User:RossBurton/CVE: Difference between revisions

From Yocto Project
Jump to navigationJump to search
No edit summary
No edit summary
 
(43 intermediate revisions by 3 users not shown)
Line 1: Line 1:
* apt-1.2.31-r0 do_cve_check: Found unpatched CVE (CVE-2019-3462)
* binutils-native-2.32.0-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000876)
* binutils-2.32.0-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000876 CVE-2019-12972 CVE-2019-9070 CVE-2019-9071 CVE-2019-9072 CVE-2019-9073)
 
* boost-1.69.0-r0 do_cve_check: Found unpatched CVE (CVE-2009-3654)
It's fixed in 2.32. CPE data looks wrong.
* curl-7.65.1-r0 do_cve_check: Found unpatched CVE (CVE-2019-5443)
 
* db-1_5.3.28-r1 do_cve_check: Found unpatched CVE (CVE-2016-0682 CVE-2016-0689 CVE-2016-0692 CVE-2016-0694 CVE-2016-3418 CVE-2017-3604 CVE-2017-3605 CVE-2017-3606 CVE-2017-3607 CVE-2017-3608 CVE-2017-3609 CVE-2017-3610 CVE-2017-3611 CVE-2017-3612 CVE-2017-3613 CVE-2017-3614 CVE-2017-3615 CVE-2017-3616 CVE-2017-3617)
* db-1_5.3.28-r1 do_cve_check: Found unpatched CVE (CVE-2016-0682 CVE-2016-0689 CVE-2016-0692 CVE-2016-0694 CVE-2016-3418 CVE-2017-3604 CVE-2017-3605 CVE-2017-3606 CVE-2017-3607 CVE-2017-3608 CVE-2017-3609 CVE-2017-3610 CVE-2017-3611 CVE-2017-3612 CVE-2017-3613 CVE-2017-3614 CVE-2017-3615 CVE-2017-3616 CVE-2017-3617)
* ed-1.15-r0 do_cve_check: Found unpatched CVE (CVE-2015-2987)
* glibc-2.29-r0 do_cve_check: Found unpatched CVE (CVE-2018-20796 CVE-2019-9192)
* flex-2.6.0-r0 do_cve_check: Found unpatched CVE (<s>CVE-2015-1773</s>)
 
CVE-2019-9192 is disputed.


1773 isn't GNU Flex. Need improvement to cve-check class to compare Vendor.
* iptables-1.8.2-r0 do_cve_check: Found unpatched CVE (CVE-2019-11360)
 
This should be fixed by an upgrade. I will send.


* git-2.22.0-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000110 CVE-2018-1000182 CVE-2019-1003010)
* glib-2.0-1_2.60.4-r0 do_cve_check: Found unpatched CVE (CVE-2019-12450)
* gnupg-2.2.16-r0 do_cve_check: Found unpatched CVE (CVE-2019-13050)
* go-1.12.6-r0 do_cve_check: Found unpatched CVE (CVE-2018-17075 CVE-2018-17142 CVE-2018-17143 CVE-2018-17846 CVE-2018-17847 CVE-2018-17848)
* libgcrypt-1.8.4-r0 do_cve_check: Found unpatched CVE (CVE-2019-12904)
* libgcrypt-1.8.4-r0 do_cve_check: Found unpatched CVE (CVE-2019-12904)
* libid3tag-0.15.1b-r7 do_cve_check: Found unpatched CVE (CVE-2017-11550 CVE-2017-11551)
* linux-intel-4.19.55+gitAUTOINC+ad235db461_3347a3790f-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000026 CVE-2018-16880 CVE-2018-20784 CVE-2018-20836 CVE-2019-10125 CVE-2019-10638 CVE-2019-10639 CVE-2019-11191 CVE-2019-11486 CVE-2019-11487 CVE-2019-11599 CVE-2019-11810 CVE-2019-11811 CVE-2019-11815 CVE-2019-11833 CVE-2019-11884 CVE-2019-12378 CVE-2019-12379 CVE-2019-12380 CVE-2019-12381 CVE-2019-12382 CVE-2019-12454 CVE-2019-12455 CVE-2019-12456 CVE-2019-12614 CVE-2019-12615 CVE-2019-12817 CVE-2019-12818 CVE-2019-12819 CVE-2019-12984 CVE-2019-13233 CVE-2019-3459 CVE-2019-3460 CVE-2019-3819 CVE-2019-3887 CVE-2019-3900 CVE-2019-6974 CVE-2019-7221 CVE-2019-7222 CVE-2019-8912 CVE-2019-8956 CVE-2019-8980 CVE-2019-9003 CVE-2019-9857)
* librsvg-2.40.20-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000041)
* nasm-native-2.14.02-r0 do_cve_check: Found unpatched CVE (CVE-2019-6290 CVE-2019-6291 CVE-2019-8343)
* libsndfile1-1.0.28-r0 do_cve_check: Found unpatched CVE (CVE-2018-13419)
* openssl-1.1.1c-r0 do_cve_check: Found unpatched CVE (CVE-2018-16395 CVE-2019-0190)
* libtasn1-4.13-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000654)
 
* libxslt-1.1.33-r0 do_cve_check: Found unpatched CVE (CVE-2019-13117 CVE-2019-13118)
CVE-2018-16395 is for ruby. The CPE data looks wrong. CVE-2019-0190 is fixed in openssl 1.1.1c but the JSON data doesn't have versionEndIncluding set.
* mdadm-4.1-r0 do_cve_check: Found unpatched CVE (CVE-2014-5220)
 
