[Git][security-tracker-team/security-tracker][master] bookworm triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
f23c31fd by Moritz Muehlenhoff at 2024-08-22T11:30:56+02:00
bookworm triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -676,6 +676,7 @@ CVE-2024-8007 (A flaw was found in the Red Hat OpenStack Platform (RHOSP) direct
 	NOT-FOR-US: RHOSP Director / Red Hat OpenStack Platform
 CVE-2024-22034
 	- osc 1.9.0-1
+	[bookworm] - osc <no-dsa> (Minor issue)
 	NOTE: https://bugzilla.suse.com/show_bug.cgi?id=1225911
 CVE-2024-43882 (In the Linux kernel, the following vulnerability has been resolved:  e ...)
 	- linux 6.10.6-1
@@ -1097,6 +1098,7 @@ CVE-2024-43399 (Mobile Security Framework (MobSF) is a pen-testing, malware anal
 	NOT-FOR-US: Mobile Security Framework (MobSF)
 CVE-2024-43380 (fugit contains time tools for flor and the floraison group. The fugit  ...)
 	- ruby-fugit <unfixed>
+	[bookworm] - ruby-fugit <no-dsa> (Minor issue)
 	NOTE: https://github.com/floraison/fugit/security/advisories/GHSA-2m96-52r3-2f3g
 	NOTE: https://github.com/floraison/fugit/issues/104
 	NOTE: https://github.com/floraison/fugit/commit/6a7527497c0bb9196efe503e3d9b5271128a8ee1 (v1.11.1)
@@ -4900,6 +4902,7 @@ CVE-2024-37286 (APM server logs contain document body from a partially failed bu
 	NOT-FOR-US: APM server
 CVE-2024-7319 (An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensi ...)
 	- heat <unfixed>
+	[bookworm] - heat <no-dsa> (Minor issue)
 	[bullseye] - heat <not-affected> (Incomplete fix for CVE-2023-1625 not applied)
 	NOTE: https://storyboard.openstack.org/#!/story/2011007
 CVE-2024-7291 (The JetFormBuilder plugin for WordPress is vulnerable to privilege esc ...)
@@ -12542,7 +12545,8 @@ CVE-2024-29506 (Artifex Ghostscript before 10.03.0 has a stack-based buffer over
 	NOTE: Introduced with: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=316c3a08269212f1005709da64efcb383f8f5ce0 (ghostpdl-9.55.0rc1)
 	NOTE: Fixed by: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=77dc7f699beba606937b7ea23b50cf5974fa64b1 (ghostpdl-10.03.0)
 CVE-2023-52169 (The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) conta ...)
-	- 7zip 24.05+dfsg-1
+	- 7zip 24.05+dfsg-1 (unimportant)
+	NOTE: Crash in CLI tool, no security impact
 	- p7zip 16.02+transitional.1
 	NOTE: https://sourceforge.net/p/sevenzip/bugs/2402/
 	NOTE: https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/
@@ -12551,6 +12555,7 @@ CVE-2023-52169 (The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz)
 	NOTE: depending on 7zip. Mark this version as fixed version.
 CVE-2023-52168 (The NtfsHandler.cpp NTFS handler in 7-Zip before 24.01 (for 7zz) conta ...)
 	- 7zip 24.05+dfsg-1
+	[bookworm] - 7zip <no-dsa> (Minor issue)
 	- p7zip 16.02+transitional.1
 	NOTE: https://sourceforge.net/p/sevenzip/bugs/2402/
 	NOTE: https://dfir.ru/2024/06/19/vulnerabilities-in-7-zip-and-ntfs3/



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f23c31fd39ba2a768e7912de8274c2be0a039a6f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/f23c31fd39ba2a768e7912de8274c2be0a039a6f
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240822/227c8950/attachment.htm>