Retire some CVEs

3 files changed, 44 insertions, 0 deletions

diff --git a/retired/CVE-2023-40791 b/retired/CVE-2023-40791
new file mode 100644
index 00000000..140827c1
--- /dev/null
+++ b/retired/CVE-2023-40791
@@ -0,0 +1,14 @@
+Description: crypto, cifs: fix error handling in extract_iter_to_sg()
+References:
+Notes:
+ carnil> Commit fixes 018584697533 ("netfs: Add a function to extract an
+ carnil> iterator into a scatterlist") in 6.3-rc1.
+Bugs:
+upstream: released (6.5-rc6) [f443fd5af5dbd531f880d3645d5dd36976cf087f]
+6.1-upstream-stable: N/A "Vulnerable code not present"
+5.10-upstream-stable: N/A "Vulnerable code not present"
+4.19-upstream-stable: N/A "Vulnerable code not present"
+sid: released (6.4.13-1)
+6.1-bookworm-security: N/A "Vulnerable code not present"
+5.10-bullseye-security: N/A "Vulnerable code not present"
+4.19-buster-security: N/A "Vulnerable code not present"
diff --git a/retired/CVE-2023-42756 b/retired/CVE-2023-42756
new file mode 100644
index 00000000..9337c673
--- /dev/null
+++ b/retired/CVE-2023-42756
@@ -0,0 +1,18 @@
+Description: netfilter: ipset: Fix race between IPSET_CMD_CREATE and IPSET_CMD_SWAP
+References:
+ https://www.openwall.com/lists/oss-security/2023/09/27/2
+Notes:
+ carnil> Commit fixes 24e227896bbf ("netfilter: ipset: Add schedule
+ carnil> point in call_ad().") in 6.4-rc6 (but got backported to
+ carnil> 5.10.184, 6.1.34, 6.3.8) and so affecting stable series
+ carnil> relevant for Debian.
+ carnil> For 6.5.y fixed as well in 6.5.6.
+Bugs:
+upstream: released (6.6-rc3) [7433b6d2afd512d04398c73aa984d1e285be125b]
+6.1-upstream-stable: released (6.1.56) [ea5a61d58886ae875f1b4a371999f2a8b58cf26d]
+5.10-upstream-stable: released (5.10.198) [f1893feb20ea033bcd9c449b55df3dab3802c907]
+4.19-upstream-stable: N/A "Vulnerable code not present"
+sid: released (6.5.6-1)
+6.1-bookworm-security: released (6.1.55-1) [bugfix/all/netfilter-ipset-fix-race-between-ipset_cmd_create-an.patch]
+5.10-bullseye-security: released (5.10.197-1) [bugfix/all/netfilter-ipset-fix-race-between-ipset_cmd_create-an.patch]
+4.19-buster-security: N/A "Vulnerable code not present"
diff --git a/retired/CVE-2023-45862 b/retired/CVE-2023-45862
new file mode 100644
index 00000000..d73a87c4
--- /dev/null
+++ b/retired/CVE-2023-45862
@@ -0,0 +1,12 @@
+Description: USB: ene_usb6250: Allocate enough memory for full object
+References:
+Notes:
+Bugs:
+upstream: released (6.3-rc1) [ce33e64c1788912976b61314b56935abd4bc97ef]
+6.1-upstream-stable: released (6.1.18) [ff542083b105c9c72d83899d3f74eeec354f808e]
+5.10-upstream-stable: released (5.10.173) [961f93d63da72f5fcaa6793fb2dcbc995c119a8e]
+4.19-upstream-stable: released (4.19.276) [cef5e33d8b893891817236db819982f87943e8fd]
+sid: released (6.1.20-1)
+6.1-bookworm-security: N/A "Fixed before branching point"
+5.10-bullseye-security: released (5.10.178-1)
+4.19-buster-security: released (4.19.282-1)