Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
5138f279 by security tracker role at 2022-11-18T08:10:13+00:00
automatic update
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -1,3 +1,29 @@
+CVE-2023-21523
+ RESERVED
+CVE-2023-21522
+ RESERVED
+CVE-2023-21521
+ RESERVED
+CVE-2023-21520
+ RESERVED
+CVE-2023-21519
+ RESERVED
+CVE-2022-45467
+ RESERVED
+CVE-2022-45466
+ RESERVED
+CVE-2022-45465
+ RESERVED
+CVE-2022-45464
+ RESERVED
+CVE-2022-45463
+ RESERVED
+CVE-2022-4056
+ RESERVED
+CVE-2022-4055
+ RESERVED
+CVE-2022-4054
+ RESERVED
CVE-2022-45462
RESERVED
CVE-2022-45461 (The Java Admin Console in Veritas NetBackup through 10.1 and
related V ...)
@@ -599,8 +625,8 @@ CVE-2022-45377
RESERVED
CVE-2022-45376
RESERVED
-CVE-2022-45375
- RESERVED
+CVE-2022-45375 (Auth. Stored Cross-Site Scripting (XSS) vulnerability in
iFeature Slid ...)
+ TODO: check
CVE-2022-45374
RESERVED
CVE-2022-45373
@@ -1355,8 +1381,8 @@ CVE-2022-45079
RESERVED
CVE-2022-45078
RESERVED
-CVE-2022-45077
- RESERVED
+CVE-2022-45077 (Auth. (subscriber+) PHP Object Injection vulnerability in
Betheme them ...)
+ TODO: check
CVE-2022-45076
RESERVED
CVE-2022-45075
@@ -1365,20 +1391,20 @@ CVE-2022-45074
RESERVED
CVE-2022-45073
RESERVED
-CVE-2022-45072
- RESERVED
-CVE-2022-45071
- RESERVED
+CVE-2022-45072 (Cross-Site Request Forgery (CSRF) vulnerability in WPML
Multilingual C ...)
+ TODO: check
+CVE-2022-45071 (Cross-Site Request Forgery (CSRF) vulnerability in WPML
Multilingual C ...)
+ TODO: check
CVE-2022-45070
RESERVED
-CVE-2022-45069
- RESERVED
+CVE-2022-45069 (Auth. (contributor+) Privilege Escalation vulnerability in
Crowdsignal ...)
+ TODO: check
CVE-2022-45068
RESERVED
CVE-2022-45067
RESERVED
-CVE-2022-45066
- RESERVED
+CVE-2022-45066 (Auth. (subscriber+) Broken Access Control vulnerability in
WooSwipe Wo ...)
+ TODO: check
CVE-2022-45065
RESERVED
CVE-2022-45064
@@ -2206,8 +2232,8 @@ CVE-2022-44738
RESERVED
CVE-2022-44737
RESERVED
-CVE-2022-44736
- RESERVED
+CVE-2022-44736 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Cham ...)
+ TODO: check
CVE-2022-44735
RESERVED
CVE-2022-44734
@@ -2274,8 +2300,8 @@ CVE-2022-44727 (The EU Cookie Law GDPR (Banner + Blocker)
module before 2.1.3 fo
NOT-FOR-US: PrestaShop module
CVE-2022-44726
RESERVED
-CVE-2022-44725
- RESERVED
+CVE-2022-44725 (OPC Foundation Local Discovery Server (LDS) through
1.04.403.478 uses ...)
+ TODO: check
CVE-2022-44724 (The Handy Tip macro in Stiltsoft Handy Macros for Confluence
Server/Da ...)
NOT-FOR-US: Stiltsoft
CVE-2022-44723
@@ -3762,8 +3788,8 @@ CVE-2022-44593
RESERVED
CVE-2022-44592
RESERVED
-CVE-2022-44591
- RESERVED
+CVE-2022-44591 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Anth ...)
+ TODO: check
CVE-2022-44590 (Auth. (contributor+) Stored Cross-Site Scripting (XSS)
vulnerability i ...)
NOT-FOR-US: WordPress plugin
CVE-2022-44589
@@ -3790,8 +3816,8 @@ CVE-2022-44579
RESERVED
CVE-2022-44578
RESERVED
-CVE-2022-44577
- RESERVED
+CVE-2022-44577 (Auth. CSV Injection vulnerability in Export Users With Meta
plugin < ...)
+ TODO: check
CVE-2022-44576 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in Agen ...)
