[Git][security-tracker-team/security-tracker][master] 6 commits: Triage CVE-2023-4380 in ansible for buster LTS.

[Chris Lamb (@lamby)]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
fc32ea53 by Chris Lamb at 2023-09-05T11:18:58-07:00
Triage CVE-2023-4380 in ansible for buster LTS.

- - - - -
9afd3882 by Chris Lamb at 2023-09-05T11:19:42-07:00
Triage CVE-2023-39810 in busybox for buster LTS.

- - - - -
3faafa70 by Chris Lamb at 2023-09-05T11:20:04-07:00
Triage CVE-2021-32050 in mongo-c-driver for buster LTS.

- - - - -
947b45c4 by Chris Lamb at 2023-09-05T11:20:40-07:00
Triage CVE-2020-21722, CVE-2020-21723 & CVE-2020-21724 in oggvideotools for buster LTS.

- - - - -
bdf2a2fa by Chris Lamb at 2023-09-05T11:20:56-07:00
Triage CVE-2023-4738 in vim for buster LTS.

- - - - -
26c5043d by Chris Lamb at 2023-09-05T11:21:25-07:00
Triage CVE-2020-18770 in zziplib for buster LTS.

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -355,6 +355,7 @@ CVE-2023-4738 (Heap-based Buffer Overflow in GitHub repository vim/vim prior to
 	- vim <unfixed>
 	[bookworm] - vim <no-dsa> (Minor issue)
 	[bullseye] - vim <no-dsa> (Minor issue)
+	[buster] - vim <no-dsa> (Minor issue)
 	NOTE: https://huntr.dev/bounties/9fc7dced-a7bb-4479-9718-f956df20f612/
 	NOTE: https://github.com/vim/vim/commit/ced2c7394aafdc90fb7845e09b3a3fee23d48cb1 (v9.0.1848)
 CVE-2023-4736 (Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.)
@@ -1333,6 +1334,7 @@ CVE-2023-39810 (An issue in the CPIO command of Busybox v1.33.2 allows attackers
 	- busybox <unfixed>
 	[bookworm] - busybox <no-dsa> (Minor issue)
 	[bullseye] - busybox <no-dsa> (Minor issue)
+	[buster] - busybox <no-dsa> (Minor issue)
 	NOTE: https://www.pentagrid.ch/en/blog/busybox-cpio-directory-traversal-vulnerability/
 CVE-2023-39709 (Multiple cross-site scripting (XSS) vulnerabilities in Free and Open S ...)
 	NOT-FOR-US: Free and Open Source Inventory Management System
@@ -1650,6 +1652,7 @@ CVE-2023-4380
 	- ansible <unfixed>
 	[bookworm] - ansible <no-dsa> (Minor issue)
 	[bullseye] - ansible <no-dsa> (Minor issue)
+	[buster] - ansible <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2232324
 CVE-2023-4420 (A remote unprivileged attacker can intercept the communication via e.g ...)
 	NOT-FOR-US: SICK LMS5xx
@@ -164928,6 +164931,7 @@ CVE-2021-32050 (Some MongoDB Drivers may erroneously publish events containing a
 	[bullseye] - php-mongodb <no-dsa> (Minor issue)
 	- mongo-c-driver 1.18.0-1
 	[bullseye] - mongo-c-driver <no-dsa> (Minor issue)
+	[buster] - mongo-c-driver <no-dsa> (Minor issue)
 	- node-mongodb <unfixed>
 	[bookworm] - node-mongodb <no-dsa> (Minor issue)
 	[bullseye] - node-mongodb <no-dsa> (Minor issue)
@@ -222397,16 +222401,19 @@ CVE-2020-21724 (Buffer Overflow vulnerability in ExtractorInformation function i
 	- oggvideotools <unfixed> (bug #1050836)
 	[bookworm] - oggvideotools <no-dsa> (Minor issue)
 	[bullseye] - oggvideotools <no-dsa> (Minor issue)
+	[buster] - oggvideotools <no-dsa> (Minor issue)
 	NOTE: https://sourceforge.net/p/oggvideotools/bugs/9/
 CVE-2020-21723 (A Segmentation Fault issue discovered StreamSerializer::extractStreams ...)
 	- oggvideotools <unfixed> (bug #1050836)
 	[bookworm] - oggvideotools <no-dsa> (Minor issue)
 	[bullseye] - oggvideotools <no-dsa> (Minor issue)
+	[buster] - oggvideotools <no-dsa> (Minor issue)
 	NOTE: https://sourceforge.net/p/oggvideotools/bugs/10/
 CVE-2020-21722 (Buffer Overflow vulnerability in oggvideotools 0.9.1 allows remote att ...)
 	- oggvideotools <unfixed> (bug #1050836)
 	[bookworm] - oggvideotools <no-dsa> (Minor issue)
 	[bullseye] - oggvideotools <no-dsa> (Minor issue)
+	[buster] - oggvideotools <no-dsa> (Minor issue)
 	NOTE: https://sourceforge.net/p/oggvideotools/bugs/11/
 CVE-2020-21721
 	RESERVED
@@ -228764,6 +228771,7 @@ CVE-2020-18770 (An issue was discovered in function zzip_disk_entry_to_file_head
 	- zziplib <unfixed>
 	[bookworm] - zziplib <no-dsa> (Minor issue)
 	[bullseye] - zziplib <no-dsa> (Minor issue)
+	[buster] - zziplib <no-dsa> (Minor issue)
 	NOTE: https://github.com/gdraheim/zziplib/issues/69
 CVE-2020-18769
 	RESERVED



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/f7cd20f01001e55781eb2dd9b5d08f1c130f910e...26c5043dcac54d739d3fed288de67849a0d62734

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/f7cd20f01001e55781eb2dd9b5d08f1c130f910e...26c5043dcac54d739d3fed288de67849a0d62734
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230905/f7b8959c/attachment-0001.htm>