[Git][security-tracker-team/security-tracker][master] Add CVE-2024-24826/exiv2

[Salvatore Bonaccorso (@carnil)]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
9e325265 by Salvatore Bonaccorso at 2024-02-14T21:07:23+01:00
Add CVE-2024-24826/exiv2

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -395,7 +395,10 @@ CVE-2024-24884 (Cross-Site Request Forgery (CSRF) vulnerability in ARI Soft Cont
 CVE-2024-24875 (Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Li ...)
 	NOT-FOR-US: WordPress plugin
 CVE-2024-24826 (Exiv2 is a command-line utility and C++ library for reading, writing,  ...)
-	TODO: check
+	- exiv2 <unfixed>
+	NOTE: https://github.com/Exiv2/exiv2/security/advisories/GHSA-g9xm-7538-mq8w
+	NOTE: https://github.com/Exiv2/exiv2/pull/2337
+	TODO: unclear range of affected versions: while the report claims it is new in v0.28.0 the QuickTimeVideo::NikonTagsDecoder is present earlier
 CVE-2024-24743 (SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows ...)
 	NOT-FOR-US: SAP
 CVE-2024-24742 (SAP CRM WebClient UI- version S4FND 102, S4FND 103, S4FND 104, S4FND 1 ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9e32526510b7f4f8e1bb685bf31bd021e8f20482

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/9e32526510b7f4f8e1bb685bf31bd021e8f20482
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240214/62c3cde5/attachment.htm>