[Git][security-tracker-team/security-tracker][master] bugnums
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Fri Nov 29 16:26:07 GMT 2024
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
c5b15d49 by Moritz Muehlenhoff at 2024-11-29T17:25:39+01:00
bugnums
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -250,7 +250,7 @@ CVE-2024-11738
NOTE: https://rustsec.org/advisories/RUSTSEC-2024-0399.html
NOTE: https://github.com/rustls/rustls/issues/2227
CVE-2024-53920 (In elisp-mode.el in GNU Emacs through 30.0.92, a user who chooses to i ...)
- - emacs <unfixed>
+ - emacs <unfixed> (bug #1088690)
[bookworm] - emacs <postponed> (Minor issue, revisit when fixed upstream)
NOTE: https://eshelyaron.com/posts/2024-11-27-emacs-aritrary-code-execution-and-how-to-avoid-it.html
NOTE: https://yhetil.org/emacs/CAFXAjY5f4YfHAtZur1RAqH34UbYU56_t6t2Er0YEh1Sb7-W=hg%40mail.gmail.com/
@@ -279,28 +279,28 @@ CVE-2024-46055 (OpenVidReview 1.0 is vulnerable to Cross Site Scripting (XSS) in
CVE-2024-46054 (OpenVidReview 1.0 is vulnerable to Incorrect Access Control. The /uplo ...)
NOT-FOR-US: OpenVidReview
CVE-2024-42333 (The researcher is showing that it is possible to leak a small amount o ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25629
CVE-2024-42332 (The researcher is showing that due to the way the SNMP trap log is par ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25628
CVE-2024-42331 (In the src/libs/zbxembed/browser.c file, the es_browser_ctor method re ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25627
CVE-2024-42330 (The HttpRequest object allows to get the HTTP headers from the server' ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25626
CVE-2024-42329 (The webdriver for the Browser object expects an error object to be ini ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: ttps://support.zabbix.com/browse/ZBX-25625
CVE-2024-42328 (When the webdriver for the Browser object downloads data from a HTTP s ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25624
CVE-2024-42327 (A non-admin user account on the Zabbix frontend with the default User ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25623
CVE-2024-42326 (There was discovered a use after free bug in browser.c in the es_brows ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25622
CVE-2024-41126 (Contiki-NG is an open-source, cross-platform operating system for IoT ...)
NOT-FOR-US: Contiki-NG
@@ -309,10 +309,10 @@ CVE-2024-41125 (Contiki-NG is an open-source, cross-platform operating system fo
CVE-2024-37816 (Quectel EC25-EUX EC25EUXGAR08A05M1G was discovered to contain a stack ...)
NOT-FOR-US: Quectel
CVE-2024-36468 (The reported vulnerability is a stack buffer overflow in the zbx_snmp_ ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25621
CVE-2024-36464 (When exporting media types, the password is exported in the YAML in pl ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25630
CVE-2024-31976 (EnGenius EWS356-FIR 1.1.30 and earlier devices allow a remote attacker ...)
NOT-FOR-US: EnGenius EWS356-FIR
@@ -362,7 +362,7 @@ CVE-2024-50942 (qiwen-file v1.4.0 was discovered to contain a SQL injection vuln
CVE-2024-43784 (lakeFS is an open-source tool that transforms object storage into a Gi ...)
NOT-FOR-US: lakeFS
CVE-2024-36467 (An authenticated user with API access (e.g.: user with default User ro ...)
- - zabbix <unfixed>
+ - zabbix <unfixed> (bug #1088688)
NOTE: https://support.zabbix.com/browse/ZBX-25614
CVE-2024-11820 (A vulnerability, which was classified as problematic, has been found i ...)
NOT-FOR-US: code-projects Crud Operation System
@@ -2308,32 +2308,32 @@ CVE-2024-11477 (7-Zip Zstandard Decompression Integer Underflow Remote Code Exec
NOTE: https://www.zerodayinitiative.com/advisories/ZDI-24-1532/
CVE-2024-11233 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-r977-prxv-hc43
NOTE: https://github.com/php/php-src/commit/a6c84cd7efd7eaaaefd4463412508df570d35358 (php-8.2.26)
CVE-2024-11234 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-c5f2-jwm7-mmq2
NOTE: https://github.com/php/php-src/commit/cf6700e86d6357420a7c8386da63d48fec55f633 (php-8.2.26)
CVE-2024-11236 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-5hqh-c84r-qjcv
NOTE: https://github.com/php/php-src/commit/7742f79a8a9c20522dbf40e1dc1d4ccad71d399c (php-8.2.26)
NOTE: https://github.com/php/php-src/commit/2dbe1425c5768faea2aa7bca26081dd208c94ac8 (php-8.2.26)
CVE-2024-8929 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-h35g-vwh6-m678
NOTE: https://github.com/php/php-src/commit/6c0e2eb2f839d066924c164f65f17d1261529334 (php-8.2.26)
CVE-2024-8932 (In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before ...)
