Merge ~eslerm/ubuntu-cve-tracker:select-reference-refresh into ubuntu-cve-tracker:master

[Mark Esler]

select reference refresh from NVD 2.0 data

UCT has never been "refreshed" with new NVD reference data after initial creation of a cve-uct file.

There +300,000 references that could be added. The quality of all references is dubious, so select domains are being added to an allow list. See https://code.launchpad.net/~eslerm/ubuntu-cve-tracker/+git/ubuntu-cve-tracker/+ref/cve-translate/

07f9377... by Mark Esler on 2024-01-10

cve reference refresh: add DSAs

ec6baa9... by Mark Esler on 2024-01-10

cve reference refresh: add DLAs

6843873... by Mark Esler on 2024-01-10

cve reference refresh: Debian's security-tracker

[Mark Esler (eslerm)]

The recent Debian reference adds are a little noisy, but seems reasonable as we are based on them. I don't plan to backport other distro references as extensively.

[Mark Esler (eslerm)]

Steve asked that I redo the Launchpad commit, so that bugs are added to the Bugs section instead of References.

[Alex Murray (alexmurray)]

Would it be possible to add the associated required code changes to check-cves or similar? It would be great to review these as well as part of this change.

[Marc Deslauriers (mdeslaur)]

I'm curious why we're adding Debian's DSA and DLA links to our tracker. They have no relation to anything in Ubuntu, and they will be showing up on our web pages...

[Mark Esler (eslerm)]

Alex, I moved check-cves to check_cves.py

Please also see process_cves.py (sorry, I haven't done much for experimental mode _yet_)

I'm in the midst of rework, I'll try to finish a commit soon for review.

[Mark Esler (eslerm)]

Marc, thanks for the feedback. They don't need to be added.

My plan was to exclude all other VDBs (like VulDB, Arch, Fedora, RedHat, SuSe etc)*, but kept Debian since we are based on them. And we have a large number of these links already in the UCT.

I don't mind dropping DSA/DLA additions. We could lint out existing VDB references in UCT.

*We cannot apply this exclusion to GHSAs. It doubles as a first and third party announcement.

[Eduardo Barretto (ebarretto)]

Is this still under development?

review: Needs Information

[Mark Esler (eslerm)]

Yes.

This merge request reflect tooling updates for generating UCT file metadata. Since making this merge, feature requests to lint urls (references, bugs, patches) have caused refactoring that tooling, still WIP.

Afterwards, I will stage `--refresh` updates to UCT. (i.e., My tooling lints whitespace in descriptions slightly differently (better?) and I will make a commit of just refreshing UCT's description. Another commit will include just new launchpad bug references and so on.) The thought is that each update should be isolated in a commit for review.

As it stands, once new tooling is ready I would reset this branch to master and begin layering update commits. If preferred, I could close this merge request and make a new one later.

[Eduardo Barretto (ebarretto)]

Ack, I will move the status of this PR to Work in Progress then

Unmerged commits

6843873... by Mark Esler on 2024-01-10

cve reference refresh: Debian's security-tracker

	unit-tests:0 (build)
	check-cves:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

ec6baa9... by Mark Esler on 2024-01-10

cve reference refresh: add DLAs

07f9377... by Mark Esler on 2024-01-10

cve reference refresh: add DSAs

	unit-tests:0 (build)
	check-cves:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

0dba233... by Mark Esler on 2024-01-10

cve reference refresh: novel launchpad bugs

	unit-tests:0 (build)
	check-cves:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

