Debian Bug report logs -
#1008793
fribidi: CVE-2022-25308 CVE-2022-25309 CVE-2022-25310
Reported by: Salvatore Bonaccorso <carnil@debian.org>
Date: Fri, 1 Apr 2022 17:45:01 UTC
Severity: important
Tags: security, upstream
Found in versions fribidi/1.0.5-3.1, fribidi/1.0.5-3.1+deb10u1, fribidi/1.0.8-2
Reply or subscribe to this bug.
Toggle useless messages
Report forwarded
to debian-bugs-dist@lists.debian.org, carnil@debian.org, team@security.debian.org, Debian Hebrew Packaging Team <team+hebrew@tracker.debian.org>:
Bug#1008793; Package src:fribidi.
(Fri, 01 Apr 2022 17:45:04 GMT) (full text, mbox, link).
Acknowledgement sent
to Salvatore Bonaccorso <carnil@debian.org>:
New Bug report received and forwarded. Copy sent to carnil@debian.org, team@security.debian.org, Debian Hebrew Packaging Team <team+hebrew@tracker.debian.org>.
(Fri, 01 Apr 2022 17:45:04 GMT) (full text, mbox, link).
Message #5 received at submit@bugs.debian.org (full text, mbox, reply):
Source: fribidi
Version: 1.0.8-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Control: found -1 1.0.5-3.1
Control: found -1 1.0.5-3.1+deb10u1
Hi,
The following vulnerabilities were published for fribidi.
CVE-2022-25308[0], CVE-2022-25309[1] and CVE-2022-25310[2].
The are fixed all on master in git upstream already (but no tagged
version appeared yet including the fixes).
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-25308
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25308
[1] https://security-tracker.debian.org/tracker/CVE-2022-25309
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25309
[2] https://security-tracker.debian.org/tracker/CVE-2022-25310
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25310
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
Marked as found in versions fribidi/1.0.5-3.1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to submit@bugs.debian.org.
(Fri, 01 Apr 2022 17:45:04 GMT) (full text, mbox, link).
Marked as found in versions fribidi/1.0.5-3.1+deb10u1.
Request was from Salvatore Bonaccorso <carnil@debian.org>
to submit@bugs.debian.org.
(Fri, 01 Apr 2022 17:45:04 GMT) (full text, mbox, link).
Send a report that this bug log contains spam.
Debian bug tracking system administrator <owner@bugs.debian.org>.
Last modified:
Sat Apr 2 13:09:13 2022;
Machine Name:
buxtehude
Debian Bug tracking system
Debbugs is free software and licensed under the terms of the GNU
Public License version 2. The current version can be obtained
from https://bugs.debian.org/debbugs-source/.
Copyright © 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson,
2005-2017 Don Armstrong, and many other contributors.
Vulmon