[Secure-testing-commits] r4153 - data/CVE

Stefan Fritsch stef-guest at costa.debian.org
Tue Jun 6 08:51:03 UTC 2006 

Author: stef-guest
Date: 2006-06-06 08:51:01 +0000 (Tue, 06 Jun 2006)
New Revision: 4153

Modified:
   data/CVE/list
Log:
many mozilla issues, some fixed in firefox
new webalizer issue
mysql issue CVEified and fixed in 5.0
python-pgsql fixed



Modified: data/CVE/list
===================================================================
--- data/CVE/list	2006-06-06 07:45:18 UTC (rev 4152)
+++ data/CVE/list	2006-06-06 08:51:01 UTC (rev 4153)
@@ -2,6 +2,8 @@
 	- dokuwiki <unfixed> (medium)
 CVE-2006-XXXX [PHP injection vulnerability in dokuwiki via curly braces]
 	- dokuwiki <unfixed> (medium)
+CVE-2006-XXXX [webalizer: symlink vulnerability]
+	- webalizer 2.01.10-29
 CVE-2006-2805 (SQL injection vulnerability in VBulletin 3.0.10 allows remote ...)
 	NOT-FOR-US: vBulletin
 CVE-2006-2804 (Cross-site scripting (XSS) vulnerability in index.cfm in Goss iCM 7.0 ...)
@@ -41,31 +43,99 @@
 CVE-2006-2788 (Double-free vulnerability in the getRawDER function for nsIX509Cert in ...)
 	TODO: check
 CVE-2006-2787 (EvalInSandbox in Mozilla Firefox and Thunderbird before 1.5.0.4 allows ...)
-	TODO: check
+	NOTE: MFSA-2006-31
+	- firefox 1.5.dfsg+1.5.0.4-1 (medium)
+	[sarge] - mozilla-firefox <unfixed> (medium)
+	- thunderbird <unfixed> (medium)
+	[sarge] - mozilla-thunderbird <unfixed> (medium)
+	- mozilla <unfixed> (medium)
+	- xulruner <unfixed> (medium)
 CVE-2006-2786 (HTTP response smuggling vulnerability in Mozilla Firefox and ...)
-	TODO: check
+	NOTE: MFSA-2006-33
+	- firefox 1.5.dfsg+1.5.0.4-1 (medium)
+	[sarge] - mozilla-firefox <unfixed> (medium)
+	- thunderbird <unfixed> (medium)
+	[sarge] - mozilla-thunderbird <unfixed> (medium)
+	- mozilla <unfixed> (medium)
+	- xulruner <unfixed> (medium)
 CVE-2006-2785 (Cross-site scripting (XSS) vulnerability in Mozilla Firefox before ...)
-	TODO: check
+	NOTE: MFSA-2006-34
+	- firefox 1.5.dfsg+1.5.0.4-1 (medium)
+	[sarge] - mozilla-firefox <unfixed> (medium)
+	- mozilla <unfixed> (medium)
+	- xulruner <unfixed> (medium)
 CVE-2006-2784 (The PLUGINSPAGE functionality in Mozilla Firefox before 1.5.0.4 allows ...)
-	TODO: check
+	NOTE: MFSA-2006-36
+	- firefox 1.5.dfsg+1.5.0.4-1 (medium)
+	[sarge] - mozilla-firefox <unfixed> (medium)
+	- mozilla <unfixed> (medium)
+	- xulruner <unfixed> (medium)
 CVE-2006-2783 (Mozilla Firefox and Thunderbird before 1.5.0.4 strips the Unicode ...)
-	TODO: check
+	NOTE: MFSA-2006-42
+	- firefox 1.5.dfsg+1.5.0.4-1 (medium)
+	[sarge] - mozilla-firefox <unfixed> (medium)
+	- thunderbird <unfixed> (medium)
+	[sarge] - mozilla-thunderbird <unfixed> (medium)
+	- mozilla <unfixed> (medium)
+	- xulruner <unfixed> (medium)
 CVE-2006-2782 (Firefox 1.5.0.2 does not fix all test cases associated with ...)
-	TODO: check
+	NOTE: MFSA-2006-41
+	- firefox 1.5.dfsg+1.5.0.4-1 (medium)
+	[sarge] - mozilla-thunderbird <unfixed> (medium)
+	- mozilla <unfixed> (medium)
+	- xulruner <unfixed> (medium)
 CVE-2006-2781 (Double-free vulnerability in Mozilla Thunderbird before 1.5.0.4 and ...)
-	TODO: check
+	NOTE: MFSA-2006-40
+	- thunderbird <unfixed> (high)
+	[sarge] - mozilla-thunderbird <unfixed> (high)
+	- mozilla <unfixed> (high)
+	- xulruner <unfixed> (high)
 CVE-2006-2780 (Integer overflow in Mozilla Firefox and Thunderbird before 1.5.0.4 ...)
-	TODO: check
+	NOTE: MFSA-2006-32
+	- firefox 1.5.dfsg+1.5.0.4-1 (high)
+	[sarge] - mozilla-firefox <unfixed> (high)
+	- thunderbird <unfixed> (high)
+	[sarge] - mozilla-thunderbird <unfixed> (high)
+	- mozilla <unfixed> (high)
+	- xulruner <unfixed> (high)
 CVE-2006-2779 (Mozilla Firefox and Thunderbird before 1.5.0.4 allow remote attackers ...)
-	TODO: check
+	NOTE: MFSA-2006-32
+	- firefox 1.5.dfsg+1.5.0.4-1 (high)
+	[sarge] - mozilla-firefox <unfixed> (high)
+	- thunderbird <unfixed> (high)
+	[sarge] - mozilla-thunderbird <unfixed> (high)
+	- mozilla <unfixed> (high)
