[Git][security-tracker-team/security-tracker][master] Reserve DLA-3572-1 for libyang

[Markus Koschany (@apo)]

Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker


Commits:
00889805 by Markus Koschany at 2023-09-19T21:32:04+02:00
Reserve DLA-3572-1 for libyang

- - - - -


2 changed files:

- data/CVE/list
- data/DLA/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -259746,55 +259746,47 @@ CVE-2019-20399 (A timing vulnerability in the Scalar::check_overflow function in
 CVE-2019-20398 (A NULL pointer dereference is present in libyang before v1.0-r3 in the ...)
 	[experimental] - libyang 1.0.167-1
 	- libyang 1.0.176-1
-	[buster] - libyang <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1793935
 	NOTE: https://github.com/CESNET/libyang/commit/7852b272ef77f8098c35deea6c6f09cb78176f08
 	NOTE: https://github.com/CESNET/libyang/issues/773
 CVE-2019-20397 (A double-free is present in libyang before v1.0-r1 in the function yyp ...)
 	[experimental] - libyang 1.0.167-1
 	- libyang 1.0.176-1
-	[buster] - libyang <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1793928
 	NOTE: https://github.com/CESNET/libyang/commit/88bd6c548ba79bce176cd875e9b56e7e0ef4d8d4
 	NOTE: https://github.com/CESNET/libyang/issues/739
 CVE-2019-20396 (A segmentation fault is present in yyparse in libyang before v1.0-r1 d ...)
 	[experimental] - libyang 1.0.167-1
 	- libyang 1.0.176-1
-	[buster] - libyang <no-dsa> (Minor issue)
 	NOTE: https://github.com/CESNET/libyang/commit/a1f17693904ed6fecc8902c747fc50a8f20e6af8
 	NOTE: https://github.com/CESNET/libyang/issues/740
 CVE-2019-20395 (A stack consumption issue is present in libyang before v1.0-r1 due to  ...)
 	[experimental] - libyang 1.0.167-1
 	- libyang 1.0.176-1
-	[buster] - libyang <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1793924
 	NOTE: https://github.com/CESNET/libyang/commit/4e610ccd87a2ba9413819777d508f71163fcc237
 	NOTE: https://github.com/CESNET/libyang/issues/724
 CVE-2019-20394 (A double-free is present in libyang before v1.0-r3 in the function yyp ...)
 	[experimental] - libyang 1.0.167-1
 	- libyang 1.0.176-1
-	[buster] - libyang <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1793932
 	NOTE: https://github.com/CESNET/libyang/commit/6cc51b1757dfbb7cff92de074ada65e8523289a6
 	NOTE: https://github.com/CESNET/libyang/issues/769
 CVE-2019-20393 (A double-free is present in libyang before v1.0-r1 in the function yyp ...)
 	[experimental] - libyang 1.0.167-1
 	- libyang 1.0.176-1
-	[buster] - libyang <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1793930
 	NOTE: https://github.com/CESNET/libyang/commit/d9feacc4a590d35dbc1af21caf9080008b4450ed
 	NOTE: https://github.com/CESNET/libyang/issues/742
 CVE-2019-20392 (An invalid memory access flaw is present in libyang before v1.0-r1 in  ...)
 	[experimental] - libyang 1.0.167-1
 	- libyang 1.0.176-1
-	[buster] - libyang <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1793922
 	NOTE: https://github.com/CESNET/libyang/commit/32fb4993bc8bb49e93e84016af3c10ea53964be5
 	NOTE: https://github.com/CESNET/libyang/issues/723
 CVE-2019-20391 (An invalid memory access flaw is present in libyang before v1.0-r3 in  ...)
 	[experimental] - libyang 1.0.167-1
 	- libyang 1.0.176-1
-	[buster] - libyang <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1793934
 	NOTE: https://github.com/CESNET/libyang/commit/bdb596ddc07596fa212f231135b87d0b9178f6f8
 	NOTE: https://github.com/CESNET/libyang/issues/772


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[19 Sep 2023] DLA-3572-1 libyang - security update
+	{CVE-2019-20391 CVE-2019-20392 CVE-2019-20393 CVE-2019-20394 CVE-2019-20395 CVE-2019-20396 CVE-2019-20397 CVE-2019-20398}
+	[buster] - libyang 0.16.105+really1.0-0+deb10u1
 [19 Sep 2023] DLA-3571-1 openjdk-11 - security update
 	{CVE-2023-21930 CVE-2023-21937 CVE-2023-21938 CVE-2023-21939 CVE-2023-21954 CVE-2023-21967 CVE-2023-21968 CVE-2023-22006 CVE-2023-22036 CVE-2023-22041 CVE-2023-22045 CVE-2023-22049}
 	[buster] - openjdk-11 11.0.20+8-1~deb10u1



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00889805debb0fcbd3f1cbc10460827e531870bf

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/00889805debb0fcbd3f1cbc10460827e531870bf
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230919/91ae1056/attachment.htm>