From 3ae65d66ec555fb698d767c661ed41194a1589d3 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 21 Aug 2024 22:31:17 +0000
Subject: [PATCH] Publish Advisories

GHSA-g4m4-9q4c-mfw6
GHSA-q5fm-55c2-v6j9
---
 .../2024/07/GHSA-g4m4-9q4c-mfw6/GHSA-g4m4-9q4c-mfw6.json      | 4 ++--
 .../2024/07/GHSA-q5fm-55c2-v6j9/GHSA-q5fm-55c2-v6j9.json      | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/advisories/github-reviewed/2024/07/GHSA-g4m4-9q4c-mfw6/GHSA-g4m4-9q4c-mfw6.json b/advisories/github-reviewed/2024/07/GHSA-g4m4-9q4c-mfw6/GHSA-g4m4-9q4c-mfw6.json
index 0b0949c965d..bfeaa7c03a2 100644
--- a/advisories/github-reviewed/2024/07/GHSA-g4m4-9q4c-mfw6/GHSA-g4m4-9q4c-mfw6.json
+++ b/advisories/github-reviewed/2024/07/GHSA-g4m4-9q4c-mfw6/GHSA-g4m4-9q4c-mfw6.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-g4m4-9q4c-mfw6",
-  "modified": "2024-07-16T19:32:22Z",
+  "modified": "2024-08-21T22:30:00Z",
   "published": "2024-07-16T19:32:22Z",
   "aliases": [
 
   ],
   "summary": "Fiona affected by CVE-2020-14152 related to madler-zlib",
-  "details": "### Summary\nVulnerability scan of fiona shows [CVE-2020-14152](https://nvd.nist.gov/vuln/detail/CVE-2020-14152)\n\n### Details\nIn IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.\n\n### Impact\nUnkown. Please document if this vulnerability is exposed\n",
+  "details": "### Summary\nVulnerability scan of fiona shows [CVE-2020-14152](https://nvd.nist.gov/vuln/detail/CVE-2020-14152). The vulnerability is in libjpeg, a transitive dependency of fiona (via GDAL and PROJ).\n\n### Details\nIn IJG JPEG (aka libjpeg) before 9d, jpeg_mem_available() in jmemnobs.c in djpeg does not honor the max_memory_to_use setting, possibly causing excessive memory consumption.\n\n### Impact\nfiona will not open JPEG files and is not vulnerable to attack in that way. fiona might be vulnerable to malformed PROJ grid files using JPEG compression. No such vulnerability or compromise has been demonstrated.\n",
   "severity": [
     {
       "type": "CVSS_V3",
diff --git a/advisories/github-reviewed/2024/07/GHSA-q5fm-55c2-v6j9/GHSA-q5fm-55c2-v6j9.json b/advisories/github-reviewed/2024/07/GHSA-q5fm-55c2-v6j9/GHSA-q5fm-55c2-v6j9.json
index 451baaf04d3..1a61c5e1ca3 100644
--- a/advisories/github-reviewed/2024/07/GHSA-q5fm-55c2-v6j9/GHSA-q5fm-55c2-v6j9.json
+++ b/advisories/github-reviewed/2024/07/GHSA-q5fm-55c2-v6j9/GHSA-q5fm-55c2-v6j9.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-q5fm-55c2-v6j9",
-  "modified": "2024-07-16T19:32:45Z",
+  "modified": "2024-08-21T22:30:04Z",
   "published": "2024-07-16T19:32:45Z",
   "aliases": [
 
   ],
   "summary": "Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib",
-  "details": "### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853)\n\n### Details\nfiona depends on madler-zlib 1.3.  MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. NOTE: pyminizip through 0.2.6 is also vulnerable because it bundles an affected zlib version, and exposes the applicable MiniZip code through its compress API.\n\n### Impact\nUnkown.  Please document if this vulnerability is exposed\n",
+  "details": "### Summary\nVulnerability scan of fiona shows [CVE-2023-45853](https://nvd.nist.gov/vuln/detail/CVE-2023-45853). The vulnerability is in GDAL, a dependency of fiona.\n\n### Details\nFiona depends on GDAL and GDAL has a port of minizip. MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename, comment, or extra field. The GDAL project has addressed the CVE in version 3.8.0. See https://lists.osgeo.org/pipermail/gdal-dev/2023-November/057881.html.\n\nThe Fiona version 1.9.6 wheels on PyPI include GDAL version 3.6.4 and thus could be vulnerable. All of the Fiona 1.10 pre-release wheels in PyPI include GDAL version 3.8.4 and are not vulnerable.\n\n### Impact\nSystems which use GDAL versions prior to 3.8.0 to open unchecked zip files, whether in combination with fiona or not, could be susceptible to buffer overflows.",
   "severity": [
     {
       "type": "CVSS_V3",