[Secure-testing-commits] r2138 - data/CAN

Moritz Muehlenhoff jmm-guest at costa.debian.org
Fri Sep 23 22:28:34 UTC 2005 

Author: jmm-guest
Date: 2005-09-23 22:28:31 +0000 (Fri, 23 Sep 2005)
New Revision: 2138

Modified:
   data/CAN/list
Log:
lets start breaking related scripts, first batch of
conversions to the fancy new <unfixed>.


Modified: data/CAN/list
===================================================================
--- data/CAN/list	2005-09-23 21:31:57 UTC (rev 2137)
+++ data/CAN/list	2005-09-23 22:28:31 UTC (rev 2138)
@@ -69,7 +69,7 @@
 CAN-2005-3012 (The MasterDataCD::createImage function in masterdatacd.cpp for ...)
 	NOTE: not-for-us (SimpleCDR-X)
 CAN-2005-3011 (texindex in texinfo 4.7 and earlier allows local users to overwrite ...)
-	- texinfo (unfixed; bug #328265; low)
+	- texinfo <unfixed> (bug #328265; low)
 CAN-2005-3010 (Direct static code injection vulnerability in the flood protection ...)
 	NOTE: not-for-us (CuteNews)
 CAN-2005-3009 (Cross-site scripting (XSS) vulnerability in CuteNews allows remote ...)
@@ -108,7 +108,7 @@
 CAN-2005-2993 (Unspecified vulnerability in the FTP Daemon (ftpd) for HP Tru64 UNIX ...)
 	NOTE: not-for-us (HP Tru64)
 CAN-2005-2991 (ncompress 4.2.4 and earlier allows local users to overwrite arbitrary ...)
-	- ncompress (unfixed; bug #329052; unimportant)
+	- ncompress <unfixed> (bug #329052; unimportant)
 CAN-2005-2992 [Another arc tempfile issue]
 	NOTE: reserved
 	- arc 5.21m-1 (low)
@@ -163,9 +163,9 @@
 CAN-2005-2969
 	NOTE: reserved
 CAN-2005-2968 (Firefox 1.0.6 and Mozilla 1.7.10 allows attackers to execute arbitrary ...)
-	- mozilla-firefox not-affected (Debian ships a non-vulnerable wrapper script)
-	- mozilla not-affected (Debian ships a non-vulnerable wrapper script)
-	- mozilla-thunderbird (unfixed; bug #329667; bug #329664; high)
+	- mozilla-firefox <not-affected> (Debian ships a non-vulnerable wrapper script)
+	- mozilla <not-affected> (Debian ships a non-vulnerable wrapper script)
+	- mozilla-thunderbird <unfixed> (bug #329667; bug #329664; high)
 CAN-2005-2967
 	NOTE: reserved
 CAN-2005-2966
@@ -344,10 +344,10 @@
 CAN-2005-XXXX [user password file created by gajim is world-redable]
 	- gajim 0.8.2-1 (bug #325080; low)
 CAN-2005-XXXX [mkzopeinstance.py creates world-readable inituser file]
-	- zope2.7 (unfixed; bug #313644; low)
+	- zope2.7 <unfixed> (bug #313644; low)
 	NOTE: first patch was incorrect
 CAN-2005-XXXX [wine-safe does not prompt the user/is registered in mailcap]
-	- wine (bug #327261; bug #327262; unfixed; high)
+	- wine <unfixed> (bug #327261; bug #327262; high)
 	TODO: It is not clear what the real bug is.
 	TODO: Does wine-safe prompt properly?  Or should the functionality
 	TODO: be disabled completely, like Microsoft did some time ago?
@@ -375,12 +375,12 @@
 CAN-2005-2874 (The is_path_absolute function in scheduler/client.c for the daemon in ...)
 	- cupsys 1.1.23-1 (unknown)
 CAN-2005-XXXX [snort vulnerable to DoS attack]
-	- snort (unfixed; bug #328134; low)
+	- snort <unfixed> (bug #328134; low)
 CAN-2005-2871 (Buffer overflow in the International Domain Name (IDN) support in ...)
