[Git][security-tracker-team/security-tracker][master] bookworm/bullseye triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Thu Jan 4 11:39:54 GMT 2024
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
99f1bf0a by Moritz Muehlenhoff at 2024-01-04T12:39:24+01:00
bookworm/bullseye triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -133,6 +133,7 @@ CVE-2023-50090 (Arbitrary File Write vulnerability in the saveReportFile method
NOT-FOR-US: ureport
CVE-2023-46929 (An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box ...)
- gpac <unfixed>
+ [bullseye] - gpac <not-affected> (Vulnerable code not present)
NOTE: https://github.com/gpac/gpac/issues/2662
NOTE: https://github.com/gpac/gpac/commit/4248def5d24325aeb0e35cacde3d56c9411816a6
CVE-2023-46742 (CubeFS is an open-source cloud-native file storage system. CubeFS prio ...)
@@ -179,22 +180,34 @@ CVE-2024-21623 (OTCLient is an alternative tibia client for otserv. Prior to com
NOT-FOR-US: OTCLient
CVE-2024-0211 (DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via ...)
- wireshark <unfixed> (bug #1059925)
+ [bookworm] - wireshark <no-dsa> (Minor issue)
+ [bullseye] - wireshark <no-dsa> (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2024-05.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/19557
CVE-2024-0210 (Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service ...)
- wireshark <unfixed> (bug #1059925)
+ [bookworm] - wireshark <no-dsa> (Minor issue)
+ [bullseye] - wireshark <no-dsa> (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2024-04.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/19504
CVE-2024-0209 (IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3 ...)
- wireshark <unfixed> (bug #1059925)
+ [bookworm] - wireshark <no-dsa> (Minor issue)
+ [bullseye] - wireshark <no-dsa> (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2024-02.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/19501
+ NOTE: The bug references two crashes, this is for the one labelled "BUG log 2",
+ NOTE: the more severe "Bug log 1" only affected unreleased versions
CVE-2024-0208 (GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to ...)
- wireshark <unfixed> (bug #1059925)
+ [bookworm] - wireshark <no-dsa> (Minor issue)
+ [bullseye] - wireshark <no-dsa> (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2024-01.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/19496
CVE-2024-0207 (HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via ...)
- wireshark <unfixed> (bug #1059925)
+ [bookworm] - wireshark <no-dsa> (Minor issue)
+ [bullseye] - wireshark <no-dsa> (Minor issue)
NOTE: https://www.wireshark.org/security/wnpa-sec-2024-03.html
NOTE: https://gitlab.com/wireshark/wireshark/-/issues/19502
CVE-2024-0196 (A vulnerability has been found in Magic-Api up to 2.0.1 and classified ...)
@@ -246,19 +259,24 @@ CVE-2023-50019 (An issue was discovered in open5gs v2.6.6. InitialUEMessage, Reg
CVE-2023-4164 (There is a possible informationdisclosure due to a missing permission ...)
NOT-FOR-US: Google Pixel Watch
CVE-2023-49558 (An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a de ...)
- - yasm <unfixed>
+ - yasm <unfixed> (unimportant)
+ NOTE: Crash in CLI tool, no security impact
NOTE: https://github.com/yasm/yasm/issues/252
CVE-2023-49557 (An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a de ...)
- - yasm <unfixed>
+ - yasm <unfixed> (unimportant)
+ NOTE: Crash in CLI tool, no security impact
NOTE: https://github.com/yasm/yasm/issues/253
CVE-2023-49556 (Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote a ...)
- - yasm <unfixed>
+ - yasm <unfixed> (unimportant)
+ NOTE: Crash in CLI tool, no security impact
NOTE: https://github.com/yasm/yasm/issues/250
CVE-2023-49555 (An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a de ...)
- - yasm <unfixed>
+ - yasm <unfixed> (unimportant)
+ NOTE: Crash in CLI tool, no security impact
NOTE: https://github.com/yasm/yasm/issues/248
CVE-2023-49554 (Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote at ...)
- - yasm <unfixed>
+ - yasm <unfixed> (unimportant)
+ NOTE: Crash in CLI tool, no security impact
NOTE: https://github.com/yasm/yasm/issues/249
CVE-2023-49553 (An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a den ...)
NOT-FOR-US: Cesenta MJS
@@ -1246,6 +1264,8 @@ CVE-2023-51363 (VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacen
NOT-FOR-US: VR-S1000 firmware
CVE-2023-50658 (The jose2go component before 1.6.0 for Go allows attackers to cause a ...)
- golang-github-dvsekhvalnov-jose2go <unfixed> (bug #1059507)
+ [bookworm] - golang-github-dvsekhvalnov-jose2go <no-dsa> (Minor issue)
+ [bullseye] - golang-github-dvsekhvalnov-jose2go <no-dsa> (Minor issue)
NOTE: https://github.com/dvsekhvalnov/jose2go/commit/a4584e9dd7128608fedbc67892eba9697f0d5317 (v1.6.0)
CVE-2023-50339 (Stored cross-site scripting vulnerability exists in the User Managemen ...)
NOT-FOR-US: GROWI
@@ -51199,6 +51219,8 @@ CVE-2023-26160
RESERVED
CVE-2023-26159 (Versions of the package follow-redirects before 1.15.4 are vulnerable ...)
- node-follow-redirects <unfixed> (bug #1059926)
+ [bookworm] - node-follow-redirects <no-dsa> (Minor issue)
+ [bullseye] - node-follow-redirects <no-dsa> (Minor issue)
NOTE: https://security.snyk.io/vuln/SNYK-JS-FOLLOWREDIRECTS-6141137
NOTE: https://github.com/follow-redirects/follow-redirects/issues/235
NOTE: https://github.com/follow-redirects/follow-redirects/pull/236
=====================================
data/dsa-needed.txt
=====================================
@@ -14,6 +14,8 @@ If needed, specify the release by adding a slash after the name of the source pa
--
asterisk (apo)
--
+cacti
+--
chromium (dilinger)
--
cryptojs
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/99f1bf0a58c73efe3599c44f0d0c87ca91c58169
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/99f1bf0a58c73efe3599c44f0d0c87ca91c58169
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240104/1cf1a8e7/attachment.htm>
More information about the debian-security-tracker-commits
mailing list