Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
2576ab77 by Moritz Muehlenhoff at 2019-03-30T15:25:17Z
buster triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -2941,7 +2941,9 @@ CVE-2019-9660 (Stored XSS exists in YzmCMS 5.2 via the
admin/category/edit.html
CVE-2019-9659 (The Chuango 433 MHz burglar-alarm product line uses static
codes in th ...)
NOT-FOR-US: Chuango
CVE-2019-9658 (Checkstyle before 8.18 loads external DTDs by default. ...)
- - checkstyle <unfixed> (bug #924598)
+ - checkstyle <unfixed> (low; bug #924598)
+ [buster] - checkstyle <no-dsa> (Minor issue)
+ [stretch] - checkstyle <no-dsa> (Minor issue)
NOTE: https://github.com/checkstyle/checkstyle/issues/6474
NOTE: https://github.com/checkstyle/checkstyle/issues/6478
NOTE: https://github.com/checkstyle/checkstyle/pull/6476
@@ -8265,6 +8267,7 @@ CVE-2019-7443 [Insecure handling of arguments in helpers]
- kauth 5.54.0-2 (bug #921995)
[stretch] - kauth <no-dsa> (Minor issue, will be fixed in a point
release)
- kde4libs <unfixed> (bug #922727)
+ [buster] - kde4libs <no-dsa> (Minor issue)
[stretch] - kde4libs <no-dsa> (Minor issue)
[jessie] - kde4libs <no-dsa> (Minor issue)
NOTE:
https://mail.kde.org/pipermail/kde-announce/2019-February/000011.html
@@ -60298,7 +60301,7 @@ CVE-2018-1000078 (RubyGems version Ruby 2.2 series:
2.2.9 and earlier, Ruby 2.3
- ruby2.1 <removed>
- ruby1.9.1 <removed>
- rubygems <removed>
- - jruby <unfixed> (bug #895778)
+ - jruby 9.1.17.0-1 (bug #895778)
[jessie] - jruby <end-of-life> (See DSA-4219-1)
NOTE:
https://github.com/rubygems/rubygems/commit/66a28b9275551384fdab45f3591a82d6b59952cb
NOTE:
https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
@@ -162278,7 +162281,8 @@ CVE-2015-8567 (Memory leak in net/vmxnet3.c in QEMU
allows remote attackers to c
NOTE:
https://lists.gnu.org/archive/html/qemu-devel/2015-12/msg02299.html
NOTE: http://www.openwall.com/lists/oss-security/2015/12/15/4
CVE-2015-8559 (The knife bootstrap command in chef leaks the validator.pem
private RS ...)
- - chef <unfixed> (bug #809670)
+ - chef <unfixed> (low; bug #809670)
+ [buster] - chef <ignored> (Minor issue; workaround using validatorless
bootstrapping)
[stretch] - chef <ignored> (Minor issue; workaround using validatorless
bootstrapping)
[jessie] - chef <ignored> (Minor issue; workaround using validatorless
bootstrapping)
[wheezy] - chef <ignored> (Minor issue; workaround using validatorless
bootstrapping)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/2576ab770ee0c87cc0bc4a2da3be92d336970e6f
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/2576ab770ee0c87cc0bc4a2da3be92d336970e6f
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
