[Git][security-tracker-team/security-tracker][master] Add embded angular.js in openshot-qt
Bastien Roucariès (@rouca)
rouca at debian.org
Tue May 6 20:46:20 BST 2025
Bastien Roucariès pushed to branch master at Debian Security Tracker / security-tracker
Commits:
6ed72542 by Bastien Roucariès at 2025-05-06T21:46:10+02:00
Add embded angular.js in openshot-qt
- - - - -
2 changed files:
- data/CVE/list
- data/embedded-code-copies
Changes:
=====================================
data/CVE/list
=====================================
@@ -2695,6 +2695,7 @@ CVE-2025-1194 (A Regular Expression Denial of Service (ReDoS) vulnerability was
CVE-2025-0716 (Improper sanitization of the value of the 'href' and 'xlink:href' attr ...)
- angular.js <unfixed> (bug #1104485)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
CVE-2025-0520 (An unrestricted file upload vulnerability in ShowDoc caused by imprope ...)
NOT-FOR-US: ShowDoc
CVE-2024-57698 (An issue in modernwms v.1.0 allows an attacker view the MD5 hash of th ...)
@@ -72916,6 +72917,7 @@ CVE-2024-8373 (Improper sanitization of the value of the [srcset] attribute in <
[bookworm] - angular.js <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - angular.js <postponed> (Minor issue)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://codepen.io/herodevs/full/bGPQgMp/8da9ce87e99403ee13a295c305ebfa0b
CVE-2024-8372 (Improper sanitization of the value of the 'srcset' attribute in Angula ...)
- angular.js <unfixed> (bug #1088804)
@@ -72923,6 +72925,7 @@ CVE-2024-8372 (Improper sanitization of the value of the 'srcset' attribute in A
[bookworm] - angular.js <postponed> (Minor issue, revisit when fixed upstream)
[bullseye] - angular.js <postponed> (Minor issue)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://codepen.io/herodevs/full/xxoQRNL/0072e627abe03e9cda373bc75b4c1017
CVE-2024-8042 (Rapid7 Insight Platform versions between November 2019 and August 14, ...)
NOT-FOR-US: Rapid7 Insight Platform
@@ -134747,6 +134750,7 @@ CVE-2024-21490 (This affects versions of the package angular from 1.3.0. A regul
[bullseye] - angular.js <no-dsa> (Minor issue)
[buster] - angular.js <postponed> (Fix along with the next DLA)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://security.snyk.io/vuln/SNYK-JS-ANGULAR-6091113
CVE-2024-1406 (A vulnerability was found in Linksys WRT54GL 4.30.18. It has been decl ...)
NOT-FOR-US: Linksys
@@ -194084,6 +194088,7 @@ CVE-2023-26118 (Versions of the package angular from 1.4.9 are vulnerable to Reg
[bullseye] - angular.js <no-dsa> (Minor issue)
[buster] - angular.js <no-dsa> (Minor issue)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373046
CVE-2023-26117 (Versions of the package angular from 1.0.0 are vulnerable to Regular E ...)
- angular.js <unfixed> (bug #1036694)
@@ -194092,6 +194097,7 @@ CVE-2023-26117 (Versions of the package angular from 1.0.0 are vulnerable to Reg
[bullseye] - angular.js <no-dsa> (Minor issue)
[buster] - angular.js <no-dsa> (Minor issue)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373045
CVE-2023-26116 (Versions of the package angular from 1.2.21 are vulnerable to Regular ...)
- angular.js <unfixed> (bug #1036694)
@@ -194100,6 +194106,7 @@ CVE-2023-26116 (Versions of the package angular from 1.2.21 are vulnerable to Re
[bullseye] - angular.js <no-dsa> (Minor issue)
[buster] - angular.js <no-dsa> (Minor issue)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://security.snyk.io/vuln/SNYK-JS-ANGULAR-3373044
CVE-2023-26115 (All versions of the package word-wrap are vulnerable to Regular Expres ...)
NOT-FOR-US: Node.js word-wrap module
@@ -274458,6 +274465,7 @@ CVE-2022-25869 (All versions of package angular are vulnerable to Cross-site Scr
[bullseye] - angular.js <no-dsa> (Minor issue)
[buster] - angular.js <no-dsa> (Minor issue)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781
CVE-2022-25867 (The package io.socket:socket.io-client before 2.0.1 are vulnerable to ...)
NOT-FOR-US: socket.io-client-java
@@ -274520,6 +274528,7 @@ CVE-2022-25844 (The package angular after 1.7.0 are vulnerable to Regular Expres
[buster] - angular.js <no-dsa> (Minor issue, probably even not-affected)
[stretch] - angular.js <ignored> (Nodejs in stretch not covered by security support)
- civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735
CVE-2022-25843
RESERVED
@@ -422454,6 +422463,7 @@ CVE-2020-7676 (angular.js prior to 1.8.0 allows cross site scripting. The regex-
[buster] - angular.js <no-dsa> (Minor issue; can be fixed via point release)
[stretch] - angular.js <ignored> (Nodejs in stretch not covered by security support)
[jessie] - angular.js <no-dsa> (Minor issue, low usage of 2014-era Nodejs)
+ - openshot-qt <unfixed>
NOTE: https://github.com/angular/angular.js/pull/17028
NOTE: https://snyk.io/vuln/SNYK-JS-ANGULAR-570058
CVE-2020-7675 (cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. ...)
@@ -468802,10 +468812,11 @@ CVE-2019-10769 (safer-eval is a npm package to sandbox the he evaluation of code
NOT-FOR-US: safer-eval Node module
CVE-2019-10768 (In AngularJS before 1.7.9 the function `merge()` could be tricked into ...)
- angular.js 1.7.9-1 (bug #945249)
- - civicrm <unfixed>
[buster] - angular.js <no-dsa> (Minor issue; can be fixed via point release)
[stretch] - angular.js <ignored> (Nodejs in stretch not covered by security support)
[jessie] - angular.js <not-affected> (vulnerable code is not present, deep merging introduced later)
+ - civicrm <unfixed>
+ - openshot-qt <unfixed>
NOTE: https://github.com/angular/angular.js/commit/add78e62004e80bb1e16ab2dfe224afa8e513bc3
NOTE: https://snyk.io/vuln/SNYK-JS-ANGULAR-534884
CVE-2019-10767 (An attacker can include file contents from outside the `/adapter/xxx/` ...)
=====================================
data/embedded-code-copies
=====================================
@@ -3854,3 +3854,4 @@ sabberworm (not packaged in Debian)
angular.js
- civicrm <unfixed> (embded; bug #1104797)
+ - openshot-qt <unfixed> (embded; bug #1104810)
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ed72542de445bf31e1ca223a275d6f50f5fd9c2
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/6ed72542de445bf31e1ca223a275d6f50f5fd9c2
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250506/f7d8dada/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list