[Secure-testing-commits] r2916 - data/CVE

Thu Dec 1 11:50:20 UTC 2005

Author: jmm-guest
Date: 2005-12-01 11:50:15 +0000 (Thu, 01 Dec 2005)
New Revision: 2916

Modified:
   data/CVE/list
Log:
updates on several kernel issues


Modified: data/CVE/list
===================================================================

--- data/CVE/list	2005-12-01 10:36:12 UTC (rev 2915)
+++ data/CVE/list	2005-12-01 11:50:15 UTC (rev 2916)
@@ -2122,18 +2122,20 @@
 	NOTE: see http://www.apsis.ch/pound/pound_list/archive/2005/2005-10/1129827166000/index_html?fullMode=1#1129827166000
 CVE-2005-3276 (The sys_get_thread_area function in process.c in Linux 2.6 before ...)
 	- linux-2.6 2.6.12-2
-	- kernel-source-2.6.8 2.6.8-16sarge1
+	- kernel-source-2.4.27 <not-affected>
+	[sarge] - kernel-source-2.6.8 2.6.8-16sarge1
 CVE-2005-3275 (The NAT code (1) ip_nat_proto_tcp.c and (2) ip_nat_proto_udp.c in ...)
 	- linux-2.6 2.6.13-1 (low)
-	- kernel-source-2.6.8 2.6.8-16sarge1 (low)
-	- kernel-source-2.4.27 2.4.27-10sarge1 (low)
+	- kernel-source-2.4.27 2.4.27-11 (low)
+	[sarge] - kernel-source-2.6.8 2.6.8-16sarge1 (low)
+	[sarge] - kernel-source-2.4.27 2.4.27-10sarge1 (low)
 CVE-2005-3274 (Race condition in ip_vs_conn_flush in Linux 2.6 before 2.6.13 and 2.4 ...)
 	- linux-2.6 2.6.13-1 (low)
-	- kernel-source-2.6.8 2.6.8-16sarge1 (low)
-	- kernel-source-2.4.27 2.4.27-10sarge1 (low)
+	[sarge] - kernel-source-2.6.8 2.6.8-16sarge1 (low)
+	[sarge] - kernel-source-2.4.27 2.4.27-10sarge1 (low)
 CVE-2005-3273 (The rose_rt_ioctl function in rose_route.c for ROSE in Linux 2.6 ...)
 	- linux-2.6 2.6.12-1
-	- kernel-source-2.6.8 2.6.8-16sarge1
+	[sarge] - kernel-source-2.6.8 2.6.8-16sarge1
 CVE-2005-3272 (Linux kernel before 2.6.12 allows remote attackers to poison the ...)
 	- linux-2.6 2.6.12-1
 	- kernel-source-2.6.8 2.6.8-16sarge1
@@ -2733,7 +2735,8 @@
 	- twiki 20040902-2 (bug #330733; high)
 CVE-2005-3055 (Linux kernel 2.6.8 to 2.6.14-rc2 allows local users to cause a denial ...)
 	- linux-2.6 <unfixed> (bug #330287; bug #332587; medium)
-	- kernel-source-2.6.8 <unfixed> (bug #332596)
+	- kernel-source-2.4.27 <not-affected>
+	[sarge] - kernel-source-2.6.8 <unfixed> (bug #332596)
 CVE-2005-3054 (fopen_wrappers.c in PHP 4.4.0, and possibly other versions, does not ...)
 	- php4 4:4.4.0-3 (bug #353585; medium)
 	- php5 5.0.5-2 (bug #353585; medium)
@@ -3159,8 +3162,8 @@
 	- gtkdiskfree 1.9.3-4sarge1 (bug #328566; low)
 CVE-2005-3044 (Multiple vulnerabilities in Linux kernel before 2.6.13.2 allow local ...)
 	- linux-2.6 2.6.12-7 (medium)
-	- kernel-source-2.6.8 2.6.8-16sarge2 (medium)
-	NOTE: code is vulnerable but there is no amd64 for 2.4 in Sarge
+	- kernel-source-2.4.27 <not-affected> (code is vulnerable but there is no amd64 for 2.4 in Sarge)
+	[sarge] - kernel-source-2.6.8 2.6.8-16sarge2 (medium)
 CVE-2005-2877 (The history (revision control) function in TWiki 02-Sep-2004 and ...)
 	NOTE: proactively fixed by the robustness patch
 	- twiki 20040902-2
@@ -3330,6 +3333,7 @@
 	- hiki 0.8.3-1
 CVE-2005-2800 (Memory leak in the seq_file implemenetation in the SCSI procfs ...)