NOT-FOR-US: WordPress plugin
CVE-2022-44575
@@ -4104,22 +4130,22 @@ CVE-2022-44458
RESERVED
CVE-2022-44457 (A vulnerability has been identified in Mendix SAML Module
(Mendix 7 co ...)
NOT-FOR-US: Siemens
-CVE-2022-43506
- RESERVED
+CVE-2022-43506 (SQL Injection in HandlerTag_KID.ashx in Delta Electronics
DIAEnergie v ...)
+ TODO: check
CVE-2022-43495 (OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability
in distr ...)
NOT-FOR-US: OpenHarmony
-CVE-2022-43457
- RESERVED
-CVE-2022-43452
- RESERVED
+CVE-2022-43457 (SQL Injection in HandlerPage_KID.ashx in Delta Electronics
DIAEnergie ...)
+ TODO: check
+CVE-2022-43452 (SQL Injection in FtyInfoSetting.aspx in Delta Electronics
DIAEnergie v ...)
+ TODO: check
CVE-2022-43451 (OpenHarmony-v3.1.2 and prior versions had an Multiple path
traversal v ...)
NOT-FOR-US: OpenHarmony
CVE-2022-43449 (OpenHarmony-v3.1.2 and prior versions had an Arbitrary file
read vulne ...)
NOT-FOR-US: OpenHarmony
-CVE-2022-43447
- RESERVED
-CVE-2022-41775
- RESERVED
+CVE-2022-43447 (SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics
DIAEnergie ...)
+ TODO: check
+CVE-2022-41775 (SQL Injection in Handler_CFG.ashx in Delta Electronics
DIAEnergie vers ...)
+ TODO: check
CVE-2022-3780 (Database connections on deleted users could stay active on
MySQL data ...)
NOT-FOR-US: Devolutions Remote Desktop Manager
CVE-2022-3779
@@ -5074,8 +5100,8 @@ CVE-2022-44003 (An issue was discovered in BACKCLICK
Professional 5.9.63. Due to
NOT-FOR-US: BACKCLICK Professional
CVE-2022-44002 (An issue was discovered in BACKCLICK Professional 5.9.63. Due
to insuf ...)
NOT-FOR-US: BACKCLICK Professional
-CVE-2022-44001
- RESERVED
+CVE-2022-44001 (An issue was discovered in BACKCLICK Professional 5.9.63. User
authent ...)
+ TODO: check
CVE-2022-44000 (An issue was discovered in BACKCLICK Professional 5.9.63. Due
to an ex ...)
NOT-FOR-US: BACKCLICK Professional
CVE-2022-43999 (An issue was discovered in BACKCLICK Professional 5.9.63. Due
to expos ...)
@@ -8200,8 +8226,8 @@ CVE-2022-41831
RESERVED
CVE-2022-41805
RESERVED
-CVE-2022-41791
- RESERVED
+CVE-2022-41791 (Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid
plugin ...)
+ TODO: check
CVE-2022-41790
RESERVED
CVE-2022-41788
@@ -8713,8 +8739,8 @@ CVE-2022-43334
RESERVED
CVE-2022-43333
RESERVED
-CVE-2022-43332
- RESERVED
+CVE-2022-43332 (A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4
allows ...)
+ TODO: check
CVE-2022-43331 (Canteen Management System v1.0 was discovered to contain a SQL
injecti ...)
NOT-FOR-US: Canteen Management System
CVE-2022-43330 (Canteen Management System v1.0 was discovered to contain a SQL
injecti ...)
@@ -8761,8 +8787,8 @@ CVE-2022-43310 (An Uncontrolled Search Path Element in
Foxit Software released F
NOT-FOR-US: Foxit Reader
CVE-2022-43309
RESERVED
-CVE-2022-43308
- RESERVED
+CVE-2022-43308 (INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated
attackers ...)
+ TODO: check
CVE-2022-43307
RESERVED
CVE-2022-43306 (The d8s-timer for python, as distributed on PyPI, included a
potential ...)
@@ -9023,8 +9049,8 @@ CVE-2022-43194
RESERVED
CVE-2022-43193
RESERVED
-CVE-2022-43192
- RESERVED
+CVE-2022-43192 (An arbitrary file upload vulnerability in the component
/dede/file_man ...)
+ TODO: check
CVE-2022-43191
RESERVED
CVE-2022-43190
@@ -9041,16 +9067,16 @@ CVE-2022-43185 (A stored cross-site scripting (XSS)
vulnerability in the Configu
NOT-FOR-US: Rukovoditel
CVE-2022-43184 (D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a
command in ...)
