Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker
Commits: e37bdd50 by security tracker role at 2024-01-11T08:11:58+00:00 automatic update - - - - - 1 changed file: - data/CVE/list Changes: ===================================== data/CVE/list ===================================== @@ -1,3 +1,171 @@ +CVE-2024-22195 (Jinja is an extensible templating engine. Special placeholders in the ...) + TODO: check +CVE-2024-22194 (cdo-local-uuid project provides a specialized UUID-generating function ...) + TODO: check +CVE-2024-22190 (GitPython is a python library used to interact with Git repositories. ...) + TODO: check +CVE-2024-21833 (Multiple TP-LINK products allow a network-adjacent unauthenticated att ...) + TODO: check +CVE-2024-21821 (Multiple TP-LINK products allow a network-adjacent authenticated attac ...) + TODO: check +CVE-2024-21773 (Multiple TP-LINK products allow a network-adjacent unauthenticated att ...) + TODO: check +CVE-2024-21669 (Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for buil ...) + TODO: check +CVE-2024-21667 (pimcore/customer-data-framework is the Customer Management Framework f ...) + TODO: check +CVE-2024-21666 (The Customer Management Framework (CMF) for Pimcore adds functionality ...) + TODO: check +CVE-2024-21665 (ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. ...) + TODO: check +CVE-2024-21638 (Azure IPAM (IP Address Management) is a lightweight solution developed ...) + TODO: check +CVE-2024-21637 (Authentik is an open-source Identity Provider. Authentik is a vulnerab ...) + TODO: check +CVE-2024-0252 (ManageEngine ADSelfService Plus versions6401and below are vulnerable t ...) + TODO: check +CVE-2023-6883 (The Easy Social Feed plugin for WordPress is vulnerable to unauthorize ...) + TODO: check +CVE-2023-6699 (The WP Compress \u2013 Image Optimizer [All-In-One] plugin for WordPre ...) + TODO: check +CVE-2023-6630 (The Contact Form 7 \u2013 Dynamic Text Extension plugin for WordPress ...) + TODO: check +CVE-2023-6520 (The WP 2FA \u2013 Two-factor authentication for WordPress plugin for W ...) + TODO: check +CVE-2023-6506 (The WP 2FA \u2013 Two-factor authentication for WordPress plugin for W ...) + TODO: check +CVE-2023-6446 (The Calculated Fields Form plugin for WordPress is vulnerable to Store ...) + TODO: check +CVE-2023-6223 (The LearnPress plugin for WordPress is vulnerable to Insecure Direct O ...) + TODO: check +CVE-2023-5448 (The WP Register Profile With Shortcode plugin for WordPress is vulnera ...) + TODO: check +CVE-2023-52274 (member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via th ...) + TODO: check +CVE-2023-52064 (Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerabilit ...) + TODO: check +CVE-2023-51127 (FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulner ...) + TODO: check +CVE-2023-51126 (Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to ...) + TODO: check +CVE-2023-51123 (An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote a ...) + TODO: check +CVE-2023-51073 (An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to exe ...) + TODO: check +CVE-2023-49295 (quic-go is an implementation of the QUIC protocol (RFC 9000, RFC 9001, ...) + TODO: check +CVE-2023-45175 (IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user ...) + TODO: check +CVE-2023-45173 (IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user ...) + TODO: check +CVE-2023-45171 (IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user ...) + TODO: check +CVE-2023-45169 (IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user ...) + TODO: check +CVE-2023-42941 (The issue was addressed with improved checks. This issue is fixed in i ...) + TODO: check +CVE-2023-42934 (An information disclosure issue was addressed by removing the vulnerab ...) + TODO: check +CVE-2023-42933 (This issue was addressed with improved checks. This issue is fixed in ...) + TODO: check +CVE-2023-42929 (The issue was addressed with improved checks. This issue is fixed in m ...) + TODO: check +CVE-2023-42876 (The issue was addressed with improved bounds checks. This issue is fix ...) + TODO: check +CVE-2023-42872 (The issue was addressed with additional permissions checks. This issue ...) + TODO: check +CVE-2023-42871 (The issue was addressed with improved memory handling. This issue is f ...) + TODO: check +CVE-2023-42870 (A use-after-free issue was addressed with improved memory management. ...) + TODO: check +CVE-2023-42869 (Multiple memory corruption issues were addressed with improved input v ...) + TODO: check +CVE-2023-42866 (The issue was addressed with improved memory handling. This issue is f ...) + TODO: check +CVE-2023-42865 (An out-of-bounds read was addressed with improved input validation. Th ...) + TODO: