[Git][security-tracker-team/security-tracker][master] bullseye/bookworm triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Sep 26 09:55:56 BST 2023
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
6e0c5676 by Moritz Muehlenhoff at 2023-09-26T10:52:06+02:00
bullseye/bookworm triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -244,6 +244,7 @@ CVE-2023-43144 (Projectworldsl Assets-management-system-in-php 1.0 is vulnerable
NOT-FOR-US: Projectworldsl Assets-management-system-in-php
CVE-2023-42821 (The package `github.com/gomarkdown/markdown` is a Go library for parsi ...)
- golang-github-gomarkdown-markdown <unfixed>
+ [bookworm] - golang-github-gomarkdown-markdown <no-dsa> (Minor issue)
NOTE: https://github.com/gomarkdown/markdown/commit/14b16010c2ee7ff33a940a541d993bd043a88940
NOTE: https://github.com/gomarkdown/markdown/security/advisories/GHSA-m9xq-6h2j-65r2
CVE-2023-42812 (Galaxy is an open-source platform for FAIR data analysis. Prior to ver ...)
@@ -360,6 +361,7 @@ CVE-2023-42806 (Hydra is the layer-two scalability solution for Cardano. Prior t
TODO: check
CVE-2023-42805 (quinn-proto is a state machine for the QUIC transport protocol. Prior ...)
- rust-quinn-proto <unfixed> (bug #1052546)
+ [bookworm] - rust-quinn-proto <no-dsa> (Minor issue)
NOTE: https://github.com/quinn-rs/quinn/pull/1667
NOTE: https://github.com/quinn-rs/quinn/pull/1668
NOTE: https://github.com/quinn-rs/quinn/pull/1669
@@ -864,6 +866,7 @@ CVE-2023-3025 (The Dropbox Folder Share plugin for WordPress is vulnerable to Se
NOT-FOR-US: Dropbox Folder Share plugin for WordPress
CVE-2023-43091 [Code injection via service.json file]
- gnome-maps 45~rc-1
+ [bookworm] - gnome-maps <no-dsa> (Minor issue)
[bullseye] - gnome-maps <not-affected> (Vulnerable code not present)
[buster] - gnome-maps <not-affected> (Vulnerable code not present)
NOTE: https://gitlab.gnome.org/GNOME/gnome-maps/-/issues/588
@@ -988,10 +991,12 @@ CVE-2023-41889 (SHIRASAGI is a Content Management System. Prior to version 1.18.
NOT-FOR-US: SHIRASAGI
CVE-2023-41887 (OpenRefine is a powerful free, open source tool for working with messy ...)
- openrefine 3.7.5-1
+ [bookworm] - openrefine <no-dsa> (Minor issue)
NOTE: https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-p3r5-x3hr-gpg5
NOTE: https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511 (3.7.5)
CVE-2023-41886 (OpenRefine is a powerful free, open source tool for working with messy ...)
- openrefine 3.7.5-1
+ [bookworm] - openrefine <no-dsa> (Minor issue)
NOTE: https://github.com/OpenRefine/OpenRefine/security/advisories/GHSA-qqh2-wvmv-h72m
NOTE: https://github.com/OpenRefine/OpenRefine/commit/2de1439f5be63d9d0e89bbacbd24fa28c8c3e29d (master)
NOTE: https://github.com/OpenRefine/OpenRefine/commit/693fde606d4b5b78b16391c29d110389eb605511 (3.7.5)
@@ -1235,6 +1240,7 @@ CVE-2023-39915 (NLnet Labs\u2019 Routinator up to and including version 0.12.1 m
- routinator <itp> (bug #929024)
CVE-2023-39914 (NLnet Labs\u2019 bcder library up to and including version 0.7.2 panic ...)
