[Secure-testing-commits] r2268 - data/CAN

Moritz Muehlenhoff jmm-guest at costa.debian.org
Sun Oct 2 16:38:03 UTC 2005


Author: jmm-guest
Date: 2005-10-02 16:37:59 +0000 (Sun, 02 Oct 2005)
New Revision: 2268

Modified:
   data/CAN/list
Log:
lots of older bugnums (only 200 more to check)


Modified: data/CAN/list
===================================================================
--- data/CAN/list	2005-10-02 10:17:48 UTC (rev 2267)
+++ data/CAN/list	2005-10-02 16:37:59 UTC (rev 2268)
@@ -578,7 +578,7 @@
 CAN-2005-XXXX [snort vulnerable to DoS attack]
 	- snort 2.3.3-2 (bug #328134; low)
 CAN-2005-2871 (Buffer overflow in the International Domain Name (IDN) support in ...)
-	- mozilla-firefox 1.0.6-5 (medium)
+	- mozilla-firefox 1.0.6-5 (bug #327452; medium)
 	- mozilla <unfixed> (bug #327455; medium)
 	- epiphany-browser <unfixed> (bug #327366; medium)
 CAN-2005-XXXX [several buffer overflows in MS CHM library before version 0.36]
@@ -1730,7 +1730,7 @@
 	NOT-FOR-US: FlatNuke
 CAN-2005-2536 (pstotext before 1.8g does not properly use the &quot;-dSAFER&quot; option when ...)
 	{DSA-792-1}
-	- pstotext 1.9-2 (medium)
+	- pstotext 1.9-2 (bug #319758; medium)
 CAN-2005-2535 (Buffer overflow in the Discovery Service in BrightStor ARCserve Backup ...)
 	NOT-FOR-US: ARCserve Backup
 CAN-2005-2534 (Race condition in OpenVPN before 2.0.1, when --duplicate-cn is not ...)
@@ -1833,8 +1833,8 @@
 CAN-2005-2491 (Integer overflow in pcre_compile.c in Perl Compatible Regular ...)
 	{DSA-821-1 DSA-819-1 DSA-817-1 DSA-800-1 DTSA-10-1}
 	- pcre3 6.3-0.1etch1 (bug #324531; medium)
-	- gnumeric <unfixed> (bug #326628; unimportant)
-	- goffice <unfixed> (unimportant)
+	- gnumeric <unfixed> (bug #326628; bug #326898; unimportant)
+	- goffice <unfixed> (bug #326898; unimportant)
 	NOTE: gnumeric/goffice includes one as well; not exploitable as affected code not used
 	- python2.1 2.1.3dfsg-3 (medium)
 	- python2.2 2.2.3dfsg-4 (medium)
@@ -2041,9 +2041,9 @@
 	- clamav-getfiles 0.5-1 (bug #321446; medium)
 begin claimed by neilm
 CAN-2005-XXXX [cgiwrap: Minimum UID does not include all system users]
-	- cgiwrap 3.9-3.0etch1 (low)
+	- cgiwrap 3.9-3.0etch1 (bug #316881; low)
 CAN-2005-XXXX [cgiwrap: CGIs can be used to disclose system information]
-	- cgiwrap 3.9-3.0etch1 (low)
+	- cgiwrap 3.9-3.0etch1 (bug #316901; low)
 CAN-2004-2162 (Multiple cross-site scripting (XSS) vulnerabilities in TUTOS 1.1 allow ...)
 	- tutos 1.1.20031017-2.1 (bug #318633; medium)
 CAN-2004-2161 (SQL injection vulnerability in file_overview.php in TUTOS 1.1 allows ...)