check +CVE-2023-42862 (An out-of-bounds read was addressed with improved input validation. Th ...) + TODO: check +CVE-2023-42833 (A correctness issue was addressed with improved checks. This issue is ...) + TODO: check +CVE-2023-42832 (A race condition was addressed with improved state handling. This issu ...) + TODO: check +CVE-2023-42831 (This issue was addressed by removing the vulnerable code. This issue i ...) + TODO: check +CVE-2023-42830 (A privacy issue was addressed with improved private data redaction for ...) + TODO: check +CVE-2023-42829 (The issue was addressed with additional restrictions on the observabil ...) + TODO: check +CVE-2023-42828 (This issue was addressed by removing the vulnerable code. This issue i ...) + TODO: check +CVE-2023-42826 (The issue was addressed with improved checks. This issue is fixed in m ...) + TODO: check +CVE-2023-41994 (A logic issue was addressed with improved checks This issue is fixed i ...) + TODO: check +CVE-2023-41987 (This issue was addressed with improved checks. This issue is fixed in ...) + TODO: check +CVE-2023-41974 (A use-after-free issue was addressed with improved memory management. ...) + TODO: check +CVE-2023-41075 (A type confusion issue was addressed with improved checks. This issue ...) + TODO: check +CVE-2023-41069 (This issue was addressed by improving Face ID anti-spoofing models. Th ...) + TODO: check +CVE-2023-41060 (A type confusion issue was addressed with improved checks. This issue ...) + TODO: check +CVE-2023-40529 (This issue was addressed with improved redaction of sensitive informat ...) + TODO: check +CVE-2023-40439 (A privacy issue was addressed with improved private data redaction for ...) + TODO: check +CVE-2023-40438 (An issue was addressed with improved handling of temporary files. This ...) + TODO: check +CVE-2023-40437 (A privacy issue was addressed with improved private data redaction for ...) + TODO: check +CVE-2023-40433 (A logic issue was addressed with improved checks. This issue is fixed ...) + TODO: check +CVE-2023-40430 (A logic issue was addressed with improved checks. This issue is fixed ...) + TODO: check +CVE-2023-40414 (A use-after-free issue was addressed with improved memory management. ...) + TODO: check +CVE-2023-40411 (This issue was addressed with improved data protection. This issue is ...) + TODO: check +CVE-2023-40394 (The issue was addressed with improved validation of environment variab ...) + TODO: check +CVE-2023-40393 (An authentication issue was addressed with improved state management. ...) + TODO: check +CVE-2023-40385 (This issue was addressed by removing the vulnerable code. This issue i ...) + TODO: check +CVE-2023-40383 (A path handling issue was addressed with improved validation. This iss ...) + TODO: check +CVE-2023-38612 (The issue was addressed with improved checks. This issue is fixed in m ...) + TODO: check +CVE-2023-38610 (A memory corruption issue was addressed by removing the vulnerable cod ...) + TODO: check +CVE-2023-38607 (The issue was addressed with improved handling of caches. This issue i ...) + TODO: check +CVE-2023-38267 (IBM Security Access Manager Appliance (IBM Security Verify Access Appl ...) + TODO: check +CVE-2023-37644 (SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allo ...) + TODO: check +CVE-2023-32436 (The issue was addressed with improved bounds checks. This issue is fix ...) + TODO: check +CVE-2023-32424 (The issue was addressed with improved memory handling. This issue is f ...) + TODO: check +CVE-2023-32401 (A buffer overflow was addressed with improved bounds checking. This is ...) + TODO: check +CVE-2023-32383 (This issue was addressed by forcing hardened runtime on the affected b ...) + TODO: check +CVE-2023-32378 (A use-after-free issue was addressed with improved memory management. ...) + TODO: check +CVE-2023-32366 (An out-of-bounds write issue was addressed with improved input validat ...) + TODO: check +CVE-2022-48577 (An access issue was addressed with improved access restrictions. This ...) + TODO: check +CVE-2022-48504 (The issue was addressed with improved handling of caches. This issue i ...) + TODO: check +CVE-2022-47965 (The issue was addressed with improved memory handling. This issue is f ...) + TODO: check +CVE-2022-47915 (The issue was addressed with improved memory handling. This issue is f ...) + TODO: check CVE-2023-4001 [bypass the GRUB password protection feature] - grub2 <undetermined> NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2224951 @@ -278,7 +446,7 @@ CVE-2023-31446 (In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2. NOT-FOR-US: Cassia Gateway firmware CVE-2023-6476 (A flaw was found in CRI-O that involves an experimental annotation lea ...) - cri-o <itp> (bug #979702) -CVE-2024-0333 +CVE-2024-0333 (Insufficient data validation in Extensions in Google Chrome prior to 1 ...) {DSA-5598-1} - chromium 120.0.6099.216-1 [buster] - chromium <end-of-life> (see DSA 5046) @@ -364,7 +532,7 @@ CVE-2024-20676 (Azure Storage Mover Remote Code Execution Vulnerability) NOT-FOR-US: Microsoft CVE-2024-20674 (Windows Kerberos Security Feature Bypass Vulnerability) NOT-FOR-US: Microsoft -CVE-2024-20672 (.NET Core and Visual Studio Denial of Service Vulnerability) +CVE-2024-20672 (.NET Denial of Service Vulnerability) NOT-FOR-US: Microsoft .NET CVE-2024-20666 (BitLocker Security Feature Bypass Vulnerability) NOT-FOR-US: Microsoft @@ -2376,7 +2544,7 @@ CVE-2023-34829 (Incorrect access control in TP-Link Tapo before v3.1.315 allows CVE-2023-7116 (A vulnerability, which was classified as critical, has been found in W ...) NOT-FOR-US: WeiYe-Jing datax-web CVE-2023-6531 - {DSA-5594-1 DSA-5593-1} + {DSA-5594-1 DSA-5593-1 DLA-3711-1} - linux 6.6.8-1 [buster] - linux <not-affected> (Vulnerable code not present) NOTE: https://git.kernel.org/linus/705318a99a138c29a512a72c3e0043b3cd7f55f4 (6.7-rc5) @@ -2581,15 +2749,15 @@ CVE-2023-45737 (Stored cross-site scripting vulnerability exists in the App Sett CVE-2023-42436 (Stored cross-site scripting vulnerability exists in the presentation f ...) NOT-FOR-US: GROWI CVE-2023-51782 (An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl i ...) - {DSA-5594-1 DSA-5593-1} + {DSA-5594-1 DSA-5593-1 DLA-3711-1 DLA-3710-1} - linux 6.6.8-1 NOTE: https://git.kernel.org/linus/810c38a369a0a0ce625b5c12169abce1dd9ccd53 (6.7-rc6) CVE-2023-51781 (An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl ...) - {DSA-5594-1 DSA-5593-1} + {DSA-5594-1 DSA-5593-1 DLA-3711-1 DLA-3710-1} - linux 6.6.8-1 NOTE: https://git.kernel.org/linus/189ff16722ee36ced4d2a2469d4ab65a8fee4198 (6.7-rc6) CVE-2023-51780 (An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl ...) - {DSA-5594-1 DSA-5593-1} + {DSA-5594-1 DSA-5593-1 DLA-3711-1 DLA-3710-1} - linux 6.6.8-1 NOTE: https://git.kernel.org/linus/24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 (6.7-rc6) CVE-2023-51779 (bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel th ...) @@ -3581,12 +3749,12 @@ CVE-2023-6945 (A vulnerability has been found in SourceCodester Online Student M CVE-2023-6944 (A flaw was found in the Red Hat Developer Hub (RHDH). The catalog-impo ...) NOT-FOR-US: Red Hat Developer Hub (RHDH) CVE-2023-6932 (A use-after-free vulnerability in the Linux kernel's ipv4: igmp compon ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1 DLA-3710-1} - linux 6.6.8-1 [bookworm] - linux 6.1.66-1 NOTE: https://git.kernel.org/linus/e2b706c691905fe78468c361aaabc719d0a496f1 (6.7-rc4) CVE-2023-6931 (A heap out-of-bounds write vulnerability in the Linux kernel's Perform ...) - {DSA-5594-1 DSA-5593-1} + {DSA-5594-1 DSA-5593-1 DLA-3711-1 DLA-3710-1} - linux 6.6.8-1 NOTE: https://git.kernel.org/linus/382c27f4ed28f803b1f1473ac2d8db0afc795a1b (6.7-rc5) CVE-2023-6913 (A session hijacking vulnerability has been detected in the Imou Life a ...) @@ -3895,7 +4063,7 @@ CVE-2023-6920 CVE-2023-6911 (Multiple WSO2 products have been identified as vulnerable due to impro ...) NOT-FOR-US: WSO2 CVE-2023-6817 (A use-after-free vulnerability in the Linux kernel's netfilter: nf_tab ...) - {DSA-5594-1 DSA-5593-1} + {DSA-5594-1 DSA-5593-1 DLA-3711-1} - linux 6.6.8-1 [buster] - linux <not-affected> (Vulnerable code not present) NOTE: https://git.kernel.org/linus/317eb9685095678f2c9f5a8189de698c5354316a (6.7-rc5) @@ -6109,6 +6277,7 @@ CVE-2023-6608 (A vulnerability was found in Tongda OA 2017 up to 11.9 and classi CVE-2023-6607 (A vulnerability has been found in Tongda OA 2017 up to 11.10 and class ...) NOT-FOR-US: Tongda OA CVE-2023-6606 (An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb ...) + {DLA-3710-1} - linux 6.6.9-1 NOTE: https://bugzilla.kernel.org/show_bug.cgi?id=218218 NOTE: https://git.kernel.org/linus/b35858b3786ddbb56e1c35138ba25d6adf8d0bef @@ -9583,7 +9752,7 @@ CVE-2023-6174 (SSH dissector crash in Wireshark 4.0.0 to 4.0.10 allows denial of NOTE: https://www.wireshark.org/security/wnpa-sec-2023-28.html NOTE: https://gitlab.com/wireshark/wireshark/-/issues/19369 CVE-2023-6121 (An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsy ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1} - linux 6.6.8-1 [bookworm] - linux 6.1.64-1 NOTE: https://lore.kernel.org/linux-nvme/b58a2dc6-cc8f-4d19-9efe-e1d5b4505...