[Git][security-tracker-team/security-tracker][master] 2 commits: CVE-2024-56378,poppler: bullseye is postponed
Markus Koschany (@apo)
apo at debian.org
Thu Dec 26 06:27:33 GMT 2024
Markus Koschany pushed to branch master at Debian Security Tracker / security-tracker
Commits:
869828ba by Markus Koschany at 2024-12-26T07:27:20+01:00
CVE-2024-56378,poppler: bullseye is postponed
Minor issue.
- - - - -
551b6799 by Markus Koschany at 2024-12-26T07:27:20+01:00
CVE-2024-56431,libtheora: update details
The project looks pretty dead. Similar negative shift issues have been reported
in the past. Looks like the worst outcome is a decoder crash.
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -3,7 +3,8 @@ CVE-2024-8950 (Improper Neutralization of Special Elements used in an SQL Comman
CVE-2024-56431 (oc_huff_tree_unpack in huffdec.c in libtheora in Theora through 1.0 71 ...)
- libtheora <unfixed>
NOTE: https://github.com/UnionTech-Software/libtheora-CVE-2024-56431-PoC
- TODO: check details
+ NOTE: https://github.com/advisories/GHSA-8xp8-gmmj-xc8w
+ NOTE: https://github.com/xiph/theora/issues/18
CVE-2024-56430 (OpenFHE through 1.2.3 has a NULL pointer dereference in BinFHEContext: ...)
NOT-FOR-US: OpenFHE
CVE-2024-53291 (Dell NativeEdge, version(s) 2.1.0.0, contain(s) an Exposure of Sensiti ...)
@@ -263,6 +264,7 @@ CVE-2024-XXXX [RUSTSEC-2024-0429]
CVE-2024-56378 (libpoppler.so in Poppler through 24.12.0 has an out-of-bounds read vul ...)
- poppler <unfixed> (bug #1091322)
[bookworm] - poppler <no-dsa> (Minor issue)
+ [bullseye] - poppler <postponed> (Minor issue)
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/issues/1553
NOTE: https://gitlab.freedesktop.org/poppler/poppler/-/commit/ade9b5ebed44b0c15522c27669ef6cdf93eff84e
CVE-2024-56375 (An integer underflow was discovered in Fort 1.6.3 and 1.6.4 before 1.6 ...)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5399b92f3b03119e5779857d778ffc7e32cfd7ca...551b6799be46edf8700be4d7d97ecf51243d5c29
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/5399b92f3b03119e5779857d778ffc7e32cfd7ca...551b6799be46edf8700be4d7d97ecf51243d5c29
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241226/08047a73/attachment.htm>
More information about the debian-security-tracker-commits
mailing list