 	- mozilla-firefox 1.0.6-5 (medium)
-	- mozilla (unfixed; bug #327455; medium)
-	- mozilla-thunderbird (unfixed; medium)
-	- epiphany-browser (unfixed; bug #327366; medium)
+	- mozilla <unfixed> (bug #327455; medium)
+	- mozilla-thunderbird <unfixed> (medium)
+	- epiphany-browser <unfixed> (bug #327366; medium)
 CAN-2005-XXXX [several buffer overflows in MS CHM library before version 0.36]
 	- chmlib 0.36-1 (bug #327431)
 CAN-2005-2802
@@ -409,7 +409,7 @@
 CAN-2005-2861 (Cross-site scripting (XSS) vulnerability in N-Stealth Commercial ...)
 	NOTE: not-for-us (N-Stealth)
 CAN-2005-2860 (Cross-site scripting (XSS) vulnerability in Nikto 1.35 and earlier ...)
-	- nikto (unfixed; bug #327339; medium)
+	- nikto <unfixed> (bug #327339; medium)
 CAN-2005-2859 (Savant Web Server stores user credentials in plaintext in the ...)
 	NOTE: not-for-us (Savant Web Server)
 CAN-2005-2858 (The Fetch.FetchContact.1 ActiveX control (Fetch.dll) for Rediff Bol ...)
@@ -531,7 +531,7 @@
 	NOTE: not-for-us (Linksys routers)
 CAN-2005-2798 (sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is enabled, ...)
 	- openssh 1:4.2p1-1 (bug #326065; medium)
-	- openssh-krb5 (unfixed; bug #327233; medium)
+	- openssh-krb5 <unfixed> (bug #327233; medium)
 CAN-2005-2797 (OpenSSH 4.0, and other versions before 4.2, does not properly handle ...)
 	- openssh 1:4.2p1-1 (bug #326065; medium)
 CAN-2005-2796 (The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10 and ...)
@@ -667,7 +667,7 @@
 	NOTE: not-for-us (Simple PHP Blog)
 CAN-2005-2732 (AWStats 6.4, and possibly earlier versions, allows remote attackers to ...)
 	NOTE: path disclosure, so not very important on debian systems
-	- awstats (unfixed; bug #327729; low)
+	- awstats <unfixed> (bug #327729; low)
 CAN-2005-2731 (Directory traversal vulnerability in Astaro Security Linux 6.0, when ...)
 	NOTE: not-for-us (Astato specific)
 CAN-2005-2730 (The HTTP proxy in Astaro Security Linux 6.0 allows remote attackers to ...)
@@ -718,31 +718,31 @@
 CAN-2005-2707 [Firefox: Spoofing through clever construction of windows/tabs]
 	NOTE: reserved
 	- mozilla-firefox 1.0.7-1 (bug filed; medium)
-	- mozilla (unfixed; bug filed; medium)
+	- mozilla <unfixed> (bug filed; medium)
 CAN-2005-2706 [Firefox: Javascript execution with chrome privileges through about: subcommand]
 	NOTE: reserved
 	- mozilla-firefox 1.0.7-1 (bug filed; high)
-	- mozilla (unfixed; bug filed; high)
+	- mozilla <unfixed> (bug filed; high)
 CAN-2005-2705 [Firefox: Integer overflow in Javascript engine]
 	NOTE: reserved
 	- mozilla-firefox 1.0.7-1 (bug filed; high)
-	- mozilla (unfixed; bug filed; high)
+	- mozilla <unfixed> (bug filed; high)
 CAN-2005-2704 [Firefox: Incorrect chrome/javascript permission handling]
 	NOTE: reserved
 	- mozilla-firefox 1.0.7-1 (bug filed; medium)
-	- mozilla (unfixed; bug filed; medium)
+	- mozilla <unfixed> (bug filed; medium)
 CAN-2005-2703 [Firefox: Incorrect passing of XMLHttp requests]
 	NOTE: reserved
 	- mozilla-firefox 1.0.7-1 (bug filed; medium)
-	- mozilla (unfixed; bug filed; medium)
+	- mozilla <unfixed> (bug filed; medium)
 CAN-2005-2702 [Firefox: Arbitrary code execution through crafted Unicode sequences]
 	NOTE: reserved
 	- mozilla-firefox 1.0.7-1 (bug filed; high)
-	- mozilla (unfixed; bug filed; high)
+	- mozilla <unfixed> (bug filed; high)
 CAN-2005-2701 [Firefox: Arbitrary code execution through crafted XBM through unspecified vuln]
 	NOTE: reserved
 	- mozilla-firefox 1.0.7-1 (bug filed; medium)
-	- mozilla (unfixed; bug filed; medium)
+	- mozilla <unfixed> (bug filed; medium)
 CAN-2005-2700 (ssl_engine_kernel.c in mod_ssl before 2.8.24, when using ...)