@@ -2058,7 +2058,7 @@
 CAN-2005-XXXX [libnet-ssleay-perl: /tmp/entropy insecure]
 	- libnet-ssleay-perl 1.25-1.1 (bug #296112; low)
 CAN-2005-XXXX [nvi: init.d recover file security bugs]
-	- nvi 1.79-22 (medium)
+	- nvi 1.79-22 (bug #298114; medium)
 CAN-2005-XXXX [bugzilla: Maintainer's postinst script use temporary files in an unsafe way]
 	- bugzilla 2.18.3-2 (bug #321567; low)
 CAN-2005-XXXX [Crypto weakness in Tor's handshaking process]
@@ -2629,9 +2629,9 @@
 	NOTE: Maintainers already preparing packages of 2.0.17
 	- phpbb2 <unfixed> (low)
 CAN-2005-XXXX [xgalaga score file segfault]
-	- xgalaga 2.0.34-31 (low)
+	- xgalaga 2.0.34-31 (bug #319686; low)
 CAN-2005-XXXX [xemeraldia games file overwrite]
-	- xemeraldia 0.4-1 (low)
+	- xemeraldia 0.4-1 (bug #319661; low)
 CAN-2005-2335 (Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows ...)
 	{DSA-774-1}
 	NOTE: previous fix in -15 was broken
@@ -3083,7 +3083,7 @@
 	NOT-FOR-US: PhpSlash
 CAN-2005-2256 (Encoded directory traversal vulnerability in phpPgAdmin 3.1 to 3.5.3 ...)
 	{DSA-759-1}
-	- phppgadmin 3.5.4-1 (medium)
+	- phppgadmin 3.5.4-1 (bug #318284; medium)
 CAN-2005-2255 (Directory traversal vulnerability in PhpAuction 2.5 allows remote ...)
 	NOT-FOR-US: PhpAuction
 CAN-2005-2254 (Multiple cross-site scripting (XSS) vulnerabilities in PhpAuction 2.5 ...)
@@ -3419,7 +3419,7 @@
 	NOT-FOR-US: Geeklog
 CAN-2005-2151 (spf.c in Courier Mail Server does not properly handle DNS failures ...)
 	{DSA-784-1}
-	- courier 0.47-6 (low)
+	- courier 0.47-6 (bug #320290; low)
 CAN-2005-2150 (Windows NT 4.0 and Windows 2000 before URP1 for Windows 2000 SP4 does ...)
 	NOT-FOR-US: Microsoft
 CAN-2005-2149 (config.php in Cacti 0.8.6e and earlier allows remote attackers to set ...)
@@ -3559,25 +3559,26 @@
 	NOTE: Not all of the listed packages have been checked for actual
 	NOTE: exploitability using this hole.
 	- dpkg 1.13.11 (bug #317967; medium)
-	- zsync 0.4.0-2 (medium)
+	- zsync 0.4.0-2 (bug #317968; medium)
 	- dump 0.4b40-1 (bug #317966; medium)
 	- aide 0.10-6.1.1 (bug #317523; medium)
 	- amd64-libs <unfixed> (bug #317970; medium)
 	- ia32-libs <unfixed> (bug #317971; medium)
 	NOTE: dar-static claimed not used on untrusted input by maintainer in #317989
-	- bacula 1.36.3-2 (medium)
-	- sash 3.7-6 (bug #318246; medium)
-	- libphysfs-1.0-0 1.0.0-5 (medium)
+	- bacula 1.36.3-2 (bug #318014; medium)
+	- sash 3.7-6 (bug #318246; bug #318069; medium)
+	- libphysfs 1.0.0-5 (bug #318091; medium)
 	- oops <unfixed> (bug #318097; medium)
 	- rpm 4.0.4-31.1 (bug #318099; medium)
-	- rageircd 2.0.0-3sid1 (medium)
+	- rageircd 2.0.0-3sid1 (bug #309196; medium)
 	- systemimager-ssh <unfixed> (bug #318101; unimportant)
 	- texmacs 1:1.0.5-3 (bug #318100; medium)
-	- zlib 1:1.2.2-7 (medium)
+	- zlib 1:1.2.2-7 (bug #317133; medium)
+	- mysql-dfsg-4.1 (bug #319858; unimportant)
 	NOTE: fixed in experimental in 1:1.0.5.6-1, not yet in sid
 CAN-2005-2095 (SquirrelMail 1.4.4 and earlier does not properly handle the $_POST ...)