0fa6a3f... by Mark Esler on 2024-01-09

cve reference refresh: USNs

diff --git a/active/CVE-2002-2439 b/active/CVE-2002-2439
index 8778412..d2bb63b 100644
--- a/active/CVE-2002-2439
+++ b/active/CVE-2002-2439
@@ -2,6 +2,7 @@ Candidate: CVE-2002-2439
 PublicDate: 2019-10-23 18:15:00 UTC
 References: 
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-2439
+ https://security-tracker.debian.org/tracker/CVE-2002-2439
 Description: 
  operator new[] sometimes returns pointers to heap blocks which
  are too small.  When a new array is allocated, the C++ run-time
diff --git a/active/CVE-2008-7315 b/active/CVE-2008-7315
index 5b93b59..d49623d 100644
--- a/active/CVE-2008-7315
+++ b/active/CVE-2008-7315
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-7315
  https://rt.cpan.org/Public/Bug/Display.html?id=107364
  http://www.openwall.com/lists/oss-security/2015/10/08/2
+ https://security-tracker.debian.org/tracker/CVE-2008-7315/
 Description:
  UI-Dialog 1.09 and earlier allows remote attackers to execute arbitrary
  commands.
diff --git a/active/CVE-2009-3603 b/active/CVE-2009-3603
index 6ce1ba9..ce4d3ba 100644
--- a/active/CVE-2009-3603
+++ b/active/CVE-2009-3603
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603
  https://ubuntu.com/security/notices/USN-850-1
  https://ubuntu.com/security/notices/USN-850-3
+ http://www.debian.org/security/2010/dsa-2028
+ http://www.debian.org/security/2010/dsa-2050
 Description:
  Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf 3.x
  before 3.02pl4 and Poppler before 0.12.1 might allow remote attackers to
diff --git a/active/CVE-2009-3604 b/active/CVE-2009-3604
index 098ab76..1581630 100644
--- a/active/CVE-2009-3604
+++ b/active/CVE-2009-3604
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604
  https://ubuntu.com/security/notices/USN-850-1
  https://ubuntu.com/security/notices/USN-850-3
+ http://www.debian.org/security/2010/dsa-2028
+ http://www.debian.org/security/2010/dsa-2050
 Description:
  The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before
  3.02pl4, and Poppler 0.x, as used in GPdf and kdegraphics KPDF, does not
diff --git a/active/CVE-2009-3606 b/active/CVE-2009-3606
index f283745..95a8c45 100644
--- a/active/CVE-2009-3606
+++ b/active/CVE-2009-3606
@@ -4,6 +4,9 @@ PublicDate: 2009-10-21 17:30:00 UTC
 References: 
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606
  https://ubuntu.com/security/notices/USN-973-1
+ http://www.debian.org/security/2009/dsa-1941
+ http://www.debian.org/security/2010/dsa-2028
+ http://www.debian.org/security/2010/dsa-2050
 Description:
  Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf before
  3.02pl4, and Poppler 0.x, as used in kdegraphics KPDF, might allow remote
diff --git a/active/CVE-2009-3608 b/active/CVE-2009-3608
index feb31a1..8fe662d 100644
--- a/active/CVE-2009-3608
+++ b/active/CVE-2009-3608
@@ -6,6 +6,9 @@ References:
  https://ubuntu.com/security/notices/USN-850-1
  https://ubuntu.com/security/notices/USN-850-3
  https://ubuntu.com/security/notices/USN-973-1
+ http://www.debian.org/security/2009/dsa-1941
+ http://www.debian.org/security/2010/dsa-2028
+ http://www.debian.org/security/2010/dsa-2050
 Description:
  Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in
  Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf,
diff --git a/active/CVE-2009-3609 b/active/CVE-2009-3609
index 713b1ef..12bce6c 100644
--- a/active/CVE-2009-3609
+++ b/active/CVE-2009-3609
@@ -6,6 +6,8 @@ References:
  https://ubuntu.com/security/notices/USN-850-1
  https://ubuntu.com/security/notices/USN-850-3
  https://ubuntu.com/security/notices/USN-973-1
+ http://www.debian.org/security/2010/dsa-2028
+ http://www.debian.org/security/2010/dsa-2050
 Description:
  Integer overflow in the ImageStream::ImageStream function in Stream.cc in
  Xpdf before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics
diff --git a/active/CVE-2010-3702 b/active/CVE-2010-3702
index ecec2b3..4483f66 100644
--- a/active/CVE-2010-3702
+++ b/active/CVE-2010-3702
@@ -4,6 +4,8 @@ PublicDate: 2010-11-05 18:00:00 UTC
 References: 
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3702
  https://ubuntu.com/security/notices/USN-1005-1
+ http://www.debian.org/security/2010/dsa-2119
+ http://www.debian.org/security/2010/dsa-2135
 Description:
  The Gfx::getPos function in the PDF parser in xpdf before 3.02pl5, poppler
  0.8.7 and possibly other versions up to 0.15.1, CUPS, kdegraphics, and
diff --git a/active/CVE-2010-3704 b/active/CVE-2010-3704
index 1b314b5..a16e2f4 100644
--- a/active/CVE-2010-3704
+++ b/active/CVE-2010-3704
@@ -4,6 +4,8 @@ PublicDate: 2010-11-05 18:00:00 UTC
 References: 
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3704
  https://ubuntu.com/security/notices/USN-1005-1
+ http://www.debian.org/security/2010/dsa-2119
+ http://www.debian.org/security/2010/dsa-2135
 Description:
  The FoFiType1::parse function in fofi/FoFiType1.cc in the PDF parser in
  xpdf before 3.02pl5, poppler 0.8.7 and possibly other versions up to
diff --git a/active/CVE-2010-4654 b/active/CVE-2010-4654
index 5bc68e7..32fd194 100644
--- a/active/CVE-2010-4654
+++ b/active/CVE-2010-4654
@@ -3,6 +3,7 @@ PublicDate: 2019-11-13 20:15:00 UTC
 References: 
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4654
  http://thread.gmane.org/gmane.comp.security.oss.general/4109
+ https://security-tracker.debian.org/tracker/CVE-2010-4654
 Description:
  poppler before 0.16.3 has malformed commands that may cause corruption of
  the internal stack.
diff --git a/active/CVE-2010-4664 b/active/CVE-2010-4664
index 956973b..27fa5e4 100644
--- a/active/CVE-2010-4664
+++ b/active/CVE-2010-4664
@@ -2,6 +2,7 @@ Candidate: CVE-2010-4664
 PublicDate: 2019-11-13 22:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4664
+ https://security-tracker.debian.org/tracker/CVE-2010-4664
 Description:
  In ConsoleKit before 0.4.2, an intended security policy restriction bypass
  was found. This flaw allows an authenticated system user to escalate their
diff --git a/active/CVE-2011-2896 b/active/CVE-2011-2896
index a736053..f4a2666 100644
--- a/active/CVE-2011-2896
+++ b/active/CVE-2011-2896
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2896
  https://ubuntu.com/security/notices/USN-1207-1
  https://ubuntu.com/security/notices/USN-1214-1
+ http://www.debian.org/security/2011/dsa-2354
+ http://www.debian.org/security/2012/dsa-2426
 Description:
  The LZW decompressor in the LWZReadByte function in giftoppm.c in the David
  Koblas GIF decoder in PBMPLUS, as used in the gif_read_lzw function in
diff --git a/active/CVE-2011-3170 b/active/CVE-2011-3170
index 642aacc..7480f43 100644
--- a/active/CVE-2011-3170
+++ b/active/CVE-2011-3170
@@ -4,6 +4,7 @@ PublicDate: 2011-08-19 17:55:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3170
  https://ubuntu.com/security/notices/USN-1207-1
+ http://www.debian.org/security/2011/dsa-2354
 Description:
  The gif_read_lzw function in filter/image-gif.c in CUPS 1.4.8 and earlier
  does not properly handle the first code word in an LZW stream, which allows
diff --git a/active/CVE-2011-4931 b/active/CVE-2011-4931
index b97cb6b..d5f1aa4 100644
--- a/active/CVE-2011-4931
+++ b/active/CVE-2011-4931
@@ -3,6 +3,7 @@ PublicDate: 2019-10-29 19:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4931
  http://openwall.com/lists/oss-security/2012/01/17/2
+ https://security-tracker.debian.org/tracker/CVE-2011-4931
 Description:
  gpw generates shorter passwords than required
 Ubuntu-Description:
diff --git a/active/CVE-2012-0876 b/active/CVE-2012-0876
index a433258..910a8d9 100644
--- a/active/CVE-2012-0876
+++ b/active/CVE-2012-0876
@@ -10,6 +10,7 @@ References:
  https://ubuntu.com/security/notices/USN-1527-2
  https://ubuntu.com/security/notices/USN-1613-1
  https://ubuntu.com/security/notices/USN-1613-2
+ http://www.debian.org/security/2012/dsa-2525
 Description:
  The XML parser (xmlparse.c) in expat before 2.1.0 computes hash values
  without restricting the ability to trigger hash collisions predictably,
diff --git a/active/CVE-2012-1096 b/active/CVE-2012-1096
index 05c8ed9..4805108 100644
--- a/active/CVE-2012-1096
+++ b/active/CVE-2012-1096
@@ -3,6 +3,7 @@ PublicDate: 2020-03-10 17:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1096
  http://www.openwall.com/lists/oss-security/2012/02/29/2
+ https://security-tracker.debian.org/tracker/CVE-2012-1096
 Description:
  NetworkManager 0.9 and earlier allows local users to use other users'
  certificates or private keys when making a connection via the file path
diff --git a/active/CVE-2012-1148 b/active/CVE-2012-1148
index 1895e9a..8bbdef8 100644
--- a/active/CVE-2012-1148
+++ b/active/CVE-2012-1148
@@ -10,6 +10,7 @@ References:
  https://ubuntu.com/security/notices/USN-1613-1
  https://ubuntu.com/security/notices/USN-1613-2
  https://ubuntu.com/security/notices/USN-5455-1
+ http://www.debian.org/security/2012/dsa-2525
 Description:
  Memory leak in the poolGrow function in expat/lib/xmlparse.c in expat
  before 2.1.0 allows context-dependent attackers to cause a denial of
diff --git a/active/CVE-2012-3363 b/active/CVE-2012-3363
index 6646832..1ae650e 100644
--- a/active/CVE-2012-3363
+++ b/active/CVE-2012-3363
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3363
  http://framework.zend.com/security/advisory/ZF2012-01
  https://www.sec-consult.com/files/20120626-0_zend_framework_xxe_injection.txt
+ http://www.debian.org/security/2012/dsa-2505
 Description:
  Zend_XmlRpc in Zend Framework 1.x before 1.11.12 and 1.12.x before 1.12.0
  does not properly handle SimpleXMLElement classes, which allows remote
diff --git a/active/CVE-2012-5521 b/active/CVE-2012-5521
index bed7c6b..5df77e5 100644
--- a/active/CVE-2012-5521
+++ b/active/CVE-2012-5521
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5521
  http://www.openwall.com/lists/oss-security/2012/11/13/7
  http://www.openwall.com/lists/oss-security/2012/11/13
+ https://security-tracker.debian.org/tracker/CVE-2012-5521
 Description:
  quagga (ospf6d) 0.99.21 has a DoS flaw in the way the ospf6d daemon
  performs routes removal
diff --git a/active/CVE-2012-5630 b/active/CVE-2012-5630
index a8b91f7..467e449 100644
--- a/active/CVE-2012-5630
+++ b/active/CVE-2012-5630
@@ -2,6 +2,7 @@ Candidate: CVE-2012-5630
 PublicDate: 2019-11-25 14:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5630
+ https://security-tracker.debian.org/tracker/CVE-2012-5630
 Description:
  libuser 0.56 and 0.57 has a TOCTOU (time-of-check time-of-use) race
  condition when copying and removing directory trees.
diff --git a/active/CVE-2012-5644 b/active/CVE-2012-5644
index 0ac1b0e..d029eb6 100644
--- a/active/CVE-2012-5644
+++ b/active/CVE-2012-5644
@@ -3,6 +3,7 @@ PublicDate: 2019-11-25 15:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5644
  https://bugzilla.redhat.com/show_bug.cgi?id=928846
+ https://security-tracker.debian.org/tracker/CVE-2012-5644
 Description:
  libuser has information disclosure when moving user's home directory
 Ubuntu-Description:
diff --git a/active/CVE-2012-5657 b/active/CVE-2012-5657
index 093ab07..2bf70f1 100644
--- a/active/CVE-2012-5657
+++ b/active/CVE-2012-5657
@@ -6,6 +6,7 @@ References:
  http://framework.zend.com/security/advisory/ZF2012-05
  https://bugzilla.redhat.com/show_bug.cgi?id=889037
  http://secunia.com/advisories/51583
+ http://www.debian.org/security/2012/dsa-2602
 Description:
  The (1) Zend_Feed_Rss and (2) Zend_Feed_Atom classes in Zend_Feed in Zend
  Framework 1.11.x before 1.11.15 and 1.12.x before 1.12.1 allow remote
diff --git a/active/CVE-2012-6655 b/active/CVE-2012-6655
index f7be29c..b8224a7 100644
--- a/active/CVE-2012-6655
+++ b/active/CVE-2012-6655
@@ -3,6 +3,7 @@ PublicDate: 2019-11-27 18:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6655
  http://openwall.com/lists/oss-security/2014/08/15/5
+ https://security-tracker.debian.org/tracker/CVE-2012-6655
 Description:
  An issue exists AccountService 0.6.37 in the
  user_change_password_authorized_cb() function in user.c which could let a
diff --git a/active/CVE-2012-6702 b/active/CVE-2012-6702
index 34d7d8f..0a2eff4 100644
--- a/active/CVE-2012-6702
+++ b/active/CVE-2012-6702
@@ -6,6 +6,7 @@ References:
  http://seclists.org/oss-sec/2016/q2/468
  https://ubuntu.com/security/notices/USN-3013-1
  https://ubuntu.com/security/notices/USN-3010-1
+ http://www.debian.org/security/2016/dsa-3597
 Description:
  Expat, when used in a parser that has not called XML_SetHashSalt or passed
  it a seed of 0, makes it easier for context-dependent attackers to defeat
diff --git a/active/CVE-2013-1438 b/active/CVE-2013-1438
index 8e13feb..88f73cc 100644
--- a/active/CVE-2013-1438
+++ b/active/CVE-2013-1438
@@ -6,6 +6,7 @@ References:
  http://www.openwall.com/lists/oss-security/2013/08/29/3
  https://ubuntu.com/security/notices/USN-1964-1
  https://ubuntu.com/security/notices/USN-1978-1
+ http://www.debian.org/security/2013/dsa-2748
 Description:
  Unspecified vulnerability in dcraw 0.8.x through 0.8.9, as used in libraw,
  ufraw, shotwell, and other products, allows context-dependent attackers to
diff --git a/active/CVE-2013-1910 b/active/CVE-2013-1910
index bf5feef..096fea7 100644
--- a/active/CVE-2013-1910
+++ b/active/CVE-2013-1910
@@ -5,6 +5,7 @@ References:
  http://yum.baseurl.org/gitweb?p=yum.git;a=commitdiff;h=c148eb10b798270b3d15087433c8efb2a79a69d0
  https://bugzilla.redhat.com/show_bug.cgi?id=910446
  https://access.redhat.com/security/cve/CVE-2013-1910
+ https://security-tracker.debian.org/tracker/CVE-2013-1910
 Description:
  yum does not properly handle bad metadata, which allows an attacker to
  cause a denial of service and possibly have other unspecified impact via a
diff --git a/active/CVE-2013-2024 b/active/CVE-2013-2024
index ecb6f5f..85713fa 100644
--- a/active/CVE-2013-2024
+++ b/active/CVE-2013-2024
@@ -3,6 +3,7 @@ PublicDate: 2019-10-31 20:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2024
  http://lists.nongnu.org/archive/html/chicken-announce/2013-04/msg00000.html
+ https://security-tracker.debian.org/tracker/CVE-2013-2024
 Description:
  OS command injection vulnerability in the "qs" procedure from the "utils"
  module in Chicken before 4.9.0.
diff --git a/active/CVE-2013-4158 b/active/CVE-2013-4158
index bc58056..a1ec8ec 100644
--- a/active/CVE-2013-4158
+++ b/active/CVE-2013-4158
@@ -3,6 +3,7 @@ PublicDate: 2019-12-11 13:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4158
  http://www.openwall.com/lists/oss-security/2013/07/19
+ https://security-tracker.debian.org/tracker/CVE-2013-4158
 Description:
  smokeping before 2.6.9 has XSS (incomplete fix for CVE-2012-0790)
 Ubuntu-Description:
diff --git a/active/CVE-2013-4235 b/active/CVE-2013-4235
index 266cdf7..b620d75 100644
--- a/active/CVE-2013-4235
+++ b/active/CVE-2013-4235
@@ -8,6 +8,7 @@ References:
  https://ubuntu.com/security/notices/USN-5745-1
  https://ubuntu.com/security/notices/USN-5745-2
  https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1998169
+ https://security-tracker.debian.org/tracker/CVE-2013-4235
 Description:
  shadow: TOCTOU (time-of-check time-of-use) race condition when copying and
  removing directory trees
diff --git a/active/CVE-2013-4245 b/active/CVE-2013-4245
index 0e4564b..8e7c936 100644
--- a/active/CVE-2013-4245
+++ b/active/CVE-2013-4245
@@ -2,6 +2,7 @@ Candidate: CVE-2013-4245
 PublicDate: 2019-12-11 14:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4245
+ https://security-tracker.debian.org/tracker/CVE-2013-4245
 Description:
  Orca has arbitrary code execution due to insecure Python module load
 Ubuntu-Description:
diff --git a/active/CVE-2013-4492 b/active/CVE-2013-4492
index 4f8333f..0b44696 100644
--- a/active/CVE-2013-4492
+++ b/active/CVE-2013-4492
@@ -5,6 +5,7 @@ References:
  https://groups.google.com/forum/message/raw?msg=ruby-security-ann/pLrh6DUw998/bLFEyIO4k_EJ
  https://github.com/svenfuchs/i18n/commit/92b57b1e4f84adcdcc3a375278f299274be62445
  http://weblog.rubyonrails.org/2013/12/3/Rails_3_2_16_and_4_0_2_have_been_released/
+ http://www.debian.org/security/2013/dsa-2830
 Description:
  Cross-site scripting (XSS) vulnerability in exceptions.rb in the i18n gem
  before 0.6.6 for Ruby allows remote attackers to inject arbitrary web
diff --git a/active/CVE-2013-4584 b/active/CVE-2013-4584
index fdddab4..2e3c591 100644
--- a/active/CVE-2013-4584
+++ b/active/CVE-2013-4584
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4584
  http://www.openwall.com/lists/oss-security/2013/11/13/2
  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729028
+ https://security-tracker.debian.org/tracker/CVE-2013-4584
 Description:
  Perdition before 2.2 may have weak security when handling outbound
  connections, caused by an error in the STARTTLS IMAP and POP server.
diff --git a/active/CVE-2013-6364 b/active/CVE-2013-6364
index c16c3bb..91ce288 100644
--- a/active/CVE-2013-6364
+++ b/active/CVE-2013-6364
@@ -2,6 +2,7 @@ Candidate: CVE-2013-6364
 PublicDate: 2019-11-05 14:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6364
+ https://security-tracker.debian.org/tracker/CVE-2013-6364
 Description:
  Horde Groupware Webmail Edition has CSRF and XSS when saving search as a
  virtual address book
diff --git a/active/CVE-2013-6365 b/active/CVE-2013-6365
index 5fc927d..7c672a1 100644
--- a/active/CVE-2013-6365
+++ b/active/CVE-2013-6365
@@ -2,6 +2,7 @@ Candidate: CVE-2013-6365
 PublicDate: 2019-11-05 14:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6365
+ https://security-tracker.debian.org/tracker/CVE-2013-6365
 Description:
  Horde Groupware Web mail 5.1.2 has CSRF with requests to change permissions
 Ubuntu-Description:
diff --git a/active/CVE-2013-7370 b/active/CVE-2013-7370
index ed0d77e..dc0aefe 100644
--- a/active/CVE-2013-7370
+++ b/active/CVE-2013-7370
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7370
  https://nodesecurity.io/advisories/methodOverride_Middleware_Reflected_Cross-Site_Scripting
  https://github.com/senchalabs/connect/issues/831
+ https://security-tracker.debian.org/tracker/CVE-2013-7370
 Description:
  node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware
 Ubuntu-Description:
diff --git a/active/CVE-2013-7402 b/active/CVE-2013-7402
index e941d6e..9b33dd2 100644
--- a/active/CVE-2013-7402
+++ b/active/CVE-2013-7402
@@ -3,6 +3,7 @@ PublicDate: 2014-12-17 19:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7402
  http://www.openwall.com/lists/oss-security/2014/09/15
+ http://www.debian.org/security/2014/dsa-3101
 Description:
  Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow
  remote attackers to cause a denial of service (crash) via a crafted ICAP
diff --git a/active/CVE-2013-7484 b/active/CVE-2013-7484
index bea3c3f..7499bb1 100644
--- a/active/CVE-2013-7484
+++ b/active/CVE-2013-7484
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-7484
  https://support.zabbix.com/browse/ZBX-16551
  https://support.zabbix.com/browse/ZBXNEXT-1898
+ https://lists.debian.org/debian-lts-announce/2023/08/msg00027.html
 Description:
  Zabbix before 5.0 represents passwords in the users table with unsalted
  MD5.
diff --git a/active/CVE-2014-0083 b/active/CVE-2014-0083
index 45d7c51..60cf5d6 100644
--- a/active/CVE-2014-0083
+++ b/active/CVE-2014-0083
@@ -3,6 +3,7 @@ PublicDate: 2019-11-21 14:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0083
  https://github.com/ruby-ldap/ruby-net-ldap/blob/master/lib/net/ldap/password.rb
+ https://security-tracker.debian.org/tracker/CVE-2014-0083
 Description:
  The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA
  passwords.
diff --git a/active/CVE-2014-0175 b/active/CVE-2014-0175
index 4f572f7..aae90ff 100644
--- a/active/CVE-2014-0175
+++ b/active/CVE-2014-0175
@@ -2,6 +2,7 @@ Candidate: CVE-2014-0175
 PublicDate: 2019-12-13 13:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0175
+ https://security-tracker.debian.org/tracker/CVE-2014-0175
 Description:
  mcollective has a default password set at install
 Ubuntu-Description:
diff --git a/active/CVE-2014-0212 b/active/CVE-2014-0212
index e480f34..e2f9671 100644
--- a/active/CVE-2014-0212
+++ b/active/CVE-2014-0212
@@ -2,6 +2,7 @@ Candidate: CVE-2014-0212
 PublicDate: 2019-12-13 13:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0212
+ https://security-tracker.debian.org/tracker/CVE-2014-0212
 Description:
  qpid-cpp: ACL policies only loaded if the acl-file option specified
  enabling DoS by consuming all available file descriptors
diff --git a/active/CVE-2014-0459 b/active/CVE-2014-0459
index 72137b6..542151c 100644
--- a/active/CVE-2014-0459
+++ b/active/CVE-2014-0459
@@ -6,6 +6,7 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpuapr2014-1972952.html
  https://ubuntu.com/security/notices/USN-2187-1
  https://ubuntu.com/security/notices/USN-2191-1
+ http://www.debian.org/security/2014/dsa-2912
 Description:
  Unspecified vulnerability in Oracle Java SE 7u51 and 8, and Java SE
  Embedded 7u51, allows remote attackers to affect availability via unknown
diff --git a/active/CVE-2014-10073 b/active/CVE-2014-10073
index 562336e..0f0c4c6 100644
--- a/active/CVE-2014-10073
+++ b/active/CVE-2014-10073
@@ -6,6 +6,7 @@ References:
  http://git.wpitchoune.net/gitweb/?p=psensor.git;a=blob;f=NEWS
  http://git.wpitchoune.net/gitweb/?p=psensor.git;a=commit;h=48739caa745f9f8002e87af574f03e5dc6ae3447
  http://git.wpitchoune.net/gitweb/?p=psensor.git;a=commit;h=8b10426dcc0246c1712a99460dd470dcb1cc4d9c
+ https://lists.debian.org/debian-lts-announce/2018/04/msg00026.html
 Description:
  The create_response function in server/server.c in Psensor before 1.1.4
  allows Directory Traversal because it lacks a check for whether a file is
diff --git a/active/CVE-2014-10077 b/active/CVE-2014-10077
index e5b3e39..e71ff23 100644
--- a/active/CVE-2014-10077
+++ b/active/CVE-2014-10077
@@ -5,6 +5,7 @@ References:
  https://github.com/rubysec/ruby-advisory-db/pull/182/files
  https://github.com/svenfuchs/i18n/pull/289
  https://github.com/svenfuchs/i18n/releases/tag/v0.8.0
+ https://lists.debian.org/debian-lts-announce/2018/11/msg00021.html
 Description:
  Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for
  Ruby allows remote attackers to cause a denial of service (application
diff --git a/active/CVE-2014-10402 b/active/CVE-2014-10402
index c2c827a..dbcf0ad 100644
--- a/active/CVE-2014-10402
+++ b/active/CVE-2014-10402
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-10402
  https://ubuntu.com/security/notices/USN-5030-1
  https://ubuntu.com/security/notices/USN-5030-2
+ https://lists.debian.org/debian-lts-announce/2022/05/msg00046.html
 Description:
  An issue was discovered in the DBI module through 1.643 for Perl. DBD::File
  drivers can open files from folders other than those specifically passed
diff --git a/active/CVE-2014-1935 b/active/CVE-2014-1935
index 20b05ce..30f9324 100644
--- a/active/CVE-2014-1935
+++ b/active/CVE-2014-1935
@@ -2,6 +2,7 @@ Candidate: CVE-2014-1935
 PublicDate: 2019-11-21 15:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1935
+ https://security-tracker.debian.org/tracker/CVE-2014-1935
 Description:
  9base 1:6-6 and 1:6-7 insecurely creates temporary files which results in
  predictable filenames.
diff --git a/active/CVE-2014-2983 b/active/CVE-2014-2983
index 2b3b115..f4a26da 100644
--- a/active/CVE-2014-2983
+++ b/active/CVE-2014-2983
@@ -3,6 +3,8 @@ PublicDate: 2014-04-23 15:55:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2983
  https://drupal.org/SA-CORE-2014-002
+ http://www.debian.org/security/2014/dsa-2913
+ http://www.debian.org/security/2014/dsa-2914
 Description:
  Drupal 6.x before 6.31 and 7.x before 7.27 does not properly isolate the
  cached data of different anonymous users, which allows remote anonymous
diff --git a/active/CVE-2014-3495 b/active/CVE-2014-3495
index 7bfa03a..d9c5087 100644
--- a/active/CVE-2014-3495
+++ b/active/CVE-2014-3495
@@ -2,6 +2,7 @@ Candidate: CVE-2014-3495
 PublicDate: 2019-12-13 14:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3495
+ https://security-tracker.debian.org/tracker/CVE-2014-3495
 Description:
  duplicity 0.6.24 has improper verification of SSL certificates
 Ubuntu-Description:
diff --git a/active/CVE-2014-3566 b/active/CVE-2014-3566
index b2216d4..1996195 100644
--- a/active/CVE-2014-3566
+++ b/active/CVE-2014-3566
@@ -11,6 +11,11 @@ References:
  http://askubuntu.com/a/537196
  https://ubuntu.com/security/notices/USN-2486-1
  https://ubuntu.com/security/notices/USN-2487-1
+ http://www.debian.org/security/2014/dsa-3053
+ http://www.debian.org/security/2015/dsa-3144
+ http://www.debian.org/security/2015/dsa-3147
+ http://www.debian.org/security/2015/dsa-3253
+ http://www.debian.org/security/2016/dsa-3489
 Description:
  The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products,
  uses nondeterministic CBC padding, which makes it easier for
diff --git a/active/CVE-2014-5265 b/active/CVE-2014-5265
index 1875b65..34fb0bf 100644
--- a/active/CVE-2014-5265
+++ b/active/CVE-2014-5265
@@ -7,6 +7,8 @@ References:
  https://wordpress.org/news/2014/08/wordpress-3-9-2/
  https://core.trac.wordpress.org/changeset/29404
  http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830
+ http://www.debian.org/security/2014/dsa-2999
+ http://www.debian.org/security/2014/dsa-3001
 Description:
  The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and
  Drupal 6.x before 6.33 and 7.x before 7.31, permits entity declarations
diff --git a/active/CVE-2014-5266 b/active/CVE-2014-5266
index 3b43624..8302ba4 100644
--- a/active/CVE-2014-5266
+++ b/active/CVE-2014-5266
@@ -8,6 +8,8 @@ References:
  https://core.trac.wordpress.org/changeset/29404
  http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830
  http://cgit.drupalcode.org/drupal/diff/includes/xmlrpc.inc?id=1849830
+ http://www.debian.org/security/2014/dsa-2999
+ http://www.debian.org/security/2014/dsa-3001
 Description:
  The Incutio XML-RPC (IXR) Library, as used in WordPress before 3.9.2 and
  Drupal 6.x before 6.33 and 7.x before 7.31, does not limit the number of
diff --git a/active/CVE-2014-5267 b/active/CVE-2014-5267
index ee0578e..0ae8c3f 100644
--- a/active/CVE-2014-5267
+++ b/active/CVE-2014-5267
@@ -2,6 +2,7 @@ Candidate: CVE-2014-5267
 PublicDate: 2014-09-30 14:55:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5267
+ http://www.debian.org/security/2014/dsa-2999
 Description:
  modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31
  allows remote attackers to have unspecified impact via a crafted DOCTYPE
diff --git a/active/CVE-2014-6053 b/active/CVE-2014-6053
index c12bd8c..f0d3145 100644
--- a/active/CVE-2014-6053
+++ b/active/CVE-2014-6053
@@ -9,6 +9,10 @@ References:
  https://ubuntu.com/security/notices/USN-2365-1
  https://ubuntu.com/security/notices/USN-4573-1
  https://ubuntu.com/security/notices/USN-4587-1
+ http://www.debian.org/security/2014/dsa-3081
+ https://lists.debian.org/debian-lts-announce/2019/10/msg00042.html
+ https://lists.debian.org/debian-lts-announce/2019/11/msg00032.html
+ https://lists.debian.org/debian-lts-announce/2019/12/msg00028.html
 Description:
  The rfbProcessClientNormalMessage function in libvncserver/rfbserver.c in
  LibVNCServer 0.9.9 and earlier does not properly handle attempts to send a
diff --git a/active/CVE-2014-6262 b/active/CVE-2014-6262
index f32cc4a..d5d320d 100644
--- a/active/CVE-2014-6262
+++ b/active/CVE-2014-6262
@@ -5,6 +5,8 @@ References:
  https://github.com/oetiker/rrdtool-1.x/pull/532
  https://github.com/oetiker/rrdtool-1.x/commit/64ed5314af1255ab6dded45f70b39cdeab5ae2ec (v1.5.0-rc1)
  https://github.com/oetiker/rrdtool-1.x/commit/85261a013112e278c90224033f5b0592ee387786 (v1.4.9)
+ https://lists.debian.org/debian-lts-announce/2020/03/msg00000.html
+ https://lists.debian.org/debian-lts-announce/2020/03/msg00003.html
 Description:
  Multiple format string vulnerabilities in the python module in RRDtool, as
  used in Zenoss Core before 4.2.5 and other products, allow remote attackers
diff --git a/active/CVE-2014-6311 b/active/CVE-2014-6311
index acd14c2..5bf00c3 100644
--- a/active/CVE-2014-6311
+++ b/active/CVE-2014-6311
@@ -2,6 +2,7 @@ Candidate: CVE-2014-6311
 PublicDate: 2019-11-22 19:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6311
+ https://security-tracker.debian.org/tracker/CVE-2014-6311
 Description:
  generate_doygen.pl in ace before 6.2.7+dfsg-2 creates predictable file
  names in the /tmp directory which allows attackers to gain elevated
diff --git a/active/CVE-2014-8088 b/active/CVE-2014-8088
index b1c7228..d64baed 100644
--- a/active/CVE-2014-8088
+++ b/active/CVE-2014-8088
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8088
  http://framework.zend.com/security/advisory/ZF2014-05
  http://www.openwall.com/lists/oss-security/2014/10/10
+ http://www.debian.org/security/2015/dsa-3265
 Description:
  The (1) Zend_Ldap class in Zend before 1.12.9 and (2) Zend\Ldap component
  in Zend 2.x before 2.2.8 and 2.3.x before 2.3.3 allows remote attackers to
diff --git a/active/CVE-2014-8958 b/active/CVE-2014-8958
index 9682d73..b113b61 100644
--- a/active/CVE-2014-8958
+++ b/active/CVE-2014-8958
@@ -3,6 +3,7 @@ PublicDate: 2014-11-30 11:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8958