NOT-FOR-US: D-Link
-CVE-2022-43183
- RESERVED
+CVE-2022-43183 (XXL-Job before v2.3.1 contains a Server-Side Request Forgery
(SSRF) vi ...)
+ TODO: check
CVE-2022-43182
RESERVED
CVE-2022-43181
RESERVED
CVE-2022-43180
RESERVED
-CVE-2022-43179
- RESERVED
+CVE-2022-43179 (Online Leave Management System v1.0 was discovered to contain
a SQL in ...)
+ TODO: check
CVE-2022-43178
RESERVED
CVE-2022-43177
@@ -9065,8 +9091,8 @@ CVE-2022-43173
RESERVED
CVE-2022-43172
RESERVED
-CVE-2022-43171
- RESERVED
+CVE-2022-43171 (A heap buffer overflow in the
LIEF::MachO::BinaryParser::parse_dyldinf ...)
+ TODO: check
CVE-2022-43170 (A stored cross-site scripting (XSS) vulnerability in the
Dashboard Con ...)
NOT-FOR-US: Rukovoditel
CVE-2022-43169 (A stored cross-site scripting (XSS) vulnerability in the Users
Access ...)
@@ -9081,10 +9107,10 @@ CVE-2022-43165 (A stored cross-site scripting (XSS)
vulnerability in the Global
NOT-FOR-US: Rukovoditel
CVE-2022-43164 (A stored cross-site scripting (XSS) vulnerability in the
Global Lists ...)
NOT-FOR-US: Rukovoditel
-CVE-2022-43163
- RESERVED
-CVE-2022-43162
- RESERVED
+CVE-2022-43163 (Online Diagnostic Lab Management System v1.0 was discovered to
contain ...)
+ TODO: check
+CVE-2022-43162 (Online Diagnostic Lab Management System v1.0 was discovered to
contain ...)
+ TODO: check
CVE-2022-43161
RESERVED
CVE-2022-43160
@@ -9218,8 +9244,8 @@ CVE-2022-43098
RESERVED
CVE-2022-43097
RESERVED
-CVE-2022-43096
- RESERVED
+CVE-2022-43096 (Mediatrix 4102 before v48.5.2718 allows local attackers to
gain root a ...)
+ TODO: check
CVE-2022-43095
RESERVED
CVE-2022-43094
@@ -9945,8 +9971,8 @@ CVE-2022-42905 (In wolfSSL before 5.5.2, if callback
functions are enabled (via
NOTE: Fixed in 5.5.2
(https://www.wolfssl.com/docs/security-vulnerabilities/)
CVE-2022-42904
RESERVED
-CVE-2022-42903
- RESERVED
+CVE-2022-42903 (Zoho ManageEngine SupportCenter Plus through 11024 allows
low-privileg ...)
+ TODO: check
CVE-2022-42902 (In Linaro Automated Validation Architecture (LAVA) before
2022.10, the ...)
{DSA-5260-1 DLA-3192-1}
- lava 2022.10-1 (bug #1021737)
@@ -10876,8 +10902,8 @@ CVE-2022-42535
RESERVED
CVE-2022-42534
RESERVED
-CVE-2022-42533
- RESERVED
+CVE-2022-42533 (In shared_metadata_init of SharedMetadata.cpp, there is a
possible out ...)
+ TODO: check
CVE-2022-42532
RESERVED
CVE-2022-42531
@@ -13083,8 +13109,8 @@ CVE-2022-41570 (An issue was discovered in
EyesOfNetwork (EON) through 5.3.11. U
NOT-FOR-US: EyesOfNetwork (EON)
CVE-2022-41569
RESERVED
-CVE-2022-41315
- RESERVED
+CVE-2022-41315 (Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic
plugin ...)
+ TODO: check
CVE-2022-41155
RESERVED
CVE-2022-41136 (Cross-Site Request Forgery (CSRF) vulnerability leading to
Stored Cros ...)
@@ -13093,8 +13119,8 @@ CVE-2022-41135
RESERVED
CVE-2022-41134
RESERVED
-CVE-2022-41132
- RESERVED
+CVE-2022-41132 (Unauthenticated Plugin Settings Change Leading To Stored XSS
Vulnerabi ...)