 	{DSA-756-1}
-	- squirrelmail 2:1.4.4-6
+	- squirrelmail 2:1.4.4-6 (bug #317094)
 CAN-2005-2094 (Sun SunONE web server 6.1 SP1 allows remote attackers to poison the ...)
 	NOT-FOR-US: Sun
 CAN-2005-2093 (Oracle 9i Application Server (Oracle9iAS) 9.0.2 allows remote ...)
@@ -3669,10 +3670,10 @@
 	NOT-FOR-US: Solaris
 CAN-2005-2070 (The ClamAV Mail fILTER (clamav-milter) 0.84 through 0.85d, when used ...)
 	{DSA-737-1 DTSA-3-1}
-	- clamav 0.86.1 (medium)
+	- clamav 0.86.1 (bug #318755; medium)
 CAN-2005-2069 (pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a ...)
 	{DSA-785-1}
-	- openldap2.2 2.2.26-3 (medium)
+	- openldap2.2 2.2.26-3 (bug #316674; medium)
 	- openldap2 2.1.30-11 (medium)
 	- libpam-ldap 178-1sarge1 (bug #316972; medium)
 	- libnss-ldap 238-1.1 (bug #316973; medium)
@@ -3702,7 +3703,7 @@
 	NOT-FOR-US: Infopop UBB.Threads
 CAN-2005-2056 (The Quantum archive decompressor in Clam AntiVirus (ClamAV) before ...)
 	{DSA-737-1 DTSA-3-1}
-	- clamav 0.86.1-1 (medium)
+	- clamav 0.86.1-1 (bug #318756; medium)
 CAN-2005-2055 (RealPlayer 8, 10, 10.5 (6.0.12.1040-1069), and Enterprise and RealOne ...)
 	- helix-player 1.0.5-1 (bug #316276; high)
 CAN-2005-2054 (Unknown vulnerability in RealPlayer 10 and 10.5 (6.0.12.1040-1069) and ...)
@@ -4155,9 +4156,9 @@
 CAN-2005-2040 (Multiple buffer overflows in the getterminaltype function in telnetd ...)
 	{DSA-758-1}
 	TODO: Check telnetd from netkit, krb4, krb5, as they all seem to be derived from the same BSD code base
-	- heimdal 0.6.3-11 (high)
+	- heimdal 0.6.3-11 (bug #315065; high)
 CAN-2005-2039 (Unknown vulnerability in &quot;various plugins&quot; for NanoBlogger 3.2.1 and ...)
-	NOTE: The nanoblogger 3.1 version in Debian was not affected by this vulnerability
+	- nanoblogger <not-affected> (3.1 version in Debian was not affected by this vulnerability, see #315492)
 CAN-2005-2038 (Fortibus CMS 4.0.0 allows remote attackers to modify information of ...)
 	NOT-FOR-US: Fortibus CMS
 CAN-2005-2037 (Multiple SQL injection vulnerabilities in Fortibus CMS 4.0.0 allow ...)
@@ -4225,7 +4226,7 @@
 	- yaws 1.56-1 (low)
 CAN-2005-2007 (Directory traversal vulnerability in Edgewall Trac 0.8.3 and earlier ...)
 	{DSA-739-1}
-	- trac 0.8.4-1
+	- trac 0.8.4-1 (bug #315145)
 CAN-2005-2006 (JBOSS 3.2.2 through 3.2.7 and 4.0.2 allows remote attackers to obtain ...)
 	NOT-FOR-US: JBOSS
 CAN-2005-2005 (Ultimate PHP Board (UPB) 1.9.6 GOLD and earlier stores the users.dat ...)
