[Git][security-tracker-team/security-tracker][master] bullseye/bookworm triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Mon Jun 19 16:41:19 BST 2023
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
89ead2a8 by Moritz Muehlenhoff at 2023-06-19T17:40:13+02:00
bullseye/bookworm triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -809,6 +809,8 @@ CVE-2015-10118 (A vulnerability classified as problematic was found in cchetanon
NOT-FOR-US: WordPress plugin
CVE-2023-3195 (A stack-based buffer overflow issue was found in ImageMagick's coders/ ...)
- imagemagick <unfixed>
+ [bookworm] - imagemagick <no-dsa> (Minor issue)
+ [bullseye] - imagemagick <no-dsa> (Minor issue)
[buster] - imagemagick <no-dsa> (Minor issue)
NOTE: https://www.openwall.com/lists/oss-security/2023/05/29/1
NOTE: ImageMagick6: https://github.com/ImageMagick/ImageMagick6/commit/85a370c79afeb45a97842b0959366af5236e9023 (6.9.12-26)
@@ -1363,6 +1365,8 @@ CVE-2023-33477 (In Harmonic NSG 9000-6G devices, an authenticated remote user ca
NOT-FOR-US: Harmonic NSG 9000-6G devices
CVE-2023-33460 (There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse functi ...)
- yajl <unfixed>
+ [bookworm] - yajl <no-dsa> (Minor issue)
+ [bullseye] - yajl <no-dsa> (Minor issue)
[buster] - yajl <postponed> (Minor issue)
NOTE: https://github.com/lloyd/yajl/issues/250
CVE-2023-33457 (In Sogou Workflow v0.10.6, memcpy a negtive size in URIParser::parse , ...)
@@ -2563,6 +2567,8 @@ CVE-2023-27529 (Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) conta
NOT-FOR-US: Wacom Tablet Driver installer
CVE-2023-XXXX [Block themes parsing shortcodes in user-generated data]
- wordpress 6.2.2+dfsg1-1 (bug #1036689)
+ [bookworm] - wordpress <postponed> (Minor issue, fix along in future update)
+ [bullseye] - wordpress <postponed> (Minor issue, fix along in future update)
NOTE: https://wordpress.org/news/2023/05/wordpress-6-2-2-security-release/
CVE-2023-33983 (The Introduction Client in Briar through 1.5.3 does not implement out- ...)
- briar <itp> (bug #1019932)
@@ -3135,6 +3141,8 @@ CVE-2023-2756 (SQL Injection in GitHub repository pimcore/customer-data-framewor
NOT-FOR-US: pimcore
CVE-2023-2745 (WordPress Core is vulnerable to Directory Traversal in versions up to, ...)
- wordpress 6.2.1+dfsg1-1 (bug #1036296)
+ [bookworm] - wordpress <postponed> (Minor issue, fix along in future update)
+ [bullseye] - wordpress <postponed> (Minor issue, fix along in future update)
NOTE: https://core.trac.wordpress.org/changeset?old=55765&new=55765
NOTE: https://wordpress.org/news/2023/05/wordpress-6-2-1-maintenance-security-release/
CVE-2023-2679 (Data leakage in Adobe connector in Snow Software SPE 9.27.0 on Windows ...)
@@ -9342,6 +9350,7 @@ CVE-2012-10010 (A vulnerability was found in BestWebSoft Contact Form 3.21. It h
NOT-FOR-US: WordPress plugin
CVE-2023-32665 [GVariant deserialisation does not match spec for non-normal data]
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2121
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -9351,6 +9360,7 @@ CVE-2023-32665 [GVariant deserialisation does not match spec for non-normal data
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2841
CVE-2023-32611 [g_variant_byteswap() can take a long time with some non-normal inputs]
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2797
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -9360,6 +9370,7 @@ CVE-2023-32611 [g_variant_byteswap() can take a long time with some non-normal i
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2841
CVE-2023-29499 [GVariant offset table entry size is not checked in is_normal()]
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/glib/-/issues/2794
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -11895,6 +11906,7 @@ CVE-2023-28766 (A vulnerability has been identified in SIPROTEC 5 6MD85 (CP300)
CVE-2023-25180
RESERVED
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -11906,6 +11918,7 @@ CVE-2023-25180
CVE-2023-24593
RESERVED
- glib2.0 2.74.4-1
+ [bullseye] - glib2.0 <no-dsa> (Minor issue)
NOTE: https://discourse.gnome.org/t/multiple-fixes-for-gvariant-normalisation-issues-in-glib/12835
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3125
NOTE: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/3126
@@ -22189,6 +22202,8 @@ CVE-2023-25441
RESERVED
CVE-2023-25440 (Stored Cross Site Scripting (XSS) vulnerability in the add contact fun ...)
- civicrm <unfixed> (bug #1036695)
+ [bullseye] - civicrm <no-dsa> (Minor issue)
+ NOTE: https://packetstormsecurity.com/files/172470/CiviCRM-5.59.alpha1-Cross-Site-Scripting.html
CVE-2023-25439 (Stored Cross Site Scripting (XSS) vulnerability in Square Pig FusionIn ...)
NOT-FOR-US: Square Pig FusionInvoice
CVE-2023-25438 (An issue was discovered in Genomedics MilleGP5 5.9.2, allows remote at ...)
@@ -102890,6 +102905,7 @@ CVE-2022-24725 (Shescape is a shell escape package for JavaScript. An issue in v
NOT-FOR-US: Node shescape
CVE-2022-24724 (cmark-gfm is GitHub's extended version of the C reference implementati ...)
- cmark-gfm 0.29.0.gfm.3-3 (bug #1006756)
+ [bullseye] - cmark-gfm <no-dsa> (Minor issue)
[buster] - cmark-gfm <no-dsa> (Minor issue)
- ghostwriter 2.1.6+ds-1 (bug #1006757)
[bullseye] - ghostwriter <not-affected> (Vulnerable code not present)
@@ -112123,6 +112139,7 @@ CVE-2021-45986 (Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to
NOT-FOR-US: Tenda routers
CVE-2021-45985 (In Lua 5.4.3, an erroneous finalizer called during a tail call leads t ...)
- lua5.4 5.4.4-1
+ [bullseye] - lua5.4 <no-dsa> (Minor issue)
- lua5.3 <not-affected> (Specific to 5.4)
- lua5.2 <not-affected> (Specific to 5.4)
- lua5.1 <not-affected> (Specific to 5.4)
=====================================
data/dsa-needed.txt
=====================================
@@ -30,6 +30,8 @@ nbconvert/oldstable
--
maradns/oldstable
--
+minidlna
+--
netatalk/oldstable
open regression with MacOS, tentative patch not yet merged upstream
See discussion on team mailing list.
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89ead2a89eecdb02380832be6bd962e064a906b7
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/89ead2a89eecdb02380832be6bd962e064a906b7
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230619/d1765a10/attachment.htm>
More information about the debian-security-tracker-commits
mailing list