[Git][security-tracker-team/security-tracker][master] automatic update
Salvatore Bonaccorso (@carnil)
carnil at debian.org
Fri Feb 23 08:12:21 GMT 2024
Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3453e444 by security tracker role at 2024-02-23T08:12:06+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,113 @@
+CVE-2024-26445 (flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forge ...)
+ TODO: check
+CVE-2024-26352 (flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forge ...)
+ TODO: check
+CVE-2024-26351 (flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forge ...)
+ TODO: check
+CVE-2024-26350 (flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forge ...)
+ TODO: check
+CVE-2024-26349 (flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forge ...)
+ TODO: check
+CVE-2024-26287
+ REJECTED
+CVE-2024-26284 (Utilizing a 302 redirect, an attacker could have conducted a Universal ...)
+ TODO: check
+CVE-2024-26283 (An attacker could have executed unauthorized scripts on top origin sit ...)
+ TODO: check
+CVE-2024-26282 (Using an AMP url with a canonical element, an attacker could have exec ...)
+ TODO: check
+CVE-2024-26281 (Upon scanning a JavaScript URI with the QR code scanner, an attacker c ...)
+ TODO: check
+CVE-2024-26152 (### Summary On all Label Studio versions prior to 1.11.0, data importe ...)
+ TODO: check
+CVE-2024-26151 (The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHu ...)
+ TODO: check
+CVE-2024-26128 (baserCMS is a website development framework. Prior to version 5.0.9, t ...)
+ TODO: check
+CVE-2024-25876 (A cross-site scripting (XSS) vulnerability in the Header module of Enh ...)
+ TODO: check
+CVE-2024-25875 (A cross-site scripting (XSS) vulnerability in the Header module of Enh ...)
+ TODO: check
+CVE-2024-25874 (A cross-site scripting (XSS) vulnerability in the New/Edit Article mod ...)
+ TODO: check
+CVE-2024-25873 (Enhavo v0.13.1 was discovered to contain an HTML injection vulnerabili ...)
+ TODO: check
+CVE-2024-25851 (Netis WF2780 v2.1.40144 was discovered to contain a command injection ...)
+ TODO: check
+CVE-2024-25850 (Netis WF2780 v2.1.40144 was discovered to contain a command injection ...)
+ TODO: check
+CVE-2024-25828 (cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/a ...)
+ TODO: check
+CVE-2024-25802 (SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add M ...)
+ TODO: check
+CVE-2024-25756 (A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with fi ...)
+ TODO: check
+CVE-2024-25753 (Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firm ...)
+ TODO: check
+CVE-2024-25748 (A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 wit ...)
+ TODO: check
+CVE-2024-25746 (Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firm ...)
+ TODO: check
+CVE-2024-25385 (An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial ...)
+ TODO: check
+CVE-2024-25369 (A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2 ...)
+ TODO: check
+CVE-2024-25130 (Tuleap is an open source suite to improve management of software devel ...)
+ TODO: check
+CVE-2024-25129 (The CodeQL CLI repo holds binaries for the CodeQL command line interfa ...)
+ TODO: check
+CVE-2024-25021 (IBM AIX 7.3, VIOS 4.1's Perl implementation could allow a non-privileg ...)
+ TODO: check
+CVE-2024-24817 (Discourse Calendar adds the ability to create a dynamic calendar in th ...)
+ TODO: check
+CVE-2024-23094 (Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forge ...)
+ TODO: check
+CVE-2024-22547 (WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).)
+ TODO: check
+CVE-2024-22243 (Applications that use UriComponentsBuilderto parse an externally provi ...)
+ TODO: check
+CVE-2024-1786 (** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified ...)
+ TODO: check
+CVE-2024-1784 (A vulnerability classified as problematic was found in Limbas 5.2.14. ...)
+ TODO: check
+CVE-2024-1783 (A vulnerability classified as critical has been found in Totolink LR12 ...)
+ TODO: check
+CVE-2024-1781 (A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_202307 ...)
+ TODO: check
+CVE-2024-1779 (The Admin side data storage for Contact Form 7 plugin for WordPress is ...)