@@ -4675,7 +4676,7 @@
 	NOT-FOR-US: Apple
 CAN-2005-1934 (Gaim before 1.3.1 allows remote attackers to cause a denial of service ...)
 	{DSA-734-1}
-	- gaim 1:1.3.1-1 (low)
+	- gaim 1:1.3.1-1 (bug #315356; low)
 CAN-2005-1930
 	RESERVED
 CAN-2005-1929
@@ -4701,7 +4702,7 @@
 	- serendipity <itp> (bug #312413)
 	- drupal 4.5.4-1 (high; bug #316362)
 	- phpgroupware 0.9.16.006-1 (high)
-	- egroupware 1.0.0.007-3.dfsg-1 (high)
+	- egroupware 1.0.0.007-3.dfsg-1 (bug #317263; high)
 	- phpwiki 1.3.7-4 (high)
 	- php4 4:4.3.10-16etch1 (high; bug #316447)
 	NOTE: horde3 is not affected by this issue, they ship different XMLRPC code
@@ -4717,7 +4718,7 @@
 	NOTE: there is a kpopper in kerberos4kth-servers, but this is not the same one
 CAN-2005-1916 (linki.py in ekg 2005-06-05 and earlier allows local users to overwrite ...)
 	{DSA-760-1 DTSA-4-1}
-	- ekg 1:1.5+20050712+1.6rc2-1 (low)
+	- ekg 1:1.5+20050712+1.6rc2-1 (bug #318059; bug #317027; low)
 CAN-2005-1915 (The log4sh_readProperties function in log4sh 1.2.5 and earlier allows ...)
 	NOT-FOR-US: log4sh
 CAN-2005-1914 (CenterICQ 4.20.0 and earlier creates temporary files with predictable ...)
@@ -5100,7 +5101,7 @@
 CAN-2005-1751 (Race condition in shtool 2.0.1 and earlier allows local users to ...)
 	{DSA-789-1 DTSA-15-1}
 	- shtool 2.0.1-2 (low)
-	- mysql-ocaml 1.0.3-6 (low)
+	- mysql-ocaml 1.0.3-6 (bug #314464; low)
 	- php4 4:4.3.10-16etch1 (low)
 	NOTE: the patch applied to NMU #311206 fixes both CAN-2005-1759 and CAN-2005-1751
 CAN-2004-2136 (dm-crypt on Linux kernel 2.6.x, when used on certain file systems ...)
@@ -5238,7 +5239,7 @@
 CAN-2005-1740 (fixproc in Net-snmp 5.x before 5.2.1-r1 creates temporary files ...)
 	NOTE: fixproc not installed in Debian package
 CAN-2005-1739 (The XWD Decoder in ImageMagick before 6.2.2.3, and GraphicsMagick ...)
-	- imagemagick 6:6.0.6.2-2.4
+	- imagemagick 6:6.0.6.2-2.4 (bug #310690; bug #310812)
 CAN-2005-1738 (Format string vulnerability in the logPrintBadfile function in ...)
 	NOT-FOR-US: Iron Bars Shell
 CAN-2005-1737 (Multiple unknown vulnerabilities in PROMS 0.11 allow &quot;non-authorized ...)
@@ -5690,7 +5691,7 @@
 CAN-2005-1566 (Acrowave AAP-3100AR wireless router allows remote attackers to bypass ...)
 	NOT-FOR-US: Acrowave AAP-3100AR wireless router
 CAN-2005-1565 (Bugzilla 2.17.1 through 2.18, 2.19.1, and 2.19.2, when a user is ...)
-	- bugzilla 2.18-7 (medium)
+	- bugzilla 2.18-7 (bug #308789; medium)
 	NOTE: only affects sid
 CAN-2005-1564 (post_bug.cgi in Bugzilla 2.10 through 2.18, 2.19.1, and 2.19.2 allows ...)