@nvidia.com/T/ @@ -12775,7 +12944,7 @@ CVE-2023-5837 (A vulnerability classified as problematic was found in AlexanderL CVE-2023-5836 (A vulnerability was found in SourceCodester Task Reminder System 1.0. ...) NOT-FOR-US: SourceCodester Task Reminder System CVE-2023-46862 (An issue was discovered in the Linux kernel through 6.5.9. During a ra ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1} - linux 6.5.10-1 [bookworm] - linux 6.1.64-1 [buster] - linux <not-affected> (Vulnerable code not present) @@ -13066,7 +13235,7 @@ CVE-2023-33559 (A local file inclusion vulnerability via the lang parameter in O CVE-2023-33558 (An information disclosure vulnerability in the component users-grid-da ...) NOT-FOR-US: OcoMon CVE-2023-46813 (An issue was discovered in the Linux kernel before 6.5.9, exploitable ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1} - linux 6.5.10-1 [bookworm] - linux 6.1.64-1 [buster] - linux <not-affected> (Vulnerable code not present) @@ -13262,7 +13431,7 @@ CVE-2023-45872 - qt6-svg <not-affected> (Doesn't affect any version uploaded to unstable) NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2246067 CVE-2023-5717 (A heap out-of-bounds write vulnerability in the Linux kernel's Linux K ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1 DLA-3710-1} - linux 6.5.10-1 [bookworm] - linux 6.1.64-1 NOTE: https://git.kernel.org/linus/32671e3799ca2e4590773fd0e63aaa4229e50c06 (6.6-rc7) @@ -14122,7 +14291,7 @@ CVE-2023-46846 (SQUID is vulnerable to HTTP request smuggling, caused by chunked - squid3 <removed> NOTE: https://github.com/squid-cache/squid/security/advisories/GHSA-j83v-w3p4-5cqh CVE-2023-5178 (A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1} - linux 6.5.8-1 [bookworm] - linux 6.1.64-1 [buster] - linux <not-affected> (Vulnerable code not present) @@ -15457,12 +15626,13 @@ CVE-2023-5586 (NULL Pointer Dereference in GitHub repository gpac/gpac prior to CVE-2023-5585 (A vulnerability was found in SourceCodester Online Motorcycle Rental S ...) NOT-FOR-US: SourceCodester CVE-2023-45871 (An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c i ...) + {DLA-3710-1} - linux 6.5.3-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 NOTE: https://git.kernel.org/linus/bb5ed01cd2428cd25b1c88a3a9cba87055eb289f (6.6-rc1) CVE-2023-45863 (An issue was discovered in lib/kobject.c in the Linux kernel before 6. ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1 DLA-3710-1} - linux 6.1.20-1 NOTE: https://git.kernel.org/linus/3bb2a01caa813d3a1845d378bbe4169ef280d394 (6.3-rc1) CVE-2023-45862 (An issue was discovered in drivers/usb/storage/ene_ub6250.c for the EN ...) @@ -16641,7 +16811,7 @@ CVE-2023-44487 (The HTTP/2 protocol allows a denial of service (server resource NOTE: - apache2: https://chaos.social/@icing/111210915918780532 NOTE: - lighttpd: https://www.openwall.com/lists/oss-security/2023/10/13/9 CVE-2023-34324 (Closing of an event channel in the Linux kernel can result in a deadlo ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1 DLA-3710-1} - linux 6.5.8-1 [bookworm] - linux 6.1.64-1 NOTE: https://xenbits.xen.org/xsa/advisory-441.html @@ -16872,6 +17042,7 @@ CVE-2023-41047 (OctoPrint is a web interface for 3D printers. OctoPrint versions CVE-2023-3589 (A Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork C ...) NOT-FOR-US: Teamwork Cloudt CVE-2023-39189 (A flaw was found in the Netfilter subsystem in the Linux kernel. The n ...) + {DLA-3710-1} - linux 6.5.6-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 @@ -17399,18 +17570,21 @@ CVE-2023-3038 (SQL injection vulnerability in HelpDezk Community affecting versi CVE-2023-3037 (Improper authorization vulnerability in HelpDezk Community affecting v ...) NOT-FOR-US: HelpDezk Community CVE-2023-39194 (A flaw was found in the XFRM subsystem in the Linux kernel. The specif ...) + {DLA-3710-1} - linux 6.4.13-1 [bookworm] - linux 6.1.52-1 [bullseye] - linux 5.10.197-1 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1492/ NOTE: https://git.kernel.org/linus/dfa73c17d55b921e1d4e154976de35317e43a93a (6.5-rc7) CVE-2023-39193 (A flaw was found in the Netfilter subsystem in the Linux kernel. The s ...) + {DLA-3710-1} - linux 6.5.3-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 NOTE: https://www.zerodayinitiative.com/advisories/ZDI-23-1491/ NOTE: https://git.kernel.org/linus/e99476497687ef9e850748fe6d232264f30bc8f9 (6.6-rc1) CVE-2023-39192 (A flaw was found in the Netfilter subsystem in the Linux kernel. The x ...) + {DLA-3710-1} - linux 6.5.3-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 @@ -18990,7 +19164,7 @@ CVE-2023-43040 [Improperly verified POST keys] NOTE: https://github.com/ceph/ceph/pull/53714 NOTE: Fixed by: https://github.com/ceph/ceph/commit/100d81aa060f061271499f1fa28dbdc06de443fd (main) CVE-2023-5197 (A use-after-free vulnerability in the Linux kernel's netfilter: nf_tab ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1} - linux 6.5.6-1 [bookworm] - linux 6.1.64-1 [buster] - linux <not-affected> (Vulnerable