[Git][security-tracker-team/security-tracker][master] 5 commits: Track fixed version for CVE-2021-38371/exim4 via unstable

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
68739287 by Salvatore Bonaccorso at 2023-03-17T09:09:41+01:00
Track fixed version for CVE-2021-38371/exim4 via unstable

- - - - -
b5e42675 by Salvatore Bonaccorso at 2023-03-17T09:09:43+01:00
Add CVE-2023-24278 as NFU

- - - - -
d58f7830 by Salvatore Bonaccorso at 2023-03-17T09:09:44+01:00
Update information for CVE-2022-38457 and CVE-2022-40133

- - - - -
e0021e06 by Salvatore Bonaccorso at 2023-03-17T09:09:46+01:00
Track fixed version for CVE-2020-25016/rust-rgb via unstable

- - - - -
b55d4864 by Salvatore Bonaccorso at 2023-03-17T09:09:47+01:00
Update information for CVE-2022-43995/sudo

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -11928,6 +11928,7 @@ CVE-2023-24279 (A cross-site scripting (XSS) vulnerability in Open Networking Fo
 	NOT-FOR-US: Open Networking Foundation ONOS
 CVE-2023-24278
 	RESERVED
+	NOT-FOR-US: Squidex
 CVE-2023-24277
 	RESERVED
 CVE-2023-24276 (TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a co ...)
@@ -32644,8 +32645,8 @@ CVE-2022-43997 (Incorrect access control in Aternity agent in Riverbed Aternity
 CVE-2022-43996 (The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF d ...)
 	NOT-FOR-US: csaf_provider
 CVE-2022-43995 (Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains ...)
-	- sudo <unfixed> (unimportant)
-	NOTE: Fixed by: https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050
+	- sudo 1.9.12p1-1 (unimportant)
+	NOTE: Fixed by: https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050 (SUDO_1_9_12p1)
 	NOTE: Binary packages compiled with PAM support not enabling the plugins/sudoers/auth/passwd.c code
 CVE-2022-43994
 	RESERVED
@@ -44822,11 +44823,11 @@ CVE-2022-40139 (Improper validation of some components used by the rollback mech
 CVE-2022-40138 (An integer conversion error in Hermes bytecode generation, prior to co ...)
 	NOT-FOR-US: Facebook Hermes
 CVE-2022-40133 (A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf ...)
-	- linux <unfixed>
+	- linux 6.1.7-1
 	[buster] - linux <not-affected> (Vulnerable code not present)
 	NOTE: https://bugzilla.openanolis.cn/show_bug.cgi?id=2075
 CVE-2022-38457 (A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res ...)
-	- linux <unfixed>
+	- linux 6.1.7-1
 	[buster] - linux <not-affected> (Vulnerable code not present)
 	NOTE: https://bugzilla.openanolis.cn/show_bug.cgi?id=2074
 CVE-2022-38096 (A NULL pointer dereference vulnerability was found in vmwgfx driver in ...)
@@ -123091,7 +123092,7 @@ CVE-2021-38373 (In KDE KMail 19.12.3 (aka 5.13.3), the SMTP STARTTLS option is n
 CVE-2021-38372 (In KDE Trojita 0.7, man-in-the-middle attackers can create new folders ...)
 	- trojita <itp> (bug #795701)
 CVE-2021-38371 (The STARTTLS feature in Exim through 4.94.2 allows response injection  ...)
-	- exim4 <unfixed> (bug #992172)
+	- exim4 4.95~RC2-1 (bug #992172)
 	[bullseye] - exim4 <no-dsa> (Minor issue)
 	[buster] - exim4 <no-dsa> (Minor issue)
 	[stretch] - exim4 <postponed> (Minor issue, revisit when fixed upstream)
@@ -189377,7 +189378,7 @@ CVE-2020-24863 (A memory corruption vulnerability was found in the kernel functi
 CVE-2020-24862 (The catID parameter in Pharmacy Medical Store and Sale Point v1.0 has  ...)
 	NOT-FOR-US: Pharmacy Medical Store and Sale Point
 CVE-2020-25016 (A safety violation was discovered in the rgb crate before 0.8.20 for R ...)
-	- rust-rgb <unfixed> (bug #969213)
+	- rust-rgb 0.8.36-1 (bug #969213)
 	[bullseye] - rust-rgb <no-dsa> (Minor issue)
 	[buster] - rust-rgb <no-dsa> (Minor issue)
 	NOTE: https://rustsec.org/advisories/RUSTSEC-2020-0029.html



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/f6c41193d4b7bda16ec132f26a43e82407c068cc...b55d48649620832d1fb35d332fe14a7dbc4dbe7e

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/f6c41193d4b7bda16ec132f26a43e82407c068cc...b55d48649620832d1fb35d332fe14a7dbc4dbe7e
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230317/bb57d449/attachment.htm>