Vulnerability Roundup 36 (master)

[ckauhaus]

Scanned nixos/release-combined.nix @ e860b65. Filtered out previously reported CVEs. May contain false positives.

libtasn1-4.12 (search, files)

• CVE-2018-6003

libtiff-4.0.9 (search, files)

• CVE-2017-17095
• CVE-2017-17942
• CVE-2017-18013
• CVE-2018-5784

mupdf-1.12.0 (search, files)

• CVE-2017-17858
• CVE-2018-6187
• CVE-2018-6192

qemu-2.11.0 (search, files)

• CVE-2017-15124

Cc: @joepie91, @phanimahesh, @the-kenny, @7c6f434c, @k0001, @peterhoeg, @nh2, @LnL7, @grahamc, @adisbladis, @fpletz

Contact @ckauhaus for any questions.

[ckauhaus]

Associated vulnerability roundup for release-17.09 is #34786

[7c6f434c]

CVE-2018-6871 ?

https://nvd.nist.gov/vuln/detail/CVE-2018-6871

LibreOffice through 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function

[dotlambda]

• CVE-2018-6574: cmd/go: arbitrary code execution during “go get” golang/go#23672 (Golang: Minor updates (CVE-2018-6574) #34819)

[ckauhaus]

libtiff 4.0.10 is available on http://www.simplesystems.org/libtiff/ and should be updated

[Ekleog]

libtiff update is now merged: #51105 (comment)

[ckauhaus]

It's unlikely that we fix qemu-2.11, so I'll close this ticket for now.

[vcunat]

AFAIK we now only have qemu-3.0.0 on both master and 18.09.