 	- linux-2.6 2.6.12-6 (low)
+	- kernel-source-2.4.27 <not-affected> (seq_file introduced in 2.6)
 CVE-2005-2799 (Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and ...)
 	NOT-FOR-US: Linksys routers
 CVE-2005-2798 (sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, ...)
@@ -4701,9 +4705,9 @@
 CVE-2005-2457 (The driver for compressed ISO file systems (zisofs) in the Linux ...)
 	{DTSA-16-1}
 	- linux-2.6 2.6.12-3 (medium)
-	- kernel-source-2.6.8 2.6.8-16sarge2 (medium)
 	- kernel-source-2.4.27 2.4.27-12 (medium)
-	- kernel-source-2.4.27 2.4.27-10sarge2 (medium)
+	[sarge] - kernel-source-2.6.8 2.6.8-16sarge2 (medium)
+	[sarge] - kernel-source-2.4.27 2.4.27-10sarge2 (medium)
 CVE-2005-2456 (Array index overflow in the xfrm_sk_policy_insert function in ...)
 	{DTSA-16-1}
 	- linux-2.6 2.6.12-2 (bug #321401; medium)
@@ -12611,12 +12615,10 @@
 CVE-2005-0450 (Directory traversal vulnerability in Sami HTTP Server 1.0.5 allows ...)
 	NOT-FOR-US: Sami HTTP Server
 CVE-2005-0449 (The netfilter/iptables module in Linux before 2.6.8.1 allows remote ...)
-	NOTE: According to Herbert Xu, 2.4 is not vulnerable : http://oss.sgi.com/archives/netdev/2005-01/msg01107.html
-	NOTE: The vulnerable code has been removed from the kernel in favor of a better
-	NOTE: fix between 2.6.11 and 2.6.12, see
 	NOTE: http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1e01441051dda3bb01c455b6e20bce6d00563d82"
 	- kernel-source-2.6.8 2.6.8-14 (bug #295949; high)
 	- linux-2.6 <not-affected> (Vulnerable code was removed betwen 2.6.11 and 2.6.12)
+	- kernel-source-2.4.27 <not-affected> (Per Herbet Xu: http://oss.sgi.com/archives/netdev/2005-01/msg01107.html)
 CVE-2005-0448 (Race condition in the rmtree function in File::Path.pm in Perl before ...)
 	{DSA-696-1}
 	- perl 5.8.4-7
@@ -13422,11 +13424,9 @@
 	{DSA-667-1}
 	- squid 2.5.7-6
 CVE-2005-0210 (Netfilter in the Linux kernel 2.6.8.1 allows local users to cause a ...)
-	NOTE: fixed in ubuntu kernels
-	NOTE: 2.6.11 is not affected, apparantly 2.6.10 is no longer relevant
-	NOTE: was bug #300838
-	- kernel-source-2.6.8 2.6.8-15
-	- kernel-source-2.4.27 2.4.27-9
+	- linux-2.6 <not-affected> (Fixed before upload into archive)
+	[sarge] - kernel-source-2.6.8 2.6.8-15
+	- kernel-source-2.4.27 2.4.27-9 (bug #300838)
 CVE-2005-0209 (Netfilter in Linux kernel 2.6.8.1 allows remote attackers to cause a ...)
 	NOTE: <horms> all kernels seem to be clear with regards to 2005-0209
 	NOTE: <dilinger> http://oss.sgi.com/archives/netdev/2005-01/msg01072.html resolves this and it is in all our kernels
@@ -13496,9 +13496,8 @@
 CVE-2005-0181
 	RESERVED
 CVE-2005-0180 (Multiple integer signedness errors in the sg_scsi_ioctl function in ...)
-	- kernel-source-2.6.8 2.6.8-12
-	- kernel-source-2.6.9 2.6.9-5
-	- kernel-source-2.6.10 2.6.10-2
+	[sarge] - kernel-source-2.6.8 2.6.8-12
+	- linux-2.6 <not-affected> (Fixed before upload into archive)
 CVE-2005-0179 (Linux kernel 2.4.x and 2.6.x allows local users to cause a denial of ...)
 	NOTE: Does not apply to 2.6.8
 	NOTE: Fix in 2.6.9-6 pending upload