code not present) @@ -19336,7 +19510,7 @@ CVE-2023-42756 (A flaw was found in the Netfilter subsystem of the Linux kernel. NOTE: https://www.openwall.com/lists/oss-security/2023/09/27/2 NOTE: https://git.kernel.org/linus/7433b6d2afd512d04398c73aa984d1e285be125b (6.6-rc3) CVE-2023-42755 (A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) clas ...) - {DLA-3623-1} + {DLA-3710-1 DLA-3623-1} - linux 6.3.7-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 @@ -19543,7 +19717,7 @@ CVE-2023-42280 (mee-admin 1.5 is vulnerable to Directory Traversal. The download NOT-FOR-US: mee-admin CVE-2023-42279 (Dreamer CMS 4.1.3 is vulnerable to SQL Injection.) NOT-FOR-US: Dreamer CMS -CVE-2023-41993 (The issue was addressed with improved checks. This issue is fixed in S ...) +CVE-2023-41993 (The issue was addressed with improved checks. This issue is fixed in m ...) {DSA-5527-1} - webkit2gtk 2.42.1-1 [buster] - webkit2gtk <end-of-life> (EOL in buster LTS) @@ -19922,13 +20096,14 @@ CVE-2023-4237 (A flaw was found in the Ansible Automation Platform. When creatin NOTE: https://github.com/ansible-collections/amazon.aws/pull/1704 NOTE: Fixed by: https://github.com/ansible-collections/amazon.aws/commit/1a077fb3a15241db8964dc086d3b15370bbd1e4a (7.0.0) CVE-2023-42754 (A NULL pointer dereference flaw was found in the Linux kernel ipv4 sta ...) + {DLA-3710-1} - linux 6.5.6-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 NOTE: https://www.openwall.com/lists/oss-security/2023/10/02/8 NOTE: https://git.kernel.org/linus/0113d9c9d1ccc07f5a3710dac4aa24b6d711278c (6.6-rc3) CVE-2023-42753 (An array indexing vulnerability was found in the netfilter subsystem o ...) - {DLA-3623-1} + {DLA-3710-1 DLA-3623-1} - linux 6.5.3-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 @@ -20571,7 +20746,7 @@ CVE-2023-4527 (A flaw was found in glibc. When the getaddrinfo function is calle NOTE: Fixed by: https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b25508dd774b617f99419bdc3cf2ace4560cd2d6 (release/2.38/master branch) NOTE: https://www.openwall.com/lists/oss-security/2023/09/25/1 CVE-2023-4921 (A use-after-free vulnerability in the Linux kernel's net/sched: sch_qf ...) - {DLA-3623-1} + {DLA-3710-1 DLA-3623-1} - linux 6.5.6-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 @@ -21313,13 +21488,13 @@ CVE-2023-4809 (In pf packet processing with a 'scrub fragment reassemble' rule, CVE-2023-4634 (The Media Library Assistant plugin for WordPress is vulnerable to Loca ...) NOT-FOR-US: Media Library Assistant plugin for WordPress CVE-2023-4623 (A use-after-free vulnerability in the Linux kernel's net/sched: sch_hf ...) - {DLA-3623-1} + {DLA-3710-1 DLA-3623-1} - linux 6.5.3-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 NOTE: https://git.kernel.org/linus/b3d26c5702c7d6c45456326e56d2ccf3f103e60f CVE-2023-4622 (A use-after-free vulnerability in the Linux kernel's af_unix component ...) - {DSA-5492-1 DLA-3623-1} + {DSA-5492-1 DLA-3710-1 DLA-3623-1} - linux 6.4.13-1 [bullseye] - linux 5.10.197-1 NOTE: https://kernel.dance/790c2f9d15b594350ae9bca7b236f2b1859de02c @@ -21332,7 +21507,7 @@ CVE-2023-4588 (File accessibility vulnerability in Delinea Secret Server, in its CVE-2023-4498 (Tenda N300 Wireless N VDSL2 Modem Router allows unauthenticated access ...) NOT-FOR-US: Tenda CVE-2023-4244 (A use-after-free vulnerability in the Linux kernel's netfilter: nf_tab ...) - {DLA-3623-1} + {DLA-3710-1 DLA-3623-1} - linux 6.4.13-1 [bookworm] - linux 6.1.55-1 [bullseye] - linux 5.10.197-1 @@ -21340,17 +21515,17 @@ CVE-2023-4244 (A use-after-free vulnerability in the Linux kernel's netfilter: n NOTE: https://lore.kernel.org/netdev/20230815223011.7019-1...@strlen.de/ NOTE: https://kernel.dance/3e91b0ebd994635df2346353322ac51ce84ce6d8 CVE-2023-4208 (A use-after-free vulnerability in the Linux kernel's net/sched: cls_u3 ...) - {DSA-5492-1} + {DSA-5492-1 DLA-3710-1} - linux 6.4.11-1 [bullseye] - linux 5.10.191-1 NOTE: https://git.kernel.org/linus/3044b16e7c6fe5d24b1cdbcf1bd0a9d92d1ebd81 (6.5-rc5) CVE-2023-4207 (A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw ...) - {DSA-5492-1} + {DSA-5492-1 DLA-3710-1} - linux 6.4.11-1 [bullseye] - linux 5.10.191-1 NOTE: https://git.kernel.org/linus/76e42ae831991c828cffa8c37736ebfb831ad5ec (6.5-rc5) CVE-2023-4206 (A use-after-free vulnerability in the Linux kernel's net/sched: cls_ro ...) - {DSA-5492-1} + {DSA-5492-1 DLA-3710-1} - linux 6.4.11-1 [bullseye] - linux 5.10.191-1 NOTE: https://git.kernel.org/linus/b80b829e9e2c1b3f7aae34855e04d8f6ecaf13c8 (6.5-rc5) @@ -24865,7 +25040,7 @@ CVE-2023-40292 (Harman Infotainment 20190525031613 and later discloses the IP ad CVE-2023-40291 (Harman Infotainment 20190525031613 allows root access via SSH over a U ...) NOT-FOR-US: Harman