 	- bugzilla 2.16.7-7sarge1
@@ -5730,14 +5731,14 @@
 	NOT-FOR-US: Bakbone Netvault
 CAN-2005-1546 (Buffer overflow in the PE parser in HT Editor before 0.8.0 allows ...)
 	{DSA-743-1}
-	- ht 0.8.0-2
+	- ht 0.8.0-2 (bug #308587)
 CAN-2005-1545 (Integer overflow in the ELF parser in HT Editor before 0.8.0 allows ...)
 	{DSA-743-1}
-	- ht 0.8.0-3
+	- ht 0.8.0-3 (bug #308587)
 CAN-2005-1544 (Stack-based buffer overflow in libTIFF before 3.7.2 allows remote ...)
 	{DSA-755-1}
 	NOTE: CVE info about vulnerable version number is bogus
-	- tiff 3.7.2-3
+	- tiff 3.7.2-3 (bug #309739)
 	NOTE: tiff3g not in testing
 CAN-2005-1543 (Multiple stack-based and heap-based buffer overflows in Remote ...)
 	NOT-FOR-US: Novell Zenworks
@@ -5800,7 +5801,7 @@
 	- mailutils 1:0.6.1-3
 CAN-2005-1519 (Squid 2.5 STABLE9 and earlier, when the DNS client port is unfiltered ...)
 	{DSA-751-1}
-	- squid 2.5.9-9
+	- squid 2.5.9-9 (bug #309504)
 CAN-2005-1518 (Unknown vulnerability in Solaris 7 through 9, when using Federated ...)
 	NOT-FOR-US: Solaris
 CAN-2005-1517 (Unknown vulnerability in Cisco Firewall Services Module (FWSM) 2.3.1 ...)
@@ -6571,7 +6572,7 @@
 CAN-2003-1156 (Java Runtime Environment (JRE) and Software Development Kit (SDK) ...)
 	NOT-FOR-US: Sun JRE/SDK
 CAN-2003-1155 (X-CD-Roast 0.98 alpha10 through alpha14 allows local users to ...)
-	- xcdroast 0.98+0alpha15-1
+	- xcdroast 0.98+0alpha15-1 (bug #310046)
 	NOTE: woody seems to be vulnerable (see bug #310046)
 CAN-2003-1154 (MAILsweeper for SMTP 4.3 allows remote attackers to bypass virus ...)
 	NOT-FOR-US: MAILsweeper
@@ -6709,7 +6710,7 @@
 	NOT-FOR-US: Leafnode2 development branch
 CAN-2005-XXXX [Missing input validation in xtradius]
 	NOTE: not shipped in deb
-	- xtradius 1.2.1-beta2-2 (low)
+	- xtradius 1.2.1-beta2-2 (bug #307796; low)
 CAN-2005-XXXX [fai tempfile vulnerability]
 	- fai 2.8.2
 CAN-2005-2354 [nvu uses old copy of mozilla xpcom]
@@ -6718,7 +6719,7 @@
 	NOTE: Has been removed from Sarge
 	- nvu <unfixed> (bug #306822; medium)
 CAN-2005-XXXX [eskuel: arbitrary file retreiving]
-	- eskuel 1.0.5-3.1 (low)
+	- eskuel 1.0.5-3.1 (bug #307270; low)
 CAN-2005-2356 [eskuel: No authentication at all]
 	RESERVED
 	- eskuel <unfixed> (bug #163653; low)
@@ -6959,7 +6960,7 @@
 	{DSA-721-1}
 	- squid 2.5.9-7
 CAN-2005-1344 (Buffer overflow in htdigest in Apache 2.0.52 may allow attackers to ...)
-	- apache2 2.0.54-3
+	- apache2 2.0.54-3 (bug #322604)
 CAN-2005-1343 (Stack-based buffer overflow in the VPN daemon (vpnd) for Mac OS X ...)
 	NOT-FOR-US: vpnd for Mac OS X
 CAN-2005-1342 (The x-man-page: URI handler for Apple Terminal 1.4.4 in Mac OS X ...)
