diff options
| author | Salvatore Bonaccorso <carnil@debian.org> | 2021-02-18 07:31:45 +0100 |
|---|---|---|
| committer | Salvatore Bonaccorso <carnil@debian.org> | 2021-02-18 07:31:45 +0100 |
| commit | 68ae7af745ba9de1b3f9ad431693953c5613f4ad (patch) | |
| tree | a82a73666469a6d3e374c5ea084dde40617cd832 /data/CVE/2019.list | |
| parent | 3a580f3aeb1c927eaba55af4cf2948ec1abd23ee (diff) | |
Add CVE-2019-17582/libzip
Note that the reporter states "This use-after-free is triggered prior to
the double free reported in CVE-2017-12858." and a second CVE assigned.
Please double-check correctness of CVE-2019-17582 tracking.
Diffstat (limited to 'data/CVE/2019.list')
| -rw-r--r-- | data/CVE/2019.list | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/data/CVE/2019.list b/data/CVE/2019.list index 03fefaf6f2..acdf14de03 100644 --- a/data/CVE/2019.list +++ b/data/CVE/2019.list @@ -8574,7 +8574,11 @@ CVE-2019-17584 (The Meinberg SyncBox/PTP/PTPv2 devices have default SSH keys whi CVE-2019-17583 (idreamsoft iCMS 7.0.15 allows remote attackers to cause a denial of se ...) NOT-FOR-US: idreamsoft iCMS CVE-2019-17582 (A use-after-free in the _zip_dirent_read function of zip_dirent.c in l ...) - TODO: check + - libzip <not-affected> (Vulnerable code introduced later; and never in a released version in Debian) + NOTE: Introduced after: https://github.com/nih-at/libzip/commit/796c5968ad679220db3fb65ec6f48c66e554e5d5 (rel-1-2-0) + NOTE: Fixed by: https://github.com/nih-at/libzip/commit/2217022b7d1142738656d891e00b3d2d9179b796 (rel-1-3-0) + NOTE: Same fixing commit as CVE-2017-12858 apparently, but CVE assignment for + NOTE: two different use-after-free issues. CVE-2019-17581 (tonyy dormsystem through 1.3 allows DOM XSS. ...) NOT-FOR-US: tonyy dormsystem CVE-2019-17580 (tonyy dormsystem through 1.3 allows SQL Injection in admin.php. ...) |