+ TODO: check
+CVE-2024-1778 (The Admin side data storage for Contact Form 7 plugin for WordPress is ...)
+ TODO: check
+CVE-2024-1777 (The Admin side data storage for Contact Form 7 plugin for WordPress is ...)
+ TODO: check
+CVE-2024-1776 (The Admin side data storage for Contact Form 7 plugin for WordPress is ...)
+ TODO: check
+CVE-2024-1750 (A vulnerability, which was classified as critical, was found in Temmok ...)
+ TODO: check
+CVE-2024-1749 (A vulnerability, which was classified as problematic, has been found i ...)
+ TODO: check
+CVE-2024-1748 (A vulnerability classified as critical was found in van_der_Schaar LAB ...)
+ TODO: check
+CVE-2024-1683 (A DLL injection vulnerability exists where an authenticated, low-privi ...)
+ TODO: check
+CVE-2024-1563 (An attacker could have executed unauthorized scripts on top origin sit ...)
+ TODO: check
+CVE-2024-1104 (An unauthenticated remote attacker can bypass the brute force preventi ...)
+ TODO: check
+CVE-2024-0220 (B&R Automation Studio Upgrade Service and B&R Technology Guarding use ...)
+ TODO: check
+CVE-2023-51653 (Hertzbeat is a real-time monitoring system. In the implementation of ` ...)
+ TODO: check
+CVE-2023-51450 (baserCMS is a website development framework. Prior to version 5.0.9, t ...)
+ TODO: check
+CVE-2023-51389 (Hertzbeat is a real-time monitoring system. At the interface of `/defi ...)
+ TODO: check
+CVE-2023-51388 (Hertzbeat is a real-time monitoring system. In `CalculateAlarm.java`, ...)
+ TODO: check
+CVE-2023-44379 (baserCMS is a website development framework. Prior to version 5.0.9, t ...)
+ TODO: check
+CVE-2023-37540 (Sametime Connect desktop chat client includes, but does not use or req ...)
+ TODO: check
CVE-2024-26141 [Reject Range headers which are too large]
- ruby-rack <unfixed>
NOTE: https://github.com/rack/rack/releases/tag/v2.2.8.1
@@ -9,102 +119,102 @@ CVE-2024-26146 [Fixed ReDoS in Accept header parsing]
- ruby-rack <unfixed>
NOTE: https://github.com/rack/rack/releases/tag/v2.2.8.1
NOTE: https://github.com/rack/rack/commit/e4c117749ba24a66f8ec5a08eddf68deeb425ccd (v2.2.8.1)
-CVE-2024-26592
+CVE-2024-26592 (In the Linux kernel, the following vulnerability has been resolved: k ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/38d20c62903d669693a1869aa68c4dd5674e2544 (6.8-rc1)
-CVE-2023-52446
+CVE-2023-52446 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.6.15-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/59e5791f59dd83e8aa72a4e74217eabb6e8cfd90 (6.8-rc1)
-CVE-2024-26588 [LoongArch: BPF: Prevent out-of-bounds memory access]
+CVE-2024-26588 (In the Linux kernel, the following vulnerability has been resolved: L ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/36a87385e31c9343af9a4756598e704741250a67 (6.8-rc1)
-CVE-2024-26587 [net: netdevsim: don't try to destroy PHC on VFs]
+CVE-2024-26587 (In the Linux kernel, the following vulnerability has been resolved: n ...)
- linux 6.6.15-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/ea937f77208323d35ffe2f8d8fc81b00118bfcda (6.8-rc1)
-CVE-2024-26586 [mlxsw: spectrum_acl_tcam: Fix stack corruption]
+CVE-2024-26586 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.6.15-1
[bullseye] - linux 5.10.209-1
NOTE: https://git.kernel.org/linus/483ae90d8f976f8339cf81066312e1329f2d3706 (6.8-rc1)
-CVE-2024-26591 [bpf: Fix re-attachment branch in bpf_tracing_prog_attach]
+CVE-2024-26591 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/715d82ba636cb3629a6e18a33bb9dbe53f9936ee (6.8-rc1)
-CVE-2023-52451 [powerpc/pseries/memhp: Fix access beyond end of drmem array]
+CVE-2023-52451 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux 5.10.209-1
NOTE: https://git.kernel.org/linus/bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 (6.8-rc1)
-CVE-2023-52452 [bpf: Fix accesses to uninit stack slots]
+CVE-2023-52452 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.6.15-1
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/6b4a64bafd107e521c01eec3453ce94a3fb38529 (6.8-rc1)
-CVE-2023-52450 [perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()]
+CVE-2023-52450 (In the Linux kernel, the following vulnerability has been resolved: p ...)
- linux 6.6.15-1
[bookworm] - linux <not-affected> (Vulnerable code not present)
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/1692cf434ba13ee212495b5af795b6a07e986ce4 (6.8-rc1)
-CVE-2023-52448 [gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump]
+CVE-2023-52448 (In the Linux kernel, the following vulnerability has been resolved: g ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux 5.10.209-1
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/8877243beafa7c6bfc42022cbfdf9e39b25bd4fa (6.8-rc1)
-CVE-2023-52449 [mtd: Fix gluebi NULL pointer dereference caused by ftl notifier]
+CVE-2023-52449 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux 5.10.209-1
NOTE: https://git.kernel.org/linus/a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 (6.8-rc1)
-CVE-2023-52447 [bpf: Defer the free of inner map when necessary]
+CVE-2023-52447 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/876673364161da50eed6b472d746ef88242b2368 (6.8-rc1)
-CVE-2023-52445 [media: pvrusb2: fix use after free on context disconnection]
+CVE-2023-52445 (In the Linux kernel, the following vulnerability has been resolved: m ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux 5.10.209-1
NOTE: https://git.kernel.org/linus/ded85b0c0edd8f45fec88783d7555a5b982449c1 (6.8-rc1)
-CVE-2023-52444 [f2fs: fix to avoid dirent corruption]
+CVE-2023-52444 (In the Linux kernel, the following vulnerability has been resolved: f ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux 5.10.209-1
NOTE: https://git.kernel.org/linus/53edb549565f55ccd0bdf43be3d66ce4c2d48b28 (6.8-rc1)
-CVE-2024-26590 [erofs: fix inconsistent per-file compression format]
+CVE-2024-26590 (In the Linux kernel, the following vulnerability has been resolved: e ...)
- linux 6.6.15-1
[bullseye] - linux <not-affected> (Vulnerable code not present)
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/118a8cf504d7dfa519562d000f423ee3ca75d2c4 (6.8-rc1)
-CVE-2024-26589 [bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS]
+CVE-2024-26589 (In the Linux kernel, the following vulnerability has been resolved: b ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://git.kernel.org/linus/22c7fa171a02d310e3a3f6ed46a698ca8a0060ed (6.8-rc1)
-CVE-2023-52443 [apparmor: avoid crash when parsed profile name is empty]
+CVE-2023-52443 (In the Linux kernel, the following vulnerability has been resolved: a ...)
- linux 6.6.15-1
[bookworm] - linux 6.1.76-1
[bullseye] - linux 5.10.209-1
NOTE: https://git.kernel.org/linus/55a8210c9e7d21ff2644809699765796d4bfb200 (6.8-rc1)
-CVE-2024-26578
+CVE-2024-26578 (Concurrent Execution using Shared Resource with Improper Synchronizati ...)
NOT-FOR-US: Apache Answer
-CVE-2024-23349
+CVE-2024-23349 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
NOT-FOR-US: Apache Answer
-CVE-2024-22393
+CVE-2024-22393 (Unrestricted Upload of File with Dangerous Type vulnerability in Apach ...)
NOT-FOR-US: Apache Answer
CVE-2024-27283 (A vulnerability was discovered in Veritas eDiscovery Platform before 1 ...)
NOT-FOR-US: Veritas
@@ -124,7 +234,7 @@ CVE-2024-26481 (Kirby CMS v4.1.0 was discovered to contain a reflected cross-sit
NOT-FOR-US: Kirby CMS
CVE-2024-26148 (Querybook is a user interface for querying big data. Prior to version ...)
