安全更新列表

[UTsweetyfish]

本 issue 用于跟踪安全更新推送。 This issue is used for tracking security updates.

• exiftool CVE-2022-23935 https://github.com/linuxdeepin/developer-center/issues/4967
• kernel https://github.com/linuxdeepin/developer-center/issues/4969
• glibc CVE-2023-4911 https://github.com/linuxdeepin/developer-center/issues/5268 https://github.com/linuxdeepin/developer-center/issues/5796
• flatpak CVE-2023-28100 CVE-2023-28101 https://github.com/linuxdeepin/developer-center/issues/5306
• curl CVE-2023-38545 https://github.com/linuxdeepin/developer-center/issues/5846
• openssl CVE-2023-5363 https://github.com/linuxdeepin/developer-center/issues/6070
• libssh CVE-2023-6004 CVE-2023-6918 CVE-2023-48795 CVE-2023-1667 CVE-2023-2283 https://github.com/linuxdeepin/developer-center/issues/6668
• libx11 CVE-2023-43785 CVE-2023-43786 CVE-2023-43787 https://github.com/linuxdeepin/developer-center/issues/7574
• xen CVE-2023-46839 CVE-2023-46840 https://github.com/linuxdeepin/developer-center/issues/7582
• util-linux CVE-2024-28085 https://github.com/linuxdeepin/developer-center/issues/7709
• putty CVE-2024-31497 https://github.com/linuxdeepin/developer-center/issues/7921
• flatpak CVE-2024-32462 https://github.com/linuxdeepin/developer-center/issues/8037
• glibc CVE-2024-2961 https://github.com/linuxdeepin/developer-center/issues/8063
• glibc CVE-2024-33599 CVE-2024-33600 CVE-2024-33601 CVE-2024-33602 https://github.com/linuxdeepin/developer-center/issues/8387
• less CVE-2024-32487 https://github.com/linuxdeepin/developer-center/issues/8399
• glib2.0 CVE-2024-34397 https://github.com/linuxdeepin/developer-center/issues/8518
• dav1d CVE-2024-1580 https://github.com/linuxdeepin/developer-center/issues/8519
• git CVE-2024-32002 CVE-2024-32004 CVE-2024-32020 CVE-2024-32021 https://github.com/linuxdeepin/developer-center/issues/8387
• gst-plugins-base1.0 CVE-2024-4453 https://github.com/linuxdeepin/developer-center/issues/8875
• openssh CVE-2024-6387 https://github.com/linuxdeepin/developer-center/issues/9500
• python CVE-2024-4032 https://github.com/linuxdeepin/developer-center/issues/9753
• wpa CVE-2024-5290 https://github.com/linuxdeepin/developer-center/issues/10238
• flatpak CVE-2024-42472 https://github.com/linuxdeepin/developer-center/issues/10407
• gst-plugins-base1.0 在 topic-py3.12 后需要重新将 CVE-2024-4453 修复 (https://github.com/linuxdeepin/developer-center/issues/10317)
• https://github.com/linuxdeepin/developer-center/issues/10532
• python-pymysql CVE-2024-36039 https://github.com/linuxdeepin/developer-center/issues/10480
• pillow CVE-2023-44271 CVE-2023-50447 CVE-2024-28219 https://github.com/deepin-community/pillow/blob/a055d68af1b8ead6e07d78351d5bd7f4f3678417/debian/changelog#L16
• libarchive CVE-2024-26256 https://github.com/linuxdeepin/developer-center/issues/10515
• libndp CVE-2024-5564 https://github.com/linuxdeepin/developer-center/issues/10520
• chromium CVE-2024-7971 https://github.com/linuxdeepin/developer-center/issues/10530
• curl CVE-2024-8096 https://github.com/linuxdeepin/developer-center/issues/10646
• cups-filters(cups-browsed) CVE-2024-47176 https://github.com/linuxdeepin/developer-center/issues/10705
• cups-filters(get_printer_attributes5) CVE-2024-47076 https://github.com/linuxdeepin/developer-center/issues/10705

[UTsweetyfish]

TODO

• [ ] vlc integer overflow in MMS module (fixed in 3.0.21) https://security-tracker.debian.org/tracker/DSA-5707-1
• [ ] ffmpeg CVE-2023-50010 CVE-2023-51793 CVE-2023-51794 CVE-2023-51795 CVE-2023-51798 CVE-2024-31585
• [ ] python CVE-2024-8088
• [ ] python CVE-2024-0397
• [ ] openssl CVE-2024-6119
• [ ] node-rollup CVE-2024-47068
• [ ] cups-filters(ppdgenerator) CVE-2024-47175
• [ ] CVE-2024-47177
• [ ] oath-toolkit CVE-2024-47191
• [ ] libgsf CVE-2024-36474 CVE-2024-42415
• [ ] firefox CVE-2024-9680

Move to sig-deepin-security

• [x] gtk CVE-2024-6655 (done by sig-deepin-security at https://github.com/deepin-community/sig-deepin-security/issues/7)
• [x] aom CVE-2024-5171 https://github.com/deepin-community/sig-deepin-security/issues/5
• [x] vim GHSA-rj48-v4mq-j4vg https://github.com/deepin-community/sig-deepin-security/issues/10