  http://www.phpmyadmin.net/home_page/security/PMASA-2014-13.php
+ http://www.debian.org/security/2015/dsa-3382
 Description:
  Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x
  before 4.0.10.6, 4.1.x before 4.1.14.7, and 4.2.x before 4.2.12 allow
diff --git a/active/CVE-2014-9015 b/active/CVE-2014-9015
index faa2069..ea26b88 100644
--- a/active/CVE-2014-9015
+++ b/active/CVE-2014-9015
@@ -3,6 +3,7 @@ PublicDate: 2014-11-24 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9015
  https://www.drupal.org/SA-CORE-2014-006
+ http://www.debian.org/security/2014/dsa-3075
 Description:
  Drupal 6.x before 6.34 and 7.x before 7.34 allows remote attackers to
  hijack sessions via a crafted request, as demonstrated by a crafted request
diff --git a/active/CVE-2014-9016 b/active/CVE-2014-9016
index 3d31406..1a7db9f 100644
--- a/active/CVE-2014-9016
+++ b/active/CVE-2014-9016
@@ -3,6 +3,7 @@ PublicDate: 2014-11-24 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9016
  https://www.drupal.org/SA-CORE-2014-006
+ http://www.debian.org/security/2014/dsa-3075
 Description:
  The password hashing API in Drupal 7.x before 7.34 and the Secure Password
  Hashes (aka phpass) module 6.x-2.x before 6.x-2.1 for Drupal allows remote
diff --git a/active/CVE-2014-9767 b/active/CVE-2014-9767
index 56e2d04..2b8d284 100644
--- a/active/CVE-2014-9767
+++ b/active/CVE-2014-9767
@@ -4,6 +4,7 @@ PublicDate: 2016-05-22 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9767
  https://ubuntu.com/security/notices/USN-2952-1
+ https://ubuntu.com/security/notices/USN-2952-2
 Description:
  Directory traversal vulnerability in the ZipArchive::extractTo function in
  ext/zip/php_zip.c in PHP before 5.4.45, 5.5.x before 5.5.29, and 5.6.x
diff --git a/active/CVE-2015-0255 b/active/CVE-2015-0255
index 42ed742..ae8bd29 100644
--- a/active/CVE-2015-0255
+++ b/active/CVE-2015-0255
@@ -6,6 +6,7 @@ References:
  http://www.openwall.com/lists/oss-security/2015/02/10/18
  https://ubuntu.com/security/notices/USN-2500-1
  https://ubuntu.com/security/notices/USN-4772-1
+ http://www.debian.org/security/2015/dsa-3160
 Description:
  X.Org Server (aka xserver and xorg-server) before 1.16.3 and 1.17.x before
  1.17.1 allows remote attackers to obtain sensitive information from process
diff --git a/active/CVE-2015-1273 b/active/CVE-2015-1273
index d2cfd14..a608ab8 100644
--- a/active/CVE-2015-1273
+++ b/active/CVE-2015-1273
@@ -3,6 +3,7 @@ PublicDate: 2015-07-23 00:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1273
  http://googlechromereleases.blogspot.com/2015/07/stable-channel-update_21.html
+ http://www.debian.org/security/2015/dsa-3315
 Description:
  Heap-based buffer overflow in j2k.c in OpenJPEG before r3002, as used in
  PDFium in Google Chrome before 44.0.2403.89, allows remote attackers to
diff --git a/active/CVE-2015-1283 b/active/CVE-2015-1283
index e806414..4303fe5 100644
--- a/active/CVE-2015-1283
+++ b/active/CVE-2015-1283
@@ -9,6 +9,8 @@ References:
  https://ubuntu.com/security/notices/USN-3013-1
  https://ubuntu.com/security/notices/USN-5455-1
  https://ubuntu.com/security/notices/USN-4772-1
+ http://www.debian.org/security/2015/dsa-3315
+ http://www.debian.org/security/2015/dsa-3318
 Description:
  Multiple integer overflows in the XML_GetBuffer function in Expat through
  2.1.0, as used in Google Chrome before 44.0.2403.89 and other products,
diff --git a/active/CVE-2015-1872 b/active/CVE-2015-1872
index 69a6121..611ec62 100644
--- a/active/CVE-2015-1872
+++ b/active/CVE-2015-1872
@@ -4,6 +4,7 @@ PublicDate: 2015-07-26 22:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1872
  https://ubuntu.com/security/notices/USN-2944-1
+ https://lists.debian.org/debian-lts-announce/2019/03/msg00041.html
 Description:
  The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before
  2.5.4 does not validate the number of components in a JPEG-LS Start Of
diff --git a/active/CVE-2015-20107 b/active/CVE-2015-20107
index 7b9ebea..8d138e5 100644
--- a/active/CVE-2015-20107
+++ b/active/CVE-2015-20107
@@ -8,6 +8,8 @@ References:
  https://github.com/python/cpython/pull/91993
  https://ubuntu.com/security/notices/USN-5519-1
  https://ubuntu.com/security/notices/USN-5888-1
+ https://lists.debian.org/debian-lts-announce/2023/05/msg00024.html
+ https://lists.debian.org/debian-lts-announce/2023/06/msg00039.html
 Description:
  In Python (aka CPython) up to 3.10.8, the mailcap module does not add
  escape characters into commands discovered in the system mailcap file. This
diff --git a/active/CVE-2015-2206 b/active/CVE-2015-2206
index f3265ba..a773320 100644
--- a/active/CVE-2015-2206
+++ b/active/CVE-2015-2206
@@ -3,6 +3,7 @@ PublicDate: 2015-03-09 17:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2206
  http://www.phpmyadmin.net/home_page/security/PMASA-2015-1.php
+ http://www.debian.org/security/2015/dsa-3382
 Description:
  libraries/select_lang.lib.php in phpMyAdmin 4.0.x before 4.0.10.9, 4.2.x
  before 4.2.13.2, and 4.3.x before 4.3.11.1 includes invalid language values
diff --git a/active/CVE-2015-2305 b/active/CVE-2015-2305
index ad9847e..1dc8db5 100644
--- a/active/CVE-2015-2305
+++ b/active/CVE-2015-2305
@@ -7,6 +7,7 @@ References:
  https://guidovranken.wordpress.com/2015/02/04/full-disclosure-heap-overflow-in-h-spencers-regex-library-on-32-bit-systems/
  https://ubuntu.com/security/notices/USN-2572-1
  https://ubuntu.com/security/notices/USN-2594-1
+ http://www.debian.org/security/2015/dsa-3195
 Description:
  Integer overflow in the regcomp implementation in the Henry Spencer BSD
  regex library (aka rxspencer) alpha3.8.g5 on 32-bit platforms, as used in
diff --git a/active/CVE-2015-2575 b/active/CVE-2015-2575
index 161e2cf..00a7778 100644
--- a/active/CVE-2015-2575
+++ b/active/CVE-2015-2575
@@ -3,6 +3,7 @@ PublicDate: 2015-04-16 17:00:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2575
  http://www.oracle.com/technetwork/topics/security/cpuapr2015-2365600.html
+ http://www.debian.org/security/2016/dsa-3621
 Description:
  Unspecified vulnerability in the MySQL Connectors component in Oracle MySQL
  5.1.34 and earlier allows remote authenticated users to affect
diff --git a/active/CVE-2015-2582 b/active/CVE-2015-2582
index d90d855..ff842a4 100644
--- a/active/CVE-2015-2582
+++ b/active/CVE-2015-2582
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2582
  http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
  https://ubuntu.com/security/notices/USN-2674-1
+ http://www.debian.org/security/2015/dsa-3308
+ http://www.debian.org/security/2015/dsa-3311
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and
  5.6.24 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-2620 b/active/CVE-2015-2620
index 6b5fc47..104bf64 100644
--- a/active/CVE-2015-2620
+++ b/active/CVE-2015-2620
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2620
  http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
  https://ubuntu.com/security/notices/USN-2674-1
+ http://www.debian.org/security/2015/dsa-3308
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and
  5.6.23 and earlier allows remote authenticated users to affect
diff --git a/active/CVE-2015-2643 b/active/CVE-2015-2643
index 2e93e8d..7e67db0 100644
--- a/active/CVE-2015-2643
+++ b/active/CVE-2015-2643
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2643
  http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
  https://ubuntu.com/security/notices/USN-2674-1
+ http://www.debian.org/security/2015/dsa-3308
+ http://www.debian.org/security/2015/dsa-3311
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and
  5.6.24 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-2648 b/active/CVE-2015-2648
index decd6f8..91c9c90 100644
--- a/active/CVE-2015-2648
+++ b/active/CVE-2015-2648
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2648
  http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
  https://ubuntu.com/security/notices/USN-2674-1
+ http://www.debian.org/security/2015/dsa-3308
+ http://www.debian.org/security/2015/dsa-3311
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and
  5.6.24 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-3008 b/active/CVE-2015-3008
index ce3f5e9..5ab445f 100644
--- a/active/CVE-2015-3008
+++ b/active/CVE-2015-3008
@@ -7,6 +7,7 @@ References:
  http://www.securitytracker.com/id/1032052
  http://seclists.org/fulldisclosure/2015/Apr/22
  http://packetstormsecurity.com/files/131364/Asterisk-Project-Security-Advisory-AST-2015-003.html
+ http://www.debian.org/security/2016/dsa-3700
 Description:
  Asterisk Open Source 1.8 before 1.8.32.3, 11.x before 11.17.1, 12.x before
  12.8.2, and 13.x before 13.3.2 and Certified Asterisk 1.8.28 before
diff --git a/active/CVE-2015-3152 b/active/CVE-2015-3152
index 2e77dbb..1c6c160 100644
--- a/active/CVE-2015-3152
+++ b/active/CVE-2015-3152
@@ -5,6 +5,7 @@ References:
  http://www.ocert.org/advisories/ocert-2015-003.html
  http://dev.mysql.com/doc/relnotes/mysql/5.7/en/news-5-7-3.html
  http://mysqlblog.fivefarmers.com/2015/04/29/ssltls-in-5-6-and-5-5-ocert-advisory/
+ http://www.debian.org/security/2015/dsa-3311
 Description:
  Oracle MySQL before 5.7.3, Oracle MySQL Connector/C (aka libmysqlclient)
  before 6.1.3, and MariaDB before 5.5.44 use the --ssl option to mean that
diff --git a/active/CVE-2015-3156 b/active/CVE-2015-3156
index 07349db..ff6dc04 100644
--- a/active/CVE-2015-3156
+++ b/active/CVE-2015-3156
@@ -3,6 +3,7 @@ PublicDate: 2017-08-11 21:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3156
  https://bugzilla.redhat.com/show_bug.cgi?id=1216073#c1
+ https://bugs.launchpad.net/trove/+bug/1398195
 Description:
  The _write_config function in
  trove/guestagent/datastore/experimental/mongodb/service.py,
diff --git a/active/CVE-2015-3231 b/active/CVE-2015-3231
index a5dee80..6dc5976 100644
--- a/active/CVE-2015-3231
+++ b/active/CVE-2015-3231
@@ -3,6 +3,7 @@ PublicDate: 2015-06-22 19:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3231
  https://www.drupal.org/SA-CORE-2015-002
+ http://www.debian.org/security/2015/dsa-3291
 Description:
  The Render cache system in Drupal 7.x before 7.38, when used to cache
  content by user role, allows remote authenticated users to obtain private
diff --git a/active/CVE-2015-3232 b/active/CVE-2015-3232
index 722fc98..0922221 100644
--- a/active/CVE-2015-3232
+++ b/active/CVE-2015-3232
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3232
  https://www.drupal.org/SA-CORE-2015-002
  https://www.drupal.org/node/2507753 (drupal6-mod-cck)
+ http://www.debian.org/security/2015/dsa-3291
 Description:
  Open redirect vulnerability in the Field UI module in Drupal 7.x before
  7.38 allows remote attackers to redirect users to arbitrary web sites and
diff --git a/active/CVE-2015-3233 b/active/CVE-2015-3233
index d85da7f..7e21684 100644
--- a/active/CVE-2015-3233
+++ b/active/CVE-2015-3233
@@ -3,6 +3,7 @@ PublicDate: 2015-06-22 19:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3233
  https://www.drupal.org/SA-CORE-2015-002
+ http://www.debian.org/security/2015/dsa-3291
 Description:
  Open redirect vulnerability in the Overlay module in Drupal 7.x before 7.38
  allows remote attackers to redirect users to arbitrary web sites and
diff --git a/active/CVE-2015-3234 b/active/CVE-2015-3234
index 220d9d9..d9ac612 100644
--- a/active/CVE-2015-3234
+++ b/active/CVE-2015-3234
@@ -3,6 +3,7 @@ PublicDate: 2015-06-22 19:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3234
  https://www.drupal.org/SA-CORE-2015-002
+ http://www.debian.org/security/2015/dsa-3291
 Description:
  The OpenID module in Drupal 6.x before 6.36 and 7.x before 7.38 allows
  remote attackers to log into other users' accounts by leveraging an OpenID
diff --git a/active/CVE-2015-3416 b/active/CVE-2015-3416
index 0e339a2..2ab0cc5 100644
--- a/active/CVE-2015-3416
+++ b/active/CVE-2015-3416
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3416
  http://seclists.org/fulldisclosure/2015/Apr/31
  https://ubuntu.com/security/notices/USN-2698-1
+ http://www.debian.org/security/2015/dsa-3252
 Description:
  The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not
  properly handle precision and width values during floating-point
diff --git a/active/CVE-2015-3902 b/active/CVE-2015-3902
index e59ae93..304abad 100644
--- a/active/CVE-2015-3902
+++ b/active/CVE-2015-3902
@@ -2,6 +2,7 @@ Candidate: CVE-2015-3902
 PublicDate: 2015-05-26 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3902
+ http://www.debian.org/security/2015/dsa-3382
 Description:
  Multiple cross-site request forgery (CSRF) vulnerabilities in the setup
  process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x
diff --git a/active/CVE-2015-3903 b/active/CVE-2015-3903
index 668195e..2d903ab 100644
--- a/active/CVE-2015-3903
+++ b/active/CVE-2015-3903
@@ -2,6 +2,7 @@ Candidate: CVE-2015-3903
 PublicDate: 2015-05-26 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3903
+ http://www.debian.org/security/2015/dsa-3382
 Description:
  libraries/Config.class.php in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x
  before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 disables
diff --git a/active/CVE-2015-3908 b/active/CVE-2015-3908
index 6110f23..a45f558 100644
--- a/active/CVE-2015-3908
+++ b/active/CVE-2015-3908
@@ -3,6 +3,7 @@ PublicDate: 2015-08-12 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3908
  http://www.openwall.com/lists/oss-security/2015/07/14/4
+ https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html
 Description:
  Ansible before 1.9.2 does not verify that the server hostname matches a
  domain name in the subject's Common Name (CN) or subjectAltName field of
diff --git a/active/CVE-2015-4737 b/active/CVE-2015-4737
index 2013ef3..8c5f21e 100644
--- a/active/CVE-2015-4737
+++ b/active/CVE-2015-4737
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4737
  http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
  https://ubuntu.com/security/notices/USN-2674-1
+ http://www.debian.org/security/2015/dsa-3308
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier, and
  5.6.23 and earlier, allows remote authenticated users to affect
diff --git a/active/CVE-2015-4752 b/active/CVE-2015-4752
index 0f9c4d2..62389bd 100644
--- a/active/CVE-2015-4752
+++ b/active/CVE-2015-4752
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4752
  http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
  https://ubuntu.com/security/notices/USN-2674-1
+ http://www.debian.org/security/2015/dsa-3308
+ http://www.debian.org/security/2015/dsa-3311
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.43 and earlier and
  5.6.24 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-4757 b/active/CVE-2015-4757
index fb6e92b..59d9d2a 100644
--- a/active/CVE-2015-4757
+++ b/active/CVE-2015-4757
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4757
  http://www.oracle.com/technetwork/topics/security/cpujul2015-2367936.html
  https://ubuntu.com/security/notices/USN-2674-1
+ http://www.debian.org/security/2015/dsa-3311
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.42 and earlier and
  5.6.23 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-4792 b/active/CVE-2015-4792
index 37fbfde..e5e85b2 100644
--- a/active/CVE-2015-4792
+++ b/active/CVE-2015-4792
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4792
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and
  5.6.26 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-4802 b/active/CVE-2015-4802
index e9832b5..6822bdc 100644
--- a/active/CVE-2015-4802
+++ b/active/CVE-2015-4802
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4802
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and
  5.6.26 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-4815 b/active/CVE-2015-4815
index 7acb34e..c4a3228 100644
--- a/active/CVE-2015-4815
+++ b/active/CVE-2015-4815
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4815
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and
  5.6.26 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-4816 b/active/CVE-2015-4816
index 0e1ccc7..2b3f513 100644
--- a/active/CVE-2015-4816
+++ b/active/CVE-2015-4816
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4816
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier allows
  remote authenticated users to affect availability via unknown vectors
diff --git a/active/CVE-2015-4819 b/active/CVE-2015-4819
index f9938fd..a4a6693 100644
--- a/active/CVE-2015-4819
+++ b/active/CVE-2015-4819
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4819
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and
  5.6.25 and earlier, allows local users to affect confidentiality,
diff --git a/active/CVE-2015-4826 b/active/CVE-2015-4826
index 148d5e9..7698ef8 100644
--- a/active/CVE-2015-4826
+++ b/active/CVE-2015-4826
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4826
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and
  5.6.26 and earlier allows remote authenticated users to affect
diff --git a/active/CVE-2015-4830 b/active/CVE-2015-4830
index ca7ebad..66c56c3 100644
--- a/active/CVE-2015-4830
+++ b/active/CVE-2015-4830
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4830
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and
  5.6.26 and earlier allows remote authenticated users to affect integrity
diff --git a/active/CVE-2015-4836 b/active/CVE-2015-4836
index ff36c04..4803291 100644
--- a/active/CVE-2015-4836
+++ b/active/CVE-2015-4836
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4836
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and
  5.6.26 and earlier, allows remote authenticated users to affect
diff --git a/active/CVE-2015-4858 b/active/CVE-2015-4858
index 1960832..dbce4d9 100644
--- a/active/CVE-2015-4858
+++ b/active/CVE-2015-4858
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4858
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and
  5.6.26 and earlier, allows remote authenticated users to affect
diff --git a/active/CVE-2015-4861 b/active/CVE-2015-4861
index 37f803a..8229f1b 100644
--- a/active/CVE-2015-4861
+++ b/active/CVE-2015-4861
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4861
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and
  5.6.26 and earlier, allows remote authenticated users to affect
diff --git a/active/CVE-2015-4870 b/active/CVE-2015-4870
index 8cff532..a449809 100644
--- a/active/CVE-2015-4870
+++ b/active/CVE-2015-4870
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4870
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier, and
  5.6.26 and earlier, allows remote authenticated users to affect
diff --git a/active/CVE-2015-4879 b/active/CVE-2015-4879
index 87976e3..8f60117 100644
--- a/active/CVE-2015-4879
+++ b/active/CVE-2015-4879
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4879
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.44 and earlier, and
  5.6.25 and earlier, allows remote authenticated users to affect
diff --git a/active/CVE-2015-4895 b/active/CVE-2015-4895
index 83506d6..d45cf30 100644
--- a/active/CVE-2015-4895
+++ b/active/CVE-2015-4895
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4895
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.6.25 and earlier allows
  remote authenticated users to affect availability via unknown vectors
diff --git a/active/CVE-2015-4913 b/active/CVE-2015-4913
index 80516b0..3d1525a 100644
--- a/active/CVE-2015-4913
+++ b/active/CVE-2015-4913
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4913
  http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-2781-1
+ http://www.debian.org/security/2015/dsa-3377
+ http://www.debian.org/security/2015/dsa-3385
 Description:
  Unspecified vulnerability in Oracle MySQL Server 5.5.45 and earlier and
  5.6.26 and earlier allows remote authenticated users to affect availability
diff --git a/active/CVE-2015-5303 b/active/CVE-2015-5303
index 0a97a26..393f7f5 100644
--- a/active/CVE-2015-5303
+++ b/active/CVE-2015-5303
@@ -2,6 +2,7 @@ Candidate: CVE-2015-5303
 PublicDate: 2016-04-11 21:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5303
+ https://bugs.launchpad.net/tripleo/+bug/1516027
 Description:
  The TripleO Heat templates (tripleo-heat-templates), when deployed via the
  commandline interface, allow remote attackers to spoof OpenStack Networking
diff --git a/active/CVE-2015-5395 b/active/CVE-2015-5395
index c4915cb..3cc4ac0 100644
--- a/active/CVE-2015-5395
+++ b/active/CVE-2015-5395
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5395
  http://www.openwall.com/lists/oss-security/2015/07/07/10
  http://www.sogo.nu/bugs/view.php?id=3246
+ https://security-tracker.debian.org/tracker/CVE-2015-5395/
 Description:
  Cross-site request forgery (CSRF) vulnerability in SOGo before 3.1.0.
 Ubuntu-Description:
diff --git a/active/CVE-2015-6240 b/active/CVE-2015-6240
index bcce327..4a68c41 100644
--- a/active/CVE-2015-6240
+++ b/active/CVE-2015-6240
@@ -3,6 +3,7 @@ PublicDate: 2017-06-07 20:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6240
  http://www.openwall.com/lists/oss-security/2015/07/14/3
+ https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html
 Description:
  The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow
  local users to escape a restricted environment via a symlink attack.
diff --git a/active/CVE-2015-6644 b/active/CVE-2015-6644
index cf82014..fdac8c1 100644
--- a/active/CVE-2015-6644
+++ b/active/CVE-2015-6644
@@ -4,6 +4,7 @@ PublicDate: 2016-01-06 19:59:00 UTC
 References: 
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6644
  https://ubuntu.com/security/notices/USN-3727-1
+ http://www.debian.org/security/2017/dsa-3829
 Description:
  Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01
  allows attackers to obtain sensitive information via a crafted application,
diff --git a/active/CVE-2015-6658 b/active/CVE-2015-6658
index 569ea49..cdb705f 100644
--- a/active/CVE-2015-6658
+++ b/active/CVE-2015-6658
@@ -3,6 +3,7 @@ PublicDate: 2015-08-24 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6658
  https://www.drupal.org/SA-CORE-2015-003
+ http://www.debian.org/security/2015/dsa-3346
 Description:
  Cross-site scripting (XSS) vulnerability in the Autocomplete system in
  Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to
diff --git a/active/CVE-2015-6659 b/active/CVE-2015-6659
index 447068a..c54e940 100644
--- a/active/CVE-2015-6659
+++ b/active/CVE-2015-6659
@@ -3,6 +3,7 @@ PublicDate: 2015-08-24 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6659
  https://www.drupal.org/SA-CORE-2015-003
+ http://www.debian.org/security/2015/dsa-3346
 Description:
  SQL injection vulnerability in the SQL comment filtering system in the
  Database API in Drupal 7.x before 7.39 allows remote attackers to execute
diff --git a/active/CVE-2015-6660 b/active/CVE-2015-6660
index ef3a003..ce1ba76 100644
--- a/active/CVE-2015-6660
+++ b/active/CVE-2015-6660
@@ -3,6 +3,7 @@ PublicDate: 2015-08-24 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6660
  https://www.drupal.org/SA-CORE-2015-003
+ http://www.debian.org/security/2015/dsa-3346
 Description:
  The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not
  properly validate the form token, which allows remote attackers to conduct
diff --git a/active/CVE-2015-6661 b/active/CVE-2015-6661
index 9747628..4bba3db 100644
--- a/active/CVE-2015-6661
+++ b/active/CVE-2015-6661
@@ -3,6 +3,7 @@ PublicDate: 2015-08-24 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6661
  https://www.drupal.org/SA-CORE-2015-003
+ http://www.debian.org/security/2015/dsa-3346
 Description:
  Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to
  obtain sensitive node titles by reading the menu.
diff --git a/active/CVE-2015-6665 b/active/CVE-2015-6665
index fdefb1e..62d4f92 100644
--- a/active/CVE-2015-6665
+++ b/active/CVE-2015-6665
@@ -5,6 +5,7 @@ References:
  https://www.drupal.org/SA-CORE-2015-003
  https://www.drupal.org/node/2554145
  https://www.drupal.org/node/2554133
+ http://www.debian.org/security/2015/dsa-3346
 Description:
  Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x
  before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows
diff --git a/active/CVE-2015-7695 b/active/CVE-2015-7695
index 49c2eec..14a9bec 100644
--- a/active/CVE-2015-7695
+++ b/active/CVE-2015-7695
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7695
  http://framework.zend.com/security/advisory/ZF2015-08
  https://github.com/zendframework/zf1/commit/2ac9c30f73ec2e6235c602bed745749a551b4fe2
+ http://www.debian.org/security/2015/dsa-3369
 Description:
  The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes
  in SQL statements, which allows remote attackers to execute arbitrary SQL
diff --git a/active/CVE-2015-7810 b/active/CVE-2015-7810
index e1bc3c2..5455d86 100644
--- a/active/CVE-2015-7810
+++ b/active/CVE-2015-7810
@@ -3,6 +3,7 @@ PublicDate: 2019-11-22 15:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7810
  http://www.openwall.com/lists/oss-security/2015/10/12
+ https://security-tracker.debian.org/tracker/CVE-2015-7810
 Description:
  libbluray MountManager class has a time-of-check time-of-use (TOCTOU) race
  when expanding JAR files
diff --git a/active/CVE-2015-7827 b/active/CVE-2015-7827
index 2477ddf..8621f8f 100644
--- a/active/CVE-2015-7827
+++ b/active/CVE-2015-7827
@@ -3,6 +3,7 @@ PublicDate: 2016-05-13 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7827
  http://botan.randombit.net/security.html
+ http://www.debian.org/security/2016/dsa-3565
 Description:
  Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote
  attackers to conduct million-message attacks by measuring time differences,
diff --git a/active/CVE-2015-7943 b/active/CVE-2015-7943
index 0d570f3..eb31db2 100644
--- a/active/CVE-2015-7943
+++ b/active/CVE-2015-7943
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7943
  https://www.drupal.org/SA-CORE-2015-004
  http://www.openwall.com/lists/oss-security/2015/10/21/6
+ http://www.debian.org/security/2017/dsa-3897
 Description:
  Open redirect vulnerability in the Overlay module in Drupal 7.x before
  7.41, the jQuery Update module 7.x-2.x before 7.x-2.7 for Drupal, and the
diff --git a/active/CVE-2015-8312 b/active/CVE-2015-8312
index 7d8713e..9ef7173 100644
--- a/active/CVE-2015-8312
+++ b/active/CVE-2015-8312
@@ -3,6 +3,7 @@ PublicDate: 2016-05-13 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8312
  https://www.openafs.org/dl/1.6.16/RELNOTES-1.6.16
+ http://www.debian.org/security/2016/dsa-3569
 Description:
  Off-by-one error in afs_pioctl.c in OpenAFS before 1.6.16 might allow local
  users to cause a denial of service (memory overwrite and system crash) via
diff --git a/active/CVE-2015-8466 b/active/CVE-2015-8466
index b548587..7084fbe 100644
--- a/active/CVE-2015-8466
+++ b/active/CVE-2015-8466
@@ -6,6 +6,7 @@ References:
  https://github.com/openstack/swift3/blob/master/CHANGELOG
  https://bugs.launchpad.net/swift3/+bug/1497424
  http://lists.fedoraproject.org/pipermail/package-announce/2015-December/174374.html
+ http://www.debian.org/security/2016/dsa-3583
 Description:
  Swift3 before 1.9 allows remote attackers to conduct replay attacks via an
  Authorization request that lacks a Date header.
diff --git a/active/CVE-2015-8553 b/active/CVE-2015-8553
index c80707c..a561e3a 100644
--- a/active/CVE-2015-8553
+++ b/active/CVE-2015-8553
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8553
  http://xenbits.xen.org/xsa/advisory-120.html
  http://thread.gmane.org/gmane.linux.kernel/1924087/focus=1930758 (regression mention)
+ https://www.debian.org/security/2019/dsa-4497
 Description:
  Xen allows guest OS users to obtain sensitive information from
  uninitialized locations in host OS kernel memory by not enabling memory and
diff --git a/active/CVE-2015-8614 b/active/CVE-2015-8614
index cedd244..87ac51f 100644
--- a/active/CVE-2015-8614
+++ b/active/CVE-2015-8614
@@ -7,6 +7,7 @@ References:
  http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3557
  http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3584
  https://bugs.gentoo.org/show_bug.cgi?id=569010
+ http://www.debian.org/security/2016/dsa-3452
 Description:
  Multiple stack-based buffer overflows in the (1) conv_jistoeuc, (2)
  conv_euctojis, and (3) conv_sjistoeuc functions in codeconv.c in Claws Mail
diff --git a/active/CVE-2015-8697 b/active/CVE-2015-8697
index 145c54c..d72400a 100644
--- a/active/CVE-2015-8697
+++ b/active/CVE-2015-8697
@@ -3,6 +3,7 @@ PublicDate: 2017-06-27 20:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8697
  http://www.openwall.com/lists/oss-security/2015/12/27/1
+ https://security-tracker.debian.org/tracker/CVE-2015-8697/
 Description:
  stalin 0.11-5 allows local users to write to arbitrary files.
 Ubuntu-Description:
diff --git a/active/CVE-2016-0505 b/active/CVE-2016-0505
index a492326..842ad41 100644
--- a/active/CVE-2016-0505
+++ b/active/CVE-2016-0505
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and
  earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and
diff --git a/active/CVE-2016-0546 b/active/CVE-2016-0546
index d15da1f..3a724d3 100644
--- a/active/CVE-2016-0546
+++ b/active/CVE-2016-0546