+ TODO: check
CVE-2022-40975
RESERVED
CVE-2022-40966
@@ -13107,8 +13133,8 @@ CVE-2022-40699
RESERVED
CVE-2022-40697
RESERVED
-CVE-2022-40694
- RESERVED
+CVE-2022-40694 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability
in News ...)
+ TODO: check
CVE-2022-40311 (Auth. (admin+) Stored Cross-Site Scripting (XSS) in Fatcat
Apps Analyt ...)
NOT-FOR-US: WordPress plugin
CVE-2022-40218
@@ -13119,8 +13145,8 @@ CVE-2022-40209
RESERVED
CVE-2022-40203
RESERVED
-CVE-2022-40192
- RESERVED
+CVE-2022-40192 (Cross-Site Request Forgery (CSRF) vulnerability in wpForo
Forum plugin ...)
+ TODO: check
CVE-2022-40130
RESERVED
CVE-2022-40128 (Cross-Site Request Forgery (CSRF) vulnerability in Advanced
Order Expo ...)
@@ -15404,8 +15430,8 @@ CVE-2022-38974
RESERVED
CVE-2022-38468
RESERVED
-CVE-2022-38461
- RESERVED
+CVE-2022-38461 (Broken Access Control vulnerability in WPML Multilingual CMS
premium p ...)
+ TODO: check
CVE-2022-38454 (Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io
Image Opt ...)
NOT-FOR-US: WordPress plugin
CVE-2022-38104 (Auth. WordPress Options Change (siteurl, users_can_register,
default_r ...)
@@ -16526,8 +16552,8 @@ CVE-2022-40226 (A vulnerability has been identified in
SICAM P850 (All versions
NOT-FOR-US: Siemens
CVE-2022-40225
REJECTED
-CVE-2022-40200
- RESERVED
+CVE-2022-40200 (Auth. (subscriber+) Arbitrary File Upload vulnerability in
wpForo Foru ...)
+ TODO: check
CVE-2022-40198
RESERVED
CVE-2022-40197
@@ -18433,8 +18459,8 @@ CVE-2022-39391
RESERVED
CVE-2022-39390
REJECTED
-CVE-2022-39389
- RESERVED
+CVE-2022-39389 (Lightning Network Daemon (lnd) is an implementation of a
lightning bit ...)
+ TODO: check
CVE-2022-39388 (Istio is an open platform to connect, manage, and secure
microservices ...)
NOT-FOR-US: Istio
CVE-2022-39387 (XWiki OIDC has various tools to manipulate OpenID Connect
protocol in ...)
@@ -19004,14 +19030,14 @@ CVE-2022-39183
RESERVED
CVE-2022-39182
RESERVED
-CVE-2022-39181
- RESERVED
-CVE-2022-39180
- RESERVED
-CVE-2022-39179
- RESERVED
-CVE-2022-39178
- RESERVED
+CVE-2022-39181 (GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting
(RXSS). ...)
+ TODO: check
+CVE-2022-39180 (College Management System v1.0 - SQL Injection (SQLi). By
inserting SQ ...)
+ TODO: check
+CVE-2022-39179 (College Management System v1.0 - Authenticated remote code
execution. ...)
+ TODO: check
+CVE-2022-39178 (Webvendome - Webvendome Internal Server IP Disclosure. Send
GET Reques ...)
+ TODO: check
CVE-2022-39177 (BlueZ before 5.59 allows physically proximate attackers to
cause a den ...)
{DLA-3157-1}
- bluez 5.61-1
@@ -19072,8 +19098,8 @@ CVE-2022-3092
RESERVED
CVE-2022-3091
RESERVED
-CVE-2022-3090
- RESERVED
+CVE-2022-3090 (Red Lion Controls Crimson 3.0 versions 707.000 and prior,
Crimson 3.1 ...)
+ TODO: check
CVE-2022-3089
RESERVED
CVE-2022-3088
@@ -22262,8 +22288,8 @@ CVE-2022-38167 (The Nintex Workflow plugin 5.2.2.30 for
SharePoint allows XSS. .
NOT-FOR-US: Nintex Workflow plugin for SharePoint
CVE-2022-38166
RESERVED
-CVE-2022-38165
- RESERVED
+CVE-2022-38165 (WithSecure through 2022-08-10 allows attackers to cause a
denial of se ...)
+ TODO: check
CVE-2022-38164 (WithSecure through 2022-08-10 allows attackers to cause a
denial of se ...)
NOT-FOR-US: WithSecure
CVE-2022-38163 (A Drag and Drop spoof vulnerability was discovered in F-Secure
SAFE Br ...)
