[Secure-testing-commits] r786 - sarge-checks/CAN

[Moritz Muehlenhoff]

Author: jmm-guest
Date: 2005-04-10 11:09:48 +0000 (Sun, 10 Apr 2005)
New Revision: 786

Modified:
   sarge-checks/CAN/list
Log:
Checked all xpdf patches for 64bit cleanliness, gpdf needs to
be fixed properly, the rest is fine.

bug# for kernel bug.


Modified: sarge-checks/CAN/list
===================================================================
--- sarge-checks/CAN/list	2005-04-09 19:10:13 UTC (rev 785)
+++ sarge-checks/CAN/list	2005-04-10 11:09:48 UTC (rev 786)
@@ -703,7 +703,7 @@
 	- kernel-source-2.4.27-10
 	- kernel-source-2.6.8 2.6.8-16
 CAN-2005-0749 [Linux kernel DoS vulnerability in elf_load_library()]
-	TODO: File similar bug for 2.6.8
+	- kernel-source-2.6.8 (unfixed; bug #303498)
 	- kernel-source-2.4.27-10
 CAN-2003-1131 (PHP remote code injection vulnerability in index.php in ...)
 	NOTE: not-for-us (ActiveCampaign KnowledgeBuilder)
@@ -2888,11 +2888,9 @@
 	NOTE: fixed in upstream 2.6.10, 2.6.9 is dead
 	- kernel-source-2.6.8 2.6.8-14
 CAN-2005-0206 (The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 ...)
-	NOTE: turns out that tetex was patched for CAN-2004-0888 with
-	NOTE: a fixed patch from the beginning
-	- tetex-bin 2.0.2-23
-	TODO: check other packages
-	NOTE: Also needs to be checked in pdftex (in tetex-bin) gpdf, kpdf/kdegraphics, cupsysnd and pdftohtml all have xpdf code 
+	NOTE: turns out that xpdf, kpdf, tetex-bin and pdftohtml were patched for CAN-2004-0888 with
+	NOTE: a fixed patch from the beginning, cupsys doesn't include xpdf code any more
+	- gpdf (unfixed)
 	NOTE: found this: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=135393
 CAN-2005-0205 (KPPP 2.1.2 in KDE 3.1.5 and earlier, when setuid root without certain ...)
 	{DSA-692-1}