@@ -7004,11 +7005,11 @@
 CAN-2005-1323 (Buffer overflow in NetFtpd for NetTerm 5.1.1 and earlier allows remote ...)
 	NOT-FOR-US: NetTerm
 CAN-2005-1322 (Cross-site scripting (XSS) vulnerability in Horde Nag Task List ...)
-	- nag 1.1-3.1
+	- nag 1.1-3.1 (bug #307173)
 CAN-2005-1321 (Cross-site scripting (XSS) vulnerability in Horde Vacation module ...)
 	- sork-vacation 2.2.2-1
 CAN-2005-1320 (Cross-site scripting (XSS) vulnerability in Horde Mnemo Note Manager ...)
-	- mnemo 1.1-2.1
+	- mnemo 1.1-2.1 (bug #307180)
 	TODO: check whether nmeno2 is affected as well
 CAN-2005-1319 (Cross-site scripting (XSS) vulnerability in Horde IMP Webmail client ...)
 	NOTE: imp4 is not affected
@@ -7120,7 +7121,7 @@
 	- libconvert-uulib-perl 1.0.5.1-1
 CAN-2005-1269 (Gaim before 1.3.1 allows remote attackers to cause a denial of service ...)
 	{DSA-734-1}
-	- gaim 1:1.3.1-1 (low)
+	- gaim 1:1.3.1-1 (bug #315356; low)
 CAN-2005-1268 (Off-by-one error in the mod_ssl Certificate Revocation List (CRL) ...)
 	{DSA-805-1}
 	NOTE: This is from latest Trustix advisory, exploitation would require to trick
@@ -7295,7 +7296,7 @@
 	NOTE: The vulnerable code is present in xine-lib as well, MPlayer is not in Debian
 	- xine-lib 1.0.1-1
 CAN-2005-1194 (Stack-based buffer overflow in the ieee_putascii function for nasm ...)
-	- nasm 0.98.38-1.2
+	- nasm 0.98.38-1.2 (bug #309049)
 CAN-2005-1193 (The bbencode_second_pass and make_clickable functions in bbcode.php ...)
 	- phpbb2 2.0.13-6sarge1 (medium)
 CAN-2005-1192 (Unknown vulnerability in HP-UX B.11.00, B.11.04, B.11.11, B.11.22, and ...)
@@ -7770,9 +7771,9 @@
 CAN-2005-1044
 	REJECTED
 CAN-2005-1043 (exif.c in PHP before 4.3.11 allows remote attackers to cause a denial ...)
-	- php4 4:4.3.10-10
+	- php4 4:4.3.10-10 (bug #306003)
 CAN-2005-1042 (Integer overflow in the exif_process_IFD_TAG function in exif.c in PHP ...)
-	- php4 4:4.3.10-10
+	- php4 4:4.3.10-10 (bug #306003)
 CAN-2005-1041 (The fib_seq_start function in fib_hash.c in Linux kernel allows local ...)
 	- kernel-source-2.6.11 2.6.11-1
 	- kernel-source-2.6.8 2.6.8-16
@@ -7897,7 +7898,7 @@
 	- sharutils 1:4.2.1-13
 CAN-2005-0989 (The find_replen function in jsstr.c in the the Javascript engine for ...)
 	{DSA-781-1}
-	- mozilla 2:1.7.7-1
+	- mozilla 2:1.7.7-1 (bug #306001)
 	- mozilla-firefox 1.0.2-3
 	- mozilla-thunderbird 1.0.6-1 (medium)
 CAN-2005-0988 (Race condition in gzip 1.2.4, 1.3.3, and earlier, when decompressing a ...)
@@ -8662,7 +8663,7 @@
 CAN-2005-0719 (Unknown vulnerability in the systems message queue in HP Tru64 Unix ...)
 	NOT-FOR-US: Tru64
 CAN-2005-0718 (Squid 2.5.STABLE7 and earlier allows remote attackers to cause a ...)
-	- squid 2.5.8
+	- squid 2.5.8 (bug #305605)
 CAN-2005-0717
 	RESERVED
 CAN-2005-0716 (Stack-based buffer overflow in the Core Foundation Library in Mac OS X ...)
@@ -8783,8 +8784,8 @@
 	NOTE: Sarge version of gnome-vfs2 does not install the module with the vulnerable code
 	NOTE: fixed in gnome-vfs2 2.10 long ago too.
 	- grip 3.2.0-4 (low)
-	- libcdaudio 0.99.9-2.1 (low)
-	- gnome-vfs 1.0.5-5.1 (low)
+	- libcdaudio 0.99.9-2.1 (bug #304799; low)
+	- gnome-vfs 1.0.5-5.1 (bug #305163; low)
 CAN-2005-0705 (The GPRS-LLC dissector in Ethereal 0.10.7 through 0.10.9, with the ...)
 	- ethereal 0.10.10-1
 CAN-2005-0704 (Buffer overflow in the Etheric dissector in Ethereal 0.10.7 through ...)
@@ -8974,7 +8975,7 @@
 CAN-2005-0638 (xloadimage before 4.1-r2, and xli before 1.17, allows attackers to ...)
 	{DSA-695-1 DSA-694-1}
 	- xli 1.17.0-18
-	- xloadimage 4.1-14.1
+	- xloadimage 4.1-14.1 (bug #298926)
 CAN-2005-0637 (The copy functions in locore.s such as copyout in OpenBSD 3.5 and 3.6, ...)
 	NOT-FOR-US: OpenBSD
 CAN-2005-0636 (Format string vulnerability in Foxmail Server 2.0 allows remote ...)
@@ -9222,7 +9223,7 @@
 CAN-2004-1736 (Cacti 0.8.5a allows remote attackers to gain sensitive information via ...)
 	- cacti 0.8.5a-5
 CAN-2004-1735 (Cross-site scripting (XSS) vulnerability in the create list option in ...)
-	- sympa 4.1.5-4 (low)
+	- sympa 4.1.5-4 (bug #298105; low)
 CAN-2004-1734 (PHP remote code injection vulnerability in Mantis 0.19.0a allows ...)
 	- mantis 0.19.2-1
 CAN-2004-1733 (Directory traversal vulnerability in MyDMS 1.4.2 and other versions ...)
@@ -9802,13 +9803,13 @@
 	- wpasupplicant 0.3.8-1
 CAN-2005-0469 (Buffer overflow in the slc_add_reply function in various BSD-based ...)
 	{DSA-765-1 DSA-731-1 DSA-703-1 DSA-699-1 DSA-697-1}
-	- krb4 1.2.2-11.2
+	- krb4 1.2.2-11.2 (bug #306141)
 	- krb5 1.3.6-2
 	- heimdal 0.6.3-10
 CAN-2005-0468 (Heap-based buffer overflow in the env_opt_add function in telnet.c for ...)
 	{DSA-731-1 DSA-703-1}
 	- krb5 1.3.6-2
-	- krb4 1.2.2-11.2
+	- krb4 1.2.2-11.2 (bug #306141)
 	TODO: check netkit-telnet, netkit-telnet-ssl
 CAN-2005-0467 (Multiple integer overflows in the (1) sftp_pkt_getstring and (2) ...)
 	- putty 0.57-1
@@ -10085,7 +10086,7 @@
 	- racoon 1:0.5-5
 CAN-2005-0397 (Format string vulnerability in the SetImageInfo function in image.c ...)
 	{DSA-702-1}
-	- imagemagick 6:6.0.6.2-2.2
+	- imagemagick 6:6.0.6.2-2.2 (bug #297990)
 CAN-2005-0396 (Desktop Communication Protocol (DCOP) daemon, aka dcopserver, in KDE ...)
 	NOTE: fix in -4 was broken
 	- kdelibs 4:3.3.2-6
@@ -11402,7 +11403,7 @@
 	- ethereal 0.10.9-1
 CAN-2005-0005 (Heap-based buffer overflow in psd.c for ImageMagick 6.1.0, 6.1.7, and ...)
 	{DSA-646-1}
-	- imagemagick 6:6.0.6.2-2.1
+	- imagemagick 6:6.0.6.2-2.1 (bug #291118)
 CAN-2005-0004 (The mysqlaccess script in MySQL 4.0.23 and earlier, 4.1.x before ...)
 	{DSA-647-1}
 	- mysql-dfsg-4.1 4.1.8a-6
@@ -11551,7 +11552,7 @@
 CAN-2004-1284 (Buffer overflow in the find_next_file function in playlist.c for ...)
 	NOTE: non-free
 	NOTE: Previous fix 0.59r-18 introduced new integer overflows and caused regressions
-	- mpg123 0.59r-20
+	- mpg123 0.59r-20 (bug #287043)
 CAN-2004-1283 (Buffer overflow in the Mesh::type method in mesh.c for the mview ...)
 	NOT-FOR-US: mview
 CAN-2004-1282 (Buffer overflow in the strexpand function in string.c for LinPopUp ...)
@@ -11904,7 +11905,7 @@
 CAN-2004-1128 (Buffer overflow in CMailCOM.dll in CMailServer 5.2 allows remote ...)
 	NOT-FOR-US: CMailServer
 CAN-2004-1127 (Buffer overflow in Open Dc Hub 0.7.14 allows remote attackers, with ...)
-	- opendchub 0.7.14-1.1
+	- opendchub 0.7.14-1.1 (bug #284350)
 CAN-2004-1126
 	RESERVED
 CAN-2004-1125 (Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf 3.00, ...)
@@ -11977,7 +11978,7 @@
 	- libarchive-zip-perl 1.14-1
 CAN-2004-1095 (Multiple integer overflows in (1) readbmp.c, (2) readgif.c, (3) ...)
 	{DSA-608-1}
-	- zgv 5.7-1.3
+	- zgv 5.7-1.3 (bug #284124)
 CAN-2004-1094 (Buffer overflow in DUNZIP32.DLL in RealPlayer 10 through RealPlayer ...)
 	NOT-FOR-US: RealPlayer
 CAN-2004-1093 (Midnight commander (mc) 4.5.55 and earlier allows remote attackers to ...)
@@ -12055,7 +12056,7 @@
 CAN-2004-1063 (PHP 4.x to 4.3.9, and PHP 5.x to 5.0.2, when running in safe mode on a ...)
 	- php4 4:4.3.10-1
 CAN-2004-1062 (Multiple cross-site scripting (XSS) vulnerabilities in ViewCVS 0.9.2 ...)
-	- viewcvs 0.9.2+cvs.1.0.dev.2004.07.28-1.3
+	- viewcvs 0.9.2+cvs.1.0.dev.2004.07.28-1.3 (bug #287771)
 CAN-2004-1061 (Cross-site scripting (XSS) vulnerability in unknown versions of ...)
 	- bugzilla 2.16.7-2
 CAN-2004-1060 (Multiple TCP/IP and ICMP implementations, when using Path MTU (PMTU) ...)
@@ -12268,7 +12269,7 @@
 	- mpg123 0.59r-18
 CAN-2004-0981 (Buffer overflow in the EXIF parsing routine in ImageMagick before ...)
 	{DSA-593-1}
-	- imagemagick 6:6.0.6.2-1.5
+	- imagemagick 6:6.0.6.2-1.5 (bug #278401)
 CAN-2004-0980 (Format string vulnerability in ez-ipupdate.c for ez-ipupdate 3.0.10 ...)
 	{DSA-592-1}
 	- ez-ipupdate 3.0.11b8-8




More information about the Secure-testing-commits mailing list