@@ -25512,8 +25538,8 @@ CVE-2022-36926
RESERVED
CVE-2022-36925
RESERVED
-CVE-2022-36924
- RESERVED
+CVE-2022-36924 (The Zoom Rooms Installer for Windows prior to 5.12.6 contains
a local ...)
+ TODO: check
CVE-2022-36923 (Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP,
Network Co ...)
NOT-FOR-US: Zoho ManageEngine
CVE-2022-2556 (The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has
an AJA ...)
@@ -25794,14 +25820,14 @@ CVE-2022-2548
RESERVED
CVE-2022-2547 (A crafted HTTP packet without a content-type header can create
a denia ...)
NOT-FOR-US: Softing Industrial Automation
-CVE-2022-36787
- RESERVED
-CVE-2022-36786
- RESERVED
-CVE-2022-36785
- RESERVED
-CVE-2022-36784
- RESERVED
+CVE-2022-36787 (Webvendome - Webvendome SQL Injection. SQL Injection in the
Parameter ...)
+ TODO: check
+CVE-2022-36786 (DLINK - DSL-224 Post-auth PCE. DLINK router has an interface
where you ...)
+ TODO: check
+CVE-2022-36785 (D-Link – G integrated Access Device4 Information
Disclosure & ...)
+ TODO: check
+CVE-2022-36784 (Elsight – Elsight Halo Remote Code Execution (RCE)
Elsight Halo ...)
+ TODO: check
CVE-2022-36783 (AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS)
A malic ...)
TODO: check
CVE-2022-36782 (Pal Electronics Systems - Pal Gate Authorization Errors. The
vulnerabi ...)
@@ -26706,8 +26732,8 @@ CVE-2022-36375 (Authenticated (high role user)
WordPress Options Change vulnerab
NOT-FOR-US: WordPress plugin
CVE-2022-36371
RESERVED
-CVE-2022-36357
- RESERVED
+CVE-2022-36357 (Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in
ULTIMATE ...)
+ TODO: check
CVE-2022-36346 (Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in
Max Foun ...)
NOT-FOR-US: WordPress plugin
CVE-2022-36344 (An unquoted search path vulnerability exists in 'JustSystems
JUST Onli ...)
@@ -48184,12 +48210,12 @@ CVE-2022-28770 (Due to insufficient input validation,
SAPUI5 library(vbm) - vers
NOT-FOR-US: SAP
CVE-2022-28769
RESERVED
-CVE-2022-28768
- RESERVED
+CVE-2022-28768 (The Zoom Client for Meetings Installer for macOS (Standard and
for IT ...)
+ TODO: check
CVE-2022-28767
RESERVED
-CVE-2022-28766
- RESERVED
+CVE-2022-28766 (Windows 32-bit versions of the Zoom Client for Meetings before
5.12.6 ...)
+ TODO: check
CVE-2022-28765
RESERVED
CVE-2022-28764 (The Zoom Client for Meetings (for Android, iOS, Linux, macOS,
and Wind ...)
@@ -54488,7 +54514,7 @@ CVE-2022-26652 (NATS nats-server before 2.7.4 allows
Directory Traversal (with w
NOTE:
https://github.com/nats-io/nats-server/security/advisories/GHSA-6h3m-36w8-hv68
NOTE: http://www.openwall.com/lists/oss-security/2022/03/10/1
CVE-2022-26651 (An issue was discovered in Asterisk through 19.x and Certified
Asteris ...)
- {DLA-3194-1}
+ {DSA-5285-1 DLA-3194-1}
- asterisk 1:18.11.2~dfsg+~cs6.10.40431413-1
[stretch] - asterisk <postponed> (Fix in next upload)
NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-29838
@@ -54817,13 +54843,13 @@ CVE-2022-26501 (Improper authentication in Veeam
Backup & Replication 9.5U3,
CVE-2022-26500 (Improper limitation of path names in Veeam Backup &
Replication 9. ...)
NOT-FOR-US: Veeam
CVE-2022-26499 (An SSRF issue was discovered in Asterisk through 19.x. When
using STIR ...)
- {DLA-3194-1}
+ {DSA-5285-1 DLA-3194-1}
- asterisk 1:18.11.2~dfsg+~cs6.10.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-29476
NOTE: https://downloads.asterisk.org/pub/security/AST-2022-002.html
CVE-2022-26498 (An issue was discovered in Asterisk through 19.x. When using
STIR/SHAK ...)