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and
  earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and
diff --git a/active/CVE-2016-0596 b/active/CVE-2016-0596
index 187b6a0..f84b9a0 100644
--- a/active/CVE-2016-0596
+++ b/active/CVE-2016-0596
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and 5.6.27 and
  earlier and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before
diff --git a/active/CVE-2016-0597 b/active/CVE-2016-0597
index 6d2ffa4..d9c4022 100644
--- a/active/CVE-2016-0597
+++ b/active/CVE-2016-0597
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and
  earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and
diff --git a/active/CVE-2016-0598 b/active/CVE-2016-0598
index ddcb4bb..d662a50 100644
--- a/active/CVE-2016-0598
+++ b/active/CVE-2016-0598
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and
  earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and
diff --git a/active/CVE-2016-0600 b/active/CVE-2016-0600
index a754610..f156acd 100644
--- a/active/CVE-2016-0600
+++ b/active/CVE-2016-0600
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and
  earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and
diff --git a/active/CVE-2016-0606 b/active/CVE-2016-0606
index 5ed6a80..b42d95a 100644
--- a/active/CVE-2016-0606
+++ b/active/CVE-2016-0606
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and
  earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and
diff --git a/active/CVE-2016-0608 b/active/CVE-2016-0608
index a4b8ca5..9b50f70 100644
--- a/active/CVE-2016-0608
+++ b/active/CVE-2016-0608
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and
  earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and
diff --git a/active/CVE-2016-0609 b/active/CVE-2016-0609
index 092b722..664004a 100644
--- a/active/CVE-2016-0609
+++ b/active/CVE-2016-0609
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and
  earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and
diff --git a/active/CVE-2016-0616 b/active/CVE-2016-0616
index e04bb33..c746b54 100644
--- a/active/CVE-2016-0616
+++ b/active/CVE-2016-0616
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html#AppendixMSQL
  http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
  https://ubuntu.com/security/notices/USN-2881-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3459
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier and MariaDB
  before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows
diff --git a/active/CVE-2016-0640 b/active/CVE-2016-0640
index 507b951..77cd664 100644
--- a/active/CVE-2016-0640
+++ b/active/CVE-2016-0640
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0640
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before
diff --git a/active/CVE-2016-0641 b/active/CVE-2016-0641
index d2c99e0..9b15c78 100644
--- a/active/CVE-2016-0641
+++ b/active/CVE-2016-0641
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0641
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before
diff --git a/active/CVE-2016-0642 b/active/CVE-2016-0642
index 91323ea..5da57c0 100644
--- a/active/CVE-2016-0642
+++ b/active/CVE-2016-0642
@@ -6,6 +6,7 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
  https://ubuntu.com/security/notices/USN-2954-1
+ http://www.debian.org/security/2016/dsa-3557
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier allows local users to affect integrity and
diff --git a/active/CVE-2016-0643 b/active/CVE-2016-0643
index 5254a98..e91f803 100644
--- a/active/CVE-2016-0643
+++ b/active/CVE-2016-0643
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
  https://ubuntu.com/security/notices/USN-2954-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before
diff --git a/active/CVE-2016-0644 b/active/CVE-2016-0644
index db75839..1cd8478 100644
--- a/active/CVE-2016-0644
+++ b/active/CVE-2016-0644
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0644
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before
diff --git a/active/CVE-2016-0646 b/active/CVE-2016-0646
index ad58fe7..4e3bf66 100644
--- a/active/CVE-2016-0646
+++ b/active/CVE-2016-0646
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0646
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before
diff --git a/active/CVE-2016-0647 b/active/CVE-2016-0647
index f7a6967..c2c7f58 100644
--- a/active/CVE-2016-0647
+++ b/active/CVE-2016-0647
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
  https://ubuntu.com/security/notices/USN-2954-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before
diff --git a/active/CVE-2016-0648 b/active/CVE-2016-0648
index 9d4e527..128fe7f 100644
--- a/active/CVE-2016-0648
+++ b/active/CVE-2016-0648
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
  https://ubuntu.com/security/notices/USN-2954-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before
diff --git a/active/CVE-2016-0649 b/active/CVE-2016-0649
index 5f68f32..2ca3ce2 100644
--- a/active/CVE-2016-0649
+++ b/active/CVE-2016-0649
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0649
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before
diff --git a/active/CVE-2016-0650 b/active/CVE-2016-0650
index 8c2e540..b7ebf24 100644
--- a/active/CVE-2016-0650
+++ b/active/CVE-2016-0650
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0650
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and
  earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before
diff --git a/active/CVE-2016-0655 b/active/CVE-2016-0655
index c5caa3e..d0db46b 100644
--- a/active/CVE-2016-0655
+++ b/active/CVE-2016-0655
@@ -6,6 +6,7 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
  https://ubuntu.com/security/notices/USN-2954-1
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and
  earlier and MariaDB 10.0.x before 10.0.25 and 10.1.x before 10.1.14 allows
diff --git a/active/CVE-2016-0666 b/active/CVE-2016-0666
index 508beee..292664b 100644
--- a/active/CVE-2016-0666
+++ b/active/CVE-2016-0666
@@ -6,6 +6,8 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
  https://ubuntu.com/security/notices/USN-2954-1
+ http://www.debian.org/security/2016/dsa-3557
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and
  earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before
diff --git a/active/CVE-2016-0668 b/active/CVE-2016-0668
index 72af003..c9be3b0 100644
--- a/active/CVE-2016-0668
+++ b/active/CVE-2016-0668
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0668
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
+ http://www.debian.org/security/2016/dsa-3595
 Description:
  Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and
  earlier and MariaDB 10.0.x before 10.0.24 and 10.1.x before 10.1.12 allows
diff --git a/active/CVE-2016-0718 b/active/CVE-2016-0718
index f83c2c7..cb751a0 100644
--- a/active/CVE-2016-0718
+++ b/active/CVE-2016-0718
@@ -8,6 +8,7 @@ References:
  https://ubuntu.com/security/notices/USN-3013-1
  https://ubuntu.com/security/notices/USN-3044-1
  https://ubuntu.com/security/notices/USN-5455-1
+ http://www.debian.org/security/2016/dsa-3582
 Description:
  Expat allows context-dependent attackers to cause a denial of service
  (crash) or possibly execute arbitrary code via a malformed input document,
diff --git a/active/CVE-2016-1000002 b/active/CVE-2016-1000002
index 3e5ef02..0a2416f 100644
--- a/active/CVE-2016-1000002
+++ b/active/CVE-2016-1000002
@@ -2,6 +2,7 @@ Candidate: CVE-2016-1000002
 PublicDate: 2019-11-05 14:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000002
+ https://security-tracker.debian.org/tracker/CVE-2016-1000002
 Description:
  gdm3 3.14.2 and possibly later has an information leak before screen lock
 Ubuntu-Description:
diff --git a/active/CVE-2016-1000006 b/active/CVE-2016-1000006
index 41eae17..732e706 100644
--- a/active/CVE-2016-1000006
+++ b/active/CVE-2016-1000006
@@ -3,6 +3,7 @@ PublicDate: 2019-11-19 15:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000006
  https://qa.debian.org/cgi-bin/vcswatch?package=hhvm
+ https://security-tracker.debian.org/tracker/CVE-2016-1000006
 Description:
  hhvm before 3.12.11 has a use-after-free in the serialize_memoize_param()
  and ResourceBundle::__construct() functions.
diff --git a/active/CVE-2016-1000027 b/active/CVE-2016-1000027
index a5329e8..47fb6db 100644
--- a/active/CVE-2016-1000027
+++ b/active/CVE-2016-1000027
@@ -3,6 +3,7 @@ PublicDate: 2020-01-02 23:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000027
  https://www.tenable.com/security/research/tra-2016-20
+ https://security-tracker.debian.org/tracker/CVE-2016-1000027
 Description:
  Pivotal Spring Framework through 5.3.16 suffers from a potential remote
  code execution (RCE) issue if used for Java deserialization of untrusted
diff --git a/active/CVE-2016-1000108 b/active/CVE-2016-1000108
index d38ff81..9c4a128 100644
--- a/active/CVE-2016-1000108
+++ b/active/CVE-2016-1000108
@@ -3,6 +3,7 @@ PublicDate: 2019-12-10 15:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000108
  https://marc.info/?l=oss-security&m=146885145004975&w=2
+ https://security-tracker.debian.org/tracker/CVE-2016-1000108
 Description:
  yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18
  namespace conflicts and therefore does not protect CGI applications from
diff --git a/active/CVE-2016-1000236 b/active/CVE-2016-1000236
index 302ee77..9763037 100644
--- a/active/CVE-2016-1000236
+++ b/active/CVE-2016-1000236
@@ -3,6 +3,7 @@ PublicDate: 2019-11-19 17:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000236
  https://nodesecurity.io/advisories/134
+ https://security-tracker.debian.org/tracker/CVE-2016-1000236
 Description:
  Node-cookie-signature before 1.0.6 is affected by a timing attack due to
  the type of comparison used.
diff --git a/active/CVE-2016-1000338 b/active/CVE-2016-1000338
index 2e85d85..548dbc3 100644
--- a/active/CVE-2016-1000338
+++ b/active/CVE-2016-1000338
@@ -4,6 +4,7 @@ PublicDate: 2018-06-01 20:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000338
  https://ubuntu.com/security/notices/USN-3727-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
 Description:
  In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not
  fully validate ASN.1 encoding of signature on verification. It is possible
diff --git a/active/CVE-2016-1000339 b/active/CVE-2016-1000339
index c8a06af..44454a4 100644
--- a/active/CVE-2016-1000339
+++ b/active/CVE-2016-1000339
@@ -4,6 +4,7 @@ PublicDate: 2018-06-04 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000339
  https://ubuntu.com/security/notices/USN-3727-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
 Description:
  In the Bouncy Castle JCE Provider version 1.55 and earlier the primary
  engine class used for AES was AESFastEngine. Due to the highly table driven
diff --git a/active/CVE-2016-1000341 b/active/CVE-2016-1000341
index de50b51..7802e90 100644
--- a/active/CVE-2016-1000341
+++ b/active/CVE-2016-1000341
@@ -4,6 +4,7 @@ PublicDate: 2018-06-04 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000341
  https://ubuntu.com/security/notices/USN-3727-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
 Description:
  In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature
  generation is vulnerable to timing attack. Where timings can be closely
diff --git a/active/CVE-2016-1000342 b/active/CVE-2016-1000342
index 9d9a602..548ec8a 100644
--- a/active/CVE-2016-1000342
+++ b/active/CVE-2016-1000342
@@ -4,6 +4,7 @@ PublicDate: 2018-06-04 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000342
  https://ubuntu.com/security/notices/USN-3727-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
 Description:
  In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not
  fully validate ASN.1 encoding of signature on verification. It is possible
diff --git a/active/CVE-2016-1000343 b/active/CVE-2016-1000343
index a4e0b82..3d6c5e0 100644
--- a/active/CVE-2016-1000343
+++ b/active/CVE-2016-1000343
@@ -4,6 +4,7 @@ PublicDate: 2018-06-04 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000343
  https://ubuntu.com/security/notices/USN-3727-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
 Description:
  In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair
  generator generates a weak private key if used with default values. If the
diff --git a/active/CVE-2016-1000345 b/active/CVE-2016-1000345
index 550165d..53f98b4 100644
--- a/active/CVE-2016-1000345
+++ b/active/CVE-2016-1000345
@@ -4,6 +4,7 @@ PublicDate: 2018-06-04 21:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000345
  https://ubuntu.com/security/notices/USN-3727-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
 Description:
  In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES
  CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an
diff --git a/active/CVE-2016-1000346 b/active/CVE-2016-1000346
index 28f26cf..a7b93f0 100644
--- a/active/CVE-2016-1000346
+++ b/active/CVE-2016-1000346
@@ -4,6 +4,7 @@ PublicDate: 2018-06-04 21:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000346
  https://ubuntu.com/security/notices/USN-3727-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00009.html
 Description:
  In the Bouncy Castle JCE Provider version 1.55 and earlier the other party
  DH public key is not fully validated. This can cause issues as invalid keys
diff --git a/active/CVE-2016-10026 b/active/CVE-2016-10026
index d07946f..48dac96 100644
--- a/active/CVE-2016-10026
+++ b/active/CVE-2016-10026
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10026
  http://ikiwiki.info/bugs/rcs_revert_can_bypass_authorization_if_affected_files_were_renamed/
  http://www.openwall.com/lists/oss-security/2016/12/20/7
+ http://www.debian.org/security/2017/dsa-3760
 Description:
  ikiwiki 3.20161219 does not properly check if a revision changes the access
  permissions for a page on sites with the git and recentchanges plugins and
diff --git a/active/CVE-2016-10074 b/active/CVE-2016-10074
index c7b141c..5db2d80 100644
--- a/active/CVE-2016-10074
+++ b/active/CVE-2016-10074
@@ -7,6 +7,7 @@ References:
  http://seclists.org/fulldisclosure/2016/Dec/86
  https://github.com/swiftmailer/swiftmailer/blob/5.x/CHANGES
  https://www.exploit-db.com/exploits/40972/
+ http://www.debian.org/security/2017/dsa-3769
 Description:
  The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer
  before 5.4.5 might allow remote attackers to pass extra parameters to the
diff --git a/active/CVE-2016-10187 b/active/CVE-2016-10187
index 86ced9f..45ef885 100644
--- a/active/CVE-2016-10187
+++ b/active/CVE-2016-10187
@@ -3,6 +3,7 @@ PublicDate: 2017-03-16 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10187
  http://www.openwall.com/lists/oss-security/2017/01/29/8
+ https://bugs.launchpad.net/calibre/+bug/1651728
 Description:
  The E-book viewer in calibre before 2.75 allows remote attackers to read
  arbitrary files via a crafted epub file with JavaScript.
diff --git a/active/CVE-2016-10188 b/active/CVE-2016-10188
index 3afda96..2a01a2c 100644
--- a/active/CVE-2016-10188
+++ b/active/CVE-2016-10188
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10188
  https://bugs.bitlbee.org/ticket/1281
  http://www.openwall.com/lists/oss-security/2017/01/30/4
+ http://www.debian.org/security/2017/dsa-3853
 Description:
  Use-after-free vulnerability in bitlbee-libpurple before 3.5 allows remote
  servers to cause a denial of service (crash) or possibly execute arbitrary
diff --git a/active/CVE-2016-10189 b/active/CVE-2016-10189
index 329ab15..3050e47 100644
--- a/active/CVE-2016-10189
+++ b/active/CVE-2016-10189
@@ -5,6 +5,7 @@ References:
  https://bugs.bitlbee.org/ticket/1282
  http://www.openwall.com/lists/oss-security/2017/01/30/4
  https://github.com/bitlbee/bitlbee/commit/30d598ce7cd3f136ee9d7097f39fa9818a272441
+ http://www.debian.org/security/2017/dsa-3853
 Description:
  BitlBee before 3.5 allows remote attackers to cause a denial of service
  (NULL pointer dereference and crash) and possibly execute arbitrary code
diff --git a/active/CVE-2016-10228 b/active/CVE-2016-10228
index b63baeb..9e5aef2 100644
--- a/active/CVE-2016-10228
+++ b/active/CVE-2016-10228
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10228
  https://ubuntu.com/security/notices/USN-5310-1
  https://ubuntu.com/security/notices/USN-5768-1
+ https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html
 Description:
  The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and
  earlier, when invoked with multiple suffixes in the destination encoding
diff --git a/active/CVE-2016-10245 b/active/CVE-2016-10245
index cbf2576..050cb43 100644
--- a/active/CVE-2016-10245
+++ b/active/CVE-2016-10245
@@ -6,6 +6,7 @@ References:
  http://www.stack.nl/~dimitri/doxygen/manual/changelog.html#log_1_8_12
  https://bugzilla.gnome.org/show_bug.cgi?id=762934
  https://ubuntu.com/security/notices/USN-4002-1
+ https://lists.debian.org/debian-lts-announce/2019/05/msg00046.html
 Description:
  Insufficient sanitization of the query parameter in
  templates/html/search_opensearch.php could lead to reflected cross-site
diff --git a/active/CVE-2016-10375 b/active/CVE-2016-10375
index 2649f61..a21dcdb 100644
--- a/active/CVE-2016-10375
+++ b/active/CVE-2016-10375
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10375
  https://github.com/fbb-git/yodl/issues/1
  https://github.com/fbb-git/yodl/commit/fd85f8c94182558ff1480d06a236d6fb927979a3
+ https://lists.debian.org/debian-lts-announce/2020/04/msg00026.html
 Description:
  Yodl before 3.07.01 has a Buffer Over-read in the queue_push function in
  queue/queuepush.c.
diff --git a/active/CVE-2016-10376 b/active/CVE-2016-10376
index 5c03525..2266bd7 100644
--- a/active/CVE-2016-10376
+++ b/active/CVE-2016-10376
@@ -6,6 +6,7 @@ References:
  https://dev.gajim.org/gajim/gajim/issues/8378
  https://bugs.debian.org/863445
  https://mail.jabber.org/pipermail/standards/2016-August/031335.html
+ http://www.debian.org/security/2017/dsa-3943
 Description:
  Gajim through 0.16.7 unconditionally implements the "XEP-0146: Remote
  Controlling Clients" extension. This can be abused by malicious XMPP
diff --git a/active/CVE-2016-10728 b/active/CVE-2016-10728
index 57915ea..7296971 100644
--- a/active/CVE-2016-10728
+++ b/active/CVE-2016-10728
@@ -5,6 +5,7 @@ References:
  https://github.com/kirillwow/ids_bypass
  https://redmine.openinfosecfoundation.org/issues/1880
  https://suricata-ids.org/2016/09/07/suricata-3-1-2-released/
+ https://lists.debian.org/debian-lts-announce/2018/09/msg00019.html
 Description:
  An issue was discovered in Suricata before 3.1.2. If an ICMPv4 error packet
  is received as the first packet on a flow in the to_client direction, it
diff --git a/active/CVE-2016-10746 b/active/CVE-2016-10746
index df690c2..c56f7ab 100644
--- a/active/CVE-2016-10746
+++ b/active/CVE-2016-10746
@@ -2,6 +2,7 @@ Candidate: CVE-2016-10746
 PublicDate: 2019-04-18 16:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10746
+ https://lists.debian.org/debian-lts-announce/2019/04/msg00032.html
 Description:
  libvirt-domain.c in libvirt before 1.3.1 supports virDomainGetTime API
  calls by guest agents with an RO connection, even though an RW connection
diff --git a/active/CVE-2016-10894 b/active/CVE-2016-10894
index 8dafd59..109de3f 100644
--- a/active/CVE-2016-10894
+++ b/active/CVE-2016-10894
@@ -3,6 +3,7 @@ PublicDate: 2019-08-16 03:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10894
  https://bugs.debian.org/830726
+ https://lists.debian.org/debian-lts-announce/2019/10/msg00019.html
 Description:
  xtrlock through 2.10 does not block multitouch events. Consequently, an
  attacker at a locked screen can send input to (and thus control) various
diff --git a/active/CVE-2016-10937 b/active/CVE-2016-10937
index 5034cc3..51da531 100644
--- a/active/CVE-2016-10937
+++ b/active/CVE-2016-10937
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10937
  https://github.com/lefcha/imapfilter/issues/142
  https://bugs.debian.org/939702
+ https://lists.debian.org/debian-lts-announce/2019/10/msg00040.html
 Description:
  IMAPFilter through 2.6.12 does not validate the hostname in an SSL
  certificate.
diff --git a/active/CVE-2016-1235 b/active/CVE-2016-1235
index 89df829..96cbd66 100644
--- a/active/CVE-2016-1235
+++ b/active/CVE-2016-1235
@@ -3,6 +3,7 @@ PublicDate: 2016-04-11 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1235
  https://raw.githubusercontent.com/oar-team/oar/ce77ffed620fdce94881c9b35064507777c24a1c/debian/patches/004-fix-oarsh-security-issue
+ http://www.debian.org/security/2016/dsa-3543
 Description:
  The oarsh script in OAR before 2.5.7 allows remote authenticated users of a
  cluster to obtain sensitive information and possibly gain privileges via
diff --git a/active/CVE-2016-1241 b/active/CVE-2016-1241
index ebb6e8d..d501367 100644
--- a/active/CVE-2016-1241
+++ b/active/CVE-2016-1241
@@ -2,6 +2,7 @@ Candidate: CVE-2016-1241
 PublicDate: 2016-09-07 19:28:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1241
+ http://www.debian.org/security/2016/dsa-3656
 Description:
  Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x
  before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to
diff --git a/active/CVE-2016-1242 b/active/CVE-2016-1242
index 523c1d9..03b35f8 100644
--- a/active/CVE-2016-1242
+++ b/active/CVE-2016-1242
@@ -2,6 +2,7 @@ Candidate: CVE-2016-1242
 PublicDate: 2016-09-07 19:28:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1242
+ http://www.debian.org/security/2016/dsa-3656
 Description:
  file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before
  3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote
diff --git a/active/CVE-2016-1927 b/active/CVE-2016-1927
index e3dcc02..e388d07 100644
--- a/active/CVE-2016-1927
+++ b/active/CVE-2016-1927
@@ -3,6 +3,7 @@ PublicDate: 2016-02-20 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1927
  https://www.phpmyadmin.net/security/PMASA-2016-4/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  The suggestPassword function in js/functions.js in phpMyAdmin 4.0.x before
  4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 relies on the
diff --git a/active/CVE-2016-2039 b/active/CVE-2016-2039
index 2fc17bb..cab6f60 100644
--- a/active/CVE-2016-2039
+++ b/active/CVE-2016-2039
@@ -3,6 +3,7 @@ PublicDate: 2016-02-20 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2039
  https://www.phpmyadmin.net/security/PMASA-2016-2/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x
  before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF
diff --git a/active/CVE-2016-2040 b/active/CVE-2016-2040
index f021ea2..50e5d03 100644
--- a/active/CVE-2016-2040
+++ b/active/CVE-2016-2040
@@ -3,6 +3,7 @@ PublicDate: 2016-02-20 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2040
  https://www.phpmyadmin.net/security/PMASA-2016-3/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x
  before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 allow
diff --git a/active/CVE-2016-2041 b/active/CVE-2016-2041
index c82a1cd..43923f0 100644
--- a/active/CVE-2016-2041
+++ b/active/CVE-2016-2041
@@ -3,6 +3,7 @@ PublicDate: 2016-02-20 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2041
  https://www.phpmyadmin.net/security/PMASA-2016-5/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  libraries/common.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before
  4.4.15.3, and 4.5.x before 4.5.4 does not use a constant-time algorithm for
diff --git a/active/CVE-2016-2047 b/active/CVE-2016-2047
index f303938..8b08687 100644
--- a/active/CVE-2016-2047
+++ b/active/CVE-2016-2047
@@ -9,6 +9,8 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
  https://ubuntu.com/security/notices/USN-2953-1
  https://ubuntu.com/security/notices/USN-2954-1
+ http://www.debian.org/security/2016/dsa-3453
+ http://www.debian.org/security/2016/dsa-3557
 Description:
  The ssl_verify_server_cert function in sql-common/client.c in MariaDB
  before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10; Oracle
diff --git a/active/CVE-2016-2120 b/active/CVE-2016-2120
index 805ca3c..775cf9c 100644
--- a/active/CVE-2016-2120
+++ b/active/CVE-2016-2120
@@ -3,6 +3,7 @@ PublicDate: 2018-11-01 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2120
  https://doc.powerdns.com/md/security/powerdns-advisory-2016-05/
+ https://www.debian.org/security/2017/dsa-3764
 Description:
  An issue has been found in PowerDNS Authoritative Server versions up to and
  including 3.4.10, 4.0.1 allowing an authorized user to crash the server by
diff --git a/active/CVE-2016-2124 b/active/CVE-2016-2124
index 3dd6bb8..180175a 100644
--- a/active/CVE-2016-2124
+++ b/active/CVE-2016-2124
@@ -8,6 +8,7 @@ References:
  https://www.samba.org/samba/history/samba-4.13.14.html
  https://ubuntu.com/security/notices/USN-5142-1
  https://ubuntu.com/security/notices/USN-5174-1
+ https://lists.debian.org/debian-lts-announce/2023/09/msg00013.html
 Description:
  A flaw was found in the way samba implemented SMB1 authentication. An
  attacker could use this flaw to retrieve the plaintext password sent over
diff --git a/active/CVE-2016-2175 b/active/CVE-2016-2175
index 0a259b9..afd95e1 100644
--- a/active/CVE-2016-2175
+++ b/active/CVE-2016-2175
@@ -3,6 +3,7 @@ PublicDate: 2016-06-01 20:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2175
  http://seclists.org/oss-sec/2016/q2/419
+ http://www.debian.org/security/2016/dsa-3606
 Description:
  Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly
  initialize the XML parsers, which allows context-dependent attackers to
diff --git a/active/CVE-2016-2232 b/active/CVE-2016-2232
index e553a02..93d022d 100644
--- a/active/CVE-2016-2232
+++ b/active/CVE-2016-2232
@@ -3,6 +3,7 @@ PublicDate: 2016-02-22 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2232
  http://downloads.asterisk.org/pub/security/AST-2016-003.html
+ http://www.debian.org/security/2016/dsa-3700
 Description:
  Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x before
  13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and 13.1
diff --git a/active/CVE-2016-2316 b/active/CVE-2016-2316
index 8ba9a43..52212f9 100644
--- a/active/CVE-2016-2316
+++ b/active/CVE-2016-2316
@@ -3,6 +3,7 @@ PublicDate: 2016-02-22 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2316
  http://downloads.asterisk.org/pub/security/AST-2016-002.html
+ http://www.debian.org/security/2016/dsa-3700
 Description:
  chan_sip in Asterisk Open Source 1.8.x, 11.x before 11.21.1, 12.x, and 13.x
  before 13.7.1 and Certified Asterisk 1.8.28, 11.6 before 11.6-cert12, and
diff --git a/active/CVE-2016-2347 b/active/CVE-2016-2347
index 2817c1c..f25b46e 100644
--- a/active/CVE-2016-2347
+++ b/active/CVE-2016-2347
@@ -3,6 +3,7 @@ PublicDate: 2017-04-21 20:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2347
  http://www.talosintel.com/reports/TALOS-2016-0095/
+ http://www.debian.org/security/2016/dsa-3540
 Description:
  Integer underflow in the decode_level3_header function in
  lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to
diff --git a/active/CVE-2016-2385 b/active/CVE-2016-2385
index 1a6b634..87b7555 100644
--- a/active/CVE-2016-2385
+++ b/active/CVE-2016-2385
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2385
  https://github.com/kamailio/kamailio/commit/f50c9c853e7809810099c970780c30b0765b0643
  http://www.openwall.com/lists/oss-security/2016/02/15/4
+ http://www.debian.org/security/2016/dsa-3535
+ http://www.debian.org/security/2016/dsa-3537
 Description:
  Heap-based buffer overflow in the encode_msg function in encode_msg.c in
  the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows
diff --git a/active/CVE-2016-2560 b/active/CVE-2016-2560
index b630bda..67c9b9f 100644
--- a/active/CVE-2016-2560
+++ b/active/CVE-2016-2560
@@ -8,6 +8,7 @@ References:
  https://github.com/phpmyadmin/phpmyadmin/commit/7877a9c0084bf8ae15cbd8d2729b126271f682cc
  https://github.com/phpmyadmin/phpmyadmin/commit/41c4e0214c286f28830cca54423b5db57e7c0ce4
  https://github.com/phpmyadmin/phpmyadmin/commit/38fa1191049ac0c626a6684eea52068dfbbb5078
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x
  before 4.0.10.15, 4.4.x before 4.4.15.5, and 4.5.x before 4.5.5.1 allow
diff --git a/active/CVE-2016-2561 b/active/CVE-2016-2561
index 8399687..2a3671a 100644
--- a/active/CVE-2016-2561
+++ b/active/CVE-2016-2561
@@ -9,6 +9,7 @@ References:
  https://github.com/phpmyadmin/phpmyadmin/commit/983faa94f161df3623ecd371d3696a1b3f91c15f
  https://github.com/phpmyadmin/phpmyadmin/commit/746240bd13b62b5956fc34389cfbdc09e1e67775
  https://github.com/phpmyadmin/phpmyadmin/commit/37c34d089aa19f30d11203bb0c7f85b486424372
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x
  before 4.4.15.5 and 4.5.x before 4.5.5.1 allow remote authenticated users
diff --git a/active/CVE-2016-2849 b/active/CVE-2016-2849
index 991f6aa..95a314e 100644
--- a/active/CVE-2016-2849
+++ b/active/CVE-2016-2849
@@ -3,6 +3,7 @@ PublicDate: 2016-05-13 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2849
  http://botan.randombit.net/security.html
+ http://www.debian.org/security/2016/dsa-3565
 Description:
  Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time
  algorithm to perform a modular inverse on the signature nonce k, which