TODO: check
-CVE-2024-25801 (An arbitrary file upload vulnerability in the Add Media function of SK ...)
+CVE-2024-25801 (SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded fi ...)
NOT-FOR-US: SKINsoft S-Museum
CVE-2024-25423 (An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execu ...)
NOT-FOR-US: MAXON CINEMA 4D
@@ -243,11 +353,11 @@ CVE-2024-25117 (php-svg-lib is a scalable vector graphics (SVG) file parsing/ren
NOTE: https://github.com/dompdf/php-svg-lib/security/advisories/GHSA-f3qr-qr4x-j273
NOTE: https://github.com/dompdf/php-svg-lib/commit/732faa9fb4309221e2bd9b2fda5de44f947133aa (0.5.2)
NOTE: https://github.com/dompdf/php-svg-lib/commit/8ffcc41bbde39f09f94b9760768086f12bbdce42 (0.5.2)
-CVE-2024-24479 (Buffer Overflow vulnerability in Wireshark team Wireshark before v.4.2 ...)
+CVE-2024-24479 (A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker t ...)
TODO: check
-CVE-2024-24478 (An issue in Wireshark team Wireshark before v.4.2.0 allows a remote at ...)
+CVE-2024-24478 (An issue in Wireshark before 4.2.0 allows a remote attacker to cause a ...)
TODO: check
-CVE-2024-24476 (Buffer Overflow vulnerability in Wireshark team Wireshark before v.4.2 ...)
+CVE-2024-24476 (A buffer overflow in Wireshark before 4.2.0 allows a remote attacker t ...)
TODO: check
CVE-2024-23346 (Pymatgen (Python Materials Genomics) is an open-source Python library ...)
TODO: check
@@ -478,34 +588,42 @@ CVE-2023-42496 (Reflected cross-site scripting (XSS) vulnerability on the add as
CVE-2023-40191 (Reflected cross-site scripting (XSS) vulnerability in the instance set ...)
NOT-FOR-US: Liferay
CVE-2024-1676 (Inappropriate implementation in Navigation in Google Chrome prior to 1 ...)
+ {DSA-5629-1}
- chromium 122.0.6261.57-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-1675 (Insufficient policy enforcement in Download in Google Chrome prior to ...)
+ {DSA-5629-1}
- chromium 122.0.6261.57-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-1674 (Inappropriate implementation in Navigation in Google Chrome prior to 1 ...)
+ {DSA-5629-1}
- chromium 122.0.6261.57-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-1673 (Use after free in Accessibility in Google Chrome prior to 122.0.6261.5 ...)
+ {DSA-5629-1}
- chromium 122.0.6261.57-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-1672 (Inappropriate implementation in Content Security Policy in Google Chro ...)
+ {DSA-5629-1}
- chromium 122.0.6261.57-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-1671 (Inappropriate implementation in Site Isolation in Google Chrome prior ...)
+ {DSA-5629-1}
- chromium 122.0.6261.57-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-1670 (Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed ...)
+ {DSA-5629-1}
- chromium 122.0.6261.57-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
CVE-2024-1669 (Out of bounds memory access in Blink in Google Chrome prior to 122.0.6 ...)
+ {DSA-5629-1}
- chromium 122.0.6261.57-1
[bullseye] - chromium <end-of-life> (see #1061268)
[buster] - chromium <end-of-life> (see DSA 5046)
@@ -1320,11 +1438,12 @@ CVE-2023-45860 (In Hazelcast Platform through 5.3.4, a security issue exists wit
- hazelcast <itp> (bug #745640)
CVE-2023-40085 (In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible ou ...)
NOT-FOR-US: Android
-CVE-2023-52160
+CVE-2023-52160 (The implementation of PEAP in wpa_supplicant through 2.10 allows authe ...)