- {DLA-3194-1}
+ {DSA-5285-1 DLA-3194-1}
- asterisk 1:18.11.2~dfsg+~cs6.10.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-29872
@@ -59396,8 +59422,8 @@ CVE-2022-24941
RESERVED
CVE-2022-24940
RESERVED
-CVE-2022-24939
- RESERVED
+CVE-2022-24939 (A malformed packet containing an invalid destination address,
causes a ...)
+ TODO: check
CVE-2022-24938 (A malformed packet causes a stack overflow in the Ember ZNet
stack. Th ...)
NOT-FOR-US: Ember ZNet
CVE-2022-24937 (Improper Restriction of Operations within the Bounds of a
Memory Buffe ...)
@@ -59811,7 +59837,7 @@ CVE-2022-24795 (yajl-ruby is a C binding to the YAJL
JSON parsing and generation
CVE-2022-24794 (Express OpenID Connect is an Express JS middleware
implementing sign o ...)
NOT-FOR-US: Express OpenID Connect
CVE-2022-24793 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-3036-1}
+ {DSA-5285-1 DLA-3194-1 DLA-3036-1}
- asterisk 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 (bug #1014976)
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -59819,7 +59845,7 @@ CVE-2022-24793 (PJSIP is a free and open source
multimedia communication library
NOTE:
https://github.com/pjsip/pjproject/security/advisories/GHSA-p6g5-v97c-w5q4
NOTE:
https://github.com/pjsip/pjproject/commit/9fae8f43accef8ea65d4a8ae9cdf297c46cfe29a
CVE-2022-24792 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-3036-1}
+ {DSA-5285-1 DLA-3194-1 DLA-3036-1}
- asterisk 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 (bug #1014976)
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -59845,7 +59871,7 @@ CVE-2022-24788 (Vyper is a pythonic Smart Contract
Language for the ethereum vir
CVE-2022-24787 (Vyper is a Pythonic Smart Contract Language for the Ethereum
Virtual M ...)
NOT-FOR-US: Vyper
CVE-2022-24786 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1}
+ {DSA-5285-1 DLA-3194-1}
- asterisk 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 (bug #1014976)
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -59938,7 +59964,7 @@ CVE-2022-24765 (Git for Windows is a fork of Git
containing Windows-specific pat
NOTE:
https://lore.kernel.org/git/CAKJfoCEgiNvQJGt=rgytakq1i2ihrpmx2sz3zxg-y66l+1q...@mail.gmail.com/
NOTE:
https://github.blog/2022-04-12-git-security-vulnerability-announced/
CVE-2022-24764 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 (bug #1014976)
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <unfixed>
@@ -59946,7 +59972,7 @@ CVE-2022-24764 (PJSIP is a free and open source
multimedia communication library
NOTE:
https://github.com/pjsip/pjproject/security/advisories/GHSA-f5qg-pqcg-765m
NOTE:
https://github.com/pjsip/pjproject/commit/560a1346f87aabe126509bb24930106dea292b00
CVE-2022-24763 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-3036-1}
+ {DSA-5285-1 DLA-3194-1 DLA-3036-1}
- asterisk 1:18.14.0~~rc1~dfsg+~cs6.12.40431414-1 (bug #1014976)
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -63932,8 +63958,8 @@ CVE-2022-23750
RESERVED
CVE-2022-23749
RESERVED
-CVE-2022-23748
- RESERVED
+CVE-2022-23748 (mDNSResponder.exe is vulnerable to DLL Sideloading attack.
Executable ...)
+ TODO: check
CVE-2022-23747 (In Sony Xperia series 1, 5, and Pro, an out of bound memory
access can ...)
NOT-FOR-US: Sony
CVE-2022-23746
@@ -64256,7 +64282,7 @@ CVE-2022-23610 (wire-server provides back end services
for Wire, an open source
CVE-2022-23609 (iTunesRPC-Remastered is a Discord Rich Presence for iTunes on
Windows ...)