+	- xulruner <unfixed> (high)
 CVE-2006-2778 (The crypto.signText function in Mozilla Firefox and Thunderbird before ...)
-	TODO: check
+	NOTE: MFSA-2006-38
+	- firefox 1.5.dfsg+1.5.0.4-1 (high)
+	[sarge] - mozilla-firefox <unfixed> (high)
+	- thunderbird <unfixed> (high)
+	[sarge] - mozilla-thunderbird <unfixed> (high)
+	- mozilla <unfixed> (high)
+	- xulruner <unfixed> (high)
 CVE-2006-2777 (Unspecified vulnerability in Mozilla Firefox before 1.5.0.4 and ...)
-	TODO: check
+	NOTE: MFSA-2006-43
+	- firefox 1.5.dfsg+1.5.0.4-1 (high)
+	[sarge] - mozilla-firefox <unfixed> (high)
+	- mozilla <unfixed> (high)
+	- xulruner <unfixed> (high)
 CVE-2006-2776 (Certain privileged UI code in Mozilla Firefox and Thunderbird before ...)
-	TODO: check
+	NOTE: MFSA-2006-37
+	- firefox 1.5.dfsg+1.5.0.4-1 (high)
+	[sarge] - mozilla-firefox <unfixed> (high)
+	- thunderbird <unfixed> (high)
+	[sarge] - mozilla-thunderbird <unfixed> (high)
+	- mozilla <unfixed> (high)
+	- xulruner <unfixed> (high)
 CVE-2006-2775 (Mozilla Firefox and Thunderbird before 1.5.0.4 associates XUL ...)
-	TODO: check
+	NOTE: MFSA-2006-35
+	- firefox 1.5.dfsg+1.5.0.4-1 (high)
+	[sarge] - mozilla-firefox <unfixed> (high)
+	- thunderbird <unfixed> (high)
+	[sarge] - mozilla-thunderbird <unfixed> (high)
+	- mozilla <unfixed> (high)
+	- xulruner <unfixed> (high)
 CVE-2006-2774 (Cross-site scripting (XSS) vulnerability in search.php in QontentOne ...)
 	TODO: check
 CVE-2006-2773 (admin/redigera/redigera2.asp in Hogstorps hogstorp Guestbook 2.0 does ...)
@@ -108,8 +178,6 @@
 	TODO: check
 CVE-2006-2754 (Stack-based buffer overflow in st.c in slurpd for OpenLDAP before ...)
 	TODO: check
-CVE-2006-2753 (SQL injection vulnerability in MySQL 4.1.x before 4.1.20 and 5.0.x ...)
-	TODO: check
 CVE-2006-2752 (The RedCarpet /etc/ximian/rcd.conf configuration file in Novell Linux ...)
 	TODO: check
 CVE-2006-2751 (Cross-site scripting (XSS) vulnerability in Open Searchable Image ...)
@@ -333,10 +401,10 @@
 CVE-2006-XXXX [drupal: Execution of arbitrary files in certain Apache configurations]
 	- drupal <unfixed> (bug #368835; medium)
 	NOTE: Micah requested CVE, June 6, 2006
-CVE-2006-XXXX [mysql SQL-injection with multibyte encoding]
+CVE-2006-2753 [mysql SQL-injection with multibyte encoding]
 	- mysql-dfsg <removed> (bug #369741; bug #356751; medium)
 	- mysql <unfixed> (bug #369754; medium)
-	- mysql-dfsg-5.0 <unfixed> (bug #369735; medium)
+	- mysql-dfsg-5.0 5.0.22-1 (bug #369735; medium)
 	- mysql-dfsg-4.1 <unfixed> (medium)
 CVE-2006-2659 (libs/comverp.c in Courier MTA before 0.53.2 allows attackers to cause ...)
 	- courier 0.53.2-1 (bug #368834)
@@ -1068,7 +1136,7 @@
 	- postgresql-8.0 <removed> (medium)
 	- postgresql-8.1 8.1.4-1 (medium)
 	- psycopg 1.1.21-5 (bug #369230)
-	- python-pgsql <unfixed> (bug #369250)
+	- python-pgsql 2.4.0-8 (bug #369250)
 	- pygresql 1:3.6.1-1 (bug #369239)
 	[sarge] - pygresql <not-affected> (Already includes proper quoting)
 	NOTE: Beginning with version 7.5.4, postgresql is a transition
@@ -1910,9 +1978,13 @@
 CVE-2006-1943 (Multiple cross-site scripting (XSS) vulnerabilities in Smarter Scripts ...)
 	NOT-FOR-US: Smarter Scripts IntelliLink Pro
 CVE-2006-1942 (Mozilla Firefox 1.5.0.2 and possibly other versions before 1.5.0.4, ...)
-	TODO: check
-	NOTE: pkg-mozilla-maintainers are preparing a big security release, I've pinged them
-	NOTE: to ask about this issue
+	NOTE: MFSA-2006-39
+	- firefox 1.5.dfsg+1.5.0.4-1 (low)
+	[sarge] - mozilla-firefox <unfixed> (low)
+	- thunderbird <unfixed> (low)
+	[sarge] - mozilla-thunderbird <unfixed> (low)
+	- mozilla <unfixed> (low)
+	- xulruner <unfixed> (low)
 CVE-2006-1941 (Neon Responder 5.4 for LANsurveyor allows remote attackers to cause a ...)
 	NOT-FOR-US: Neon Responder
 CVE-2006-1940 (Unspecified vulnerability in Ethereal 0.10.4 up to 0.10.14 allows ...)

More information about the Secure-testing-commits mailing list