- wpa <unfixed> (bug #1064061)
NOTE: https://w1.fi/cgit/hostap/commit/?id=8e6485a1bcb0baffdea9e55255a81270b768439c
NOTE: https://www.top10vpn.com/research/wifi-vulnerabilities/
-CVE-2023-52161
+CVE-2023-52161 (The Access Point functionality in eapol_auth_key_handle in eapol.c in ...)
+ {DLA-3738-1}
- iwd 2.14-1 (bug #1064062)
NOTE: https://www.top10vpn.com/research/wifi-vulnerabilities/
NOTE: https://git.kernel.org/pub/scm/network/wireless/iwd.git/commit/?id=6415420f1c92012f64063c131480ffcef58e60ca (2.14)
@@ -2954,7 +3073,7 @@ CVE-2023-31506 (A cross-site scripting (XSS) vulnerability in Grav versions 1.7.
CVE-2023-4639 [Cookie Smuggling/Spoofing]
- undertow <unfixed> (bug #1063539)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2166022
-CVE-2023-3966 [Invalid memory access in Geneve with HW offload]
+CVE-2023-3966 (A flaw was found in Open vSwitch where multiple versions are vulnerabl ...)
- openvswitch <unfixed> (bug #1063492)
[buster] - openvswitch <not-affected> (Vulnerable feature introduced later)
NOTE: https://www.openwall.com/lists/oss-security/2024/02/08/3
@@ -26513,6 +26632,7 @@ CVE-2023-5344 (Heap-based Buffer Overflow in GitHub repository vim/vim prior to
NOTE: https://github.com/vim/vim/commit/3bd7fa12e146c6051490d048a4acbfba974eeb04
NOTE: https://huntr.dev/bounties/530cb762-899e-48d7-b50e-dad09eb775bf
CVE-2023-5341 (A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.)
+ {DSA-5628-1 DLA-3737-1}
- imagemagick 8:6.9.12.98+dfsg1-2
NOTE: https://github.com/ImageMagick/ImageMagick/commit/aa673b2e4defc7cad5bec16c4fc8324f71e531f1 (7.1.1-19)
NOTE: https://github.com/ImageMagick/ImageMagick6/commit/405684654eb9b43424c3c0276ea343681021d9e0 (6.9.12-97)
@@ -40022,6 +40142,7 @@ CVE-2023-2625 (A vulnerability exists that can be exploited by an authenticated
CVE-2023-3436 (Xpdf 4.04 will deadlock on a PDF object stream whose "Length" field is ...)
- xpdf <not-affected> (Debian uses poppler, which is not affected)
CVE-2023-3428 (A heap-based buffer overflow vulnerability was found in coders/tiff.c ...)
+ {DSA-5628-1}
[experimental] - imagemagick 8:6.9.12.98+dfsg1-1
- imagemagick 8:6.9.12.98+dfsg1-2
[buster] - imagemagick <not-affected> (code is introduced later)
@@ -51058,6 +51179,7 @@ CVE-2023-1908 (A vulnerability was found in SourceCodester Simple Mobile Compari
CVE-2023-1907
RESERVED
CVE-2023-1906 (A heap-based buffer overflow issue was discovered in ImageMagick's Imp ...)
+ {DSA-5628-1}
- imagemagick 8:6.9.12.98+dfsg1-2 (bug #1034373)
[buster] - imagemagick <not-affected> (Vulnerable code introduced later)
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-35q2-86c7-9247
@@ -51999,12 +52121,12 @@ CVE-2023-29183 (An improper neutralization of input during web page generation (
NOT-FOR-US: FortiGuard
CVE-2023-29182 (A stack-based buffer overflow vulnerability [CWE-121]in Fortinet Forti ...)
NOT-FOR-US: FortiGuard
-CVE-2023-29181
- RESERVED
-CVE-2023-29180
- RESERVED
-CVE-2023-29179
- RESERVED
+CVE-2023-29181 (A use of externally-controlled format string in Fortinet FortiOS 7.2.0 ...)
+ TODO: check
+CVE-2023-29180 (A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7 ...)
+ TODO: check
+CVE-2023-29179 (A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7 ...)