NOT-FOR-US: iTunesRPC-Remastered
CVE-2022-23608 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.10.1~dfsg+~cs6.10.40431411-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -76618,7 +76644,7 @@ CVE-2022-21724 (pgjdbc is the offical PostgreSQL JDBC
Driver. A security hole wa
NOTE:
https://github.com/pgjdbc/pgjdbc/security/advisories/GHSA-v7wg-cpwc-24m4
NOTE:
https://github.com/pgjdbc/pgjdbc/commit/f4d0ed69c0b3aae8531d83d6af4c57f22312c813
(REL42.3.2)
CVE-2022-21723 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.10.1~dfsg+~cs6.10.40431411-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -76629,7 +76655,7 @@ CVE-2022-21723 (PJSIP is a free and open source
multimedia communication library
NOTE:
https://github.com/pjsip/pjproject/security/advisories/GHSA-7fw8-54cv-r7pm
NOTE:
https://github.com/pjsip/pjproject/commit/077b465c33f0aec05a49cd2ca456f9a1b112e896
CVE-2022-21722 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.12.0~dfsg+~cs6.12.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -77176,7 +77202,7 @@ CVE-2021-43847 (HumHub is an open-source social network
kit written in PHP. Prio
CVE-2021-43846 (`solidus_frontend` is the cart and storefront for the Solidus
e-commer ...)
NOT-FOR-US: solidus_frontend
CVE-2021-43845 (PJSIP is a free and open source multimedia communication
library. In v ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.12.0~dfsg+~cs6.12.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -77281,7 +77307,7 @@ CVE-2021-43806 (Tuleap is a Libre and Open Source tool
for end to end traceabili
CVE-2021-43805 (Solidus is a free, open-source ecommerce platform built on
Rails. Vers ...)
NOT-FOR-US: Solidus
CVE-2021-43804 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.12.0~dfsg+~cs6.12.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -79659,7 +79685,7 @@ CVE-2021-43304 (Heap buffer overflow in Clickhouse's
LZ4 compression codec when
NOTE: https://github.com/ClickHouse/ClickHouse/pull/27136
NOTE:
https://jfrog.com/blog/7-rce-and-dos-vulnerabilities-found-in-clickhouse-dbms/
CVE-2021-43303 (Buffer overflow in PJSUA API when calling pjsua_call_dump. An
attacker ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.11.1~dfsg+~cs6.10.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -79667,7 +79693,7 @@ CVE-2021-43303 (Buffer overflow in PJSUA API when
calling pjsua_call_dump. An at
NOTE:
https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9
NOTE:
https://github.com/pjsip/pjproject/commit/d979253c924a686fa511d705be1f3ad0c5b20337
CVE-2021-43302 (Read out-of-bounds in PJSUA API when calling
pjsua_recorder_create. An ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.11.1~dfsg+~cs6.10.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -79675,7 +79701,7 @@ CVE-2021-43302 (Read out-of-bounds in PJSUA API when
calling pjsua_recorder_crea
NOTE:
https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9
NOTE:
https://github.com/pjsip/pjproject/commit/d979253c924a686fa511d705be1f3ad0c5b20337
CVE-2021-43301 (Stack overflow in PJSUA API when calling
pjsua_playlist_create. An att ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.11.1~dfsg+~cs6.10.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -79683,7 +79709,7 @@ CVE-2021-43301 (Stack overflow in PJSUA API when
calling pjsua_playlist_create.
NOTE:
https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9
NOTE:
https://github.com/pjsip/pjproject/commit/d979253c924a686fa511d705be1f3ad0c5b20337
CVE-2021-43300 (Stack overflow in PJSUA API when calling
pjsua_recorder_create. An att ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.11.1~dfsg+~cs6.10.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -79691,7 +79717,7 @@ CVE-2021-43300 (Stack overflow in PJSUA API when
calling pjsua_recorder_create.
NOTE:
https://github.com/pjsip/pjproject/security/advisories/GHSA-qcvw-h34v-c7r9
NOTE:
https://github.com/pjsip/pjproject/commit/d979253c924a686fa511d705be1f3ad0c5b20337
CVE-2021-43299 (Stack overflow in PJSUA API when calling pjsua_player_create.
An attac ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.11.1~dfsg+~cs6.10.40431413-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -83000,10 +83026,10 @@ CVE-2022-20462 (In phNxpNciHal_write_unlocked of
phNxpNciHal.cc, there is a poss
NOT-FOR-US: Android
CVE-2022-20461
RESERVED
-CVE-2022-20460
- RESERVED
-CVE-2022-20459
- RESERVED
+CVE-2022-20460 (In (TBD) mprot_unmap? of (TBD), there is a possible way to
corrupt the ...)
+ TODO: check
+CVE-2022-20459 (In (TBD) of (TBD), there is a possible way to redirect code
execution ...)
+ TODO: check
CVE-2022-20458
RESERVED
CVE-2022-20457 (In getMountModeInternal of StorageManagerService.java, there
is a poss ...)