diff --git a/active/CVE-2016-2860 b/active/CVE-2016-2860
index b158359..2e70947 100644
--- a/active/CVE-2016-2860
+++ b/active/CVE-2016-2860
@@ -3,6 +3,7 @@ PublicDate: 2016-05-13 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2860
  https://www.openafs.org/pages/security/OPENAFS-SA-2016-001.txt
+ http://www.debian.org/security/2016/dsa-3569
 Description:
  The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows
  remote authenticated users from foreign Kerberos realms to bypass intended
diff --git a/active/CVE-2016-3092 b/active/CVE-2016-3092
index 9b51be2..62e0276 100644
--- a/active/CVE-2016-3092
+++ b/active/CVE-2016-3092
@@ -6,6 +6,9 @@ References:
  http://markmail.org/message/oyxfv73jb2g7rjg3
  https://ubuntu.com/security/notices/USN-3024-1
  https://ubuntu.com/security/notices/USN-3027-1
+ http://www.debian.org/security/2016/dsa-3609
+ http://www.debian.org/security/2016/dsa-3611
+ http://www.debian.org/security/2016/dsa-3614
 Description:
  The MultipartStream class in Apache Commons Fileupload before 1.3.2, as
  used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before
diff --git a/active/CVE-2016-3153 b/active/CVE-2016-3153
index cd579fe..afd044e 100644
--- a/active/CVE-2016-3153
+++ b/active/CVE-2016-3153
@@ -3,6 +3,7 @@ PublicDate: 2016-04-08 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3153
  http://www.openwall.com/lists/oss-security/2016/03/15/2
+ http://www.debian.org/security/2016/dsa-3518
 Description:
  SPIP 2.x before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows
  remote attackers to execute arbitrary PHP code by adding content, related
diff --git a/active/CVE-2016-3154 b/active/CVE-2016-3154
index c04c794..991228a 100644
--- a/active/CVE-2016-3154
+++ b/active/CVE-2016-3154
@@ -3,6 +3,7 @@ PublicDate: 2016-04-08 14:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3154
  http://www.openwall.com/lists/oss-security/2016/03/15/2
+ http://www.debian.org/security/2016/dsa-3518
 Description:
  The encoder_contexte_ajax function in ecrire/inc/filtres.php in SPIP 2.x
  before 2.1.19, 3.0.x before 3.0.22, and 3.1.x before 3.1.1 allows remote
diff --git a/active/CVE-2016-3162 b/active/CVE-2016-3162
index 5387190..a960291 100644
--- a/active/CVE-2016-3162
+++ b/active/CVE-2016-3162
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3162
  https://www.drupal.org/SA-CORE-2016-001
  http://www.openwall.com/lists/oss-security/2016/02/24/19
+ http://www.debian.org/security/2016/dsa-3498
 Description:
  The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows
  remote authenticated users to bypass access restrictions and read, delete,
diff --git a/active/CVE-2016-3163 b/active/CVE-2016-3163
index 66d40b9..d1a273e 100644
--- a/active/CVE-2016-3163
+++ b/active/CVE-2016-3163
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3163
  https://www.drupal.org/SA-CORE-2016-001
  http://www.openwall.com/lists/oss-security/2016/02/24/19
+ http://www.debian.org/security/2016/dsa-3498
 Description:
  The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make
  it easier for remote attackers to conduct brute-force attacks via a large
diff --git a/active/CVE-2016-3164 b/active/CVE-2016-3164
index 6f6652f..1caf3b6 100644
--- a/active/CVE-2016-3164
+++ b/active/CVE-2016-3164
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3164
  https://www.drupal.org/SA-CORE-2016-001
  http://www.openwall.com/lists/oss-security/2016/02/24/19
+ http://www.debian.org/security/2016/dsa-3498
 Description:
  Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow
  remote attackers to conduct open redirect attacks by leveraging (1) custom
diff --git a/active/CVE-2016-3168 b/active/CVE-2016-3168
index 026089b..d699124 100644
--- a/active/CVE-2016-3168
+++ b/active/CVE-2016-3168
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3168
  https://www.drupal.org/SA-CORE-2016-001
  http://www.openwall.com/lists/oss-security/2016/02/24/19
+ http://www.debian.org/security/2016/dsa-3498
 Description:
  The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow
  remote attackers to hijack the authentication of site administrators for
diff --git a/active/CVE-2016-3169 b/active/CVE-2016-3169
index 4a5af8c..8046e08 100644
--- a/active/CVE-2016-3169
+++ b/active/CVE-2016-3169
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3169
  https://www.drupal.org/SA-CORE-2016-001
  http://www.openwall.com/lists/oss-security/2016/02/24/19
+ http://www.debian.org/security/2016/dsa-3498
 Description:
  The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote
  attackers to gain privileges by leveraging contributed or custom code that
diff --git a/active/CVE-2016-3170 b/active/CVE-2016-3170
index af8dabf..cb8b5a7 100644
--- a/active/CVE-2016-3170
+++ b/active/CVE-2016-3170
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3170
  https://www.drupal.org/SA-CORE-2016-001
  http://www.openwall.com/lists/oss-security/2016/02/24/19
+ http://www.debian.org/security/2016/dsa-3498
 Description:
  The "have you forgotten your password" links in the User module in Drupal
  7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain
diff --git a/active/CVE-2016-3477 b/active/CVE-2016-3477
index 3b69a62..b16c650 100644
--- a/active/CVE-2016-3477
+++ b/active/CVE-2016-3477
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3477
  http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
  https://ubuntu.com/security/notices/USN-3040-1
+ http://www.debian.org/security/2016/dsa-3624
+ http://www.debian.org/security/2016/dsa-3632
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and
  earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before
diff --git a/active/CVE-2016-3521 b/active/CVE-2016-3521
index 9d22de2..5553ca1 100644
--- a/active/CVE-2016-3521
+++ b/active/CVE-2016-3521
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3521
  http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
  https://ubuntu.com/security/notices/USN-3040-1
+ http://www.debian.org/security/2016/dsa-3624
+ http://www.debian.org/security/2016/dsa-3632
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and
  earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before
diff --git a/active/CVE-2016-3615 b/active/CVE-2016-3615
index 8db4ed4..3c2bb98 100644
--- a/active/CVE-2016-3615
+++ b/active/CVE-2016-3615
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3615
  http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
  https://ubuntu.com/security/notices/USN-3040-1
+ http://www.debian.org/security/2016/dsa-3624
+ http://www.debian.org/security/2016/dsa-3632
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and
  earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before
diff --git a/active/CVE-2016-3674 b/active/CVE-2016-3674
index 6b0f301..b9f6091 100644
--- a/active/CVE-2016-3674
+++ b/active/CVE-2016-3674
@@ -3,6 +3,7 @@ PublicDate: 2016-05-17 14:08:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3674
  http://x-stream.github.io/changes.html#1.4.9
+ http://www.debian.org/security/2016/dsa-3575
 Description:
  Multiple XML external entity (XXE) vulnerabilities in the (1) Dom4JDriver,
  (2) DomDriver, (3) JDomDriver, (4) JDom2Driver, (5) SjsxpDriver, (6)
diff --git a/active/CVE-2016-4029 b/active/CVE-2016-4029
index a8055ef..9d42a62 100644
--- a/active/CVE-2016-4029
+++ b/active/CVE-2016-4029
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4029
  http://codex.wordpress.org/Version_4.5
  https://core.trac.wordpress.org/query?status=closed&milestone=4.5
+ http://www.debian.org/security/2016/dsa-3681
 Description:
  WordPress before 4.5 does not consider octal and hexadecimal IP address
  formats when determining an intranet address, which allows remote attackers
diff --git a/active/CVE-2016-4423 b/active/CVE-2016-4423
index cd0a188..76466ce 100644
--- a/active/CVE-2016-4423
+++ b/active/CVE-2016-4423
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4423
  https://github.com/symfony/symfony/pull/18733
  https://symfony.com/blog/cve-2016-4423-large-username-storage-in-session
+ http://www.debian.org/security/2016/dsa-3588
 Description:
  The attemptAuthentication function in
  Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php
diff --git a/active/CVE-2016-4561 b/active/CVE-2016-4561
index 1658b84..71c5a61 100644
--- a/active/CVE-2016-4561
+++ b/active/CVE-2016-4561
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4561
  http://source.ikiwiki.branchable.com/?p=source.git;a=commitdiff;h=32ef584dc5abb6ddb9f794f94ea0b2934967bba7
  http://www.openwall.com/lists/oss-security/2016/05/06/8
+ http://www.debian.org/security/2016/dsa-3571
 Description:
  Cross-site scripting (XSS) vulnerability in the cgierror function in CGI.pm
  in ikiwiki before 3.20160506 might allow remote attackers to inject
diff --git a/active/CVE-2016-4570 b/active/CVE-2016-4570
index 71d9af9..d982ffa 100644
--- a/active/CVE-2016-4570
+++ b/active/CVE-2016-4570
@@ -3,6 +3,7 @@ PublicDate: 2017-02-03 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4570
  http://www.openwall.com/lists/oss-security/2016/05/07/8
+ https://lists.debian.org/debian-lts-announce/2019/01/msg00018.html
 Description:
  The mxmlDelete function in mxml-node.c in mxml 2.9, 2.7, and possibly
  earlier allows remote attackers to cause a denial of service (stack
diff --git a/active/CVE-2016-4571 b/active/CVE-2016-4571
index b6c4bbf..ec63e65 100644
--- a/active/CVE-2016-4571
+++ b/active/CVE-2016-4571
@@ -3,6 +3,7 @@ PublicDate: 2017-02-03 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4571
  http://www.openwall.com/lists/oss-security/2016/05/07/8
+ https://lists.debian.org/debian-lts-announce/2019/01/msg00018.html
 Description:
  The mxml_write_node function in mxml-file.c in mxml 2.9, 2.7, and possibly
  earlier allows remote attackers to cause a denial of service (stack
diff --git a/active/CVE-2016-4861 b/active/CVE-2016-4861
index f38176f..5de2533 100644
--- a/active/CVE-2016-4861
+++ b/active/CVE-2016-4861
@@ -3,6 +3,7 @@ PublicDate: 2017-02-17 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4861
  http://framework.zend.com/security/advisory/ZF2016-03
+ https://lists.debian.org/debian-lts-announce/2018/06/msg00012.html
 Description:
  The (1) order and (2) group methods in Zend_Db_Select in the Zend Framework
  before 1.12.20 might allow remote attackers to conduct SQL injection
diff --git a/active/CVE-2016-4972 b/active/CVE-2016-4972
index 3afc49c..cf16ae0 100644
--- a/active/CVE-2016-4972
+++ b/active/CVE-2016-4972
@@ -3,6 +3,8 @@ PublicDate: 2016-09-26 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4972
  https://marc.info/?l=oss-security&m=146670562610827&w=2
+ https://bugs.launchpad.net/murano/+bug/1586079
+ https://bugs.launchpad.net/python-muranoclient/+bug/1586078
 Description:
  OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka),
  Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and
diff --git a/active/CVE-2016-5018 b/active/CVE-2016-5018
index d92735e..6cb5e1c 100644
--- a/active/CVE-2016-5018
+++ b/active/CVE-2016-5018
@@ -6,6 +6,7 @@ References:
  http://markmail.org/message/lixw6iyojoxwfizv?q=list:org.apache.tomcat.announce/
  https://ubuntu.com/security/notices/USN-3177-1
  https://ubuntu.com/security/notices/USN-4557-1
+ http://www.debian.org/security/2016/dsa-3720
 Description:
  In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36,
  7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to
diff --git a/active/CVE-2016-5099 b/active/CVE-2016-5099
index 971f1f3..fda79be 100644
--- a/active/CVE-2016-5099
+++ b/active/CVE-2016-5099
@@ -3,6 +3,7 @@ PublicDate: 2016-07-05 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5099
  https://www.phpmyadmin.net/security/PMASA-2016-16/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  Cross-site scripting (XSS) vulnerability in phpMyAdmin 4.4.x before
  4.4.15.6 and 4.6.x before 4.6.2 allows remote attackers to inject arbitrary
diff --git a/active/CVE-2016-5300 b/active/CVE-2016-5300
index f97a0b3..b92fe98 100644
--- a/active/CVE-2016-5300
+++ b/active/CVE-2016-5300
@@ -6,6 +6,7 @@ References:
  http://seclists.org/oss-sec/2016/q2/468
  https://ubuntu.com/security/notices/USN-3013-1
  https://ubuntu.com/security/notices/USN-3010-1
+ http://www.debian.org/security/2016/dsa-3597
 Description:
  The XML parser in Expat does not use sufficient entropy for hash
  initialization, which allows context-dependent attackers to cause a denial
diff --git a/active/CVE-2016-5388 b/active/CVE-2016-5388
index 2e29c61..e6992fb 100644
--- a/active/CVE-2016-5388
+++ b/active/CVE-2016-5388
@@ -8,6 +8,7 @@ References:
  https://www.apache.org/security/asf-httpoxy-response.txt
  https://ubuntu.com/security/notices/USN-3177-1
  https://ubuntu.com/security/notices/USN-4791-1
+ https://lists.debian.org/debian-lts-announce/2019/08/msg00015.html
 Description:
  Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI
  Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not
diff --git a/active/CVE-2016-5440 b/active/CVE-2016-5440
index 5911df6..916b09f 100644
--- a/active/CVE-2016-5440
+++ b/active/CVE-2016-5440
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5440
  http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
  https://ubuntu.com/security/notices/USN-3040-1
+ http://www.debian.org/security/2016/dsa-3624
+ http://www.debian.org/security/2016/dsa-3632
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and
  earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before
diff --git a/active/CVE-2016-5584 b/active/CVE-2016-5584
index 6dfff89..18304e0 100644
--- a/active/CVE-2016-5584
+++ b/active/CVE-2016-5584
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5584
  http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-3109-1
+ http://www.debian.org/security/2016/dsa-3706
 Description:
  Unspecified vulnerability in Oracle MySQL 5.5.52 and earlier, 5.6.33 and
  earlier, and 5.7.15 and earlier allows remote administrators to affect
diff --git a/active/CVE-2016-5701 b/active/CVE-2016-5701
index 1c061fd..a4a20e5 100644
--- a/active/CVE-2016-5701
+++ b/active/CVE-2016-5701
@@ -3,6 +3,7 @@ PublicDate: 2016-07-03 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5701
  https://www.phpmyadmin.net/security/PMASA-2016-17/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16,
  4.4.15.x before 4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to
diff --git a/active/CVE-2016-5705 b/active/CVE-2016-5705
index 2e637f7..545040a 100644
--- a/active/CVE-2016-5705
+++ b/active/CVE-2016-5705
@@ -3,6 +3,7 @@ PublicDate: 2016-07-03 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5705
  https://www.phpmyadmin.net/security/PMASA-2016-21/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.4.x
  before 4.4.15.7 and 4.6.x before 4.6.3 allow remote attackers to inject
diff --git a/active/CVE-2016-5706 b/active/CVE-2016-5706
index 3ca0a1d..a52d576 100644
--- a/active/CVE-2016-5706
+++ b/active/CVE-2016-5706
@@ -3,6 +3,7 @@ PublicDate: 2016-07-03 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5706
  https://www.phpmyadmin.net/security/PMASA-2016-22/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  js/get_scripts.js.php in phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before
  4.4.15.7, and 4.6.x before 4.6.3 allows remote attackers to cause a denial
diff --git a/active/CVE-2016-5731 b/active/CVE-2016-5731
index c7da38b..30caa0e 100644
--- a/active/CVE-2016-5731
+++ b/active/CVE-2016-5731
@@ -3,6 +3,7 @@ PublicDate: 2016-07-03 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5731
  https://www.phpmyadmin.net/security/PMASA-2016-24/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  Cross-site scripting (XSS) vulnerability in examples/openid.php in
  phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before
diff --git a/active/CVE-2016-5733 b/active/CVE-2016-5733
index b02af6e..e655f7b 100644
--- a/active/CVE-2016-5733
+++ b/active/CVE-2016-5733
@@ -3,6 +3,7 @@ PublicDate: 2016-07-03 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5733
  https://www.phpmyadmin.net/security/PMASA-2016-26/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  Multiple cross-site scripting (XSS) vulnerabilities in phpMyAdmin 4.0.x
  before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 allow
diff --git a/active/CVE-2016-5735 b/active/CVE-2016-5735
index 5bc0675..bad061b 100644
--- a/active/CVE-2016-5735
+++ b/active/CVE-2016-5735
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5735
  https://github.com/pornel/pngquant/commit/b7c217680cda02dddced245d237ebe8c383be285
  http://sf.snu.ac.kr/gil.hur/publications/shovel.pdf
+ https://lists.debian.org/debian-lts-announce/2020/06/msg00028.html
 Description:
  Integer overflow in the rwpng_read_image24_libpng function in rwpng.c in
  pngquant 2.7.0 allows remote attackers to have unspecified impact via a
diff --git a/active/CVE-2016-5739 b/active/CVE-2016-5739
index e1a8515..1872eaa 100644
--- a/active/CVE-2016-5739
+++ b/active/CVE-2016-5739
@@ -3,6 +3,7 @@ PublicDate: 2016-07-03 01:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5739
  https://www.phpmyadmin.net/security/PMASA-2016-28/
+ http://www.debian.org/security/2016/dsa-3627
 Description:
  The Transformation implementation in phpMyAdmin 4.0.x before 4.0.10.16,
  4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not use the no-referrer
diff --git a/active/CVE-2016-5832 b/active/CVE-2016-5832
index 851399f..678bff3 100644
--- a/active/CVE-2016-5832
+++ b/active/CVE-2016-5832
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5832
  https://wordpress.org/news/2016/06/wordpress-4-5-3/
  https://marc.info/?l=oss-security&m=146670813911482&w=2
+ http://www.debian.org/security/2016/dsa-3639
 Description:
  The customizer in WordPress before 4.5.3 allows remote attackers to bypass
  intended redirection restrictions via unspecified vectors.
diff --git a/active/CVE-2016-5834 b/active/CVE-2016-5834
index cd0e4f7..28d348b 100644
--- a/active/CVE-2016-5834
+++ b/active/CVE-2016-5834
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5834
  https://wordpress.org/news/2016/06/wordpress-4-5-3/
  https://marc.info/?l=oss-security&m=146670813911482&w=2
+ http://www.debian.org/security/2016/dsa-3639
 Description:
  Cross-site scripting (XSS) vulnerability in the wp_get_attachment_link
  function in wp-includes/post-template.php in WordPress before 4.5.3 allows
diff --git a/active/CVE-2016-5835 b/active/CVE-2016-5835
index cb192e4..4879716 100644
--- a/active/CVE-2016-5835
+++ b/active/CVE-2016-5835
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5835
  https://wordpress.org/news/2016/06/wordpress-4-5-3/
  https://marc.info/?l=oss-security&m=146670813911482&w=2
+ http://www.debian.org/security/2016/dsa-3639
 Description:
  WordPress before 4.5.3 allows remote attackers to obtain sensitive
  revision-history information by leveraging the ability to read a post,
diff --git a/active/CVE-2016-5836 b/active/CVE-2016-5836
index 4892dec..2c1dcbe 100644
--- a/active/CVE-2016-5836
+++ b/active/CVE-2016-5836
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5836
  https://wordpress.org/news/2016/06/wordpress-4-5-3/
  https://marc.info/?l=oss-security&m=146670813911482&w=2
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00046.html
 Description:
  The oEmbed protocol implementation in WordPress before 4.5.3 allows remote
  attackers to cause a denial of service via unspecified vectors.
diff --git a/active/CVE-2016-5837 b/active/CVE-2016-5837
index 5ee7efc..e9b3332 100644
--- a/active/CVE-2016-5837
+++ b/active/CVE-2016-5837
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5837
  https://wordpress.org/news/2016/06/wordpress-4-5-3/
  https://marc.info/?l=oss-security&m=146670813911482&w=2
+ http://www.debian.org/security/2016/dsa-3639
 Description:
  WordPress before 4.5.3 allows remote attackers to bypass intended access
  restrictions and remove a category attribute from a post via unspecified
diff --git a/active/CVE-2016-5838 b/active/CVE-2016-5838
index 58b18d0..4a84997 100644
--- a/active/CVE-2016-5838
+++ b/active/CVE-2016-5838
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5838
  https://wordpress.org/news/2016/06/wordpress-4-5-3/
  https://marc.info/?l=oss-security&m=146670813911482&w=2
+ http://www.debian.org/security/2016/dsa-3639
 Description:
  WordPress before 4.5.3 allows remote attackers to bypass intended
  password-change restrictions by leveraging knowledge of a cookie.
diff --git a/active/CVE-2016-5839 b/active/CVE-2016-5839
index c793617..cfbed6d 100644
--- a/active/CVE-2016-5839
+++ b/active/CVE-2016-5839
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5839
  https://wordpress.org/news/2016/06/wordpress-4-5-3/
  https://marc.info/?l=oss-security&m=146670813911482&w=2
+ http://www.debian.org/security/2016/dsa-3639
 Description:
  WordPress before 4.5.3 allows remote attackers to bypass the
  sanitize_file_name protection mechanism via unspecified vectors.
diff --git a/active/CVE-2016-6127 b/active/CVE-2016-6127
index af9490b..c9f807c 100644
--- a/active/CVE-2016-6127
+++ b/active/CVE-2016-6127
@@ -2,6 +2,7 @@ Candidate: CVE-2016-6127
 PublicDate: 2017-07-03 16:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6127
+ http://www.debian.org/security/2017/dsa-3882
 Description:
  Cross-site scripting (XSS) vulnerability in Request Tracker (RT) 4.x before
  4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2, when the
diff --git a/active/CVE-2016-6172 b/active/CVE-2016-6172
index cf8ff53..b1558b0 100644
--- a/active/CVE-2016-6172
+++ b/active/CVE-2016-6172
@@ -3,6 +3,7 @@ PublicDate: 2016-09-26 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6172
  http://www.openwall.com/lists/oss-security/2016/07/06/4
+ http://www.debian.org/security/2016/dsa-3664
 Description:
  PowerDNS (aka pdns) Authoritative Server before 4.0.1 allows remote primary
  DNS servers to cause a denial of service (memory exhaustion and secondary
diff --git a/active/CVE-2016-6211 b/active/CVE-2016-6211
index f42125a..3ce5184 100644
--- a/active/CVE-2016-6211
+++ b/active/CVE-2016-6211
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6211
  https://www.drupal.org/SA-CORE-2016-002
  http://www.openwall.com/lists/oss-security/2016/07/13/4
+ http://www.debian.org/security/2016/dsa-3604
 Description:
  The User module in Drupal 7.x before 7.44 allows remote authenticated users
  to gain privileges via vectors involving contributed or custom code that
diff --git a/active/CVE-2016-6265 b/active/CVE-2016-6265
index 6415502..060cafa 100644
--- a/active/CVE-2016-6265
+++ b/active/CVE-2016-6265
@@ -3,6 +3,7 @@ PublicDate: 2016-09-22 15:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6265
  http://bugs.ghostscript.com/show_bug.cgi?id=696941
+ http://www.debian.org/security/2016/dsa-3655
 Description:
  Use-after-free vulnerability in the pdf_load_xref function in
  pdf/pdf-xref.c in MuPDF allows remote attackers to cause a denial of
diff --git a/active/CVE-2016-6318 b/active/CVE-2016-6318
index 1691bea..0d8abec 100644
--- a/active/CVE-2016-6318
+++ b/active/CVE-2016-6318
@@ -3,6 +3,7 @@ PublicDate: 2016-09-07 19:28:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6318
  http://seclists.org/oss-sec/2016/q3/290
+ https://lists.debian.org/debian-lts-announce/2020/05/msg00023.html
 Description:
  Stack-based buffer overflow in the FascistGecosUser function in
  lib/fascist.c in cracklib allows local users to cause a denial of service
diff --git a/active/CVE-2016-6354 b/active/CVE-2016-6354
index b86d694..0540cb0 100644
--- a/active/CVE-2016-6354
+++ b/active/CVE-2016-6354
@@ -3,6 +3,7 @@ PublicDate: 2016-09-21 14:25:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6354
  http://seclists.org/oss-sec/2016/q3/97
+ http://www.debian.org/security/2016/dsa-3653
 Description:
  Heap-based buffer overflow in the yy_get_next_buffer function in Flex
  before 2.6.1 might allow context-dependent attackers to cause a denial of
diff --git a/active/CVE-2016-6525 b/active/CVE-2016-6525
index c830667..4434d12 100644
--- a/active/CVE-2016-6525
+++ b/active/CVE-2016-6525
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6525
  http://bugs.ghostscript.com/show_bug.cgi?id=696954
  http://www.openwall.com/lists/oss-security/2016/08/03/8
+ http://www.debian.org/security/2016/dsa-3655
 Description:
  Heap-based buffer overflow in the pdf_load_mesh_params function in
  pdf/pdf-shade.c in MuPDF allows remote attackers to cause a denial of
diff --git a/active/CVE-2016-6607 b/active/CVE-2016-6607
index 22db880..162c1d9 100644
--- a/active/CVE-2016-6607
+++ b/active/CVE-2016-6607
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6607
  http://www.phpmyadmin.net/security/PMASA-2016-30/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  XSS issues were discovered in phpMyAdmin. This affects Zoom search
  (specially crafted column content can be used to trigger an XSS attack);
diff --git a/active/CVE-2016-6611 b/active/CVE-2016-6611
index 70e93bf..612b791 100644
--- a/active/CVE-2016-6611
+++ b/active/CVE-2016-6611
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6611
  http://www.phpmyadmin.net/security/PMASA-2016-34/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. A specially crafted database and/or
  table name can be used to trigger an SQL injection attack through the
diff --git a/active/CVE-2016-6612 b/active/CVE-2016-6612
index bfc10d0..799cd22 100644
--- a/active/CVE-2016-6612
+++ b/active/CVE-2016-6612
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6612
  http://www.phpmyadmin.net/security/PMASA-2016-35/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. A user can exploit the LOAD LOCAL
  INFILE functionality to expose files on the server to the database system.
diff --git a/active/CVE-2016-6613 b/active/CVE-2016-6613
index ca7e3bd..8c49742 100644
--- a/active/CVE-2016-6613
+++ b/active/CVE-2016-6613
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6613
  http://www.phpmyadmin.net/security/PMASA-2016-36/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. A user can specially craft a symlink
  on disk, to a file which phpMyAdmin is permitted to read but the user is
diff --git a/active/CVE-2016-6614 b/active/CVE-2016-6614
index 19d74f9..264e7f3 100644
--- a/active/CVE-2016-6614
+++ b/active/CVE-2016-6614
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6614
  http://www.phpmyadmin.net/security/PMASA-2016-37/
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
 Description:
  An issue was discovered in phpMyAdmin involving the %u username replacement
  functionality of the SaveDir and UploadDir features. When the username
diff --git a/active/CVE-2016-6615 b/active/CVE-2016-6615
index 9446995..91cbc6e 100644
--- a/active/CVE-2016-6615
+++ b/active/CVE-2016-6615
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6615
  http://www.phpmyadmin.net/security/PMASA-2016-38/
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
 Description:
  XSS issues were discovered in phpMyAdmin. This affects navigation pane and
  database/table hiding feature (a specially-crafted database name can be
diff --git a/active/CVE-2016-6616 b/active/CVE-2016-6616
index a9894cc..560212b 100644
--- a/active/CVE-2016-6616
+++ b/active/CVE-2016-6616
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6616
  http://www.phpmyadmin.net/security/PMASA-2016-39/
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
 Description:
  An issue was discovered in phpMyAdmin. In the "User group" and "Designer"
  features, a user can execute an SQL injection attack against the account of
diff --git a/active/CVE-2016-6618 b/active/CVE-2016-6618
index c423e95..79be855 100644
--- a/active/CVE-2016-6618
+++ b/active/CVE-2016-6618
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6618
  http://www.phpmyadmin.net/security/PMASA-2016-41/
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
 Description:
  An issue was discovered in phpMyAdmin. The transformation feature allows a
  user to trigger a denial-of-service (DoS) attack against the server. All
diff --git a/active/CVE-2016-6620 b/active/CVE-2016-6620
index 92312e9..d3680fd 100644
--- a/active/CVE-2016-6620
+++ b/active/CVE-2016-6620
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6620
  http://www.phpmyadmin.net/security/PMASA-2016-43/
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
 Description:
  An issue was discovered in phpMyAdmin. Some data is passed to the PHP
  unserialize() function without verification that it's valid serialized
diff --git a/active/CVE-2016-6621 b/active/CVE-2016-6621
index 9536680..a630a58 100644
--- a/active/CVE-2016-6621
+++ b/active/CVE-2016-6621
@@ -3,6 +3,7 @@ PublicDate: 2017-01-31 19:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6621
  https://github.com/phpmyadmin/phpmyadmin/issues/12481
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
 Description:
  The setup script for phpMyAdmin before 4.0.10.19, 4.4.x before 4.4.15.10,
  and 4.6.x before 4.6.6 allows remote attackers to conduct server-side
diff --git a/active/CVE-2016-6622 b/active/CVE-2016-6622
index ee61eb6..339d989 100644
--- a/active/CVE-2016-6622
+++ b/active/CVE-2016-6622
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6622
  http://www.phpmyadmin.net/security/PMASA-2016-45/