 	{DSA-807-1 DSA-805-1}
 	- libapache-mod-ssl 2.8.24-1 (medium)
@@ -776,9 +776,9 @@
 	TODO: check what version of linux-2.6 fixed this. (See bug #328395)
 	NOTE: http://lists.debian.org/debian-kernel/2005/08/msg00238.html
 CAN-2005-2873 (The ipt_recent kernel module (ipt_recent.c) in Linux kernel 2.6.12 and ...)
-	- kernel-source-2.4.27 (unfixed; low)
-	- kernel-source-2.6.8 (unfixed; low)
-	- linux-2.6 (unfixed; low)
+	- kernel-source-2.4.27 <unfixed> (low)
+	- kernel-source-2.6.8 <unfixed> (low)
+	- linux-2.6 <unfixed> (low)
 	NOTE: Dave Miller didn't like the proposed fix and considers a complete rewrite
 	NOTE: of ipt_recent the best solution, which seems to occur soon
 CAN-2005-2872 (The ipt_recent kernel module (ipt_recent.c) in Linux kernel before ...)
@@ -858,9 +858,9 @@
 CAN-2005-2664 (Whisper 32 1.16, and possibly earlier versions, stores passwords in ...)
 	NOTE: not-for-us (Whisper)
 CAN-2005-2663 (masqmail before 0.2.18 allows local users to overwrite arbitrary files ...)
-	- masqmail (unfixed; low; bug #329307)
+	- masqmail <unfixed> (low; bug #329307)
 CAN-2005-2662 (masqmail before 0.2.18 allows remote attackers to execute arbitrary ...)
-	- masqmail (unfixed; high; bug #329307)
+	- masqmail <unfixed> (high; bug #329307)
 CAN-2005-2661
 	NOTE: reserved
 CAN-2005-2660
@@ -910,7 +910,7 @@
 CAN-2005-2643 (Tor 0.1.0.13 and earlier, and experimental versions 0.1.1.4-alpha and ...)
 	- tor 0.1.0.14-1 (medium)
 CAN-2005-2642 (Buffer overflow in the mutt_decode_xbit function in Handler.c for Mutt ...)
-	- mutt (unfixed; bug #323956; high)
+	- mutt <unfixed> (bug #323956; high)
 	NOTE: Status is not clear; upstream is unresponsive.
 CAN-2005-2641 (Unknown vulnerability in pam_ldap before 180 does not properly handle ...)
 	{DSA-785-1}
@@ -1197,13 +1197,13 @@
 CAN-2005-2603 (Cross-site scripting (XSS) vulnerability in index.php for My Image ...)
 	NOTE: not-for-us (My Image Gallery (Mig))
 CAN-2005-2602 (Mozilla Thunderbird 1.0 and Firefox 1.0.6 allows remote attackers to ...)
-	- mozilla-firefox (unfixed; bug #324907; low)
+	- mozilla-firefox <unfixed> (bug #324907; low)
 	TODO: file/clone bugs for mozilla-browser and mozilla-thunderbird
 CAN-2005-2601 (SQL injection vulnerability in MidiCart allows remote attackers to ...)
 	NOTE: not-for-us (MidiCart)
 CAN-2005-2600 (FUDForum 2.6.15 with &quot;Tree View&quot; enabled, as used in other products ...)
 	{DSA-798-1}
-	- egroupware-fudforum (unfixed; bug #323928; medium)
+	- egroupware-fudforum <unfixed> (bug #323928; medium)
 	- phpgroupware 0.9.16.008-1 (bug #323929; medium)
 CAN-2005-2599 (Hummingbird FTP for Connectivity 10.0 uses weak encryption (trivial ...)
 	NOTE: not-for-us (Hummingbird FTP for Connectivity)
@@ -1294,7 +1294,7 @@
 CAN-2005-2558 (Stack-based buffer overflow in the init_syms function in MySQL 4.0 ...)
 	- mysql-dfsg-4.1 4.1.13 (medium)
 	- mysql-dfsg-5.0 5.0.7beta-1 (medium)
-	- mysql-dfsg (unfixed; bug #322133; medium)
+	- mysql-dfsg <unfixed> (bug #322133; medium)
 CAN-2005-2557
 	NOTE: reserved
 	{DSA-778-1}
@@ -1505,7 +1505,7 @@
 CAN-2005-2554 (The web server for Network Associates ePolicy Orchestrator Agent 3.5.0 ...)
 	NOTE: not-for-us (Network Associated ePolicy Orchestrator Agent)
 CAN-2005-2553 (The find_target function in ptrace32.c in the Linux kernel 2.4.x ...)
-	- kernel-source-2.4.27 (unfixed; bug #323363; medium)
+	- kernel-source-2.4.27 <unfixed> (bug #323363; medium)
 CAN-2005-2552 (Unknown vulnerability in HP ProLiant DL585 servers running Integrated ...)
 	NOTE: not-for-us (Integrated Light Out in HP servers)
 CAN-2005-2551 (Buffer overflow in dhost.exe in iMonitor for Novell eDirectory 8.7.3 ...)
@@ -1526,7 +1526,7 @@
 CAN-2005-2541 (Tar 1.15.1 does not properly warn the user when extracting setuid or ...)
 	NOTE: This is intended behaviour, after all tar is an archiving tool and you
 	NOTE: need to give -p as a command line flag
-	- tar (unfixed; bug #328228; unimportant)
+	- tar <unfixed> (bug #328228; unimportant)
 CAN-2005-2540 (CRLF injection vulnerability in FlatNuke 2.5.5 and possibly earlier ...)
 	NOTE: not-for-us (FlatNuke)
 CAN-2005-2539 (Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke 2.5.5 ...)
@@ -1612,7 +1612,7 @@
 	NOTE: Does not affect 2.6.8 or 2.4.27, fixed in current 2.6.12 kernels
 	- linux-2.6 2.6.12-1 (medium)
 CAN-2005-2499 (slocate before 2.7 does not properly process very long paths, which ...)
-	- slocate (unfixed; bug #324951; low)
+	- slocate <unfixed> (bug #324951; low)
 CAN-2005-2498 (Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier (PEAR ...)
 	{DSA-798-1 DSA-789-1 DTSA-15-1}
 	- drupal 4.5.5-1 (bug #323347; high)
@@ -1647,19 +1647,19 @@
 	- linux-2.6 2.6.12-7 (bug #327416; medium)
 CAN-2004-2302 (Race condition in the sysfs_read_file and sysfs_write_file functions ...)
 	{DTSA-16-1}
-	- kernel-source-2.6.8 (unfixed; bug #322339; medium)
+	- kernel-source-2.6.8 <unfixed> (bug #322339; medium)
 	- linux-2.6 2.6.12-1 (bug #322339; medium)
 	NOTE: 2.4.27 not affected
 CAN-2005-XXXX [Buffer overflow in Description parsing]
-	- bidwatcher (unfixed; bug #319489; high)
+	- bidwatcher <unfixed> (bug #319489; high)
 CAN-2005-XXXX [Does not do escaping in mysql version - both a worrying flaw and stops adduser working]
-	- dbmail (unfixed; bug #303991; medium)
+	- dbmail <unfixed> (bug #303991; medium)
 CAN-2005-XXXX [downloads.ini writable by group users, world-readable]
 	- mldonkey 2.5.28.1-1 (bug #300560; low)
 CAN-2005-XXXX [Should include "UNRESTRICTED access to your computer" warning somewhere]
-	- gcjwebplugin (unfixed; bug #267040; high)
+	- gcjwebplugin <unfixed> (bug #267040; high)
 CAN-2005-XXXX [Inconsistent escaping of user supplied data in dbauthpgsql.c]
-	- dbmail-pgsql (unfixed; bug #290833; medium)
+	- dbmail-pgsql <unfixed> (bug #290833; medium)
 CAN-2005-XXXX [time delay of password check proves account existence to attackers]
 	NOTE: unknown if really a bug; if it is it's different than the
 	NOTE: previous ssh delay bugs

More information about the Secure-testing-commits mailing list