[Git][security-tracker-team/security-tracker][master] trixie triage

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
2fdbc960 by Moritz Muehlenhoff at 2025-04-23T08:42:52+02:00
trixie triage

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -4201,6 +4201,7 @@ CVE-2025-32464 (HAProxy 2.2 through 3.1.6, in certain uncommon configurations, h
 	- haproxy <unfixed> (bug #1102673)
 	NOTE: Introduced with: https://github.com/haproxy/haproxy/commit/07e1e3c93e74e44389545e457f0e1ff2e807cb9a (v2.2-dev3)
 	NOTE: Fixed by: https://github.com/haproxy/haproxy/commit/3e3b9eebf871510aee36c3a3336faac2f38c9559 (v3.2-dev10)
+	NOTE: Fixed by: https://git.haproxy.org/?p=haproxy-3.0.git;a=commit;h=ee1a64c2a04cc2cb38efb7e44f7ea7386d627bf6 (v3.0.10)
 CVE-2025-32461 (wikiplugin_includetpl in lib/wiki-plugins/wikiplugin_includetpl.php in ...)
 	- tikiwiki <removed>
 CVE-2025-30294 (ColdFusion versions 2023.12, 2021.18, 2025.0 and earlier are affected  ...)
@@ -5097,12 +5098,16 @@ CVE-2025-29482 (Buffer Overflow vulnerability in libheif 1.19.7 allows a local a
 	NOTE: https://github.com/lmarch2/poc/blob/main/libheif/libheif.md
 	NOTE: https://github.com/strukturag/libde265/issues/472
 CVE-2025-29481 (Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker  ...)
-	- libbpf <unfixed> (bug #1102672)
 	NOTE: https://github.com/lmarch2/poc/blob/main/libbpf/libbpf.md
 	NOTE: https://github.com/libbpf/libbpf/issues/898
 	NOTE: https://lore.kernel.org/bpf/20250410095517.141271-1-vmalik@redhat.com/
+	NOTE: Disputed libbpf issue (was also filed as #1102672) :
+	NOTE: https://lore.kernel.org/bpf/67b2be76-e1db-4163-995c-57073f127d7a@redhat.com/
+	NOTE: https://lore.kernel.org/bpf/CAEf4Bzb2S+1TonOp9UH86r0e6aGG2LEA4kwbQhJWr=9Xju=NEw@mail.gmail.com/
 CVE-2025-29480 (Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker t ...)
 	- gdal <unfixed> (bug #1103839)
+	[trixie] - gdal <postponed> (Minor issue, revisit when fixed upstream)
+	[bookworm] - gdal <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - gdal <postponed> (Minor issue, revisit when fixed upstream)
 	NOTE: https://github.com/lmarch2/poc/blob/main/gdal/gdal.md
 	NOTE: https://github.com/OSGeo/gdal/issues/12188
@@ -140943,7 +140948,8 @@ CVE-2023-48795 (The SSH transport protocol with certain OpenSSH extensions, foun
 	- python-asyncssh 2.15.0-1 (bug #1059007)
 	- tinyssh 20230101-4 (bug #1059058; unimportant)
 	- trilead-ssh2 <unfixed> (bug #1059294)
-	[bookworm] - trilead-ssh2 <ignored> (Minor issue)
+	[trixie] - trilead-ssh2 <ignored> (Minor issue, only reverse dep uses client-side only)
+	[bookworm] - trilead-ssh2 <ignored> (Minor issue, only reverse dep uses client-side only)
 	[bullseye] - trilead-ssh2 <no-dsa> (Minor issue)
 	[buster] - trilead-ssh2 <no-dsa> (Minor issue)
 	NOTE: https://terrapin-attack.com/
@@ -169764,6 +169770,7 @@ CVE-2023-34624 (An issue was discovered htmlcleaner thru = 2.28 allows attackers
 	NOTE: https://github.com/amplafi/htmlcleaner/issues/13
 CVE-2023-34623 (An issue was discovered jtidy thru r938 allows attackers to cause a de ...)
 	- jtidy <unfixed> (bug #1038663)
+	[trixie] - jtidy <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - jtidy <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - jtidy <no-dsa> (Minor issue)
 	[buster] - jtidy <postponed> (Minor issue, DoS)
@@ -226756,6 +226763,7 @@ CVE-2023-3637 (An uncontrolled resource consumption flaw was found in openstack-
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2222270
 CVE-2022-3277 (An uncontrolled resource consumption flaw was found in openstack-neutr ...)
 	- neutron <unfixed> (bug #1027150)
+	[trixie] - neutron <postponed> (Minor issue, revisit when fixed upstream)
 	[bookworm] - neutron <postponed> (Minor issue, revisit when fixed upstream)
 	[bullseye] - neutron <no-dsa> (Minor issue)
 	[buster] - neutron <no-dsa> (Minor issue)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2fdbc960d52c062b82c38b7850fe085cc91f37cd

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/2fdbc960d52c062b82c38b7850fe085cc91f37cd
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250423/1e54c61f/attachment-0001.htm>