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
 Description:
  An issue was discovered in phpMyAdmin. An unauthenticated user is able to
  execute a denial-of-service (DoS) attack by forcing persistent connections
diff --git a/active/CVE-2016-6624 b/active/CVE-2016-6624
index 710e773..40bfc99 100644
--- a/active/CVE-2016-6624
+++ b/active/CVE-2016-6624
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6624
  http://www.phpmyadmin.net/security/PMASA-2016-47/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin involving improper enforcement of the
  IP-based authentication rules. When phpMyAdmin is used with IPv6 in a proxy
diff --git a/active/CVE-2016-6626 b/active/CVE-2016-6626
index 80ab758..611ba1c 100644
--- a/active/CVE-2016-6626
+++ b/active/CVE-2016-6626
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6626
  http://www.phpmyadmin.net/security/PMASA-2016-49/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. An attacker could redirect a user to
  a malicious web page. All 4.6.x versions (prior to 4.6.4), 4.4.x versions
diff --git a/active/CVE-2016-6627 b/active/CVE-2016-6627
index d5e9689..172a496 100644
--- a/active/CVE-2016-6627
+++ b/active/CVE-2016-6627
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6627
  http://www.phpmyadmin.net/security/PMASA-2016-50/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. An attacker can determine the
  phpMyAdmin host location through the file url.php. All 4.6.x versions
diff --git a/active/CVE-2016-6628 b/active/CVE-2016-6628
index 26165ab..1e31c4c 100644
--- a/active/CVE-2016-6628
+++ b/active/CVE-2016-6628
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6628
  http://www.phpmyadmin.net/security/PMASA-2016-51/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. An attacker may be able to trigger a
  user to download a specially crafted malicious SVG file. All 4.6.x versions
diff --git a/active/CVE-2016-6632 b/active/CVE-2016-6632
index d775a03..9fb392a 100644
--- a/active/CVE-2016-6632
+++ b/active/CVE-2016-6632
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6632
  http://www.phpmyadmin.net/security/PMASA-2016-55/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin where, under certain conditions,
  phpMyAdmin may not delete temporary files during the import of ESRI files.
diff --git a/active/CVE-2016-6634 b/active/CVE-2016-6634
index 2fac981..24fe798 100644
--- a/active/CVE-2016-6634
+++ b/active/CVE-2016-6634
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6634
  http://codex.wordpress.org/Version_4.5
  https://core.trac.wordpress.org/query?status=closed&milestone=4.5
+ http://www.debian.org/security/2016/dsa-3681
 Description:
  Cross-site scripting (XSS) vulnerability in the network settings page in
  WordPress before 4.5 allows remote attackers to inject arbitrary web script
diff --git a/active/CVE-2016-6635 b/active/CVE-2016-6635
index 37ad053..1525b28 100644
--- a/active/CVE-2016-6635
+++ b/active/CVE-2016-6635
@@ -3,6 +3,7 @@ PublicDate: 2016-08-07 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-6635
  http://codex.wordpress.org/Version_4.5
+ http://www.debian.org/security/2016/dsa-3681
 Description:
  Cross-site request forgery (CSRF) vulnerability in the
  wp_ajax_wp_compression_test function in wp-admin/includes/ajax-actions.php
diff --git a/active/CVE-2016-6662 b/active/CVE-2016-6662
index 0165f28..665da8e 100644
--- a/active/CVE-2016-6662
+++ b/active/CVE-2016-6662
@@ -6,6 +6,7 @@ References:
  http://legalhackers.com/advisories/MySQL-Exploit-Remote-Root-Code-Execution-Privesc-CVE-2016-6662.html
  https://mariadb.com/kb/en/mariadb/mariadb-10027-release-notes/
  https://ubuntu.com/security/notices/USN-3078-1
+ http://www.debian.org/security/2016/dsa-3666
 Description:
  Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through
  5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before
diff --git a/active/CVE-2016-6794 b/active/CVE-2016-6794
index bac0a77..e008e0a 100644
--- a/active/CVE-2016-6794
+++ b/active/CVE-2016-6794
@@ -6,6 +6,7 @@ References:
  http://markmail.org/message/zk7w6yly5mviocci?q=list:org.apache.tomcat.announce/
  https://ubuntu.com/security/notices/USN-3177-1
  https://ubuntu.com/security/notices/USN-4557-1
+ http://www.debian.org/security/2016/dsa-3720
 Description:
  When a SecurityManager is configured, a web application's ability to read
  system properties should be controlled by the SecurityManager. In Apache
diff --git a/active/CVE-2016-6796 b/active/CVE-2016-6796
index 5f7d352..165e5c5 100644
--- a/active/CVE-2016-6796
+++ b/active/CVE-2016-6796
@@ -6,6 +6,7 @@ References:
  http://markmail.org/message/hynaeawxxhpvvctu?q=list:org.apache.tomcat.announce/
  https://ubuntu.com/security/notices/USN-3177-1
  https://ubuntu.com/security/notices/USN-4557-1
+ http://www.debian.org/security/2016/dsa-3720
 Description:
  A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9,
  8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45
diff --git a/active/CVE-2016-6797 b/active/CVE-2016-6797
index c4cab95..8f00062 100644
--- a/active/CVE-2016-6797
+++ b/active/CVE-2016-6797
@@ -6,6 +6,7 @@ References:
  http://markmail.org/message/wrku5orwxfpt5mzl?q=list:org.apache.tomcat.announce/
  https://ubuntu.com/security/notices/USN-3177-1
  https://ubuntu.com/security/notices/USN-4557-1
+ http://www.debian.org/security/2016/dsa-3720
 Description:
  The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to
  9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to
diff --git a/active/CVE-2016-6801 b/active/CVE-2016-6801
index 71a21d1..21dd28c 100644
--- a/active/CVE-2016-6801
+++ b/active/CVE-2016-6801
@@ -5,6 +5,7 @@ References:
  http://svn.apache.org/r1758791 (2.4.x)
  http://svn.apache.org/r1758771 (2.6.x)
  http://svn.apache.org/r1758764 (2.8.x)
+ http://www.debian.org/security/2016/dsa-3679
 Description:
  Cross-site request forgery (CSRF) vulnerability in the CSRF content-type
  check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6, 2.6.x
diff --git a/active/CVE-2016-6816 b/active/CVE-2016-6816
index 5561385..6ace4f0 100644
--- a/active/CVE-2016-6816
+++ b/active/CVE-2016-6816
@@ -6,6 +6,7 @@ References:
  http://www.openwall.com/lists/oss-security/2016/11/22/17
  https://ubuntu.com/security/notices/USN-3177-1
  https://ubuntu.com/security/notices/USN-4557-1
+ http://www.debian.org/security/2016/dsa-3738
 Description:
  The code in Apache Tomcat 9.0.0.M1 to 9.0.0.M11, 8.5.0 to 8.5.6, 8.0.0.RC1
  to 8.0.38, 7.0.0 to 7.0.72, and 6.0.0 to 6.0.47 that parsed the HTTP
diff --git a/active/CVE-2016-7068 b/active/CVE-2016-7068
index c4ff39b..64e51b3 100644
--- a/active/CVE-2016-7068
+++ b/active/CVE-2016-7068
@@ -3,6 +3,8 @@ PublicDate: 2018-09-11 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7068
  https://doc.powerdns.com/md/security/powerdns-advisory-2016-02/
+ https://www.debian.org/security/2017/dsa-3763
+ https://www.debian.org/security/2017/dsa-3764
 Description:
  An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS
  recursor before 3.7.4 and 4.0.4, allowing a remote, unauthenticated
diff --git a/active/CVE-2016-7072 b/active/CVE-2016-7072
index 0653e3b..5dbd01c 100644
--- a/active/CVE-2016-7072
+++ b/active/CVE-2016-7072
@@ -3,6 +3,7 @@ PublicDate: 2018-09-10 17:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7072
  https://doc.powerdns.com/md/security/powerdns-advisory-2016-03/
+ https://www.debian.org/security/2017/dsa-3764
 Description:
  An issue has been found in PowerDNS Authoritative Server before 3.4.11 and
  4.0.2 allowing a remote, unauthenticated attacker to cause a denial of
diff --git a/active/CVE-2016-7073 b/active/CVE-2016-7073
index 4869acf..607deaa 100644
--- a/active/CVE-2016-7073
+++ b/active/CVE-2016-7073
@@ -3,6 +3,7 @@ PublicDate: 2018-09-11 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7073
  https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/
+ https://www.debian.org/security/2017/dsa-3764
 Description:
  An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS
  recursor before 4.0.4, allowing an attacker in position of
diff --git a/active/CVE-2016-7074 b/active/CVE-2016-7074
index d0c518e..35b3d59 100644
--- a/active/CVE-2016-7074
+++ b/active/CVE-2016-7074
@@ -3,6 +3,7 @@ PublicDate: 2018-09-11 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7074
  https://doc.powerdns.com/md/security/powerdns-advisory-2016-04/
+ https://www.debian.org/security/2017/dsa-3764
 Description:
  An issue has been found in PowerDNS before 3.4.11 and 4.0.2, and PowerDNS
  recursor before 4.0.4, allowing an attacker in position of
diff --git a/active/CVE-2016-7142 b/active/CVE-2016-7142
index 4f9bbfa..7a47170 100644
--- a/active/CVE-2016-7142
+++ b/active/CVE-2016-7142
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7142
  http://www.inspircd.org/2016/09/03/v2023-released.html
  http://www.openwall.com/lists/oss-security/2016/09/04/3
+ http://www.debian.org/security/2016/dsa-3662
 Description:
  The m_sasl module in InspIRCd before 2.0.23, when used with a service that
  supports SASL_EXTERNAL authentication, allows remote attackers to spoof
diff --git a/active/CVE-2016-7143 b/active/CVE-2016-7143
index 26202e8..fd28f34 100644
--- a/active/CVE-2016-7143
+++ b/active/CVE-2016-7143
@@ -2,6 +2,7 @@ Candidate: CVE-2016-7143
 PublicDate: 2016-09-21 14:25:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7143
+ http://www.debian.org/security/2016/dsa-3661
 Description:
  The m_authenticate function in modules/m_sasl.c in Charybdis before 3.5.3
  allows remote attackers to spoof certificate fingerprints and consequently
diff --git a/active/CVE-2016-7168 b/active/CVE-2016-7168
index c42abf3..e16d2ea 100644
--- a/active/CVE-2016-7168
+++ b/active/CVE-2016-7168
@@ -3,6 +3,7 @@ PublicDate: 2017-01-05 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7168
  https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/
+ http://www.debian.org/security/2016/dsa-3681
 Description:
  Cross-site scripting (XSS) vulnerability in the media_handle_upload
  function in wp-admin/includes/media.php in WordPress before 4.6.1 might
diff --git a/active/CVE-2016-7169 b/active/CVE-2016-7169
index eb8157c..1886702 100644
--- a/active/CVE-2016-7169
+++ b/active/CVE-2016-7169
@@ -3,6 +3,7 @@ PublicDate: 2017-01-05 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7169
  https://wordpress.org/news/2016/09/wordpress-4-6-1-security-and-maintenance-release/
+ http://www.debian.org/security/2016/dsa-3681
 Description:
  Directory traversal vulnerability in the File_Upload_Upgrader class in
  wp-admin/includes/class-file-upload-upgrader.php in the upgrade package
diff --git a/active/CVE-2016-7395 b/active/CVE-2016-7395
index f5dcc77..172d0ad 100644
--- a/active/CVE-2016-7395
+++ b/active/CVE-2016-7395
@@ -5,6 +5,7 @@ References:
  https://codereview.chromium.org/2006143009
  https://crbug.com/613918
  https://googlechromereleases.blogspot.com/2016/08/stable-channel-update-for-desktop_31.html
+ http://www.debian.org/security/2016/dsa-3667
 Description:
  SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows
  and OS X and before 53.0.2785.92 on Linux, does not properly validate the
diff --git a/active/CVE-2016-7398 b/active/CVE-2016-7398
index a328c71..9e2e72c 100644
--- a/active/CVE-2016-7398
+++ b/active/CVE-2016-7398
@@ -5,6 +5,7 @@ References:
  https://bugs.php.net/bug.php?id=73055
  https://bugs.php.net/bug.php?id=73055&edit=1
  https://github.com/m6w6/ext-http/commit/17137d4ab1ce81a2cee0fae842340a344ef3da83
+ https://lists.debian.org/debian-lts-announce/2019/09/msg00022.html
 Description:
  A type confusion vulnerability in the merge_param() function of
  php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and
diff --git a/active/CVE-2016-7404 b/active/CVE-2016-7404
index 234f95a..0daafba 100644
--- a/active/CVE-2016-7404
+++ b/active/CVE-2016-7404
@@ -3,6 +3,7 @@ PublicDate: 2019-06-21 14:15:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7404
  https://git.openstack.org/cgit/openstack/magnum/commit/?id=0bb0d6486d6771ee21bbf897a091b1aa59e01b22
+ https://bugs.launchpad.net/magnum/+bug/1620536
 Description:
  OpenStack Magnum passes OpenStack credentials into the Heat templates
  creating its instances. While these should just be used for retrieving the
diff --git a/active/CVE-2016-7440 b/active/CVE-2016-7440
index f45a31c..d89a87c 100644
--- a/active/CVE-2016-7440
+++ b/active/CVE-2016-7440
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7440
  http://www.oracle.com/technetwork/security-advisory/cpuoct2016-2881722.html#AppendixMSQL
  https://ubuntu.com/security/notices/USN-3109-1
+ http://www.debian.org/security/2016/dsa-3706
 Description:
  The C software implementation of AES Encryption and Decryption in wolfSSL
  (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover
diff --git a/active/CVE-2016-7551 b/active/CVE-2016-7551
index 8d8b994..0be5f97 100644
--- a/active/CVE-2016-7551
+++ b/active/CVE-2016-7551
@@ -3,6 +3,7 @@ PublicDate: 2017-04-17 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7551
  http://downloads.asterisk.org/pub/security/AST-2016-007.html
+ http://www.debian.org/security/2016/dsa-3700
 Description:
  chain_sip in Asterisk Open Source 11.x before 11.23.1 and 13.x 13.11.1 and
  Certified Asterisk 11.6 before 11.6-cert15 and 13.8 before 13.8-cert3
diff --git a/active/CVE-2016-7798 b/active/CVE-2016-7798
index 70f71ed..5f0f1c2 100644
--- a/active/CVE-2016-7798
+++ b/active/CVE-2016-7798
@@ -6,6 +6,8 @@ References:
  https://github.com/attr-encrypted/attr_encrypted/issues/203
  https://github.com/attr-encrypted/encryptor/pull/22
  https://ubuntu.com/security/notices/USN-3365-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+ https://www.debian.org/security/2017/dsa-3966
 Description:
  The openssl gem for Ruby uses the same initialization vector (IV) in GCM
  Mode (aes-*-gcm) when the IV is set before the key, which makes it easier
diff --git a/active/CVE-2016-8674 b/active/CVE-2016-8674
index ca80d6e..afcf5d3 100644
--- a/active/CVE-2016-8674
+++ b/active/CVE-2016-8674
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8674
  http://bugs.ghostscript.com/show_bug.cgi?id=697015
  http://bugs.ghostscript.com/show_bug.cgi?id=697019
+ http://www.debian.org/security/2017/dsa-3797
 Description:
  The pdf_to_num function in pdf-object.c in MuPDF before 1.10 allows remote
  attackers to cause a denial of service (use-after-free and application
diff --git a/active/CVE-2016-8735 b/active/CVE-2016-8735
index 5c5bb2b..66db461 100644
--- a/active/CVE-2016-8735
+++ b/active/CVE-2016-8735
@@ -6,6 +6,7 @@ References:
  http://www.openwall.com/lists/oss-security/2016/11/22/16
  https://ubuntu.com/security/notices/USN-3177-1
  https://ubuntu.com/security/notices/USN-4557-1
+ http://www.debian.org/security/2016/dsa-3738
 Description:
  Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x
  before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before
diff --git a/active/CVE-2016-8745 b/active/CVE-2016-8745
index 36e65f2..841edd2 100644
--- a/active/CVE-2016-8745
+++ b/active/CVE-2016-8745
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8745
  http://www.openwall.com/lists/oss-security/2016/12/12/1
  https://ubuntu.com/security/notices/USN-3177-1
+ http://www.debian.org/security/2017/dsa-3754
+ http://www.debian.org/security/2017/dsa-3755
 Description:
  A bug in the error handling of the send file code for the NIO HTTP
  connector in Apache Tomcat 9.0.0.M1 to 9.0.0.M13, 8.5.0 to 8.5.8, 8.0.0.RC1
diff --git a/active/CVE-2016-9112 b/active/CVE-2016-9112
index 41f275c..22b9691 100644
--- a/active/CVE-2016-9112
+++ b/active/CVE-2016-9112
@@ -6,6 +6,7 @@ References:
  https://github.com/Young-X/pocs/tree/master/OpenJPEG_POC
  https://ubuntu.com/security/notices/USN-4497-1
  https://ubuntu.com/security/notices/USN-5664-1
+ https://lists.debian.org/debian-lts-announce/2019/07/msg00010.html
 Description:
  Floating Point Exception (aka FPE or divide by zero) in opj_pi_next_cprl
  function in openjp2/pi.c:523 in OpenJPEG 2.1.2.
diff --git a/active/CVE-2016-9449 b/active/CVE-2016-9449
index db00d65..07bf7d8 100644
--- a/active/CVE-2016-9449
+++ b/active/CVE-2016-9449
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9449
  https://www.drupal.org/SA-CORE-2016-005
  http://www.openwall.com/lists/oss-security/2016/11/18/8
+ http://www.debian.org/security/2016/dsa-3718
 Description:
  The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might
  allow remote authenticated users to obtain sensitive information about
diff --git a/active/CVE-2016-9451 b/active/CVE-2016-9451
index 7e5a948..0052009 100644
--- a/active/CVE-2016-9451
+++ b/active/CVE-2016-9451
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9451
  https://www.drupal.org/SA-CORE-2016-005
  http://www.openwall.com/lists/oss-security/2016/11/18/8
+ http://www.debian.org/security/2016/dsa-3718
 Description:
  Confirmation forms in Drupal 7.x before 7.52 make it easier for remote
  authenticated users to conduct open redirect attacks via unspecified
diff --git a/active/CVE-2016-9645 b/active/CVE-2016-9645
index 6ab6709..6a70698 100644
--- a/active/CVE-2016-9645
+++ b/active/CVE-2016-9645
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9645
  https://ikiwiki.info/security/#cve-2016-9645
  http://www.openwall.com/lists/oss-security/2016/12/29/3
+ https://security-tracker.debian.org/tracker/CVE-2016-9645
 Description:
  The fix for ikiwiki for CVE-2016-10026 was incomplete resulting in editing
  restriction bypass for git revert when using git versions older than 2.8.0.
diff --git a/active/CVE-2016-9646 b/active/CVE-2016-9646
index 39d59de..9b8f68f 100644
--- a/active/CVE-2016-9646
+++ b/active/CVE-2016-9646
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9646
  https://ikiwiki.info/security/#cve-2016-9646
  http://www.openwall.com/lists/oss-security/2016/12/29/3
+ https://security-tracker.debian.org/tracker/CVE-2016-9646
+ https://www.debian.org/security/2017/dsa-3760
 Description:
  ikiwiki before 3.20161229 incorrectly called the CGI::FormBuilder->field
  method (similar to the CGI->param API that led to Bugzilla's
diff --git a/active/CVE-2016-9774 b/active/CVE-2016-9774
index 5d64dbd..74b7df7 100644
--- a/active/CVE-2016-9774
+++ b/active/CVE-2016-9774
@@ -6,6 +6,9 @@ References:
  http://www.openwall.com/lists/oss-security/2016/12/02/5
  http://www.openwall.com/lists/oss-security/2016/12/02/10
  https://ubuntu.com/security/notices/USN-3177-1
+ http://www.debian.org/security/2016/dsa-3738
+ http://www.debian.org/security/2016/dsa-3739
+ https://ubuntu.com/security/notices/USN-3177-2
 Description:
  The postinst script in the tomcat6 package before 6.0.45+dfsg-1~deb7u4 on
  Debian wheezy, before 6.0.35-1ubuntu3.9 on Ubuntu 12.04 LTS and on Ubuntu
diff --git a/active/CVE-2016-9775 b/active/CVE-2016-9775
index ac7ff29..b12ca05 100644
--- a/active/CVE-2016-9775
+++ b/active/CVE-2016-9775
@@ -5,6 +5,9 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9775
  http://www.openwall.com/lists/oss-security/2016/12/02/5
  https://ubuntu.com/security/notices/USN-3177-1
+ http://www.debian.org/security/2016/dsa-3738
+ http://www.debian.org/security/2016/dsa-3739
+ https://ubuntu.com/security/notices/USN-3177-2
 Description:
  The postrm script in the tomcat6 package before 6.0.45+dfsg-1~deb7u3 on
  Debian wheezy, before 6.0.45+dfsg-1~deb8u1 on Debian jessie, before
diff --git a/active/CVE-2016-9809 b/active/CVE-2016-9809
index 74a8a3e..5bdcc48 100644
--- a/active/CVE-2016-9809
+++ b/active/CVE-2016-9809
@@ -3,6 +3,8 @@ PublicDate: 2017-01-13 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9809
  http://www.openwall.com/lists/oss-security/2016/12/01/2
+ http://www.debian.org/security/2017/dsa-3818
+ https://lists.debian.org/debian-lts-announce/2020/03/msg00038.html
 Description:
  Off-by-one error in the gst_h264_parse_set_caps function in GStreamer
  before 1.10.2 allows remote attackers to have unspecified impact via a
diff --git a/active/CVE-2016-9812 b/active/CVE-2016-9812
index 8c82761..5ecd9c4 100644
--- a/active/CVE-2016-9812
+++ b/active/CVE-2016-9812
@@ -3,6 +3,7 @@ PublicDate: 2017-01-13 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9812
  http://www.openwall.com/lists/oss-security/2016/12/01/2
+ http://www.debian.org/security/2017/dsa-3818
 Description:
  The gst_mpegts_section_new function in the mpegts decoder in GStreamer
  before 1.10.2 allows remote attackers to cause a denial of service
diff --git a/active/CVE-2016-9813 b/active/CVE-2016-9813
index 859f9f3..bc4ee3b 100644
--- a/active/CVE-2016-9813
+++ b/active/CVE-2016-9813
@@ -3,6 +3,7 @@ PublicDate: 2017-01-13 16:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9813
  http://www.openwall.com/lists/oss-security/2016/12/05/8
+ http://www.debian.org/security/2017/dsa-3818
 Description:
  The _parse_pat function in the mpegts parser in GStreamer before 1.10.2
  allows remote attackers to cause a denial of service (NULL pointer
diff --git a/active/CVE-2016-9814 b/active/CVE-2016-9814
index d5a5676..ebd87c8 100644
--- a/active/CVE-2016-9814
+++ b/active/CVE-2016-9814
@@ -6,6 +6,7 @@ References:
  https://github.com/simplesamlphp/saml2/pull/81
  https://github.com/simplesamlphp/saml2/commit/7008b0916426212c1cc2fc238b38ab9ebff0748c
  http://www.openwall.com/lists/oss-security/2016/12/03/5
+ https://lists.debian.org/debian-lts-announce/2018/03/msg00001.html
 Description:
  The validateSignature method in the SAML2\Utils class in SimpleSAMLphp
  before 1.14.10 and simplesamlphp/saml2 library before 1.9.1, 1.10.x before
diff --git a/active/CVE-2016-9840 b/active/CVE-2016-9840
index 11d557d..9969d28 100644
--- a/active/CVE-2016-9840
+++ b/active/CVE-2016-9840
@@ -6,6 +6,8 @@ References:
  http://www.openwall.com/lists/oss-security/2016/12/05/10
  https://ubuntu.com/security/notices/USN-4246-1
  https://ubuntu.com/security/notices/USN-4292-1
+ https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html
+ https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html
 Description:
  inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have
  unspecified impact by leveraging improper pointer arithmetic.
diff --git a/active/CVE-2016-9841 b/active/CVE-2016-9841
index 88a19c8..9b22f91 100644
--- a/active/CVE-2016-9841
+++ b/active/CVE-2016-9841
@@ -6,6 +6,8 @@ References:
  http://www.openwall.com/lists/oss-security/2016/12/05/21
  https://ubuntu.com/security/notices/USN-4246-1
  https://ubuntu.com/security/notices/USN-4292-1
+ https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html
+ https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html
 Description:
  inffast.c in zlib 1.2.8 might allow context-dependent attackers to have
  unspecified impact by leveraging improper pointer arithmetic.
diff --git a/active/CVE-2016-9842 b/active/CVE-2016-9842
index a70eba0..f791b9b 100644
--- a/active/CVE-2016-9842
+++ b/active/CVE-2016-9842
@@ -6,6 +6,8 @@ References:
  http://www.openwall.com/lists/oss-security/2016/12/05/10
  https://ubuntu.com/security/notices/USN-4246-1
  https://ubuntu.com/security/notices/USN-4292-1
+ https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html
+ https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html
 Description:
  The inflateMark function in inflate.c in zlib 1.2.8 might allow
  context-dependent attackers to have unspecified impact via vectors
diff --git a/active/CVE-2016-9843 b/active/CVE-2016-9843
index 293e430..53161db 100644
--- a/active/CVE-2016-9843
+++ b/active/CVE-2016-9843
@@ -6,6 +6,8 @@ References:
  http://www.openwall.com/lists/oss-security/2016/12/05/21
  https://ubuntu.com/security/notices/USN-4246-1
  https://ubuntu.com/security/notices/USN-4292-1
+ https://lists.debian.org/debian-lts-announce/2019/03/msg00027.html
+ https://lists.debian.org/debian-lts-announce/2020/01/msg00030.html
 Description:
  The crc32_big function in crc32.c in zlib 1.2.8 might allow
  context-dependent attackers to have unspecified impact via vectors
diff --git a/active/CVE-2016-9850 b/active/CVE-2016-9850
index f51a15d..f2d5b91 100644
--- a/active/CVE-2016-9850
+++ b/active/CVE-2016-9850
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 02:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9850
  https://www.phpmyadmin.net/security/PMASA-2016-61/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. Username matching for the allow/deny
  rules may result in wrong matches and detection of the username in the rule
diff --git a/active/CVE-2016-9861 b/active/CVE-2016-9861
index 6498649..00a1660 100644
--- a/active/CVE-2016-9861
+++ b/active/CVE-2016-9861
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 03:00:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9861
  https://www.phpmyadmin.net/security/PMASA-2016-66/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. Due to the limitation in URL
  matching, it was possible to bypass the URL white-list protection. All
diff --git a/active/CVE-2016-9864 b/active/CVE-2016-9864
index 3192fe7..aed207e 100644
--- a/active/CVE-2016-9864
+++ b/active/CVE-2016-9864
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 03:00:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9864
  https://www.phpmyadmin.net/security/PMASA-2016-69/
+ https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
 Description:
  An issue was discovered in phpMyAdmin. With a crafted username or a table
  name, it was possible to inject SQL statements in the tracking
diff --git a/active/CVE-2016-9865 b/active/CVE-2016-9865
index af21c1b..7e1f8dd 100644
--- a/active/CVE-2016-9865
+++ b/active/CVE-2016-9865
@@ -3,6 +3,7 @@ PublicDate: 2016-12-11 03:00:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9865
  https://www.phpmyadmin.net/security/PMASA-2016-70/
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00006.html
 Description:
  An issue was discovered in phpMyAdmin. Due to a bug in serialized string
  parsing, it was possible to bypass the protection offered by
diff --git a/active/CVE-2016-9888 b/active/CVE-2016-9888
index 2f9f1e2..c4b9c3a 100644
--- a/active/CVE-2016-9888
+++ b/active/CVE-2016-9888
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9888
  https://secunia.com/advisories/71201/
  https://secunia.com/secunia_research/2016-17/
+ https://lists.debian.org/debian-lts-announce/2020/04/msg00016.html
 Description:
  An error within the "tar_directory_for_file()" function (gsf-infile-tar.c)
  in GNOME Structured File Library before 1.14.41 can be exploited to trigger
diff --git a/active/CVE-2016-9955 b/active/CVE-2016-9955
index 91d0bca..e457be0 100644
--- a/active/CVE-2016-9955
+++ b/active/CVE-2016-9955
@@ -5,6 +5,7 @@ References:
  https://simplesamlphp.org/security/201612-02
  https://github.com/simplesamlphp/simplesamlphp/commit/a2326d75dd14accaac162dd2cb30aaefcc1f9205
  http://www.openwall.com/lists/oss-security/2016/12/14/7
+ https://lists.debian.org/debian-lts-announce/2018/03/msg00001.html
 Description:
  The SimpleSAML_XML_Validator class constructor in SimpleSAMLphp before
  1.14.11 might allow remote attackers to spoof signatures on SAML 1
diff --git a/active/CVE-2017-0356 b/active/CVE-2017-0356
index e79f9e5..e0494d4 100644
--- a/active/CVE-2017-0356
+++ b/active/CVE-2017-0356
@@ -3,6 +3,7 @@ PublicDate: 2018-04-13 15:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0356
  https://ikiwiki.info/security/#cve-2017-0356
+ https://www.debian.org/security/2017/dsa-3760
 Description:
  A flaw, similar to to CVE-2016-9646, exists in ikiwiki before 3.20170111,
  in the passwordauth plugin's use of CGI::FormBuilder, allowing an attacker
diff --git a/active/CVE-2017-0359 b/active/CVE-2017-0359
index 9d58553..154ffc2 100644
--- a/active/CVE-2017-0359
+++ b/active/CVE-2017-0359
@@ -2,6 +2,7 @@ Candidate: CVE-2017-0359
 PublicDate: 2018-04-13 16:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0359
+ https://security-tracker.debian.org/tracker/CVE-2017-0359
 Description:
  diffoscope before 77 writes to arbitrary locations on disk based on the
  contents of an untrusted archive.
diff --git a/active/CVE-2017-0360 b/active/CVE-2017-0360
index b5ec91d..f611311 100644
--- a/active/CVE-2017-0360
+++ b/active/CVE-2017-0360
@@ -3,6 +3,7 @@ PublicDate: 2017-04-04 17:59:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0360
  https://lists.debian.org/debian-security-announce/2017/msg00084.html
+ http://www.debian.org/security/2017/dsa-3826
 Description:
  file_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated
  users with certain permissions to read arbitrary files via a "same root
diff --git a/active/CVE-2017-0373 b/active/CVE-2017-0373
index d4ebe4d..b7cf976 100644
--- a/active/CVE-2017-0373
+++ b/active/CVE-2017-0373
@@ -3,6 +3,7 @@ PublicDate: 2017-05-23 18:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0373
  https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=e7e5dd1a650939a0e021d1d5b311dbb3c4884773
+ https://security-tracker.debian.org/tracker/CVE-2017-0373
 Description:
  The gen_class_pod implementation in lib/Config/Model/Utils/GenClassPod.pm
  in Config-Model (aka libconfig-model-perl) before 2.102 has a dangerous
diff --git a/active/CVE-2017-0374 b/active/CVE-2017-0374