+ TODO: check
CVE-2023-29178 (A access of uninitialized pointer vulnerability [CWE-824] in Fortinet ...)
NOT-FOR-US: Fortinet
CVE-2023-29177 (Multiple buffer copy without checking size of input ('classic buffer o ...)
@@ -56301,6 +56423,7 @@ CVE-2023-1291 (A vulnerability, which was classified as critical, was found in S
CVE-2023-1290 (A vulnerability, which was classified as critical, has been found in S ...)
NOT-FOR-US: SourceCodester Sales Tracker Management System
CVE-2023-1289 (A vulnerability was discovered in ImageMagick where a specially create ...)
+ {DSA-5628-1 DLA-3737-1}
- imagemagick 8:6.9.12.98+dfsg1-2
NOTE: https://github.com/ImageMagick/ImageMagick/security/advisories/GHSA-j96m-mjp6-99xr
NOTE: https://github.com/ImageMagick/ImageMagick/commit/c5b23cbf2119540725e6dc81f4deb25798ead6a4 (7.1.1-0)
@@ -121953,6 +122076,7 @@ CVE-2022-32547 (In ImageMagick, there is load of misaligned address for type 'do
NOTE: https://github.com/ImageMagick/ImageMagick/commit/eac8ce4d873f28bb6a46aa3a662fb196b49b95d0 (7.1.0-30)
NOTE: https://github.com/ImageMagick/ImageMagick6/commit/dc070da861a015d3c97488fdcca6063b44d47a7b (6.9.12-45)
CVE-2023-34151 (A vulnerability was found in ImageMagick. This security flaw ouccers a ...)
+ {DSA-5628-1 DLA-3737-1}
- imagemagick 8:6.9.12.98+dfsg1-2 (bug #1036999)
NOTE: https://github.com/ImageMagick/ImageMagick/issues/6341
NOTE: ImageMagick: https://github.com/ImageMagick/ImageMagick/commit/3d6d98d8a2be30d74172ab43b5b8e874d2deb158 (7.1.1-10)
@@ -135477,6 +135601,7 @@ CVE-2022-1117 (A vulnerability was found in fapolicyd. The vulnerability occurs
CVE-2022-1116 (Integer Overflow or Wraparound vulnerability in io_uring of Linux Kern ...)
- linux <not-affected> (Vulnerable code not present; introduced in 5.4.24; fixed in 5.4.189)
CVE-2022-1115 (A heap-buffer-overflow flaw was found in ImageMagick\u2019s PushShortP ...)
+ {DSA-5628-1}
- imagemagick 8:6.9.12.98+dfsg1-2 (bug #1013282)
[buster] - imagemagick <not-affected> (code is introduced later)
[stretch] - imagemagick <not-affected> (code is introduced later)
@@ -143115,8 +143240,8 @@ CVE-2022-25379
RESERVED
CVE-2022-25378
RESERVED
-CVE-2022-25377
- RESERVED
+CVE-2022-25377 (The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0. ...)
+ TODO: check
CVE-2022-25376
RESERVED
CVE-2022-25375 (An issue was discovered in drivers/usb/gadget/function/rndis.c in the ...)
@@ -188430,6 +188555,7 @@ CVE-2021-3611 (A stack overflow vulnerability was found in the Intel HD Audio de
NOTE: Proposed fix: https://lore.kernel.org/qemu-devel/20211218160912.1591633-1-philmd@redhat.com/
NOTE: Fixed by: https://gitlab.com/qemu-project/qemu/-/commit/79fa99831debc9782087e834382c577215f2f511 (v7.0.0-rc1)
CVE-2021-3610 (A heap-based buffer overflow vulnerability was found in ImageMagick in ...)
+ {DSA-5628-1}
[experimental] - imagemagick 8:6.9.12.20+dfsg1-1
- imagemagick 8:6.9.12.98+dfsg1-2 (bug #1037090)
[buster] - imagemagick <not-affected> (Vulnerable code introduced later)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3453e44428cf65056751dbbb7f6889e878af7ede
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3453e44428cf65056751dbbb7f6889e878af7ede
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240223/16d7ce39/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list