@@ -83064,10 +83090,10 @@ CVE-2022-20430 (There is an missing authorization
issue in the system service. S
NOT-FOR-US: Android
CVE-2022-20429 (In CarSettings of app packages, there is a possible permission
bypass ...)
NOT-FOR-US: Android
-CVE-2022-20428
- RESERVED
-CVE-2022-20427
- RESERVED
+CVE-2022-20428 (In (TBD) of (TBD), there is a possible out of bounds write due
to a mi ...)
+ TODO: check
+CVE-2022-20427 (In (TBD) of (TBD), there is a possible way to corrupt memory
due to im ...)
+ TODO: check
CVE-2022-20426 (In multiple functions of many files, there is a possible
obstruction o ...)
NOT-FOR-US: Android
CVE-2022-20425 (In addAutomaticZenRule of ZenModeHelper.java, there is a
possible perm ...)
@@ -96399,7 +96425,7 @@ CVE-2021-37708 (Shopware is an open source eCommerce
platform. Versions prior to
CVE-2021-37707 (Shopware is an open source eCommerce platform. Versions prior
to 6.4.3 ...)
NOT-FOR-US: Shopware
CVE-2021-37706 (PJSIP is a free and open source multimedia communication
library writt ...)
- {DLA-3194-1 DLA-2962-1}
+ {DSA-5285-1 DLA-3194-1 DLA-2962-1}
- asterisk 1:18.10.1~dfsg+~cs6.10.40431411-1
[stretch] - asterisk <not-affected> (Vulnerable code not present)
- pjproject <removed>
@@ -98272,8 +98298,8 @@ CVE-2021-36907
RESERVED
CVE-2021-36906 (Multiple Insecure Direct Object References (IDOR)
vulnerabilities in E ...)
NOT-FOR-US: WordPress plugin
-CVE-2021-36905
- RESERVED
+CVE-2021-36905 (Multiple Auth. (contributor+) Stored Cross-Site Scripting
(XSS) vulner ...)
+ TODO: check
CVE-2021-36904
RESERVED
CVE-2021-36903
@@ -105448,8 +105474,8 @@ CVE-2021-33899
RESERVED
CVE-2021-33898 (In Invoice Ninja before 4.4.0, there is an unsafe call to
unserialize( ...)
NOT-FOR-US: Invoice Ninja
-CVE-2021-33897
- RESERVED
+CVE-2021-33897 (A buffer overflow in Synthesia before 10.7.5567, when a
non-Latin loca ...)
+ TODO: check
CVE-2021-33896 (Dino before 0.1.2 and 0.2.x before 0.2.1 allows Directory
Traversal (o ...)
- dino-im 0.2.0-3
[buster] - dino-im <no-dsa> (Minor issue)
@@ -111601,8 +111627,8 @@ CVE-2021-31610 (The Bluetooth Classic implementation
on AB32VG1 devices does not
NOT-FOR-US: Bluetrum
CVE-2021-31609 (The Bluetooth Classic implementation in Silicon Labs iWRAP
6.3.0 and e ...)
NOT-FOR-US: Silicon Labs Bluetooth
-CVE-2021-31608
- RESERVED
+CVE-2021-31608 (Proofpoint Enterprise Protection before 18.8.0 allows a Bypass
of a Se ...)
+ TODO: check
CVE-2021-31607 (In SaltStack Salt 2016.9 through 3002.6, a command injection
vulnerabi ...)
{DLA-2815-1}
- salt 3002.6+dfsg1-2 (bug #987496)
@@ -234779,7 +234805,7 @@ CVE-2019-15299 (An issue was discovered in Centreon
Web through 19.04.3. When a
CVE-2019-15298 (A problem was found in Centreon Web through 19.04.3. An
authenticated ...)
- centreon-web <itp> (bug #913903)
CVE-2021-46837 (res_pjsip_t38 in Sangoma Asterisk 16.x before 16.16.2, 17.x
before 17. ...)
- {DLA-3194-1}
+ {DSA-5285-1 DLA-3194-1}
- asterisk 1:18.9.0~dfsg+~cs6.10.40431411-1 (bug #1018073)
NOTE: https://downloads.asterisk.org/pub/security/AST-2021-006.html
NOTE: This is related to CVE-2019-15297 symptoms but not for exactly
the same reason.
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5138f27915bd48bbe55a84aa0ca70de1216f8323
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/5138f27915bd48bbe55a84aa0ca70de1216f8323
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
debian-security-tracker-commits@alioth-lists.debian.net
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
