[Secure-testing-commits] r4864 - data/CVE
Moritz Muehlenhoff
jmm-guest at costa.debian.org
Fri Oct 20 16:36:52 UTC 2006
Author: jmm-guest
Date: 2006-10-20 16:36:50 +0000 (Fri, 20 Oct 2006)
New Revision: 4864
Modified:
data/CVE/list
Log:
new steam issue
python2.3 fixed
new qt issue
some mozilla issues don't affect xulrunner, some are already fixed
mediawiki fixed
bugnums
rewrote blender and bind issues, which are not important for Etch
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2006-10-19 13:15:39 UTC (rev 4863)
+++ data/CVE/list 2006-10-20 16:36:50 UTC (rev 4864)
@@ -1,3 +1,6 @@
+CVE-2006-XXXX [unspecified steam cache vulnerability]
+ - steam 2.2.31-1
+ [sarge] - steam <not-affected> (Sarge version doesn't implement caching)
CVE-2006-5381 (Contenido CMS stores sensitive data under the web root with ...)
TODO: check
CVE-2006-5380 (** DISPUTED ** ...)
@@ -835,7 +838,7 @@
CVE-2006-4980 (Buffer overflow in the repr function in Python 2.3 through 2.6 before ...)
- python2.5 2.5-1 (bug #391589)
- python2.4 2.4.3-9 (bug #391589)
- - python2.3 <unfixed> (bug #393053)
+ - python2.3 2.3.5-16 (bug #393053)
- python2.2 <not-affected> (Compiled without UCS-4 support)
CVE-2006-4979 (Direct static code injection vulnerability in cfgphpquiz/install.php ...)
NOT-FOR-US: PhpQuiz
@@ -1191,8 +1194,10 @@
CVE-2006-4812 (Integer overflow in PHP 5 up to 5.1.6 and 4 before 4.3.0 allows remote ...)
- php4 <not-affected>
- php5 <unfixed> (bug #391586)
-CVE-2006-4811
+CVE-2006-4811 [qt pixmap overflow]
RESERVED
+ - qt-x11-free <unfixed> (bug #394192)
+ - qt4-x11 <unfixed> (bug #394192)
CVE-2006-4810
RESERVED
CVE-2006-4809
@@ -2341,7 +2346,6 @@
CVE-2006-4311 (PHP remote file inclusion vulnerability in Sonium Enterprise ...)
NOT-FOR-US: Sonium Enterprise Adressbook
CVE-2006-4310 (Mozilla Firefox 1.5.0.6 allows remote attackers to cause a denial of ...)
- - xulrunner <unfixed>
- firefox <unfixed>
- mozilla <unfixed>
- mozilla-firefox <unfixed>
@@ -5566,7 +5570,7 @@
CVE-2006-2879 (SQL injection vulnerability in newscomments.php in Alex News-Engine ...)
NOT-FOR-US: Alex News-Engine
CVE-2006-2878 (The spellchecker (spellcheck.php) in DokuWiki 2006/06/04 and earlier ...)
- - dokuwiki 0.0.20060309-4 (bug #370369; high)
+ - dokuwiki 0.0.20060309-4 (bug #370369; bug #370785; high)
CVE-2006-2877 (PHP remote file inclusion vulnerability in Bookmark4U 2.0.0 and ...)
NOT-FOR-US: Bookmark4U
CVE-2006-2876 (Cross-site scripting (XSS) vulnerability in cat.php in PHP Pro Publish ...)
@@ -5826,7 +5830,6 @@
NOTE: MFSA-2006-40
- thunderbird 1.5.0.4-1 (high)
- mozilla 2:1.7.13-0.3 (high)
- - xulrunner <unfixed> (high)
CVE-2006-2780 (Integer overflow in Mozilla Firefox and Thunderbird before 1.5.0.4 ...)
{DSA-1134-1 DSA-1120 DSA-1118}
NOTE: MFSA-2006-32
@@ -5840,7 +5843,7 @@
- firefox 1.5.dfsg+1.5.0.4-1 (high)
- thunderbird 1.5.0.4-1 (high)
- mozilla 2:1.7.13-0.3 (high)
- - xulrunner <unfixed> (high)
+ - xulrunner 1.8.0.4-1 (high)
CVE-2006-2778 (The crypto.signText function in Mozilla Firefox and Thunderbird before ...)
{DSA-1134-1 DSA-1120 DSA-1118}
NOTE: MFSA-2006-38
@@ -5853,7 +5856,7 @@
NOTE: MFSA-2006-43
- firefox 1.5.dfsg+1.5.0.4-1 (high)
- mozilla 2:1.7.13-0.3 (high)
- - xulrunner <unfixed> (high)
+ - xulrunner 1.8.0.4-1 (high)
CVE-2006-2776 (Certain privileged UI code in Mozilla Firefox and Thunderbird before ...)