index e228d1d..fd84552 100644
--- a/active/CVE-2017-0374
+++ b/active/CVE-2017-0374
@@ -3,6 +3,7 @@ PublicDate: 2017-05-23 18:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0374
  https://anonscm.debian.org/cgit/pkg-perl/packages/libconfig-model-perl.git/commit/?h=stretch&id=0de8471e5a8958ad37446dfcd0362a269e3ec573
+ https://security-tracker.debian.org/tracker/CVE-2017-0374
 Description:
  lib/Config/Model.pm in Config-Model (aka libconfig-model-perl) before 2.102
  allows local users to gain privileges via a crafted model in the current
diff --git a/active/CVE-2017-0899 b/active/CVE-2017-0899
index cc8a77c..41589bd 100644
--- a/active/CVE-2017-0899
+++ b/active/CVE-2017-0899
@@ -7,6 +7,8 @@ References:
  http://blog.rubygems.org/2017/08/27/2.6.13-released.html
  https://ubuntu.com/security/notices/USN-3439-1
  https://ubuntu.com/security/notices/USN-3685-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+ https://www.debian.org/security/2017/dsa-3966
 Description:
  RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted
  gem specifications that include terminal escape characters. Printing the
diff --git a/active/CVE-2017-0900 b/active/CVE-2017-0900
index e6ca494..45f0b04 100644
--- a/active/CVE-2017-0900
+++ b/active/CVE-2017-0900
@@ -7,6 +7,8 @@ References:
  http://blog.rubygems.org/2017/08/27/2.6.13-released.html
  https://ubuntu.com/security/notices/USN-3439-1
  https://ubuntu.com/security/notices/USN-3685-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+ https://www.debian.org/security/2017/dsa-3966
 Description:
  RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted
  gem specifications to cause a denial of service attack against RubyGems
diff --git a/active/CVE-2017-0901 b/active/CVE-2017-0901
index 7f8a465..3418b0c 100644
--- a/active/CVE-2017-0901
+++ b/active/CVE-2017-0901
@@ -9,6 +9,8 @@ References:
  https://ubuntu.com/security/notices/USN-3439-1
  https://ubuntu.com/security/notices/USN-3553-1
  https://ubuntu.com/security/notices/USN-3685-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+ https://www.debian.org/security/2017/dsa-3966
 Description:
  RubyGems version 2.6.12 and earlier fails to validate specification names,
  allowing a maliciously crafted gem to potentially overwrite any file on the
diff --git a/active/CVE-2017-0902 b/active/CVE-2017-0902
index afd67ab..66c98a3 100644
--- a/active/CVE-2017-0902
+++ b/active/CVE-2017-0902
@@ -8,6 +8,8 @@ References:
  https://hackerone.com/reports/218088
  https://ubuntu.com/security/notices/USN-3553-1
  https://ubuntu.com/security/notices/USN-3685-1
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+ https://www.debian.org/security/2017/dsa-3966
 Description:
  RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking
  vulnerability that allows a MITM attacker to force the RubyGems client to
diff --git a/active/CVE-2017-0903 b/active/CVE-2017-0903
index 1d94d13..de9d37e 100644
--- a/active/CVE-2017-0903
+++ b/active/CVE-2017-0903
@@ -10,6 +10,8 @@ References:
  https://ubuntu.com/security/notices/USN-3553-1
  https://ubuntu.com/security/notices/USN-3685-1
  https://ubuntu.com/security/notices/USN-3685-2
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html
+ https://www.debian.org/security/2017/dsa-4031
 Description:
  RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible
  remote code execution vulnerability. YAML deserialization of gem
diff --git a/active/CVE-2017-0918 b/active/CVE-2017-0918
index 15ebe27..6ecc401 100644
--- a/active/CVE-2017-0918
+++ b/active/CVE-2017-0918
@@ -3,6 +3,7 @@ PublicDate: 2018-03-21 20:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0918
  https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+ https://www.debian.org/security/2018/dsa-4145
 Description:
  Gitlab Community Edition version 10.3 is vulnerable to a path traversal
  issue in the GitLab CI runner component resulting in remote code execution.
diff --git a/active/CVE-2017-0925 b/active/CVE-2017-0925
index 3998fdb..589a8a0 100644
--- a/active/CVE-2017-0925
+++ b/active/CVE-2017-0925
@@ -3,6 +3,7 @@ PublicDate: 2018-03-21 20:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0925
  https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
+ https://www.debian.org/security/2018/dsa-4145
 Description:
  Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently
  protected credential issue in the project service integration API endpoint
diff --git a/active/CVE-2017-1000480 b/active/CVE-2017-1000480
index b6a7afe..43ab00e 100644
--- a/active/CVE-2017-1000480
+++ b/active/CVE-2017-1000480
@@ -3,6 +3,9 @@ PublicDate: 2018-01-03 18:29:00 UTC
 References: 
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000480
  https://github.com/smarty-php/smarty/commit/614ad1f8b9b00086efc123e49b7bb8efbfa81b61
+ https://lists.debian.org/debian-lts-announce/2018/01/msg00023.html
+ https://lists.debian.org/debian-lts-announce/2018/02/msg00000.html
+ https://www.debian.org/security/2018/dsa-4094
 Description:
  Smarty 3 before 3.1.32 is vulnerable to a PHP code injection when calling
  fetch() or display() functions on custom resources that does not sanitize
diff --git a/active/CVE-2017-1002201 b/active/CVE-2017-1002201
index e0c313f..6449fe5 100644
--- a/active/CVE-2017-1002201
+++ b/active/CVE-2017-1002201
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1002201
  https://github.com/haml/haml/commit/18576ae6e9bdcb4303fdbe6b3199869d289d67c2
  https://snyk.io/vuln/SNYK-RUBY-HAML-20362
+ https://lists.debian.org/debian-lts-announce/2019/11/msg00007.html
+ https://lists.debian.org/debian-lts-announce/2021/12/msg00028.html
 Description:
  In haml versions prior to version 5.0.0.beta.2, when using user input to
  perform tasks on the server, characters like < > " ' must be escaped
diff --git a/active/CVE-2017-10086 b/active/CVE-2017-10086
index c13b820..db87500 100644
--- a/active/CVE-2017-10086
+++ b/active/CVE-2017-10086
@@ -2,6 +2,7 @@ Candidate: CVE-2017-10086
 PublicDate: 2017-08-08 15:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10086
+ http://www.debian.org/security/2017/dsa-4005
 Description:
  Vulnerability in the Java SE component of Oracle Java SE (subcomponent:
  JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131.
diff --git a/active/CVE-2017-10114 b/active/CVE-2017-10114
index fd93b3b..adff038 100644
--- a/active/CVE-2017-10114
+++ b/active/CVE-2017-10114
@@ -2,6 +2,7 @@ Candidate: CVE-2017-10114
 PublicDate: 2017-08-08 15:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10114
+ http://www.debian.org/security/2017/dsa-4005
 Description:
  Vulnerability in the Java SE component of Oracle Java SE (subcomponent:
  JavaFX). Supported versions that are affected are Java SE: 7u141 and 8u131.
diff --git a/active/CVE-2017-10268 b/active/CVE-2017-10268
index a30afae..9e1aaff 100644
--- a/active/CVE-2017-10268
+++ b/active/CVE-2017-10268
@@ -6,6 +6,9 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
  https://ubuntu.com/security/notices/USN-3459-1
  https://ubuntu.com/security/notices/USN-3459-2
+ http://www.debian.org/security/2017/dsa-4002
+ https://lists.debian.org/debian-lts-announce/2018/06/msg00015.html
+ https://www.debian.org/security/2018/dsa-4341
 Description:
  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:
  Server: Replication). Supported versions that are affected are 5.5.57 and
diff --git a/active/CVE-2017-10378 b/active/CVE-2017-10378
index d5a3c64..ad128f0 100644
--- a/active/CVE-2017-10378
+++ b/active/CVE-2017-10378
@@ -6,6 +6,9 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
  https://ubuntu.com/security/notices/USN-3459-1
  https://ubuntu.com/security/notices/USN-3459-2
+ http://www.debian.org/security/2017/dsa-4002
+ https://lists.debian.org/debian-lts-announce/2018/06/msg00015.html
+ https://www.debian.org/security/2018/dsa-4341
 Description:
  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:
  Server: Optimizer). Supported versions that are affected are 5.5.57 and
diff --git a/active/CVE-2017-10379 b/active/CVE-2017-10379
index 9585570..892573e 100644
--- a/active/CVE-2017-10379
+++ b/active/CVE-2017-10379
@@ -6,6 +6,7 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
  https://ubuntu.com/security/notices/USN-3459-1
  https://ubuntu.com/security/notices/USN-3459-2
+ http://www.debian.org/security/2017/dsa-4002
 Description:
  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:
  Client programs). Supported versions that are affected are 5.5.57 and
diff --git a/active/CVE-2017-10384 b/active/CVE-2017-10384
index a070687..5c03dc3 100644
--- a/active/CVE-2017-10384
+++ b/active/CVE-2017-10384
@@ -6,6 +6,7 @@ References:
  http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
  https://ubuntu.com/security/notices/USN-3459-1
  https://ubuntu.com/security/notices/USN-3459-2
+ http://www.debian.org/security/2017/dsa-4002
 Description:
  Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent:
  Server: DDL). Supported versions that are affected are 5.5.57 and earlier
diff --git a/active/CVE-2017-10800 b/active/CVE-2017-10800
index 6ef9968..1f2c0a1 100644
--- a/active/CVE-2017-10800
+++ b/active/CVE-2017-10800
@@ -3,6 +3,7 @@ PublicDate: 2017-07-03 01:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10800
  http://hg.code.sf.net/p/graphicsmagick/code/rev/e5761e3a2012
+ https://www.debian.org/security/2018/dsa-4321
 Description:
  When GraphicsMagick 1.3.25 processes a MATLAB image in coders/mat.c, it can
  lead to a denial of service (OOM) in ReadMATImage() if the size specified
diff --git a/active/CVE-2017-10807 b/active/CVE-2017-10807
index 7e9386e..d74e8f4 100644
--- a/active/CVE-2017-10807
+++ b/active/CVE-2017-10807
@@ -3,6 +3,7 @@ PublicDate: 2017-07-04 15:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-10807
  https://github.com/jabberd2/jabberd2/releases/tag/jabberd-2.6.1
+ http://www.debian.org/security/2017/dsa-3902
 Description:
  JabberD 2.x (aka jabberd2) before 2.6.1 allows anyone to authenticate using
  SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.
diff --git a/active/CVE-2017-10911 b/active/CVE-2017-10911
index 4bb1f16..9266f20 100644
--- a/active/CVE-2017-10911
+++ b/active/CVE-2017-10911
@@ -15,6 +15,10 @@ References:
  https://ubuntu.com/security/notices/USN-3468-3
  https://ubuntu.com/security/notices/USN-3470-1
  https://ubuntu.com/security/notices/USN-3470-2
+ http://www.debian.org/security/2017/dsa-3920
+ http://www.debian.org/security/2017/dsa-3927
+ http://www.debian.org/security/2017/dsa-3945
+ https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
 Description:
  The make_response function in drivers/block/xen-blkback/blkback.c in the
  Linux kernel before 4.11.8 allows guest OS users to obtain sensitive
diff --git a/active/CVE-2017-11104 b/active/CVE-2017-11104
index 3244b2a..f8809de 100644
--- a/active/CVE-2017-11104
+++ b/active/CVE-2017-11104
@@ -5,6 +5,7 @@ References:
  https://lists.nic.cz/pipermail/knot-dns-users/2017-June/001144.html
  http://www.synacktiv.ninja/ressources/Knot_DNS_TSIG_Signature_Forgery.pdf
  https://bugs.debian.org/865678
+ http://www.debian.org/security/2017/dsa-3910
 Description:
  Knot DNS before 2.4.5 and 2.5.x before 2.5.2 contains a flaw within the
  TSIG protocol implementation that would allow an attacker with a valid key
diff --git a/active/CVE-2017-11423 b/active/CVE-2017-11423
index d06cbe0..cd23eb4 100644
--- a/active/CVE-2017-11423
+++ b/active/CVE-2017-11423
@@ -5,6 +5,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11423
  https://github.com/hackerlib/hackerlib-vul/tree/master/clamav-vul
  https://ubuntu.com/security/notices/USN-3394-1
+ http://www.debian.org/security/2017/dsa-3946
+ https://lists.debian.org/debian-lts-announce/2018/02/msg00014.html
 Description:
  The cabd_read_string function in mspack/cabd.c in libmspack 0.5alpha, as
  used in ClamAV 0.99.2 and other products, allows remote attackers to cause
diff --git a/active/CVE-2017-11521 b/active/CVE-2017-11521
index 26d5ab0..c30634f 100644
--- a/active/CVE-2017-11521
+++ b/active/CVE-2017-11521
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11521
  https://github.com/resiprocate/resiprocate/pull/88
  https://github.com/resiprocate/resiprocate/pull/88/commits/4b8ffa5afd3291a2701f8d39c31ada443f79a5c8
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00031.html
+ https://lists.debian.org/debian-lts-announce/2021/12/msg00029.html
 Description:
  The SdpContents::Session::Medium::parse function in
  resip/stack/SdpContents.cxx in reSIProcate 1.10.2 allows remote attackers
diff --git a/active/CVE-2017-11721 b/active/CVE-2017-11721
index 7193dbc..6100bff 100644
--- a/active/CVE-2017-11721
+++ b/active/CVE-2017-11721
@@ -3,6 +3,8 @@ PublicDate: 2017-08-03 08:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11721
  https://github.com/ioquake/ioq3/commit/d2b1d124d4055c2fcbe5126863487c52fd58cca1
+ http://www.debian.org/security/2017/dsa-3941
+ http://www.debian.org/security/2017/dsa-3948
 Description:
  Buffer overflow in ioquake3 before 2017-08-02 allows remote attackers to
  cause a denial of service (application crash) or possibly have unspecified
diff --git a/active/CVE-2017-11732 b/active/CVE-2017-11732
index 4ac7e55..7c46ce7 100644
--- a/active/CVE-2017-11732
+++ b/active/CVE-2017-11732
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11732
  https://github.com/libming/libming/issues/80
  http://somevulnsofadlab.blogspot.jp/2017/07/libmingheap-buffer-overflow-in-dcputs.html
+ https://lists.debian.org/debian-lts-announce/2018/01/msg00014.html
 Description:
  A heap-based buffer overflow vulnerability was found in the function dcputs
  (called from decompileIMPLEMENTS) in util/decompile.c in Ming 0.4.8, which
diff --git a/active/CVE-2017-11733 b/active/CVE-2017-11733
index 6946768..92081a4 100644
--- a/active/CVE-2017-11733
+++ b/active/CVE-2017-11733
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11733
  https://github.com/libming/libming/issues/78
  http://somevulnsofadlab.blogspot.jp/2017/07/libmingnull-pointer-dereference-in.html
+ https://lists.debian.org/debian-lts-announce/2017/11/msg00022.html
 Description:
  A null pointer dereference vulnerability was found in the function
  stackswap (called from decompileSTACKSWAP) in util/decompile.c in Ming
diff --git a/active/CVE-2017-12081 b/active/CVE-2017-12081
index 59a6e68..5dfffa0 100644
--- a/active/CVE-2017-12081
+++ b/active/CVE-2017-12081
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12081
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0433
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e04d7c49dca9dc7bbf1cbe446b612aaa5ba12581
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the upgrade of a legacy Mesh
  attribute of the Blender open-source 3d creation suite v2.78c. A specially
diff --git a/active/CVE-2017-12082 b/active/CVE-2017-12082
index dfde072..5e587e1 100644
--- a/active/CVE-2017-12082
+++ b/active/CVE-2017-12082
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12082
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0434
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e04d7c49dca9dc7bbf1cbe446b612aaa5ba12581
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the 'CustomData' Mesh loading
  functionality of the Blender open-source 3d creation suite. A .blend file
diff --git a/active/CVE-2017-12086 b/active/CVE-2017-12086
index 544fdbc..5a3a5b0 100644
--- a/active/CVE-2017-12086
+++ b/active/CVE-2017-12086
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12086
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0438
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e04d7c49dca9dc7bbf1cbe446b612aaa5ba12581
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the
  'BKE_mesh_calc_normals_tessface' functionality of the Blender open-source
diff --git a/active/CVE-2017-12099 b/active/CVE-2017-12099
index 5289d32..4ceb7c9 100644
--- a/active/CVE-2017-12099
+++ b/active/CVE-2017-12099
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12099
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0451
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e04d7c49dca9dc7bbf1cbe446b612aaa5ba12581
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the upgrade of the legacy Mesh
  attribute 'tface' of the Blender open-source 3d creation suite v2.78c. A
diff --git a/active/CVE-2017-12100 b/active/CVE-2017-12100
index 51eb6ca..13568ee 100644
--- a/active/CVE-2017-12100
+++ b/active/CVE-2017-12100
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12100
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0452
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e04d7c49dca9dc7bbf1cbe446b612aaa5ba12581
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the 'multires_load_old_dm'
  functionality of the Blender open-source 3d creation suite v2.78c. A
diff --git a/active/CVE-2017-12101 b/active/CVE-2017-12101
index e32545d..ebca4c9 100644
--- a/active/CVE-2017-12101
+++ b/active/CVE-2017-12101
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12101
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0453
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e04d7c49dca9dc7bbf1cbe446b612aaa5ba12581
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the
  'modifier_mdef_compact_influences' functionality of the Blender open-source
diff --git a/active/CVE-2017-12102 b/active/CVE-2017-12102
index 57d8c23..c8390c4 100644
--- a/active/CVE-2017-12102
+++ b/active/CVE-2017-12102
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12102
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0454
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e6df02861e17f75d4dd243776f35208681b78465
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the way that the Blender
  open-source 3d creation suite v2.78c converts curves to polygons. A
diff --git a/active/CVE-2017-12103 b/active/CVE-2017-12103
index 42a5984..f68cb1d 100644
--- a/active/CVE-2017-12103
+++ b/active/CVE-2017-12103
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12103
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0455
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e6df02861e17f75d4dd243776f35208681b78465
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the way that the Blender
  open-source 3d creation suite v2.78c converts text rendered as a font into
diff --git a/active/CVE-2017-12104 b/active/CVE-2017-12104
index 3647109..9ea802d 100644
--- a/active/CVE-2017-12104
+++ b/active/CVE-2017-12104
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12104
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0456
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e6df02861e17f75d4dd243776f35208681b78465
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the way that the Blender
  open-source 3d creation suite v2.78c draws a Particle object. A specially
diff --git a/active/CVE-2017-12105 b/active/CVE-2017-12105
index 87fe05c..5145f02 100644
--- a/active/CVE-2017-12105
+++ b/active/CVE-2017-12105
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12105
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0457
  https://git.blender.org/gitweb/gitweb.cgi/blender.git/commit/e04d7c49dca9dc7bbf1cbe446b612aaa5ba12581
+ https://lists.debian.org/debian-lts-announce/2018/08/msg00011.html
+ https://www.debian.org/security/2018/dsa-4248
 Description:
  An exploitable integer overflow exists in the way that the Blender
  open-source 3d creation suite v2.78c applies a particular object modifier
diff --git a/active/CVE-2017-12110 b/active/CVE-2017-12110
index 99546dc..20ba160 100644
--- a/active/CVE-2017-12110
+++ b/active/CVE-2017-12110
@@ -3,6 +3,7 @@ PublicDate: 2017-11-20 22:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12110
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0462
+ https://www.debian.org/security/2018/dsa-4173
 Description:
  An exploitable integer overflow vulnerability exists in the xls_appendSST
  function of libxls 1.4.A specially crafted XLS file can cause memory
diff --git a/active/CVE-2017-12111 b/active/CVE-2017-12111
index 7b5411b..7d0e550 100644
--- a/active/CVE-2017-12111
+++ b/active/CVE-2017-12111
@@ -3,6 +3,7 @@ PublicDate: 2017-11-20 22:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12111
  https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0463
+ https://www.debian.org/security/2018/dsa-4173
 Description:
  An exploitable out-of-bounds vulnerability exists in the xls_addCell
  function of libxls 1.4. A specially crafted XLS file with a formula record
diff --git a/active/CVE-2017-12155 b/active/CVE-2017-12155
index 02464d0..51a3a70 100644
--- a/active/CVE-2017-12155
+++ b/active/CVE-2017-12155
@@ -2,6 +2,7 @@ Candidate: CVE-2017-12155
 PublicDate: 2017-12-12 20:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12155
+ https://bugs.launchpad.net/tripleo/+bug/1720787
 Description:
  A resource-permission flaw was found in the
  openstack-tripleo-heat-templates package where
diff --git a/active/CVE-2017-12166 b/active/CVE-2017-12166
index 4c17930..16d9368 100644
--- a/active/CVE-2017-12166
+++ b/active/CVE-2017-12166
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12166
  https://community.openvpn.net/openvpn/wiki/CVE-2017-12166
  http://www.openwall.com/lists/oss-security/2017/09/28/2
+ https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html
 Description:
  OpenVPN versions before 2.3.3 and 2.4.x before 2.4.4 are vulnerable to a
  buffer overflow vulnerability when key-method 1 is used, possibly resulting
diff --git a/active/CVE-2017-12440 b/active/CVE-2017-12440
index 320c0fa..4e86fd2 100644
--- a/active/CVE-2017-12440
+++ b/active/CVE-2017-12440
@@ -3,6 +3,7 @@ PublicDate: 2017-08-18 14:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12440
  https://wiki.openstack.org/wiki/OSSN/OSSN-0080
+ http://www.debian.org/security/2017/dsa-3953
 Description:
  Aodh as packaged in Openstack Ocata and Newton before change-ID
  I8fd11a7f9fe3c0ea5f9843a89686ac06713b7851 and before Pike-rc1 does not
diff --git a/active/CVE-2017-12616 b/active/CVE-2017-12616
index 4d35c89..71ef6ff 100644
--- a/active/CVE-2017-12616
+++ b/active/CVE-2017-12616
@@ -6,6 +6,7 @@ References:
  https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.81
  https://lists.apache.org/thread.html/1df9b4552464caa42047062fe7175da0da06c18ecc8daf99258bbda6@%3Cannounce.tomcat.apache.org%3E
  https://ubuntu.com/security/notices/USN-3665-1
+ https://lists.debian.org/debian-lts-announce/2018/06/msg00008.html
 Description:
  When using a VirtualDirContext with Apache Tomcat 7.0.0 to 7.0.80 it was
  possible to bypass security constraints and/or view the source code of JSPs
diff --git a/active/CVE-2017-12617 b/active/CVE-2017-12617
index 479a02d..c9ce674 100644
--- a/active/CVE-2017-12617
+++ b/active/CVE-2017-12617
@@ -6,6 +6,7 @@ References:
  https://www.alphabot.com/security/blog/2017/java/Apache-Tomcat-RCE-CVE-2017-12617.html
  https://lists.apache.org/thread.html/3fd341a604c4e9eab39e7eaabbbac39c30101a022acc11dd09d7ebcb@%3Cannounce.tomcat.apache.org%3E
  https://ubuntu.com/security/notices/USN-3665-1
+ https://lists.debian.org/debian-lts-announce/2017/11/msg00009.html
 Description:
  When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22,
  8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via
diff --git a/active/CVE-2017-12635 b/active/CVE-2017-12635
index 256ba92..e7556a6 100644
--- a/active/CVE-2017-12635
+++ b/active/CVE-2017-12635
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12635
  http://www.openwall.com/lists/oss-security/2017/11/14/6
  https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E
+ https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html
 Description:
  Due to differences in the Erlang-based JSON parser and JavaScript-based
  JSON parser, it is possible in Apache CouchDB before 1.7.0 and 2.x before
diff --git a/active/CVE-2017-12636 b/active/CVE-2017-12636
index 8e834c5..2e3ec23 100644
--- a/active/CVE-2017-12636
+++ b/active/CVE-2017-12636
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12636
  http://www.openwall.com/lists/oss-security/2017/11/14/6
  https://lists.apache.org/thread.html/6c405bf3f8358e6314076be9f48c89a2e0ddf00539906291ebdf0c67@%3Cdev.couchdb.apache.org%3E
+ https://lists.debian.org/debian-lts-announce/2018/01/msg00026.html
 Description:
  CouchDB administrative users can configure the database server via HTTP(S).
  Some of the configuration options include paths for operating system-level
diff --git a/active/CVE-2017-12805 b/active/CVE-2017-12805
index 395ce20..6b02d14 100644
--- a/active/CVE-2017-12805
+++ b/active/CVE-2017-12805
@@ -4,6 +4,7 @@ PublicDate: 2019-05-09 16:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12805
  https://ubuntu.com/security/notices/USN-4034-1
+ https://lists.debian.org/debian-lts-announce/2020/08/msg00030.html
 Description:
  In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the
  function ReadTIFFImage, which allows attackers to cause a denial of
diff --git a/active/CVE-2017-12806 b/active/CVE-2017-12806
index 1702da0..bcfd982 100644
--- a/active/CVE-2017-12806
+++ b/active/CVE-2017-12806
@@ -4,6 +4,7 @@ PublicDate: 2019-05-09 16:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12806
  https://ubuntu.com/security/notices/USN-4034-1
+ https://lists.debian.org/debian-lts-announce/2020/09/msg00007.html
 Description:
  In ImageMagick 7.0.6-6, a memory exhaustion vulnerability was found in the
  function format8BIM, which allows attackers to cause a denial of service.
diff --git a/active/CVE-2017-12867 b/active/CVE-2017-12867
index 1b38864..40df780 100644
--- a/active/CVE-2017-12867
+++ b/active/CVE-2017-12867
@@ -3,6 +3,8 @@ PublicDate: 2017-08-29 15:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12867
  https://simplesamlphp.org/security/201708-01
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
+ https://www.debian.org/security/2018/dsa-4127
 Description:
  The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp 1.14.14 and
  earlier allows attackers with access to a secret token to extend its
diff --git a/active/CVE-2017-12868 b/active/CVE-2017-12868
index e67b0e6..651b211 100644
--- a/active/CVE-2017-12868
+++ b/active/CVE-2017-12868
@@ -3,6 +3,8 @@ PublicDate: 2017-09-01 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12868
  https://simplesamlphp.org/security/201705-01
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
+ https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html
 Description:
  The secureCompare method in lib/SimpleSAML/Utils/Crypto.php in
  SimpleSAMLphp 1.14.13 and earlier, when used with PHP before 5.6, allows
diff --git a/active/CVE-2017-12869 b/active/CVE-2017-12869
index f149cd4..0ec0b29 100644
--- a/active/CVE-2017-12869
+++ b/active/CVE-2017-12869
@@ -3,6 +3,8 @@ PublicDate: 2017-09-01 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12869
  https://simplesamlphp.org/security/201704-02
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
+ https://www.debian.org/security/2018/dsa-4127
 Description:
  The multiauth module in SimpleSAMLphp 1.14.13 and earlier allows remote
  attackers to bypass authentication context restrictions and use an
diff --git a/active/CVE-2017-12872 b/active/CVE-2017-12872
index 9fb5d43..b42b214 100644
--- a/active/CVE-2017-12872
+++ b/active/CVE-2017-12872
@@ -3,6 +3,8 @@ PublicDate: 2017-09-01 21:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12872
  https://simplesamlphp.org/security/201703-01
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
+ https://lists.debian.org/debian-lts-announce/2018/06/msg00017.html
 Description:
  The (1) Htpasswd authentication source in the authcrypt module and (2)
  SimpleSAML_Session class in SimpleSAMLphp 1.14.11 and earlier allow remote
diff --git a/active/CVE-2017-12873 b/active/CVE-2017-12873
index 2d6bea6..8bf0270 100644
--- a/active/CVE-2017-12873
+++ b/active/CVE-2017-12873
@@ -3,6 +3,8 @@ PublicDate: 2017-09-01 21:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12873
  https://simplesamlphp.org/security/201612-04
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
+ https://www.debian.org/security/2018/dsa-4127
 Description:
  SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain
  sensitive information, gain unauthorized access, or have unspecified other
diff --git a/active/CVE-2017-12874 b/active/CVE-2017-12874
index b8481d2..a25031b 100644
--- a/active/CVE-2017-12874
+++ b/active/CVE-2017-12874
@@ -3,6 +3,8 @@ PublicDate: 2017-09-01 21:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12874
  https://simplesamlphp.org/security/201612-03
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00007.html
+ https://www.debian.org/security/2018/dsa-4127
 Description:
  The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML
  messages by leveraging an incorrect check of return values in signature
diff --git a/active/CVE-2017-12976 b/active/CVE-2017-12976
index 9a1e986..5214362 100644
--- a/active/CVE-2017-12976
+++ b/active/CVE-2017-12976
@@ -5,6 +5,8 @@ References:
  http://source.git-annex.branchable.com/?p=source.git;a=commit;h=df11e54788b254efebb4898b474de11ae8d3b471
  http://source.git-annex.branchable.com/?p=source.git;a=commit;h=c24d0f0e8984576654e2be149005bc884fe0403a
