[Git][security-tracker-team/security-tracker][master] bullseye triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri May 19 15:32:37 BST 2023
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
234c492e by Moritz Muehlenhoff at 2023-05-19T16:32:05+02:00
bullseye triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -5734,6 +5734,7 @@ CVE-2023-29660
RESERVED
CVE-2023-29659 (A Segmentation fault caused by a floating point exception exists in li ...)
- libheif <unfixed> (bug #1035607)
+ [bullseye] - libheif <no-dsa> (Minor issue)
NOTE: https://github.com/strukturag/libheif/issues/794
NOTE: https://github.com/strukturag/libheif/commit/e05e15b57a38ec411cb9acb38512a1c36ff62991 (v1.15.2)
CVE-2023-29658
@@ -8535,6 +8536,7 @@ CVE-2023-1625 [information leak in API]
RESERVED
[experimental] - heat 1:20.0.0~rc1-1
- heat 1:19.0.0-2 (bug #1034186)
+ [bullseye] - heat <no-dsa> (Minor issue)
[buster] - heat <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2181621
NOTE: https://review.opendev.org/c/openstack/heat/+/868166
@@ -21424,6 +21426,7 @@ CVE-2023-24531
CVE-2023-24473 (An information disclosure vulnerability exists in the TGAInput::read_t ...)
[experimental] - openimageio 2.4.9.0+dfsg-1
- openimageio <unfixed> (bug #1034150)
+ [bullseye] - openimageio <no-dsa> (Minor issue)
NOTE: https://github.com/OpenImageIO/oiio/pull/3768
NOTE: https://github.com/OpenImageIO/oiio/commit/759fcd392d130c12ae476857e1ed2a91bcf2686b (master)
NOTE: https://github.com/OpenImageIO/oiio/commit/209bb4c327b2a8be08f41c1a213dfe9001f0b5d0 (v2.4.8.1)
@@ -21431,12 +21434,14 @@ CVE-2023-24473 (An information disclosure vulnerability exists in the TGAInput::
CVE-2023-24472 (A denial of service vulnerability exists in the FitsOutput::close() fu ...)
[experimental] - openimageio 2.4.9.0+dfsg-1
- openimageio <unfixed> (bug #1034151)
+ [bullseye] - openimageio <no-dsa> (Minor issue)
NOTE: https://github.com/OpenImageIO/oiio/commit/f8db9f38d18a66889f444031051e0f0acaa611b6 (master)
NOTE: https://github.com/OpenImageIO/oiio/commit/a39692256b060b543f53646c6a807c81b79c5750 (v2.4.8.1)
NOTE: https://talosintelligence.com/vulnerability_reports/TALOS-2023-1709
CVE-2023-22845 (An out-of-bounds read vulnerability exists in the TGAInput::decode_pix ...)
[experimental] - openimageio 2.4.9.0+dfsg-1
- openimageio <unfixed> (bug #1034150)
+ [bullseye] - openimageio <no-dsa> (Minor issue)
NOTE: https://github.com/OpenImageIO/oiio/pull/3768
NOTE: https://github.com/OpenImageIO/oiio/commit/759fcd392d130c12ae476857e1ed2a91bcf2686b (master)
NOTE: https://github.com/OpenImageIO/oiio/commit/209bb4c327b2a8be08f41c1a213dfe9001f0b5d0 (v2.4.8.1)
@@ -67724,6 +67729,7 @@ CVE-2022-31471 (untangle is a python library to convert XML data to python objec
NOTE: https://github.com/stchris/untangle/pull/94
CVE-2022-2393 (A flaw was found in pki-core, which could allow a user to get a certif ...)
- dogtag-pki <unfixed> (bug #1034802)
+ [bullseye] - dogtag-pki <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2101046
CVE-2022-2392 (The Lana Downloads Manager WordPress plugin before 1.8.0 is affected b ...)
NOT-FOR-US: WordPress plugin
@@ -193942,9 +193948,10 @@ CVE-2020-27509 (Persistent XSS in Galaxkey Secure Mail Client in Galaxkey up to
CVE-2020-27508 (In two-factor authentication, the system also sending 2fa secret key i ...)
NOT-FOR-US: Frappe Framework
CVE-2020-27507 (The Kamailio SIP before 5.5.0 server mishandles INVITE requests with d ...)
- - kamailio 5.5.3-1
- NOTE: https://github.com/kamailio/kamailio/commit/ada3701d22b1fd579f06b4f54fa695fa988e685f (5.5.0)
+ - kamailio 5.4.2-1
NOTE: https://github.com/kamailio/kamailio/issues/2503
+ NOTE: https://github.com/kamailio/kamailio/commit/f57c900b438f3233fa1e9a9d3ca8cd383a30baa6 (5.4.2) (5.4 branch)
+ NOTE: https://github.com/kamailio/kamailio/commit/ada3701d22b1fd579f06b4f54fa695fa988e685f (5.5.0) (master branch)
CVE-2020-27506
RESERVED
CVE-2020-27505
=====================================
data/dsa-needed.txt
=====================================
@@ -14,6 +14,8 @@ If needed, specify the release by adding a slash after the name of the source pa
--
asterisk
--
+cinder
+--
cups-filters
--
gpac (aron)
@@ -37,6 +39,8 @@ netatalk
open regression with MacOS, tentative patch not yet merged upstream
See discussion on team mailing list.
--
+nova
+--
openjdk-11 (jmm)
--
openjdk-17 (jmm)
@@ -51,6 +55,10 @@ php-horde-turba
--
py7zr
--
+python-glance-store
+--
+python-os-brick
+--
python-werkzeug
--
ring
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/234c492e44d69ad58d708c5a6f68a18c28eb3dab
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/234c492e44d69ad58d708c5a6f68a18c28eb3dab
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230519/dc25e4b0/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list