Moritz Muehlenhoff pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
1712d1c2 by Moritz Muehlenhoff at 2019-06-21T21:08:48Z
buster triage
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -138,6 +138,7 @@ CVE-2019-12866
RESERVED
CVE-2019-12865 (In radare2 through 3.5.1, cmd_mount in libr/core/cmd_mount.c
has a dou ...)
- radare2 <unfixed> (bug #930704)
+ [buster] - radare2 <no-dsa> (Minor issue)
[stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <no-dsa> (Minor issue)
NOTE: https://github.com/radare/radare2/issues/14334
@@ -224,6 +225,7 @@ CVE-2019-12830 (In MyBB before 1.8.21, an attacker can
exploit a parsing flaw in
NOT-FOR-US: MyBB
CVE-2019-12829 (radare2 through 3.5.1 mishandles the RParse API, which allows
remote a ...)
- radare2 <unfixed> (bug #930590)
+ [buster] - radare2 <no-dsa> (Minor issue)
[stretch] - radare2 <no-dsa> (Minor issue)
[jessie] - radare2 <no-dsa> (Minor issue)
NOTE: https://github.com/radare/radare2/issues/14303
@@ -420,12 +422,14 @@ CVE-2019-12762 (Xiaomi Mi 5s Plus devices allow attackers
to trigger touchscreen
NOT-FOR-US: Xiaomi Mi 5s Plus devices
CVE-2019-12761 (A code injection issue was discovered in PyXDG before 0.26 via
crafted ...)
{DLA-1819-1}
- - pyxdg <unfixed> (bug #930099)
+ - pyxdg <unfixed> (low; bug #930099)
+ [buster] - pyxdg <no-dsa> (Minor issue)
[stretch] - pyxdg <no-dsa> (Minor issue)
NOTE: https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562
NOTE: https://gitlab.freedesktop.org/xdg/pyxdg/issues/14
CVE-2019-12760 (A deserialization vulnerability exists in the way parso
through 0.4.0 ...)
- parso <unfixed> (bug #930356)
+ [buster] - parso <no-dsa> (Minor issue)
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1718212
NOTE: https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7
CVE-2019-12759
@@ -1790,15 +1794,23 @@ CVE-2019-12215 (** DISPUTED ** A full path disclosure
vulnerability was discover
- matomo <itp> (bug #448532)
CVE-2019-12214 (In FreeImage 3.18.0, an out-of-bounds access occurs because of
mishand ...)
- freeimage <unfixed> (bug #929597)
+ [buster] - freeimage <postponed> (Revisit when upstream fixes are
available)
+ [stretch] - freeimage <postponed> (Revisit when upstream fixes are
available)
NOTE:
https://sourceforge.net/p/freeimage/discussion/36111/thread/e06734bed5/
CVE-2019-12213 (When FreeImage 3.18.0 reads a special TIFF file, the
TIFFReadDirectory ...)
- freeimage <unfixed> (bug #929597)
+ [buster] - freeimage <postponed> (Revisit when upstream fixes are
available)
+ [stretch] - freeimage <postponed> (Revisit when upstream fixes are
available)
NOTE:
https://sourceforge.net/p/freeimage/discussion/36111/thread/e06734bed5/
CVE-2019-12212 (When FreeImage 3.18.0 reads a special JXR file, the
StreamCalcIFDSize ...)
- freeimage <unfixed> (bug #929597)
+ [buster] - freeimage <postponed> (Revisit when upstream fixes are
available)
+ [stretch] - freeimage <postponed> (Revisit when upstream fixes are
available)
NOTE:
https://sourceforge.net/p/freeimage/discussion/36111/thread/e06734bed5/
CVE-2019-12211 (When FreeImage 3.18.0 reads a tiff file, it will be handed to
the Load ...)
- freeimage <unfixed> (bug #929597)
+ [buster] - freeimage <postponed> (Revisit when upstream fixes are
available)
+ [stretch] - freeimage <postponed> (Revisit when upstream fixes are
available)
NOTE:
https://sourceforge.net/p/freeimage/discussion/36111/thread/e06734bed5/
CVE-2019-12210 (In Yubico pam-u2f 1.0.7, when configured with debug and a
custom debug ...)
- pam-u2f <unfixed> (low; bug #930023)
@@ -1936,7 +1948,8 @@ CVE-2019-12151
CVE-2019-12150 (Karamasoft UltimateEditor 1 does not ensure that an uploaded
file is a ...)
NOT-FOR-US: Karamasoft UltimateEditor
CVE-2018-20839 (systemd 242 changes the VT1 mode upon a logout, which allows
attackers ...)
- - systemd <unfixed> (bug #929116)
+ - systemd <unfixed> (low; bug #929116)
+ [buster] - systemd <no-dsa> (Minor issue)
[stretch] - systemd <no-dsa> (Minor issue)
[jessie] - systemd <no-dsa> (Not reproducible without Ubuntu-style
persistant VT1 greeter; too invasive to fix)
NOTE: https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993
@@ -4605,6 +4618,7 @@ CVE-2019-11069 (Sequelize version 5 before 5.3.0 does not
properly ensure that s
CVE-2019-11068 (libxslt through 1.1.33 allows bypass of a protection mechanism
because ...)
{DLA-1756-1}
- libxslt <unfixed> (bug #926895)
+ [buster] - libxslt <no-dsa> (Minor issue)
[stretch] - libxslt <no-dsa> (Minor issue)
NOTE: https://gitlab.gnome.org/GNOME/libxslt/issues/12 (not public)
NOTE:
https://gitlab.gnome.org/GNOME/libxslt/commit/e03553605b45c88f0b4b2980adfbbb8f6fca2fd6
@@ -8446,7 +8460,7 @@ CVE-2019-9836
CVE-2019-9835 (The receiver (aka bridge) component of Fujitsu Wireless
Keyboard Set L ...)
NOT-FOR-US: Fujitsu Wireless Keyboard Set LX901 GK900 devices
CVE-2019-9834 (The Netdata web application through 1.13.0 allows remote
attackers to ...)
- - netdata <unfixed>
+ - netdata <undetermined>
CVE-2019-9833 (The Screen Stream application through 3.0.15 for Android allows
remote ...)
NOT-FOR-US: Screen Stream application for Android
CVE-2019-9832 (The AirDrop application through 2.0 for Android allows remote
attacker ...)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1712d1c2045b49899fa5caa6de64c6d432f49cab
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/commit/1712d1c2045b49899fa5caa6de64c6d432f49cab
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