  http://source.git-annex.branchable.com/?p=source.git;a=blob;f=doc/bugs/dashed_ssh_hostname_security_hole.mdwn
+ http://www.debian.org/security/2017/dsa-4010
+ https://lists.debian.org/debian-lts-announce/2018/09/msg00004.html
 Description:
  git-annex before 6.20170818 allows remote attackers to execute arbitrary
  commands via an ssh URL with an initial dash character in the hostname, as
diff --git a/active/CVE-2017-13144 b/active/CVE-2017-13144
index c12b1a5..b28ef2c 100644
--- a/active/CVE-2017-13144
+++ b/active/CVE-2017-13144
@@ -7,6 +7,8 @@ References:
  https://ubuntu.com/security/notices/USN-3681-1
  https://ubuntu.com/security/notices/USN-3785-1
  https://ubuntu.com/security/notices/USN-5335-1
+ https://www.debian.org/security/2017/dsa-4019
+ https://www.debian.org/security/2017/dsa-4040
 Description:
  In ImageMagick before 6.9.7-10, there is a crash (rather than a "width or
  height exceeds limit" error report) if the image dimensions are too large,
diff --git a/active/CVE-2017-13748 b/active/CVE-2017-13748
index 373710f..d689901 100644
--- a/active/CVE-2017-13748
+++ b/active/CVE-2017-13748
@@ -2,6 +2,7 @@ Candidate: CVE-2017-13748
 PublicDate: 2017-08-29 06:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13748
+ https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html
 Description:
  There are lots of memory leaks in JasPer 2.0.12, triggered in the function
  jas_strdup() in base/jas_string.c, that will lead to a remote denial of
diff --git a/active/CVE-2017-13756 b/active/CVE-2017-13756
index 8fcbae8..53c0438 100644
--- a/active/CVE-2017-13756
+++ b/active/CVE-2017-13756
@@ -3,6 +3,7 @@ PublicDate: 2017-08-29 22:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13756
  https://github.com/sleuthkit/sleuthkit/issues/914
+ https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html
 Description:
  In The Sleuth Kit (TSK) 4.4.2, opening a crafted disk image triggers
  infinite recursion in dos_load_ext_table() in tsk/vs/dos.c in libtskvs.a,
diff --git a/active/CVE-2017-13760 b/active/CVE-2017-13760
index 2b70f3d..b0da2cc 100644
--- a/active/CVE-2017-13760
+++ b/active/CVE-2017-13760
@@ -3,6 +3,7 @@ PublicDate: 2017-08-29 23:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13760
  https://github.com/sleuthkit/sleuthkit/issues/906
+ https://lists.debian.org/debian-lts-announce/2022/06/msg00015.html
 Description:
  In The Sleuth Kit (TSK) 4.4.2, fls hangs on a corrupt exfat image in
  tsk_img_read() in tsk/img/img_io.c in libtskimg.a.
diff --git a/active/CVE-2017-14099 b/active/CVE-2017-14099
index 7aa9fdb..3beefc7 100644
--- a/active/CVE-2017-14099
+++ b/active/CVE-2017-14099
@@ -8,6 +8,7 @@ References:
  https://bugs.debian.org/873907
  https://rtpbleed.com
  https://gerrit.asterisk.org/#/c/6356/
+ http://www.debian.org/security/2017/dsa-3964
 Description:
  In res/res_rtp_asterisk.c in Asterisk 11.x before 11.25.2, 13.x before
  13.17.1, and 14.x before 14.6.1 and Certified Asterisk 11.x before
diff --git a/active/CVE-2017-14100 b/active/CVE-2017-14100
index a7b9e20..0d47189 100644
--- a/active/CVE-2017-14100
+++ b/active/CVE-2017-14100
@@ -6,6 +6,7 @@ References:
  http://downloads.asterisk.org/pub/security/AST-2017-006.html
  http://www.securitytracker.com/id/1039252
  https://bugs.debian.org/873908
+ http://www.debian.org/security/2017/dsa-3964
 Description:
  In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before
  14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before
diff --git a/active/CVE-2017-14132 b/active/CVE-2017-14132
index 7260043..822650a 100644
--- a/active/CVE-2017-14132
+++ b/active/CVE-2017-14132
@@ -2,6 +2,7 @@ Candidate: CVE-2017-14132
 PublicDate: 2017-09-04 20:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14132
+ https://lists.debian.org/debian-lts-announce/2018/11/msg00023.html
 Description:
  JasPer 1.900.8, 1.900.9, 1.900.10, 1.900.11, 1.900.12, 1.900.13, 1.900.14,
  1.900.15, 1.900.16, 1.900.17, 1.900.18, 1.900.19, 1.900.20, 1.900.21,
diff --git a/active/CVE-2017-14160 b/active/CVE-2017-14160
index 02cef40..6512c7e 100644
--- a/active/CVE-2017-14160
+++ b/active/CVE-2017-14160
@@ -7,6 +7,8 @@ References:
  http://www.openwall.com/lists/oss-security/2017/09/21/3
  http://openwall.com/lists/oss-security/2017/09/21/2
  https://ubuntu.com/security/notices/USN-5420-1
+ https://lists.debian.org/debian-lts-announce/2019/11/msg00031.html
+ https://lists.debian.org/debian-lts-announce/2021/11/msg00023.html
 Description:
  The bark_noise_hybridmp function in psy.c in Xiph.Org libvorbis 1.3.5
  allows remote attackers to cause a denial of service (out-of-bounds access
diff --git a/active/CVE-2017-14339 b/active/CVE-2017-14339
index a383908..7de12f6 100644
--- a/active/CVE-2017-14339
+++ b/active/CVE-2017-14339
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14339
  https://www.tarlogic.com/blog/fuzzing-yadifa-dns/
  https://github.com/yadifa/yadifa/blob/v2.2.6/ChangeLog
+ http://www.debian.org/security/2017/dsa-4001
 Description:
  The DNS packet parser in YADIFA before 2.2.6 does not check for the
  presence of infinite pointer loops, and thus it is possible to force it to
diff --git a/active/CVE-2017-14528 b/active/CVE-2017-14528
index 2904627..6964ab3 100644
--- a/active/CVE-2017-14528
+++ b/active/CVE-2017-14528
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14528
  https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=32560
  https://ubuntu.com/security/notices/USN-4988-1
+ https://lists.debian.org/debian-lts-announce/2021/01/msg00010.html
 Description:
  The TIFFSetProfiles function in coders/tiff.c in ImageMagick 7.0.6 has
  incorrect expectations about whether LibTIFF TIFFGetField return values
diff --git a/active/CVE-2017-14603 b/active/CVE-2017-14603
index 7334b74..202761a 100644
--- a/active/CVE-2017-14603
+++ b/active/CVE-2017-14603
@@ -5,6 +5,7 @@ References:
  http://downloads.asterisk.org/pub/security/AST-2017-008.html
  https://issues.asterisk.org/jira/browse/ASTERISK-27274
  https://issues.asterisk.org/jira/browse/ASTERISK-27252
+ http://www.debian.org/security/2017/dsa-3990
 Description:
  In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before
  14.6.2 and Certified Asterisk 11.x before 11.6-cert18 and 13.x before
diff --git a/active/CVE-2017-14604 b/active/CVE-2017-14604
index e42cfc3..5b4db6b 100644
--- a/active/CVE-2017-14604
+++ b/active/CVE-2017-14604
@@ -3,6 +3,7 @@ PublicDate: 2017-09-20 08:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14604
  https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/
+ http://www.debian.org/security/2017/dsa-3994
 Description:
  GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by
  using the .desktop file extension, as demonstrated by an attack in which a
diff --git a/active/CVE-2017-14635 b/active/CVE-2017-14635
index 7464028..b93b88e 100644
--- a/active/CVE-2017-14635
+++ b/active/CVE-2017-14635
@@ -3,6 +3,7 @@ PublicDate: 2017-09-21 13:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14635
  https://www.otrs.com/security-advisory-2017-04-security-update-otrs-versions/
+ https://www.debian.org/security/2017/dsa-4021
 Description:
  In Open Ticket Request System (OTRS) 3.3.x before 3.3.18, 4.x before
  4.0.25, and 5.x before 5.0.23, remote authenticated users can leverage
diff --git a/active/CVE-2017-14650 b/active/CVE-2017-14650
index b1d4e87..a876227 100644
--- a/active/CVE-2017-14650
+++ b/active/CVE-2017-14650
@@ -5,6 +5,7 @@ References:
  https://marc.info/?l=horde-announce&m=150600299528079&w=2
  https://github.com/horde/horde/commit/eb3afd14c22c77ae0d29e2848f5ac726ef6e7c5b
  http://www.openwall.com/lists/oss-security/2017/09/21/4
+ https://www.debian.org/security/2018/dsa-4276
 Description:
  A Remote Code Execution vulnerability has been found in the Horde_Image
  library when using the "Im" backend that utilizes ImageMagick's "convert"
diff --git a/active/CVE-2017-14686 b/active/CVE-2017-14686
index 89ad490..b811bb4 100644
--- a/active/CVE-2017-14686
+++ b/active/CVE-2017-14686
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14686
  http://git.ghostscript.com/?p=mupdf.git;h=0f0fbc07d9be31f5e83ec5328d7311fdfd8328b1
  https://bugs.ghostscript.com/show_bug.cgi?id=698540
+ http://www.debian.org/security/2017/dsa-4006
 Description:
  Artifex MuPDF 1.11 allows attackers to execute arbitrary code or cause a
  denial of service via a crafted .xps file, related to a "User Mode Write AV
diff --git a/active/CVE-2017-14687 b/active/CVE-2017-14687
index cd785b0..a687a63 100644
--- a/active/CVE-2017-14687
+++ b/active/CVE-2017-14687
@@ -4,6 +4,8 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14687
  http://git.ghostscript.com/?p=mupdf.git;h=2b16dbd8f73269cb15ca61ece75cf8d2d196ed28
  https://bugs.ghostscript.com/show_bug.cgi?id=698558
+ http://www.debian.org/security/2017/dsa-4006
+ https://lists.debian.org/debian-lts-announce/2017/11/msg00007.html
 Description:
  Artifex MuPDF 1.11 allows attackers to cause a denial of service or
  possibly have unspecified other impact via a crafted .xps file, related to
diff --git a/active/CVE-2017-14718 b/active/CVE-2017-14718
index a687468..3a5c692 100644
--- a/active/CVE-2017-14718
+++ b/active/CVE-2017-14718
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14718
  https://core.trac.wordpress.org/changeset/41393
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress was susceptible to a Cross-Site Scripting
  attack in the link modal via a javascript: or data: URL.
diff --git a/active/CVE-2017-14719 b/active/CVE-2017-14719
index b7dfda8..858f4d4 100644
--- a/active/CVE-2017-14719
+++ b/active/CVE-2017-14719
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14719
  https://core.trac.wordpress.org/changeset/41457
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress was vulnerable to a directory traversal
  attack during unzip operations in the ZipArchive and PclZip components.
diff --git a/active/CVE-2017-14720 b/active/CVE-2017-14720
index 9aad643..71251ee 100644
--- a/active/CVE-2017-14720
+++ b/active/CVE-2017-14720
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14720
  https://core.trac.wordpress.org/changeset/41412
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress allowed a Cross-Site scripting attack in
  the template list view via a crafted template name.
diff --git a/active/CVE-2017-14721 b/active/CVE-2017-14721
index 880d00e..9bdd38f 100644
--- a/active/CVE-2017-14721
+++ b/active/CVE-2017-14721
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14721
  https://core.trac.wordpress.org/changeset/41412
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress allowed Cross-Site scripting in the plugin
  editor via a crafted plugin name.
diff --git a/active/CVE-2017-14722 b/active/CVE-2017-14722
index d4b3474..c158e39 100644
--- a/active/CVE-2017-14722
+++ b/active/CVE-2017-14722
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14722
  https://core.trac.wordpress.org/changeset/41397
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress allowed a Directory Traversal attack in the
  Customizer component via a crafted theme filename.
diff --git a/active/CVE-2017-14723 b/active/CVE-2017-14723
index d80fee3..7aa2c83 100644
--- a/active/CVE-2017-14723
+++ b/active/CVE-2017-14723
@@ -9,6 +9,7 @@ References:
  https://medium.com/websec/wordpress-sqli-bbb2afcc8e94
  https://medium.com/websec/wordpress-sqli-poc-f1827c20bf8e
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress mishandled % characters and additional
  placeholder values in $wpdb->prepare, and thus did not properly address the
diff --git a/active/CVE-2017-14724 b/active/CVE-2017-14724
index 5d32249..97a63db 100644
--- a/active/CVE-2017-14724
+++ b/active/CVE-2017-14724
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14724
  https://core.trac.wordpress.org/changeset/41448
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress was vulnerable to cross-site scripting in
  oEmbed discovery.
diff --git a/active/CVE-2017-14725 b/active/CVE-2017-14725
index e87438e..d439c1f 100644
--- a/active/CVE-2017-14725
+++ b/active/CVE-2017-14725
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14725
  https://core.trac.wordpress.org/changeset/41398
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress was susceptible to an open redirect attack
  in wp-admin/edit-tag-form.php and wp-admin/user-edit.php.
diff --git a/active/CVE-2017-14726 b/active/CVE-2017-14726
index 5e25d8d..b6fb5cb 100644
--- a/active/CVE-2017-14726
+++ b/active/CVE-2017-14726
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14726
  https://core.trac.wordpress.org/changeset/41395
  https://wordpress.org/news/2017/09/wordpress-4-8-2-security-and-maintenance-release/
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  Before version 4.8.2, WordPress was vulnerable to a cross-site scripting
  attack via shortcodes in the TinyMCE visual editor.
diff --git a/active/CVE-2017-14737 b/active/CVE-2017-14737
index da1ebdf..a3f3a76 100644
--- a/active/CVE-2017-14737
+++ b/active/CVE-2017-14737
@@ -4,6 +4,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14737
  https://github.com/randombit/botan/issues/1222
  https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/wang-shuai
+ https://lists.debian.org/debian-lts-announce/2021/11/msg00006.html
 Description:
  A cryptographic cache-based side channel in the RSA implementation in Botan
  before 1.10.17, and 1.11.x and 2.x before 2.3.0, allows a local attacker to
diff --git a/active/CVE-2017-14990 b/active/CVE-2017-14990
index e21d0e2..d80dc04 100644
--- a/active/CVE-2017-14990
+++ b/active/CVE-2017-14990
@@ -2,6 +2,7 @@ Candidate: CVE-2017-14990
 PublicDate: 2017-10-03 01:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14990
+ https://www.debian.org/security/2017/dsa-3997
 Description:
  WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but
  stores the analogous wp_users.user_activation_key values as hashes), which
diff --git a/active/CVE-2017-15041 b/active/CVE-2017-15041
index 656f2c4..1f6a6c9 100644
--- a/active/CVE-2017-15041
+++ b/active/CVE-2017-15041
@@ -5,6 +5,8 @@ References:
  https://golang.org/cl/68022
  https://golang.org/cl/68190
  https://groups.google.com/d/msg/golang-dev/RinSE3EiJBI/kYL7zb07AgAJ
+ https://lists.debian.org/debian-lts-announce/2021/03/msg00014.html
+ https://lists.debian.org/debian-lts-announce/2021/03/msg00015.html
 Description:
  Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command
  execution. Using custom domains, it is possible to arrange things so that
diff --git a/active/CVE-2017-15095 b/active/CVE-2017-15095
index 261509f..1acc9ff 100644
--- a/active/CVE-2017-15095
+++ b/active/CVE-2017-15095
@@ -11,6 +11,8 @@ References:
  https://github.com/FasterXML/jackson-databind/commit/ddfddfba
  https://github.com/FasterXML/jackson-databind/blob/7093008aa2afe8068e120df850189ae072dfa1b2/src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java#L43
  https://ubuntu.com/security/notices/USN-4741-1
+ https://lists.debian.org/debian-lts-announce/2020/01/msg00037.html
+ https://www.debian.org/security/2017/dsa-4037
 Description:
  A deserialization flaw was discovered in the jackson-databind in versions
  before 2.8.10 and 2.9.1, which could allow an unauthenticated user to
diff --git a/active/CVE-2017-15108 b/active/CVE-2017-15108
index d649d44..d6545ef 100644
--- a/active/CVE-2017-15108
+++ b/active/CVE-2017-15108
@@ -2,6 +2,7 @@ Candidate: CVE-2017-15108
 PublicDate: 2018-01-20 00:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15108
+ https://lists.debian.org/debian-lts-announce/2021/01/msg00012.html
 Description:
  spice-vdagent up to and including 0.17.0 does not properly escape save
  directory before passing to shell, allowing local attacker with access to
diff --git a/active/CVE-2017-15120 b/active/CVE-2017-15120
index b36ec81..bafe2de 100644
--- a/active/CVE-2017-15120
+++ b/active/CVE-2017-15120
@@ -3,6 +3,7 @@ PublicDate: 2018-07-27 15:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15120
  https://doc.powerdns.com/recursor/security-advisories/powerdns-advisory-2017-08.html
+ https://www.debian.org/security/2017/dsa-4063
 Description:
  An issue has been found in the parsing of authoritative answers in PowerDNS
  Recursor before 4.0.8, leading to a NULL pointer dereference when parsing a
diff --git a/active/CVE-2017-15134 b/active/CVE-2017-15134
index ddea1c2..a703936 100644
--- a/active/CVE-2017-15134
+++ b/active/CVE-2017-15134
@@ -2,6 +2,7 @@ Candidate: CVE-2017-15134
 PublicDate: 2018-03-01 22:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15134
+ https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html
 Description:
  A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x
  before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled
diff --git a/active/CVE-2017-15266 b/active/CVE-2017-15266
index ed38495..12a9ecb 100644
--- a/active/CVE-2017-15266
+++ b/active/CVE-2017-15266
@@ -7,6 +7,7 @@ References:
  http://openwall.com/lists/oss-security/2017/10/11/1
  https://bugzilla.redhat.com/show_bug.cgi?id=1499599
  https://ubuntu.com/security/notices/USN-4641-1
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
 Description:
  In GNU Libextractor 1.4, there is a Divide-By-Zero in
  EXTRACTOR_wav_extract_method in wav_extractor.c via a zero sample rate.
diff --git a/active/CVE-2017-15267 b/active/CVE-2017-15267
index 7cd72a2..a6e3e2b 100644
--- a/active/CVE-2017-15267
+++ b/active/CVE-2017-15267
@@ -7,6 +7,7 @@ References:
  http://openwall.com/lists/oss-security/2017/10/11/1
  https://bugzilla.redhat.com/show_bug.cgi?id=1499600
  https://ubuntu.com/security/notices/USN-4641-1
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
 Description:
  In GNU Libextractor 1.4, there is a NULL Pointer Dereference in
  flac_metadata in flac_extractor.c.
diff --git a/active/CVE-2017-15365 b/active/CVE-2017-15365
index 82a5829..16f7c05 100644
--- a/active/CVE-2017-15365
+++ b/active/CVE-2017-15365
@@ -3,6 +3,7 @@ PublicDate: 2018-01-25 16:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15365
  https://www.percona.com/doc/percona-xtradb-cluster/LATEST/release-notes/Percona-XtraDB-Cluster-5.7.19-29.22-3.html
+ https://www.debian.org/security/2018/dsa-4341
 Description:
  sql/event_data_objects.cc in MariaDB before 10.1.30 and 10.2.x before
  10.2.10 and Percona XtraDB Cluster before 5.6.37-26.21-3 and 5.7.x before
diff --git a/active/CVE-2017-15377 b/active/CVE-2017-15377
index 82f51f1..e4bf0d9 100644
--- a/active/CVE-2017-15377
+++ b/active/CVE-2017-15377
@@ -3,6 +3,7 @@ PublicDate: 2017-10-23 08:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15377
  https://redmine.openinfosecfoundation.org/issues/2231
+ https://lists.debian.org/debian-lts-announce/2018/12/msg00000.html
 Description:
  In Suricata before 4.x, it was possible to trigger lots of redundant checks
  on the content of crafted network traffic with a certain signature, because
diff --git a/active/CVE-2017-15568 b/active/CVE-2017-15568
index 6c20541..d67ea3e 100644
--- a/active/CVE-2017-15568
+++ b/active/CVE-2017-15568
@@ -6,6 +6,7 @@ References:
  https://www.redmine.org/issues/27186 (private)
  https://github.com/redmine/redmine/commit/94f7cfbf990028348b9262578acbc53a94fce448
  https://www.redmine.org/issues/27186
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS
  exists in app/helpers/application_helper.rb via a multi-value field with a
diff --git a/active/CVE-2017-15569 b/active/CVE-2017-15569
index f245741..0638320 100644
--- a/active/CVE-2017-15569
+++ b/active/CVE-2017-15569
@@ -6,6 +6,7 @@ References:
  https://www.redmine.org/issues/27186 (private)
  https://github.com/redmine/redmine/commit/56c8ee0440d8555aa7822d947ba9091c8a791508
  https://www.redmine.org/issues/27186
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS
  exists in app/helpers/queries_helper.rb via a multi-value field with a
diff --git a/active/CVE-2017-15570 b/active/CVE-2017-15570
index bfa52c0..dd2cfca 100644
--- a/active/CVE-2017-15570
+++ b/active/CVE-2017-15570
@@ -6,6 +6,7 @@ References:
  https://www.redmine.org/issues/27186 (private)
  https://github.com/redmine/redmine/commit/1a0976417975a128b0a932ba1552c37e9414953b
  https://www.redmine.org/issues/27186
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS
  exists in app/views/timelog/_list.html.erb via crafted column data.
diff --git a/active/CVE-2017-15571 b/active/CVE-2017-15571
index 75fb9f3..0cf24bc 100644
--- a/active/CVE-2017-15571
+++ b/active/CVE-2017-15571
@@ -6,6 +6,7 @@ References:
  https://www.redmine.org/issues/27186 (private)
  https://github.com/redmine/redmine/commit/273dd9cb3bcfb1e0a0b90570b3b34eafa07d67aa
  https://www.redmine.org/issues/27186
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  In Redmine before 3.2.8, 3.3.x before 3.3.5, and 3.4.x before 3.4.3, XSS
  exists in app/views/issues/_list.html.erb via crafted column data.
diff --git a/active/CVE-2017-15572 b/active/CVE-2017-15572
index be9d35c..192afd9 100644
--- a/active/CVE-2017-15572
+++ b/active/CVE-2017-15572
@@ -5,6 +5,7 @@ References:
  https://www.redmine.org/projects/redmine/wiki/Security_Advisories
  https://www.redmine.org/issues/24416 (private)
  https://www.redmine.org/issues/24416
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  In Redmine before 3.2.6 and 3.3.x before 3.3.3, remote attackers can obtain
  sensitive information (password reset tokens) by reading a Referer log,
diff --git a/active/CVE-2017-15573 b/active/CVE-2017-15573
index 6580a23..00d5c2b 100644
--- a/active/CVE-2017-15573
+++ b/active/CVE-2017-15573
@@ -5,6 +5,7 @@ References:
  https://www.redmine.org/projects/redmine/wiki/Security_Advisories
  https://www.redmine.org/issues/25503 (private)
  https://www.redmine.org/issues/25503
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  In Redmine before 3.2.6 and 3.3.x before 3.3.3, XSS exists because markup
  is mishandled in wiki content.
diff --git a/active/CVE-2017-15574 b/active/CVE-2017-15574
index 7215e7b..a5563fe 100644
--- a/active/CVE-2017-15574
+++ b/active/CVE-2017-15574
@@ -5,6 +5,7 @@ References:
  https://www.redmine.org/projects/redmine/wiki/Security_Advisories
  https://www.redmine.org/issues/24199 (private)
  https://www.redmine.org/issues/24199
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  In Redmine before 3.2.6 and 3.3.x before 3.3.3, stored XSS is possible by
  using an SVG document as an attachment.
diff --git a/active/CVE-2017-15575 b/active/CVE-2017-15575
index 76b3c8b..2e44921 100644
--- a/active/CVE-2017-15575
+++ b/active/CVE-2017-15575
@@ -5,6 +5,7 @@ References:
  https://www.redmine.org/projects/redmine/wiki/Security_Advisories
  https://www.redmine.org/issues/24307 (private)
  https://www.redmine.org/issues/24307
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  In Redmine before 3.2.6 and 3.3.x before 3.3.3, Redmine.pm lacks a check
  for whether the Repository module is enabled in a project's settings, which
diff --git a/active/CVE-2017-15576 b/active/CVE-2017-15576
index d57c668..b925db8 100644
--- a/active/CVE-2017-15576
+++ b/active/CVE-2017-15576
@@ -5,6 +5,7 @@ References:
  https://www.redmine.org/projects/redmine/wiki/Security_Advisories
  https://www.redmine.org/issues/23803 (private)
  https://www.redmine.org/issues/23803
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles Time Entry rendering
  in activity views, which allows remote attackers to obtain sensitive
diff --git a/active/CVE-2017-15577 b/active/CVE-2017-15577
index dbbb872..9a52dc1 100644
--- a/active/CVE-2017-15577
+++ b/active/CVE-2017-15577
@@ -5,6 +5,7 @@ References:
  https://www.redmine.org/projects/redmine/wiki/Security_Advisories
  https://www.redmine.org/issues/23793 (private)
  https://www.redmine.org/issues/23793
+ https://www.debian.org/security/2018/dsa-4191
 Description:
  Redmine before 3.2.6 and 3.3.x before 3.3.3 mishandles the rendering of
  wiki links, which allows remote attackers to obtain sensitive information.
diff --git a/active/CVE-2017-15587 b/active/CVE-2017-15587
index 91adfdc..30dfadc 100644
--- a/active/CVE-2017-15587
+++ b/active/CVE-2017-15587
@@ -5,6 +5,8 @@ References:
  http://git.ghostscript.com/?p=mupdf.git;h=82df2631d7d0446b206ea6b434ea609b6c28b0e8
  https://bugs.ghostscript.com/show_bug.cgi?id=698605 (not public)
  https://nandynarwhals.org/CVE-2017-15587/
+ http://www.debian.org/security/2017/dsa-4006
+ https://lists.debian.org/debian-lts-announce/2017/11/msg00007.html
 Description:
  An integer overflow was discovered in pdf_read_new_xref_section in
  pdf/pdf-xref.c in Artifex MuPDF 1.11.
diff --git a/active/CVE-2017-15597 b/active/CVE-2017-15597
index 3276aab..93a6c16 100644
--- a/active/CVE-2017-15597
+++ b/active/CVE-2017-15597
@@ -3,6 +3,8 @@ PublicDate: 2017-10-30 14:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15597
  https://xenbits.xen.org/xsa/advisory-236.html
+ https://lists.debian.org/debian-lts-announce/2018/10/msg00009.html
+ https://www.debian.org/security/2017/dsa-4050
 Description:
  An issue was discovered in Xen through 4.9.x. Grant copying code made an
  implication that any grant pin would be accompanied by a suitable page
diff --git a/active/CVE-2017-15600 b/active/CVE-2017-15600
index cd67859..2b43e28 100644
--- a/active/CVE-2017-15600
+++ b/active/CVE-2017-15600
@@ -6,6 +6,7 @@ References:
  http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00004.html
  https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz
  https://ubuntu.com/security/notices/USN-4641-1
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
 Description:
  In GNU Libextractor 1.4, there is a NULL Pointer Dereference in the
  EXTRACTOR_nsf_extract_method function of plugins/nsf_extractor.c.
diff --git a/active/CVE-2017-15601 b/active/CVE-2017-15601
index 7e5b38b..4daf889 100644
--- a/active/CVE-2017-15601
+++ b/active/CVE-2017-15601
@@ -6,6 +6,7 @@ References:
  http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00006.html
  https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz
  https://ubuntu.com/security/notices/USN-4641-1
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
 Description:
  In GNU Libextractor 1.4, there is a heap-based buffer overflow in the
  EXTRACTOR_png_extract_method function in plugins/png_extractor.c, related
diff --git a/active/CVE-2017-15602 b/active/CVE-2017-15602
index 04490cb..8a0184a 100644
--- a/active/CVE-2017-15602
+++ b/active/CVE-2017-15602
@@ -6,6 +6,7 @@ References:
  http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00005.html
  https://ftp.gnu.org/gnu/libextractor/libextractor-1.6.tar.gz
  https://ubuntu.com/security/notices/USN-4641-1
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
 Description:
  In GNU Libextractor 1.4, there is an integer signedness error for the chunk
  size in the EXTRACTOR_nsfe_extract_method function in
diff --git a/active/CVE-2017-15672 b/active/CVE-2017-15672
index 5f6590e..078675b 100644
--- a/active/CVE-2017-15672
+++ b/active/CVE-2017-15672
@@ -2,6 +2,8 @@ Candidate: CVE-2017-15672
 PublicDate: 2017-11-06 17:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15672
+ https://lists.debian.org/debian-lts-announce/2019/01/msg00006.html
+ https://www.debian.org/security/2017/dsa-4049
 Description:
  The read_header function in libavcodec/ffv1dec.c in FFmpeg 2.4 and 3.3.4
  and possibly earlier allows remote attackers to have unspecified impact via
diff --git a/active/CVE-2017-15698 b/active/CVE-2017-15698
index 39703b3..3f7f91c 100644
--- a/active/CVE-2017-15698
+++ b/active/CVE-2017-15698
@@ -5,6 +5,8 @@ References:
  https://lists.apache.org/thread.html/6eb0a53e5827d97db1a05c736d01101fec21202a5b8fc77bb0eaaed8@%3Cannounce.tomcat.apache.org%3E
  http://svn.apache.org/r1815200
  http://svn.apache.org/r1815218
+ https://lists.debian.org/debian-lts-announce/2018/02/msg00011.html
+ https://www.debian.org/security/2018/dsa-4118
 Description:
  When parsing the AIA-Extension field of a client certificate, Apache Tomcat
  Native Connector 1.2.0 to 1.2.14 and 1.1.23 to 1.1.34 did not correctly
diff --git a/active/CVE-2017-15736 b/active/CVE-2017-15736
index 0762757..30f6157 100644
--- a/active/CVE-2017-15736
+++ b/active/CVE-2017-15736
@@ -4,6 +4,7 @@ PublicDate: 2017-10-22 18:29:00 UTC
 References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15736
  https://ubuntu.com/security/notices/USN-4536-1
+ https://www.debian.org/security/2018/dsa-4228
 Description:
  Cross-site scripting (XSS) vulnerability (stored) in SPIP before 3.1.7
  allows remote attackers to inject arbitrary web script or HTML via a
diff --git a/active/CVE-2017-15922 b/active/CVE-2017-15922
index ecf7ef1..ff45172 100644
--- a/active/CVE-2017-15922
+++ b/active/CVE-2017-15922
@@ -5,6 +5,7 @@ References:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15922
  http://lists.gnu.org/archive/html/bug-libextractor/2017-10/msg00008.html
  https://ubuntu.com/security/notices/USN-4641-1
+ https://lists.debian.org/debian-lts-announce/2017/12/msg00000.html
 Description:
  In GNU Libextractor 1.4, there is an out-of-bounds read in the
  EXTRACTOR_dvi_extract_method function in plugins/dvi_extractor.c.
diff --git a/active/CVE-2017-16510 b/active/CVE-2017-16510
index dcb2f58..7847ad5 100644