Salvatore Bonaccorso pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
68739287 by Salvatore Bonaccorso at 2023-03-17T09:09:41+01:00
Track fixed version for CVE-2021-38371/exim4 via unstable
- - - - -
b5e42675 by Salvatore Bonaccorso at 2023-03-17T09:09:43+01:00
Add CVE-2023-24278 as NFU
- - - - -
d58f7830 by Salvatore Bonaccorso at 2023-03-17T09:09:44+01:00
Update information for CVE-2022-38457 and CVE-2022-40133
- - - - -
e0021e06 by Salvatore Bonaccorso at 2023-03-17T09:09:46+01:00
Track fixed version for CVE-2020-25016/rust-rgb via unstable
- - - - -
b55d4864 by Salvatore Bonaccorso at 2023-03-17T09:09:47+01:00
Update information for CVE-2022-43995/sudo
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -11928,6 +11928,7 @@ CVE-2023-24279 (A cross-site scripting (XSS)
vulnerability in Open Networking Fo
NOT-FOR-US: Open Networking Foundation ONOS
CVE-2023-24278
RESERVED
+ NOT-FOR-US: Squidex
CVE-2023-24277
RESERVED
CVE-2023-24276 (TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to
contain a co ...)
@@ -32644,8 +32645,8 @@ CVE-2022-43997 (Incorrect access control in Aternity
agent in Riverbed Aternity
CVE-2022-43996 (The csaf_provider package before 0.8.2 allows XSS via a
crafted CSAF d ...)
NOT-FOR-US: csaf_provider
CVE-2022-43995 (Sudo 1.8.0 through 1.9.12, with the crypt() password backend,
contains ...)
- - sudo <unfixed> (unimportant)
- NOTE: Fixed by:
https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050
+ - sudo 1.9.12p1-1 (unimportant)
+ NOTE: Fixed by:
https://github.com/sudo-project/sudo/commit/bd209b9f16fcd1270c13db27ae3329c677d48050
(SUDO_1_9_12p1)
NOTE: Binary packages compiled with PAM support not enabling the
plugins/sudoers/auth/passwd.c code
CVE-2022-43994
RESERVED
@@ -44822,11 +44823,11 @@ CVE-2022-40139 (Improper validation of some
components used by the rollback mech
CVE-2022-40138 (An integer conversion error in Hermes bytecode generation,
prior to co ...)
NOT-FOR-US: Facebook Hermes
CVE-2022-40133 (A use-after-free(UAF) vulnerability was found in function
'vmw_execbuf ...)
- - linux <unfixed>
+ - linux 6.1.7-1
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://bugzilla.openanolis.cn/show_bug.cgi?id=2075
CVE-2022-38457 (A use-after-free(UAF) vulnerability was found in function
'vmw_cmd_res ...)
- - linux <unfixed>
+ - linux 6.1.7-1
[buster] - linux <not-affected> (Vulnerable code not present)
NOTE: https://bugzilla.openanolis.cn/show_bug.cgi?id=2074
CVE-2022-38096 (A NULL pointer dereference vulnerability was found in vmwgfx
driver in ...)
@@ -123091,7 +123092,7 @@ CVE-2021-38373 (In KDE KMail 19.12.3 (aka 5.13.3),
the SMTP STARTTLS option is n
CVE-2021-38372 (In KDE Trojita 0.7, man-in-the-middle attackers can create new
folders ...)
- trojita <itp> (bug #795701)
CVE-2021-38371 (The STARTTLS feature in Exim through 4.94.2 allows response
injection ...)
- - exim4 <unfixed> (bug #992172)
+ - exim4 4.95~RC2-1 (bug #992172)
[bullseye] - exim4 <no-dsa> (Minor issue)
[buster] - exim4 <no-dsa> (Minor issue)
[stretch] - exim4 <postponed> (Minor issue, revisit when fixed upstream)
@@ -189377,7 +189378,7 @@ CVE-2020-24863 (A memory corruption vulnerability was
found in the kernel functi
CVE-2020-24862 (The catID parameter in Pharmacy Medical Store and Sale Point
v1.0 has ...)
NOT-FOR-US: Pharmacy Medical Store and Sale Point
CVE-2020-25016 (A safety violation was discovered in the rgb crate before
0.8.20 for R ...)
- - rust-rgb <unfixed> (bug #969213)
+ - rust-rgb 0.8.36-1 (bug #969213)
[bullseye] - rust-rgb <no-dsa> (Minor issue)
[buster] - rust-rgb <no-dsa> (Minor issue)
NOTE: https://rustsec.org/advisories/RUSTSEC-2020-0029.html
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/f6c41193d4b7bda16ec132f26a43e82407c068cc...b55d48649620832d1fb35d332fe14a7dbc4dbe7e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/compare/f6c41193d4b7bda16ec132f26a43e82407c068cc...b55d48649620832d1fb35d332fe14a7dbc4dbe7e
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