* nasm-2.14.02-r0 do_cve_check: Found unpatched CVE (CVE-2019-6290 CVE-2019-6291 CVE-2019-8343)
* qemu-native-4.0.0-r0 do_cve_check: Found unpatched CVE (CVE-2019-13164)
* openssl-1.1.1c-r0 do_cve_check: Found unpatched CVE (CVE-2016-7798 CVE-2018-16395 CVE-2019-0190)
* <s>squashfs-tools-native-4.3+gitrAUTOINC+f95864afe8-r0 do_cve_check: Found unpatched CVE (CVE-2015-4645 CVE-2015-4646)</s>
* procps-3.3.15-r0 do_cve_check: Found unpatched CVE (CVE-2018-1121)
Fixed with the upgrade to f95864afe883 in master-next
* python-2.7.16-r0 do_cve_check: Found unpatched CVE (CVE-2010-3492 CVE-2013-7338 CVE-2015-5652 CVE-2017-17522 CVE-2017-18207 CVE-2019-9740 CVE-2019-9947)
 
* qemu-4.0.0-r0 do_cve_check: Found unpatched CVE (CVE-2019-12155 CVE-2019-12928 CVE-2019-12929)
* unzip-1_6.0-r5 do_cve_check: Found unpatched CVE (CVE-2019-13232)
* rsync-3.1.3-r0 do_cve_check: Found unpatched CVE (CVE-2017-16548)
* subversion-1.12.0-r0 do_cve_check: Found unpatched CVE (CVE-2017-1000085 CVE-2018-1000111)
* tiff-4.0.10-r0 do_cve_check: Found unpatched CVE (CVE-2019-6128 CVE-2019-7663)
* virglrenderer-0.7.0-r0 do_cve_check: Found unpatched CVE (CVE-2017-5957)
* zip-3.0-r2 do_cve_check: Found unpatched CVE (CVE-2018-13410)

Latest revision as of 22:08, 18 July 2019

  • binutils-native-2.32.0-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000876)

It's fixed in 2.32. CPE data looks wrong.

  • db-1_5.3.28-r1 do_cve_check: Found unpatched CVE (CVE-2016-0682 CVE-2016-0689 CVE-2016-0692 CVE-2016-0694 CVE-2016-3418 CVE-2017-3604 CVE-2017-3605 CVE-2017-3606 CVE-2017-3607 CVE-2017-3608 CVE-2017-3609 CVE-2017-3610 CVE-2017-3611 CVE-2017-3612 CVE-2017-3613 CVE-2017-3614 CVE-2017-3615 CVE-2017-3616 CVE-2017-3617)
  • glibc-2.29-r0 do_cve_check: Found unpatched CVE (CVE-2018-20796 CVE-2019-9192)

CVE-2019-9192 is disputed.

  • iptables-1.8.2-r0 do_cve_check: Found unpatched CVE (CVE-2019-11360)

This should be fixed by an upgrade. I will send.

  • libgcrypt-1.8.4-r0 do_cve_check: Found unpatched CVE (CVE-2019-12904)
  • linux-intel-4.19.55+gitAUTOINC+ad235db461_3347a3790f-r0 do_cve_check: Found unpatched CVE (CVE-2018-1000026 CVE-2018-16880 CVE-2018-20784 CVE-2018-20836 CVE-2019-10125 CVE-2019-10638 CVE-2019-10639 CVE-2019-11191 CVE-2019-11486 CVE-2019-11487 CVE-2019-11599 CVE-2019-11810 CVE-2019-11811 CVE-2019-11815 CVE-2019-11833 CVE-2019-11884 CVE-2019-12378 CVE-2019-12379 CVE-2019-12380 CVE-2019-12381 CVE-2019-12382 CVE-2019-12454 CVE-2019-12455 CVE-2019-12456 CVE-2019-12614 CVE-2019-12615 CVE-2019-12817 CVE-2019-12818 CVE-2019-12819 CVE-2019-12984 CVE-2019-13233 CVE-2019-3459 CVE-2019-3460 CVE-2019-3819 CVE-2019-3887 CVE-2019-3900 CVE-2019-6974 CVE-2019-7221 CVE-2019-7222 CVE-2019-8912 CVE-2019-8956 CVE-2019-8980 CVE-2019-9003 CVE-2019-9857)
  • nasm-native-2.14.02-r0 do_cve_check: Found unpatched CVE (CVE-2019-6290 CVE-2019-6291 CVE-2019-8343)
  • openssl-1.1.1c-r0 do_cve_check: Found unpatched CVE (CVE-2018-16395 CVE-2019-0190)

CVE-2018-16395 is for ruby. The CPE data looks wrong. CVE-2019-0190 is fixed in openssl 1.1.1c but the JSON data doesn't have versionEndIncluding set.

  • qemu-native-4.0.0-r0 do_cve_check: Found unpatched CVE (CVE-2019-13164)
  • squashfs-tools-native-4.3+gitrAUTOINC+f95864afe8-r0 do_cve_check: Found unpatched CVE (CVE-2015-4645 CVE-2015-4646)

Fixed with the upgrade to f95864afe883 in master-next

  • unzip-1_6.0-r5 do_cve_check: Found unpatched CVE (CVE-2019-13232)
Retrieved from "https://wiki.yoctoproject.org/wiki/index.php?title=User:RossBurton/CVE&oldid=56762"