[Git][security-tracker-team/security-tracker][master] bookworm triage
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Oct 29 11:22:08 GMT 2024
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
3fee93e6 by Moritz Muehlenhoff at 2024-10-29T12:21:49+01:00
bookworm triage
- - - - -
2 changed files:
- data/CVE/list
- data/dsa-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
@@ -491,6 +491,7 @@ CVE-2024-9162 (The All-in-One WP Migration and Backup plugin for WordPress is vu
CVE-2024-50624 (ispdbservice.cpp in KDE Kmail before 6.2.0 allows man-in-the-middle at ...)
[experimental] - kmail-account-wizard 4:24.08.0-1
- kmail-account-wizard <unfixed> (bug #1086198)
+ [bookworm] - kmail-account-wizard <no-dsa> (Minor issue)
NOTE: https://bugs.kde.org/show_bug.cgi?id=487882
NOTE: https://invent.kde.org/pim/kmail-account-wizard/-/commit/9784f5ab41c3aff435d4a88afb25585180a62ee4 (v24.07.80)
CVE-2024-50623 (In Cleo Harmony before 5.8.0.20, VLTrader before 5.8.0.20, and LexiCom ...)
@@ -499,20 +500,25 @@ CVE-2024-50616 (Ironman PowerShell Universal 5.x before 5.0.12 allows an authent
NOT-FOR-US: Ironman PowerShell Universal
CVE-2024-50615 (TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/digit, ...)
- tinyxml2 <unfixed>
+ [bookworm] - tinyxml2 <postponed> (Minor issue, revisit when fixed upstream)
NOTE: https://github.com/leethomason/tinyxml2/issues/997
CVE-2024-50614 (TinyXML2 through 10.0.0 has a reachable assertion for UINT_MAX/16, tha ...)
- tinyxml2 <unfixed>
+ [bookworm] - tinyxml2 <postponed> (Minor issue, revisit when fixed upstream)
NOTE: https://github.com/leethomason/tinyxml2/issues/996
CVE-2024-50613 (libsndfile through 1.2.2 has a reachable assertion, that may lead to a ...)
- libsndfile <unfixed>
+ [bookworm] - libsndfile <postponed> (Minor issue, revisit when fixed upstream)
NOTE: https://github.com/libsndfile/libsndfile/issues/1034
CVE-2024-50612 (libsndfile through 1.2.2 has an ogg_vorbis.c vorbis_analysis_wrote out ...)
- libsndfile <unfixed>
+ [bookworm] - libsndfile <postponed> (Minor issue, revisit when fixed upstream)
NOTE: https://github.com/libsndfile/libsndfile/issues/1035
CVE-2024-50611 (CycloneDX cdxgen through 10.10.7, when run against an untrusted codeba ...)
NOT-FOR-US: CycloneDX cdxgen
CVE-2024-50610 (GSL (GNU Scientific Library) through 2.8 has an integer signedness err ...)
- gsl 2.8+dfsg-4 (bug #1086206)
+ [bookworm] - gsl <no-dsa> (Minor issue)
NOTE: https://lists.gnu.org/archive/html/bug-gsl/2024-09/msg00000.html
CVE-2024-50307 (Use of potentially dangerous function issue exists in Chatwork Desktop ...)
NOT-FOR-US: Chatwork Desktop Application
@@ -1181,9 +1187,11 @@ CVE-2024-0126 (NVIDIA GPU Display Driver for Windows and Linux contains a vulner
[bullseye] - nvidia-graphics-drivers-tesla-460 <no-dsa> (Non-free not supported)
NOTE: 460.106.00-3 turned the package into a metapackage to aid switching to nvidia-graphics-drivers-tesla-470
- nvidia-graphics-drivers-tesla-470 <unfixed> (bug #1085974)
+ [bookworm] - nvidia-graphics-drivers-tesla-470 <no-dsa> (Non-free not supported)
- nvidia-graphics-drivers-tesla 525.147.05-6 (bug #1085975)
NOTE: 525.147.05-6 turned the package into a metapackage to aid switching to nvidia-graphics-drivers
- nvidia-open-gpu-kernel-modules <unfixed> (bug #1085976)
+ [bookworm] - nvidia-open-gpu-kernel-modules <no-dsa> (Contrib not supported)
NOTE: https://nvidia.custhelp.com/app/answers/detail/a_id/5586
CVE-2024-48936 (SchedMD Slurm before 24.05.4 has Incorrect Authorization. A mistake in ...)
- slurm-wlm <unfixed> (bug #1086003)
@@ -1408,6 +1416,7 @@ CVE-2024-10250 (The Nioland theme for WordPress is vulnerable to Reflected Cross
NOT-FOR-US: WordPress theme
CVE-2024-10041 (A vulnerability was found in PAM. The secret information is stored in ...)
- pam <unfixed> (bug #1086038)
+ [bookworm] - pam <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2319212
NOTE: https://github.com/linux-pam/linux-pam/issues/846
NOTE: https://github.com/linux-pam/linux-pam/pull/686
@@ -4330,13 +4339,10 @@ CVE-2024-9925 (SQL injection vulnerability in TAI Smart Factory's QPLANT SF vers
CVE-2024-9895 (The Smart Online Order for Clover plugin for WordPress is vulnerable t ...)
NOT-FOR-US: WordPress plugin
CVE-2024-9676 (A vulnerability was found in Podman, Buildah, and CRI-O. A symlink tra ...)
- - cri-o <itp> (bug #979702)
- golang-github-containers-buildah <unfixed>
[bookworm] - golang-github-containers-buildah <no-dsa> (Minor issue)
- golang-github-containers-storage 1.55.1+ds1-1
[bookworm] - golang-github-containers-storage <no-dsa> (Minor issue)
- - libpod <unfixed>
- - podman <unfixed>
NOTE: https://github.com/advisories/GHSA-wq2p-5pc6-wpgf
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2317467
NOTE: https://github.com/containers/buildah/pull/5786
=====================================
data/dsa-needed.txt
=====================================
@@ -17,6 +17,8 @@ cacti
frr
coordination with the maintainer ongoing
--
+libarchive
+--
libreswan
Waiting on feedback from maintainer
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3fee93e6bba5a832ec42cbb481534dfbaf7a230c
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/3fee93e6bba5a832ec42cbb481534dfbaf7a230c
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20241029/7c3faec2/attachment.htm>
More information about the debian-security-tracker-commits
mailing list