Infotainment CVE-2023-40283 (An issue was discovered in l2cap_sock_release in net/bluetooth/l2cap_s ...) - {DSA-5492-1 DSA-5480-1 DLA-3623-1} + {DSA-5492-1 DSA-5480-1 DLA-3710-1 DLA-3623-1} - linux 6.4.11-1 NOTE: https://git.kernel.org/linus/1728137b33c00d5a2b5110ed7aafb42e7c32e4a1 (6.5-rc1) CVE-2023-40274 (An issue was discovered in zola 0.13.0 through 0.17.2. The custom impl ...) @@ -25895,7 +26070,7 @@ CVE-2023-32292 (Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability i CVE-2023-2423 (A vulnerability was discovered in the Rockwell Automation Armor PowerF ...) NOT-FOR-US: Rockwell Automation CVE-2023-34319 (The fix for XSA-423 added logic to Linux'es netback driver to deal wit ...) - {DSA-5492-1 DSA-5480-1 DLA-3623-1} + {DSA-5492-1 DSA-5480-1 DLA-3710-1 DLA-3623-1} - linux 6.4.11-1 NOTE: https://git.kernel.org/linus/534fc31d09b706a16d83533e16b5dc855caf7576 NOTE: https://xenbits.xen.org/xsa/advisory-432.html @@ -27643,7 +27818,7 @@ CVE-2023-3773 (A flaw was found in the Linux kernel\u2019s IP framework for tran [buster] - linux <not-affected> (Vulnerable code not present) NOTE: https://lore.kernel.org/all/20230723074110.3705047-1-li...@zju.edu.cn/T/#u CVE-2023-3772 (A flaw was found in the Linux kernel\u2019s IP framework for transform ...) - {DSA-5492-1 DLA-3623-1} + {DSA-5492-1 DLA-3710-1 DLA-3623-1} - linux 6.4.13-1 [bullseye] - linux 5.10.197-1 NOTE: https://lore.kernel.org/netdev/20230721145103.2714073-1-li...@zju.edu.cn/ @@ -27855,11 +28030,11 @@ CVE-2023-38195 (Datalust Seq before 2023.2.9489 allows insertion of sensitive in CVE-2023-3826 (A vulnerability has been found in IBOS OA 4.5.5 and classified as crit ...) NOT-FOR-US: IBOS OA CVE-2023-3776 (A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw ...) - {DSA-5492-1 DSA-5480-1 DLA-3623-1} + {DSA-5492-1 DSA-5480-1 DLA-3710-1 DLA-3623-1} - linux 6.4.4-2 NOTE: https://git.kernel.org/linus/0323bce598eea038714f941ce2b22541c46d488f (6.5-rc2) CVE-2023-3611 (An out-of-bounds write vulnerability in the Linux kernel's net/sched: ...) - {DSA-5492-1 DSA-5480-1 DLA-3623-1} + {DSA-5492-1 DSA-5480-1 DLA-3710-1 DLA-3623-1} - linux 6.4.4-2 NOTE: https://git.kernel.org/linus/3e337087c3b5805fe0b8a46ba622a962880b5d64 (6.5-rc2) CVE-2023-3610 (A use-after-free vulnerability in the Linux kernel's netfilter: nf_tab ...) @@ -27869,7 +28044,7 @@ CVE-2023-3610 (A use-after-free vulnerability in the Linux kernel's netfilter: n [buster] - linux <not-affected> (Vulnerable code not present) NOTE: https://git.kernel.org/linus/4bedf9eee016286c835e3d8fa981ddece5338795 (6.4) CVE-2023-3609 (A use-after-free vulnerability in the Linux kernel's net/sched: cls_u3 ...) - {DSA-5480-1 DLA-3623-1} + {DSA-5480-1 DLA-3710-1 DLA-3623-1} - linux 6.3.11-1 [bookworm] - linux 6.1.37-1 NOTE: https://git.kernel.org/linus/04c55383fa5689357bcdd2c8036725a55ed632bc (6.4-rc7) @@ -30560,7 +30735,7 @@ CVE-2021-46891 (Vulnerability of incomplete read and write permission verificati CVE-2021-46890 (Vulnerability of incomplete read and write permission verification in ...) NOT-FOR-US: Huawei CVE-2023-35001 (Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nft_byte ...) - {DSA-5453-1 DLA-3512-1} + {DSA-5453-1 DLA-3710-1 DLA-3512-1} - linux 6.4.4-1 [bookworm] - linux 6.1.38-1 NOTE: https://www.openwall.com/lists/oss-security/2023/07/05/3 @@ -31164,7 +31339,7 @@ CVE-2023-3439 (A flaw was found in the MCTP protocol in the Linux kernel. The fu NOTE: https://git.kernel.org/linus/b561275d633bcd8e0e8055ab86f1a13df75a0269 (5.18-rc5) NOTE: https://www.openwall.com/lists/oss-security/2023/07/02/1 CVE-2023-3390 (A use-after-free vulnerability was found in the Linux kernel's netfilt ...) - {DSA-5461-1 DSA-5448-1 DLA-3512-1} + {DSA-5461-1 DSA-5448-1 DLA-3710-1 DLA-3512-1} - linux 6.3.11-1 NOTE: https://git.kernel.org/linus/1240eb93f0616b21c675416516ff3d74798fdc97 (6.4-rc7) NOTE: https://kernel.dance/#1240eb93f0616b21c675416516ff3d74798fdc97 @@ -32314,7 +32489,7 @@ CVE-2023-35828 (An issue was discovered in the Linux kernel before 6.3.2. A use- NOTE: USB_RENESAS_USB3 not enabled in Debian NOTE: Only "exploitable" by removing the module which needs root privileges CVE-2023-35827 (An issue was discovered in the Linux kernel through 6.3.8. A use-after ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1} - linux 6.5.8-1 [bookworm] - linux 6.1.64-1 NOTE: https://lore.kernel.org/lkml/cca0b40b-d6f8-54c7-1e46-83cb62d0a2f1%40huawei.com/T/ @@ -32999,7 +33174,7 @@ CVE-2023-2563 (The WordPress Contact Forms by Cimatti plugin for WordPress is vu CVE-2023-2351 (The WP Directory Kit plugin for WordPress is vulnerable to unauthorize ...) NOT-FOR-US: WP Directory Kit plugin for WordPress CVE-2023-3212 (A NULL pointer dereference issue was found in the gfs2 file system in ...) - {DSA-5480-1 DSA-5448-1 DLA-3623-1} + {DSA-5480-1 DSA-5448-1 DLA-3710-1 DLA-3623-1} - linux 6.3.7-1 NOTE: https://git.kernel.org/linus/504a10d9e46bc37b23d0a1ae2f28973c8516e636 (6.4-rc2) CVE-2023-3208 (A vulnerability, which was classified as critical, has been found in R ...) @@ -37698,12 +37873,12 @@ CVE-2023-31005 RESERVED CVE-2023-31004 RESERVED -CVE-2023-31003 - RESERVED +CVE-2023-31003 (IBM Security Access Manager Container (IBM Security Verify Access Appl ...) + TODO: check CVE-2023-31002 RESERVED -CVE-2023-31001 - RESERVED +CVE-2023-31001 (IBM Security Access Manager Container (IBM Security Verify Access Appl ...) + TODO: check CVE-2023-31000 RESERVED CVE-2023-30999 @@ -39634,7 +39809,7 @@ CVE-2023-1990 (A use-after-free flaw was found in ndlc_remove in drivers/nfc/st- NOTE: STMicroelectronics ST NCI NFC driver (NFC_ST_NCI_I2C, NFC_ST_NCI_SPI) not NOTE: enabled in Debian CVE-2023-1989 (A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\ ...) - {DSA-5492-1 DLA-3404-1 DLA-3403-1} + {DSA-5492-1 DLA-3710-1 DLA-3404-1 DLA-3403-1} - linux 6.3.7-1 [bullseye] - linux 5.10.197-1 NOTE: https://git.kernel.org/linus/1e9ac114c4428fdb7ff4635b45d4f46017e8916f (6.3-rc4) @@ -42148,12 +42323,12 @@ CVE-2023-29449 (JavaScript preprocessing, webhooks and global scripts can cause NOTE: vulnerable module introduced in https://github.com/zabbix/zabbix/commit/18d2abfc40 (5.0.0alpha1) CVE-2023-29448 RESERVED -CVE-2023-29447 - RESERVED -CVE-2023-29446 - RESERVED -CVE-2023-29445 - RESERVED +CVE-2023-29447 (An insufficiently protected credentials vulnerability in KEPServerEX c ...) + TODO: check +CVE-2023-29446 (An improper input validation vulnerability has been discovered that co ...) + TODO: check +CVE-2023-29445 (An uncontrolled search path element vulnerability (DLL hijacking) has ...) + TODO: check CVE-2023-29444 (An uncontrolled search path element vulnerability (DLL hijacking) has ...) TODO: check CVE-2023-29443 (Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP ...) @@ -46707,8 +46882,8 @@ CVE-2023-28198 (A use-after-free issue was addressed with improved memory manage [bookworm] - wpewebkit <ignored> (wpewebkit not covered by security support in Bookworm) [bullseye] - wpewebkit <ignored> (wpewebkit >= 2.40 can no longer be sensibly backported) NOTE: https://webkitgtk.org/security/WSA-2023-0008.html -CVE-2023-28197 - RESERVED +CVE-2023-28197 (An access issue was addressed with additional sandbox restrictions. Th ...) + TODO: check CVE-2023-28196 RESERVED CVE-2023-28195 (A privacy issue was addressed with improved private data redaction for ...) @@ -46731,8 +46906,8 @@ CVE-2023-28187 (This issue was addressed with improved state management. This is NOT-FOR-US: Apple CVE-2023-28186 RESERVED -CVE-2023-28185 - RESERVED +CVE-2023-28185 (An integer overflow was addressed through improved input validation. T ...) + TODO: check CVE-2023-28184 RESERVED CVE-2023-28183 @@ -48006,7 +48181,7 @@ CVE-2023-1208 (This HTTP Headers WordPress plugin before 1.18.11 allows arbitrar CVE-2023-1207 (This HTTP Headers WordPress plugin before 1.18.8 has an import functio ...) NOT-FOR-US: WordPress plugin CVE-2023-1206 (A hash collision flaw was found in the IPv6 connection lookup table in ...) - {DSA-5492-1 DSA-5480-1 DLA-3623-1} + {DSA-5492-1 DSA-5480-1 DLA-3710-1 DLA-3623-1} - linux 6.4.11-1 NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=2175903 NOTE: https://git.kernel.org/linus/d11b0df7ddf1831f3e170972f43186dad520bfcc (6.5-rc4) @@ -49705,7 +49880,7 @@ CVE-2023-1078 (A flaw was found in the Linux Kernel in RDS (Reliable Datagram So [bullseye] - linux 5.10.178-1 NOTE: https://git.kernel.org/linus/f753a68980cf4b59a80fe677619da2b1804f526d CVE-2023-1077 (In the Linux kernel, pick_next_rt_entity() may return a type confused ...) - {DLA-3404-1} + {DLA-3710-1 DLA-3404-1} - linux 6.1.20-1 [bullseye] - linux 5.10.178-1 NOTE: https://git.kernel.org/linus/7c4a5b89a0b5a57a64b601775b296abf77a9fe97 @@ -51675,7 +51850,7 @@ CVE-2023-25779 CVE-2023-25777 RESERVED CVE-2023-25775 (Improper access control in the Intel(R) Ethernet Controller RDMA drive ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1 DLA-3710-1} - linux 6.5.3-1 [bookworm] - linux 6.1.55-1 NOTE: https://git.kernel.org/linus/bb6d73d9add68ad270888db327514384dfa44958 @@ -56748,6 +56923,7 @@ CVE-2023-0592 (A path traversal vulnerability affects jefferson's JFFS2 filesyst CVE-2023-0591 (ubireader_extract_files is vulnerable to path traversal when run again ...) NOT-FOR-US: UBI reader CVE-2023-0590 (A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c ...) + {DLA-3710-1} - linux 6.0.6-1 [bullseye] - linux 5.10.158-1 NOTE: https://git.kernel.org/linus/ebda44da44f6f309d302522b049f43d6f829f7aa (6.1-rc2) @@ -70928,8 +71104,8 @@ CVE-2022-46723 (This issue was addressed with improved checks. This issue is fix NOT-FOR-US: Apple CVE-2022-46722 (A logic issue was addressed with improved checks. This issue is fixed ...) NOT-FOR-US: Apple -CVE-2022-46721 - RESERVED +CVE-2022-46721 (The issue was addressed with improved memory handling. This issue is f ...) + TODO: check CVE-2022-46720 (An integer overflow was addressed with improved input validation. This ...) NOT-FOR-US: Apple CVE-2022-46719 @@ -70950,8 +71126,8 @@ CVE-2022-46712 (A use after free issue was addressed with improved memory manage NOT-FOR-US: Apple CVE-2022-46711 RESERVED -CVE-2022-46710 - RESERVED +CVE-2022-46710 (A logic issue was addressed with improved checks. This issue is fixed ...) + TODO: check CVE-2022-46709 (A memory corruption issue was addressed with improved state management ...) NOT-FOR-US: Apple CVE-2022-46708 @@ -73802,10 +73978,10 @@ CVE-2022-45796 (Command injection vulnerability in nw_interface.html in SHARP mu NOT-FOR-US: SHARP CVE-2022-45795 RESERVED -CVE-2022-45794 - RESERVED -CVE-2022-45793 - RESERVED +CVE-2022-45794 (An attacker with network access to the affected PLC (CJ-series and CS- ...) + TODO: check +CVE-2022-45793 ([PROBLEMTYPE] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [A ...) + TODO: check CVE-2022-45792 RESERVED CVE-2022-45791 @@ -85266,8 +85442,8 @@ CVE-2022-42841 (A type confusion issue was addressed with improved checks. This NOT-FOR-US: Apple CVE-2022-42840 (The issue was addressed with improved memory handling. This issue is f ...) NOT-FOR-US: Apple -CVE-2022-42839 - RESERVED +CVE-2022-42839 (This issue was addressed with improved redaction of sensitive informat ...) + TODO: check CVE-2022-42838 (An issue with app access to camera data was addressed with improved lo ...) NOT-FOR-US: Apple CVE-2022-42837 (An issue existed in the parsing of URLs. This issue was addressed with ...) @@ -85321,8 +85497,8 @@ CVE-2022-42818 (This issue was addressed with improved data protection. This iss NOT-FOR-US: Apple CVE-2022-42817 (A logic issue was addressed with improved state management. This issue ...) NOT-FOR-US: Apple -CVE-2022-42816 - RESERVED +CVE-2022-42816 (A logic issue was addressed with improved state management. This issue ...) + TODO: check CVE-2022-42815 (This issue was addressed with improved data protection. This issue is ...) NOT-FOR-US: Apple CVE-2022-42814 (A logic issue was addressed with improved checks. This issue is fixed ...) @@ -91817,8 +91993,8 @@ CVE-2022-40363 (A buffer overflow in the component nfc_device_load_mifare_ul_dat NOT-FOR-US: Flipper Devices CVE-2022-40362 RESERVED -CVE-2022-40361 - RESERVED +CVE-2022-40361 (Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacke ...) + TODO: check CVE-2022-40360 RESERVED CVE-2022-40359 (Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via craf ...) @@ -112181,8 +112357,8 @@ CVE-2022-32933 [A website may be able to track the websites a user visited in Sa NOTE: https://webkitgtk.org/security/WSA-2023-0010.html CVE-2022-32932 (The issue was addressed with improved memory handling. This issue is f ...) NOT-FOR-US: Apple -CVE-2022-32931 - RESERVED +CVE-2022-32931 (This issue was addressed with improved data protection. This issue is ...) + TODO: check CVE-2022-32930 REJECTED CVE-2022-32929 (A permissions issue was addressed with additional restrictions. This i ...) @@ -112208,7 +112384,7 @@ CVE-2022-32921 REJECTED CVE-2022-32920 (The issue was addressed with improved checks. This issue is fixed in X ...) NOT-FOR-US: Apple Xcode -CVE-2022-32919 [Visiting a website that frames malicious content may lead to UI spoofing] +CVE-2022-32919 (The issue was addressed with improved UI handling. This issue is fixed ...) {DSA-5341-1 DSA-5340-1} - webkit2gtk 2.38.4-1 - wpewebkit 2.38.4-1 @@ -150066,7 +150242,7 @@ CVE-2021-44881 (D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered CVE-2021-44880 (D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882 ...) NOT-FOR-US: D-Link CVE-2021-44879 (In gc_data_segment in fs/f2fs/gc.c in the Linux kernel before 5.16.3, ...) - {DSA-5594-1} + {DSA-5594-1 DLA-3711-1 DLA-3710-1} - linux 5.16.7-1 [stretch] - linux <ignored> (Minor issue; f2fs is not supportable) NOTE: https://www.openwall.com/lists/oss-security/2022/02/12/1 View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e37bdd50f23d2acc3ec717d067ad36156f0710f6 -- View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/e37bdd50f23d2acc3ec717d067ad36156f0710f6 You're receiving this email because of your account on salsa.debian.org.
_______________________________________________ debian-security-tracker-commits mailing list debian-security-tracker-commits@alioth-lists.debian.net https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits