Debian Bug report logs -
#1041421
gpac: CVE-2023-3523 CVE-2023-37174 CVE-2023-37765 CVE-2023-37766 CVE-2023-37767
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, team@security.debian.org, Dmitry Smirnov <onlyjob@debian.org>:
Bug#1041421; Package src:zabbix.
(Tue, 18 Jul 2023 18:39:03 GMT) (full text, mbox, link).
Acknowledgement sent
to Moritz Mühlenhoff <jmm@inutil.org>:
New Bug report received and forwarded. Copy sent to team@security.debian.org, Dmitry Smirnov <onlyjob@debian.org>.
(Tue, 18 Jul 2023 18:39:03 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: zabbix
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security
Hi,
The following vulnerabilities were published for zabbix.
CVE-2023-3523[0]:
| Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.
https://huntr.dev/bounties/57e0be03-8484-415e-8b5c-c1fe4546eaac/
https://github.com/gpac/gpac/commit/64201a26476c12a7dbd7ffb5757743af6954db96
CVE-2023-37174[1]:
| GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a
| segmentation violation in the dump_isom_scene function at
| /mp4box/filedump.c.
https://github.com/gpac/gpac/issues/2505
https://github.com/gpac/gpac/commit/549ff4484246f2bc4d5fec6760332b43774db483
CVE-2023-37765[2]:
| GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a
| segmentation violation in the gf_dump_vrml_sffield function at
| /lib/libgpac.so.
https://github.com/gpac/gpac/issues/2515
https://github.com/gpac/gpac/commit/36e1b9900ff638576cb88636bbbe2116ed06dfdc
CVE-2023-37766[3]:
| GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a
| segmentation violation in the gf_isom_remove_user_data function at
| /lib/libgpac.so.
https://github.com/gpac/gpac/issues/2516
https://github.com/gpac/gpac/commit/a64c60ef0983be6db8ab1e4a663e0ce83ff7bf2c
CVE-2023-37767[4]:
| GPAC v2.3-DEV-rev381-g817a848f6-master was discovered to contain a
| segmentation violation in the BM_ParseIndexValueReplace function at
| /lib/libgpac.so.
https://github.com/gpac/gpac/issues/2514
https://github.com/gpac/gpac/commit/d414df635c773b21bbb3a9fbf17b101b1e8ea345
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2023-3523
https://www.cve.org/CVERecord?id=CVE-2023-3523
[1] https://security-tracker.debian.org/tracker/CVE-2023-37174
https://www.cve.org/CVERecord?id=CVE-2023-37174
[2] https://security-tracker.debian.org/tracker/CVE-2023-37765
https://www.cve.org/CVERecord?id=CVE-2023-37765
[3] https://security-tracker.debian.org/tracker/CVE-2023-37766
https://www.cve.org/CVERecord?id=CVE-2023-37766
[4] https://security-tracker.debian.org/tracker/CVE-2023-37767
https://www.cve.org/CVERecord?id=CVE-2023-37767
Please adjust the affected versions in the BTS as needed.
Bug reassigned from package 'src:zabbix' to 'gpac'.
Request was from Moritz Muehlenhoff <jmm@debian.org>
to control@bugs.debian.org.
(Tue, 18 Jul 2023 18:45:10 GMT) (full text, mbox, link).
Changed Bug title to 'gpac: CVE-2023-3523 CVE-2023-37174 CVE-2023-37765 CVE-2023-37766 CVE-2023-37767' from 'zabbix: CVE-2023-3523 CVE-2023-37174 CVE-2023-37765 CVE-2023-37766 CVE-2023-37767'.
Request was from Moritz Muehlenhoff <jmm@debian.org>
to control@bugs.debian.org.
(Tue, 18 Jul 2023 18:45:12 GMT) (full text, mbox, link).
Added tag(s) upstream.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to control@bugs.debian.org.
(Tue, 18 Jul 2023 20:39:10 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Wed Jul 19 11:54:46 2023;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon