[Git][security-tracker-team/security-tracker][master] trixie triage

Tue Apr 22 22:17:10 BST 2025


Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
b55f42bd by Moritz Muehlenhoff at 2025-04-22T23:15:39+02:00
trixie triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -13003,15 +13003,12 @@ CVE-2024-48015 (Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 1
 CVE-2024-48013 (Dell SmartFabric OS10 Software, version(s) 10.5.4.x, 10.5.5.x, 10.5.6. ...)
 	NOT-FOR-US: Dell / EMC
 CVE-2024-44866 (A buffer overflow in the GuitarPro1::read function of MuseScore Studio ...)
-	- musescore3 <unfixed> (bug #1070860)
-	[bookworm] - musescore3 <ignored> (Minor issue)
-	[bullseye] - musescore3 <ignored> (Minor issue, limited support, see #1070860 and pending musescore.README.Debian)
-	- musescore2 <unfixed> (bug #1070860)
-	[bookworm] - musescore2 <ignored> (Minor issue)
-	[bullseye] - musescore2 <ignored> (Minor issue, limited support, see #1070860 and pending musescore.README.Debian)
+	- musescore3 3.2.3+dfsg2-18 (unimportant; bug #1070860)
+	- musescore2 2.3.2+dfsg4-16 (unimportant; bug #1070860)
 	- musescore <removed>
 	NOTE: https://github.com/moonadon9/CVE_2024
 	NOTE: Fixed by: https://github.com/musescore/MuseScore/commit/0630461b734201db24139b0dc1657371fce41fb9 (v4.4.0)
+	NOTE: Only supported with trusted files, see README.Debian shipped in package
 CVE-2024-44276 (This issue was addressed by using HTTPS when sending information over  ...)
 	NOT-FOR-US: Apple
 CVE-2024-12992 (Improper Neutralization of Special Elements used in a Command vulnerab ...)
@@ -71767,6 +71764,7 @@ CVE-2024-42364 (Homepage is a highly customizable homepage with Docker and servi
 	NOT-FOR-US: gethomepage/homepage
 CVE-2024-42040 (Buffer Overflow vulnerability in the net/bootp.c in DENEX U-Boot from  ...)
 	- u-boot <unfixed> (bug #1081557)
+	[trixie] - u-boot <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - u-boot <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - u-boot <postponed> (Minor issue; can be fixed in next update)
 	NOTE: https://lists.denx.de/pipermail/u-boot/2024-August/562528.html
@@ -105315,13 +105313,10 @@ CVE-2023-44431 (BlueZ Audio Profile AVRCP Stack-based Buffer Overflow Remote Cod
 CVE-2023-44430 (Bentley View SKP File Parsing Use-After-Free Remote Code Execution Vul ...)
 	NOT-FOR-US: Bentley
 CVE-2023-44428 (MuseScore CAP File Parsing Heap-based Buffer Overflow Remote Code Exec ...)
-	- musescore2 <unfixed> (bug #1070860)
-	[bookworm] - musescore2 <ignored> (Minor issue)
-	[bullseye] - musescore2 <ignored> (Minor issue, limited support, see #1070860 and pending musescore.README.Debian)
-	- musescore3 <unfixed> (bug #1070860)
-	[bookworm] - musescore3 <ignored> (Minor issue)
-	[bullseye] - musescore3 <ignored> (Minor issue, limited support, see #1070860 and pending musescore.README.Debian)
+	- musescore2 2.3.2+dfsg4-16 (unimportant; bug #1070860)
+	- musescore3 3.2.3+dfsg2-18 (unimportant; bug #1070860)
 	NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1526/
+	NOTE: Only supported with trusted files, see README.Debian shipped in package
 CVE-2023-44427 (D-Link DIR-X3260 SetSysEmailSettings SMTPServerAddress Command Injecti ...)
 	NOT-FOR-US: D-Link
 CVE-2023-44426 (D-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection ...)
@@ -107928,6 +107923,7 @@ CVE-2023-48683 (Sensitive information disclosure and manipulation due to missing
 	NOT-FOR-US: Acronis Cyber Protect Cloud Agent
 CVE-2023-46565 (Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d1 ...)
 	- gobgp <unfixed> (bug #1070393)
+	[trixie] - gobgp <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - gobgp <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - gobgp <no-dsa> (Minor issue)
 	NOTE: https://github.com/osrg/gobgp/issues/2725
@@ -152750,6 +152746,7 @@ CVE-2023-5072 (Denial of Service  in JSON-Java versions up to and including 2023
 	[bullseye] - jenkins-json <no-dsa> (Minor issue)
 	[buster] - jenkins-json <no-dsa> (Minor issue)
 	- libjettison-java <unfixed> (bug #1053884)
+	[trixie] - libjettison-java <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - libjettison-java <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - libjettison-java <no-dsa> (Minor issue)
 	[buster] - libjettison-java <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b55f42bde848f7a2b0b60949a6f11bf8f0d8b423

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/b55f42bde848f7a2b0b60949a6f11bf8f0d8b423
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250422/24dd918f/attachment.htm>