- rust-bcder <unfixed> (bug #1052176)
+ [bookworm] - rust-bcder <no-dsa> (Minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2023-0062.html
NOTE: https://nlnetlabs.nl/downloads/bcder/CVE-2023-39914.txt
NOTE: https://github.com/NLnetLabs/bcder/pull/74
@@ -1306,6 +1312,7 @@ CVE-2023-3865 [ksmbd: fix out-of-bound read in smb2_write]
NOTE: https://git.kernel.org/linus/5fe7f7b78290638806211046a99f031ff26164e1 (6.4)
CVE-2023-4813 (A flaw was found in glibc. In an uncommon situation, the gaih_inet fun ...)
- glibc 2.36-3
+ [bullseye] - glibc <no-dsa> (Minor issue)
NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=28931
NOTE: Fixed by: https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=1c37b8022e8763fedbb3f79c02e05c6acfe5a215 (glibc-2.36)
CVE-2023-4806 (A flaw was found in glibc. In an extremely rare situation, the getaddr ...)
@@ -33046,6 +33053,7 @@ CVE-2023-26145
RESERVED
CVE-2023-26144 (Versions of the package graphql from 16.3.0 and before 16.8.1 are vuln ...)
- node-graphql <unfixed>
+ [bookworm] - node-graphql <no-dsa> (Minor issue)
NOTE: https://security.snyk.io/vuln/SNYK-JS-GRAPHQL-5905181
NOTE: https://github.com/graphql/graphql-js/pull/3972
NOTE: https://github.com/graphql/graphql-js/issues/3955
@@ -53994,6 +54002,8 @@ CVE-2022-4133
CVE-2022-4132 [Tomcat: Memory leak in JSS]
RESERVED
- jss <unfixed> (bug #1052575)
+ [bookworm] - jss <no-dsa> (Minor issue)
+ [bullseye] - jss <no-dsa> (Minor issue)
[buster] - jss <not-affected> (The vulnerable code was introduced later)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2147372
NOTE: Triggered by: https://github.com/dogtagpki/jss/pull/928
@@ -102215,10 +102225,7 @@ CVE-2022-29656 (Wedding Management System v1.0 was discovered to contain a SQL i
CVE-2022-29655 (An arbitrary file upload vulnerability in the Upload Photos module of ...)
NOT-FOR-US: Wedding Management System
CVE-2022-29654 (Buffer overflow vulnerability in quote_for_pmake in asm/nasm.c in nasm ...)
- - nasm 2.16.01-1
- [bullseye] - nasm <no-dsa> (Minor issue)
- [buster] - nasm <no-dsa> (Minor issue)
- NOTE: https://gist.github.com/naihsin/b96e2c5c2c81621b46557fd7aacd165f
+ NOTE: Duplicate of CVE-2022-44370
CVE-2022-29653 (OFCMS v1.1.4 was discovered to contain a cross-site scripting (XSS) vu ...)
NOT-FOR-US: OFCMS
CVE-2022-29652 (Online Sports Complex Booking System 1.0 is vulnerable to SQL Injectio ...)
@@ -225108,8 +225115,9 @@ CVE-2020-21686 (A stack-use-after-scope issue discovered in expand_mmac_params f
- nasm 2.15.04-1
NOTE: https://bugzilla.nasm.us/show_bug.cgi?id=3392643
CVE-2020-21685 (Buffer Overflow vulnerability in hash_findi function in hashtbl.c in n ...)
- - nasm 2.15.04-1
+ - nasm 2.15.04-1 (unimportant)
NOTE: https://bugzilla.nasm.us/show_bug.cgi?id=3392644
+ NOTE: Crash in CLI tool, no security impact
CVE-2020-21684 (A global buffer overflow in the put_font in genpict2e.c of fig2dev 3.2 ...)
- fig2dev 1:3.2.8-1 (unimportant)
- transfig <removed>
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e0c567691441e93bdaedfdea33c7d26e9d95a49
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6e0c567691441e93bdaedfdea33c7d26e9d95a49
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20230926/a127fe2f/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list