[Secure-testing-commits] r4676 - data/CVE

[Stefan Fritsch]

Author: stef-guest
Date: 2006-09-04 21:52:02 +0000 (Mon, 04 Sep 2006)
New Revision: 4676

Modified:
   data/CVE/list
Log:
- CVEs for several already fixed php issues
- of these, CVE-2006-4484 is actually a libgd2 issue
- CVE-2006-4262: cscope is already fixed
- CVE-2006-4226 was missing mysql-dfsg-4.1 (low)


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2006-09-04 21:31:03 UTC (rev 4675)
+++ data/CVE/list	2006-09-04 21:52:02 UTC (rev 4676)
@@ -69,17 +69,23 @@
 CVE-2006-4487 (DUware DUpoll 3.0 and 3.1 stores _private/Dupoll.mdb under the web ...)
 	NOT-FOR-US: DUpoll
 CVE-2006-4486 (Unspecified vulnerability in PHP before 5.1.6, when running on a ...)
-	TODO: check
+	- php5 5.1.6-1
+	- php4 4:4.4.4-1
 CVE-2006-4485 (The stripos function in PHP before 5.1.5 has unknown impact and attack ...)
-	TODO: check
+	- php5 5.1.6-1
+	- php4 4:4.4.4-1
 CVE-2006-4484 (Buffer overflow in the LWZReadByte_ function in ...)
-	TODO: check
+	- libgd2 <unfixed> (medium; bug #384838)
+	- xloadimage <unfixed> (low; bug #384841)
 CVE-2006-4483 (The cURL extension files (1) ext/curl/interface.c and (2) ...)
-	TODO: check
+	- php5 5.1.6-1 (low)
+	- php4 4:4.4.4-1 (low)
 CVE-2006-4482 (Multiple heap-based buffer overflows in the (1) str_repeat and (2) ...)
-	TODO: check
+	- php5 5.1.6-1 (low)
+	- php4 4:4.4.4-1 (low)
 CVE-2006-4481 (The (1) file_exists and (2) imap_reopen functions in PHP before 5.1.5 ...)
-	TODO: check
+	- php5 5.1.6-1 (low)
+	- php4 4:4.4.4-1 (low)
 CVE-2006-4480 (Incomplete blacklist vulnerability in the nk_CSS function in nuked.php ...)
 	NOT-FOR-US: Nuked-Klan
 CVE-2006-4479 (Cross-site scripting (XSS) vulnerability in loginreq2.php in Visual ...)
@@ -293,7 +299,7 @@
 CVE-2006-4380 (MySQL before 4.1.13 allows local users to cause a denial of service ...)
 	- mysql-dfsg-5.0 <not-affected> (only 4.1 affected)
 	- mysql-dfsg <not-affected> (only 4.1 affected)
-	- mysql-dfsg-4.1 <unfixed>
+	- mysql-dfsg-4.1 <removed>
 CVE-2006-4379
 	RESERVED
 CVE-2006-4378 (** DISPUTED ** ...)
@@ -401,9 +407,6 @@
 CVE-2006-XXXX [zope Arbitrary file inclusion]
 	TODO: check zope zope-2.7 zope2.8 zope2.9 zope3
 	- zope2.8 2.8.8-2
-CVE-2006-XXXX [segfault on corrupt gif from php bug #38112]
-	- libgd2 <unfixed> (medium; bug #384838)
-	- xloadimage <unfixed> (low; bug #384841)
 CVE-2006-4329 (Multiple PHP remote file inclusion vulnerabilities in Shadows Rising ...)
 	NOT-FOR-US: Shadows Rising
 CVE-2006-4328 (SQL injection vulnerability in admin.php in CloudNine Interactive ...)
@@ -543,7 +546,7 @@
 CVE-2006-4263 (Multiple PHP remote file inclusion vulnerabilities in the Product ...)
 	NOT-FOR-US: mambo-phpshop (com_phpshop) for Mambo and Joomla!
 CVE-2006-4262 (Multiple buffer overflows in cscope 15.5 and earlier allow ...)
-	- cscope <unfixed> (low; bug #385893)
+	- cscope 15.5+cvs20060902-1 (low; bug #385893)
 CVE-2006-4261 (Mozilla Firefox 1.5.0.6 and earlier allows remote attackers to cause a ...)
 	- xulrunner <unfixed>
 	- firefox <unfixed>
@@ -622,7 +625,8 @@
 	- mysql-dfsg-5.0 5.0.24-3 (low; bug #384798)
 CVE-2006-4226 (MySQL before 4.1.21, 5.0 before 5.0.25, and 5.1 before 5.1.12, when ...)
 	- mysql-dfsg-5.0 5.0.24-3 (low; bug #384798)
-	- mysql-dfsg <unfixed> (low)
+	- mysql-dfsg <removed> (low)
+	- mysql-dfsg-4.1 <removed> (low)
 CVE-2006-4225
 	REJECTED
 	NOT-FOR-US: Virtual War
@@ -1047,7 +1051,7 @@
 	NOT-FOR-US: Cisco
 CVE-2006-4031 (MySQL 4.1 before 4.1.21 and 5.0 before 5.0.24 allows a local user to ...)
 	- mysql-dfsg-5.0 5.0.24-1 (bug #382415; low)
-	- mysql-dfsg <unfixed> (bug #380271; low)
+	- mysql-dfsg <removed> (bug #380271; low)
 	[sarge] - mysql-dfsg-4.1 <no-dsa> (Now documented design error, no real fix feasible)
 	[sarge] - mysql-dfsg <no-dsa> (Now documented design error, no real fix feasible)
 CVE-2006-4030 (Unspecified vulnerability in the stats module in Gallery 1.5.1-RC2 and ...)