{DSA-5819-1}
- - php8.2 <unfixed>
+ - php8.2 <unfixed> (bug #1088688)
- php7.4 <removed>
NOTE: https://github.com/php/php-src/security/advisories/GHSA-g665-fm4p-vhff
NOTE: https://github.com/php/php-src/commit/90c851a8b1dc409d074ab369acbfd318bc8aea4e (php-8.2.26)
@@ -4315,7 +4315,7 @@ CVE-2024-10571 (The Chartify \u2013 WordPress Chart Plugin plugin for WordPress
CVE-2024-10979 (Incorrect control of environment variables in PostgreSQL PL/Perl allow ...)
{DSA-5812-1 DLA-3954-1}
- postgresql-17 17.1-1
- - postgresql-16 <unfixed>
+ - postgresql-16 <unfixed> (bug #1088687)
- postgresql-15 <removed>
- postgresql-13 <removed>
NOTE: https://www.postgresql.org/support/security/CVE-2024-10979/
@@ -4340,7 +4340,7 @@ CVE-2024-10979 (Incorrect control of environment variables in PostgreSQL PL/Perl
CVE-2024-10978 (Incorrect privilege assignment in PostgreSQL allows a less-privileged ...)
{DSA-5812-1 DLA-3954-1}
- postgresql-17 17.1-1
- - postgresql-16 <unfixed>
+ - postgresql-16 <unfixed> (bug #1088687)
- postgresql-15 <removed>
- postgresql-13 <removed>
NOTE: https://www.postgresql.org/support/security/CVE-2024-10978/
@@ -4365,7 +4365,7 @@ CVE-2024-10978 (Incorrect privilege assignment in PostgreSQL allows a less-privi
CVE-2024-10977 (Client use of server error message in PostgreSQL allows a server not t ...)
{DSA-5812-1 DLA-3954-1}
- postgresql-17 17.1-1
- - postgresql-16 <unfixed>
+ - postgresql-16 <unfixed> (bug #1088687)
- postgresql-15 <removed>
- postgresql-13 <removed>
NOTE: https://www.postgresql.org/support/security/CVE-2024-10977/
@@ -4378,7 +4378,7 @@ CVE-2024-10977 (Client use of server error message in PostgreSQL allows a server
CVE-2024-10976 (Incomplete tracking in PostgreSQL of tables with row security allows a ...)
{DSA-5812-1 DLA-3954-1}
- postgresql-17 17.1-1
- - postgresql-16 <unfixed>
+ - postgresql-16 <unfixed> (bug #1088687)
- postgresql-15 <removed>
- postgresql-13 <removed>
NOTE: https://www.postgresql.org/support/security/CVE-2024-10976/
@@ -8993,7 +8993,7 @@ CVE-2024-48272 (D-Link DSL6740C v6.TR069.20211230 was discovered to use an insec
CVE-2024-48271 (D-Link DSL6740C v6.TR069.20211230 was discovered to use insecure defau ...)
NOT-FOR-US: D-Link
CVE-2024-48241 (An issue in radare2 v5.8.0 through v5.9.4 allows a local attacker to c ...)
- - radare2 <unfixed>
+ - radare2 <unfixed> (bug #1088693)
NOTE: https://github.com/radareorg/radare2/issues/23317
NOTE: https://github.com/radareorg/radare2/pull/23318
NOTE: Fixed by: https://github.com/radareorg/radare2/commit/b2a467cd13c561042554901313ebdcb749eb0de7 (5.9.6)
@@ -10129,12 +10129,12 @@ CVE-2024-50614 (TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/1
[bullseye] - tinyxml2 <postponed> (Minor issue, revisit when fixed upstream)
NOTE: https://github.com/leethomason/tinyxml2/issues/996
CVE-2024-50613 (libsndfile through 1.2.2 has a reachable assertion, that may lead to a ...)
- - libsndfile <unfixed>
+ - libsndfile <unfixed> (bug #1088691)
[bookworm] - libsndfile <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - libsndfile <postponed> (Minor issue, revisit when fixed upstream)
NOTE: https://github.com/libsndfile/libsndfile/issues/1034
CVE-2024-50612 (libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out ...)
- - libsndfile <unfixed>
+ - libsndfile <unfixed> (bug #1088692)
[bookworm] - libsndfile <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - libsndfile <postponed> (Minor issue, CLI DoS)
NOTE: https://github.com/libsndfile/libsndfile/issues/1035
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5b15d490ca076bd68644ed4dc555f1866c5cc33
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/c5b15d490ca076bd68644ed4dc555f1866c5cc33
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241129/17d59cfc/attachment.htm>
More information about the debian-security-tracker-commits
mailing list