[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2023-0330/qemu: fix is available, update buster triage

[Sylvain Beucler (@beuc)]

Sylvain Beucler pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d7614158 by Sylvain Beucler at 2023-07-31T19:46:32+02:00
CVE-2023-0330/qemu: fix is available, update buster triage

- - - - -
18cf48d9 by Sylvain Beucler at 2023-07-31T19:46:34+02:00
CVE-2021-3750/qemu: reference final generic reentrancy fix, update buster triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -32662,10 +32662,11 @@ CVE-2023-0330 (A vulnerability in the lsi53c895a device affects the latest versi
 	- qemu 1:8.0.2+dfsg-1 (bug #1029155)
 	[bookworm] - qemu 1:7.2+dfsg-7+deb12u1
 	[bullseye] - qemu <no-dsa> (Minor issue)
-	[buster] - qemu <postponed> (Minor issue, waiting for sanctioned patch)
+	[buster] - qemu <postponed> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2160151
 	NOTE: Proposed patch: https://lists.nongnu.org/archive/html/qemu-devel/2023-01/msg03411.html
 	NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/e49884a90987744ddb54b2fadc770633eb6a4d62 (v8.0.1)
+	NOTE: See also generic re-entrancy ground work at https://gitlab.com/qemu-project/qemu/-/issues/556
 CVE-2023-0329 (The Elementor Website Builder WordPress plugin before 3.12.2 does not  ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2022-48261 (There is a misinterpretation of input vulnerability in BiSheng-WNM FW  ...)
@@ -138265,8 +138266,8 @@ CVE-2021-40320
 CVE-2021-3750 (A DMA reentrancy issue was found in the USB EHCI controller emulation  ...)
 	- qemu 1:7.0+dfsg-1
 	[bullseye] - qemu <no-dsa> (Minor issue)
-	[buster] - qemu <postponed> (Minor issue, unclear status, follow bullseye updates)
-	[stretch] - qemu <postponed> (Minor issue, unclear status, follow bullseye updates)
+	[buster] - qemu <postponed> (Minor issue, follow bullseye updates)
+	[stretch] - qemu <postponed> (Minor issue, follow bullseye updates)
 	NOTE: https://gitlab.com/qemu-project/qemu/-/issues/541
 	NOTE: Fix for whole class of DMA MMIO reentrancy issues: https://gitlab.com/qemu-project/qemu/-/issues/556
 	NOTE: Patchset: https://lists.nongnu.org/archive/html/qemu-devel/2021-12/msg02356.html
@@ -138274,6 +138275,7 @@ CVE-2021-3750 (A DMA reentrancy issue was found in the USB EHCI controller emula
 	NOTE: https://gitlab.com/qemu-project/qemu/-/commit/58e74682baf4e1ad26b064d8c02e5bc99c75c5d9 (v7.0.0-rc1)
 	NOTE: https://gitlab.com/qemu-project/qemu/-/commit/3ab6fdc91b72e156da22848f0003ff4225690ced (v7.0.0-rc1)
 	NOTE: Possibly incomplete patch set: https://gitlab.com/qemu-project/qemu/-/issues/541#note_1179940468
+	NOTE: Final fix: https://gitlab.com/qemu-project/qemu/-/commit/a2e1753b8054344f32cf94f31c6399a58794a380 (v8.1.0-rc0)
 CVE-2021-3749 (axios is vulnerable to Inefficient Regular Expression Complexity)
 	- node-axios 0.21.3+dfsg-1
 	[bullseye] - node-axios 0.21.1+dfsg-1+deb11u1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/abb15c014e2e7ee5f7971b14c4f4cb6a299642c9...18cf48d997b292b7e353b322d2f3cbcd04149f38

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/abb15c014e2e7ee5f7971b14c4f4cb6a299642c9...18cf48d997b292b7e353b322d2f3cbcd04149f38
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230731/bfabbae6/attachment-0001.htm>