Vulnerability roundup 47 (release-18.09)

[ckauhaus]

Scanned nixos/release-combined.nix @ ef450ef. Filtered out previously reported CVEs. May contain false positives.

binutils-2.30 (search, files)

• CVE-2018-10372
• CVE-2018-10373
• CVE-2018-10534
• CVE-2018-10535
• CVE-2018-12641
• CVE-2018-12697
• CVE-2018-12698
• CVE-2018-12699
• CVE-2018-12700
• CVE-2018-12934
• CVE-2018-13033
• CVE-2018-6543
• CVE-2018-6759
• CVE-2018-6872

coreutils-8.29 (search, files)

• CVE-2017-18018

exempi-2.4.5 (search, files)

• CVE-2018-12648

ffmpeg-3.4.4 (search, files)

• CVE-2018-14394
• CVE-2018-14395

glibc-2.27 (search, files)

• CVE-2018-11236
• CVE-2018-11237

graphviz-2.40.1 (search, files)

• CVE-2018-10196

gstreamer-0.10.36 (search, files)

• CVE-2016-9447

jasper-2.0.14 (search, files)

• CVE-2018-9252

jquery-ui-1.11.4 (search, files)

• CVE-2016-7103

libarchive-3.3.2 (search, files)

• CVE-2017-14501
• CVE-2017-14503

libcroco-0.6.12 (search, files)

• CVE-2017-8834
• CVE-2017-8871

libid3tag-0.15.1b (search, files)

• CVE-2017-11550
• CVE-2017-11551

libmad-0.15.1b (search, files)

• CVE-2018-7263

libsass-3.5.4 (search, files)

• CVE-2018-11499
• CVE-2018-11693
• CVE-2018-11694
• CVE-2018-11696
• CVE-2018-11697
• CVE-2018-11698

libsndfile-1.0.28 (search, files)

• CVE-2017-14245
• CVE-2017-14246
• CVE-2018-13139 ad9e8ea
• CVE-2018-13419

libtiff-4.0.9 (search, files)

• CVE-2017-17095
• CVE-2018-10126
• CVE-2018-10963
• CVE-2018-12900
• CVE-2018-5784
• CVE-2018-7456

libvorbis-1.3.6 (search, files)

• CVE-2018-10393

lua-5.1.5 (search, files)

• CVE-2014-5461

net-snmp-5.7.3 (search, files)

• CVE-2014-2285

openjpeg-2.3.0 (search, files)

• CVE-2017-17479
• CVE-2017-17480
• CVE-2018-14423
• CVE-2018-5727
• CVE-2018-5785
• CVE-2018-6616
• CVE-2018-7648

patch-2.7.6 (search, files)

• CVE-2018-1000156
• CVE-2018-6952

procps-3.3.15 (search, files)

• CVE-2018-1121

rsync-3.1.3 (search, files)

• CVE-2017-16548

sddm-0.17.0 (search, files)

• CVE-2018-14345

taglib-1.11.1 (search, files)

• CVE-2018-11439

wildmidi-0.4.2 (search, files)

• CVE-2017-11661
• CVE-2017-11662
• CVE-2017-11663
• CVE-2017-11664

wpa_supplicant-2.6 (search, files)

• CVE-2017-13077
• CVE-2017-13078
• CVE-2017-13079
• CVE-2017-13080
• CVE-2017-13081
• CVE-2017-13082
• CVE-2017-13084
• CVE-2017-13086
• CVE-2017-13087
• CVE-2017-13088

zip-3.0 (search, files)

• CVE-2018-13410

Cc: @joepie91, @phanimahesh, @the-kenny, @7c6f434c, @k0001, @peterhoeg, @nh2, @LnL7, @grahamc, @adisbladis, @fpletz, @vcunat

Contact @ckauhaus for any questions.

[ckauhaus]

master is #47121

[vcunat]

coreutils: @ckauhaus can you whitelist this CVE? See #38993 (comment)

[ckauhaus]

@vcunat each CVE is reoprted only once per branch anyway

[periklis]

@ckauhaus exempi was patched in master by @Ma27 and i see it is merged in release-18.09 branch (See L12)

[periklis]

@ckauhaus i've checked our release-18.09 channel for lua and the patch is included. (See L23)

[periklis]

According to RH-Errata (https://access.redhat.com/errata/RHSA-2016:2974) the gstreamer issue affects only the package gstreamer-plugins-bad and the affected plugin was removed in 0.10.19. We have actually 1.14.2 in release-18.09 and master. I've checked the source files and the NSF plugin is not listed anymore.

[periklis]

For jquery-ui there is an new release 1.12.1 which includes the patch :
jquery/jquery-ui@1-11-stable...1.12

How important is nixos/lib/testing?

[periklis]

For libarchive-3.3.2:

• CVE-2017-14501: Patch available by debian https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=875966#34
• CVE-2017-14503: Fixed in 3.3.3 by libarchive/libarchive@2c8c83b

[periklis]

For libid3tag a patch is available in bugzilla. According to debian both CVEs point to the same issue. Thus the patch should solve both.