: 20220904: VCS: https://salsa.debian.org/lts-team/packages/imagemagick.git
@@ -90,6 +95,11 @@ ini4j
 jackson-databind
   NOTE: 20221030: Programming language: Java.
 --
+jhead
+  NOTE: 20221031: Programming language: C.
+  NOTE: 20221031: Note that multiple options are vulnerable. The attacker have to trick someone to execute the command but arbitrary code exectuion is not good..
+  NOTE: 20221031: It should be stated in the DLA that multiple options are affected..
+--
 joblib (Utkarsh)
   NOTE: 20221006: Programming language: Python.
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/38f016b32cb272c7d81309d8a49e449b05af4867...3fbc4c148d62c33824b00b11e1b9b3c35f40e179

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/38f016b32cb272c7d81309d8a49e449b05af4867...3fbc4c148d62c33824b00b11e1b9b3c35f40e179
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20221031/d305a8c3/attachment-0001.htm>