{DSA-1134-1 DSA-1120 DSA-1118}
NOTE: MFSA-2006-37
@@ -6231,7 +6234,8 @@
NOT-FOR-US: Novell Client for Windows
NOTE: The Windows clipboard is a public resource anyway.
CVE-2006-2611 (Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in ...)
- - mediawiki <unfixed> (medium)
+ - mediawiki1.7 <not-affected> (Fixed in 1.5 prior to release)
+ - mediawiki <unfixed>
CVE-2006-2610 (Cross-site scripting (XSS) vulnerability in view.php in phpRaid 2.9.5 ...)
NOT-FOR-US: phpRaid
CVE-2006-2609 (artmedic newsletter 4.1.2 and possibly other versions, when ...)
@@ -6374,11 +6378,12 @@
CVE-2002-2212 (The DNS resolver in unspecified versions of Fujitsu UXP/V, when ...)
NOT-FOR-US: Fujitsu UXP/V
CVE-2002-2211 (BIND 4 and BIND 8, when resolving recursive DNS queries for arbitrary ...)
- - bind <unfixed> (medium)
- [sarge] - bind <no-dsa> (Upgrade to BIND 9 as a fix)
+ - bind <unfixed> (unimportant)
- bind9 <not-affected> (does not send parallel queries)
NOTE: Disabling recursion does not close all attack vectors.
NOTE: Browser reflection attacks will still work.
+ NOTE: Bind 8 design limitations that are only addressed in bind 9 are not
+ NOTE: treated a security issues, DNS admins need to be aware what they are using
CVE-2006-2550 (perlpodder before 0.5 allows remote attackers to execute arbitrary ...)
NOT-FOR-US: perlpodder
CVE-2006-2549 (Stack-based buffer overflow in PDF Form Filling and Flattening Tool ...)
@@ -7447,8 +7452,8 @@
CVE-2006-2074 (Unspecified vulnerability in Juniper Networks JUNOSe E-series routers ...)
NOT-FOR-US: Juniper Networks JUNOSe
CVE-2006-2073 (Unspecified vulnerability in ISC BIND allows remote attackers to cause ...)
- - bind9 <unfixed> (low)
- [sarge] - bind9 <no-dsa> (Only exploitable by trusted users after TSIG transaction)
+ - bind9 <unfixed> (unimportant)
+ NOTE: Only exploitable by trusted users after TSIG transaction
CVE-2006-2072 (Multiple unspecified vulnerabilities in DeleGate 9.x before 9.0.6 and ...)
NOT-FOR-US: DeleGate
CVE-2005-4793 (Multiple unspecified vulnerabilities in the web utility function in ...)
@@ -8956,7 +8961,7 @@
- mysql <removed> (bug #365939; low)
CVE-2006-1516 (The check_connection function in sql_parse.cc in MySQL 4.0.x up to ...)
{DSA-1079-1 DSA-1073-1 DSA-1071-1}
- - mysql-dfsg-5.0 5.0.21-1 (bug #365939; bug #365938; low)
+ - mysql-dfsg-5.0 5.0.21-1 (bug #365939; bug #365938; #366044; low)
- mysql-dfsg-4.1 <removed> (bug #365939; bug #366043; low)
- mysql-dfsg <removed> (bug #365939; bug #356751; low)
- mysql <removed> (bug #365939; low)
@@ -16756,9 +16761,10 @@
CVE-2005-3152 (Multiple cross-site scripting (XSS) vulnerabilities in CubeCart 3.0.3 ...)
NOT-FOR-US: CubeCart
CVE-2005-3151 (Buffer overflow in blenderplay in Blender Player 2.37a allows ...)
- - blender <unfixed> (bug #332413; low)
- [sarge] - blender <no-dsa> (Hardly exploitable)
- [woody] - blender <not-affected> (Woody's blender does not contain blenderplayer)
+ - blender <unfixed> (bug #332413; unimportant)
+ NOTE: To exploit this an attacker would need to trick a user into opening a file
+ NOTE: with a very suspicious file, no automatic processing of Blender files
+ NOTE: This might even be fixed in 2.42
CVE-2005-3150 (Format string vulnerability in the Log_Flush function in Weex 2.6.1.5, ...)
{DSA-855-1}
- weex 2.6.1-6sarge1 (bug #332424; medium)
More information about the Secure-testing-commits
mailing list