[Secure-testing-commits] r6298 - in data: . CVE

keescook-guest at alioth.debian.org keescook-guest at alioth.debian.org
Mon Aug 13 21:30:43 UTC 2007 

Author: keescook-guest
Date: 2007-08-13 21:30:43 +0000 (Mon, 13 Aug 2007)
New Revision: 6298

Modified:
   data/CVE/list
   data/embedded-code-copies
Log:
NFUs: 31
unfixed: gftp linux-2.6 openssl
fixed: libvorbis sleuthkit vim
not-affected: wpasupplicant
embedded: fpslib in gftp


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2007-08-13 21:14:14 UTC (rev 6297)
+++ data/CVE/list	2007-08-13 21:30:43 UTC (rev 6298)
@@ -9,17 +9,17 @@
 CVE-2007-4263 (Unspecified vulnerability in the server side of the Secure Copy (SCP) ...)
 	NOT-FOR-US: Cisco
 CVE-2007-4262 (Unrestricted file upload vulnerability in EZPhotoSales 1.9.3 and ...)
-	TODO: NOT-FOR-US EZPhotoSales
+	NOT-FOR-US: EZPhotoSales
 CVE-2007-4261 (EZPhotoSales 1.9.3 and earlier stores sensitive information under the ...)
-	TODO: NOT-FOR-US EZPhotoSales
+	NOT-FOR-US: EZPhotoSales
 CVE-2007-4260 (EZPhotoSales 1.9.3 and earlier has a default "admin" account for ...)
-	TODO: NOT-FOR-US EZPhotoSales
+	NOT-FOR-US: EZPhotoSales
 CVE-2007-4259 (EZPhotoSales 1.9.3 and earlier allows remote attackers to download ...)
-	TODO: NOT-FOR-US EZPhotoSales
+	NOT-FOR-US: EZPhotoSales
 CVE-2007-4258 (SQL injection vulnerability in directory.php in Prozilla Pub Site ...)
 	NOT-FOR-US: Prozilla
 CVE-2007-4257 (Multiple buffer overflows in Live for Speed (LFS) S1 and S2 allow ...)
-	NOT-FOR-US: Live for Speed 
+	NOT-FOR-US: Live for Speed
 CVE-2007-4256 (Directory traversal vulnerability in showpage.cgi in YNP Portal System ...)
 	NOT-FOR-US: YNP Portal System
 CVE-2007-4255 (Buffer overflow in the mSQL extension in PHP 5.2.3 allows ...)
@@ -52,9 +52,9 @@
 CVE-2007-4244 (PHP remote file inclusion vulnerability in langset.php in the J! ...)
 	NOT-FOR-US: com_jreactions for Joomla!
 CVE-2007-4243 (Unspecified vulnerability in pfilter-reporter.pl in Astaro Security ...)
-	NOT-FOR-US: Astaro
+	NOT-FOR-US: Astaro Security Gateway
 CVE-2007-4242 (The pop3 Proxy in Astaro Security Gateway (ASG) 7 does not perform ...)
-	NOT-FOR-US: Astaro
+	NOT-FOR-US: Astaro Security Gateway
 CVE-2007-4241 (Buffer overflow in ldcconn in Hewlett-Packard (HP) Controller for ...)
 	NOT-FOR-US: Hewlett-Packard
 CVE-2007-4240 (The check_logout function in class/auth.php in Help Center Live (hcl) ...)
@@ -122,43 +122,43 @@
 CVE-2007-4210 (Multiple SQL injection vulnerabilities in module.php in LANAI (la-nai) ...)
 	NOT-FOR-US: LANAI CMS
 CVE-2007-4209 (SQL injection vulnerability in Recherche.php in Aceboard forum allows ...)
-	NOT-FOR-US: Aceboard
+	NOT-FOR-US: Aceboard forum
 CVE-2007-4208 (SQL injection vulnerability in default.asp in Next Gen Portfolio ...)
-	TODO: check
+	NOT-FOR-US: Next Gen Portfolio Manager
 CVE-2007-4207 (SQL injection vulnerability in admin_console/index.asp in Gallery In A ...)
-	TODO: check
+	NOT-FOR-US: Gallery In A Box
 CVE-2007-4206 (Kaspersky Anti-Spam 3.0 MP1 before Critical Fix 2 (3.0.278.4) sets ...)
-	TODO: check
+	NOT-FOR-US: Kaspersky Anti-Spam
 CVE-2007-4205 (XHA (Linux-HA) on the BlueCat Networks Adonis DNS/DHCP Appliance ...)
-	TODO: check
+	NOT-FOR-US: BlueCat Networks Adonis
 CVE-2007-4204 (Hitachi Groupmax Collaboration - Schedule, as used in Groupmax ...)
-	TODO: check
+	NOT-FOR-US: Hitachi Groupmax Collaboration
 CVE-2007-4203 (Session fixation vulnerability in Mambo 4.6.2 CMS allows remote ...)
 	TODO: check
 CVE-2007-4202 (Guidance Software EnCase Enterprise Edition (EEE) 6 does not properly ...)
-	TODO: check
+	NOT-FOR-US: Guidance Software EnCase
 CVE-2007-4201 (Guidance Software EnCase 6.2 and 6.5 does not properly handle a volume ...)
-	TODO: check
+	NOT-FOR-US: Guidance Software EnCase
 CVE-2007-4200 (ntfs.c in fsstat in Brian Carrier The Sleuth Kit (TSK) before 2.09 ...)
-	TODO: check
+	- sleuthkit 2.09-1 (low)
 CVE-2007-4199 (Brian Carrier The Sleuth Kit (TSK) before 2.09 allows user-assisted ...)
-	TODO: check
+	- sleuthkit 2.09-1 (low)
 CVE-2007-4198 (The fs_data_put_str function in ntfs.c in fls in Brian Carrier The ...)
-	TODO: check
+	- sleuthkit 2.09-1 (low)
 CVE-2007-4197 (icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 omits NULL ...)
-	TODO: check
+	- sleuthkit 2.09-1 (low)
 CVE-2007-4196 (icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 misinterprets a ...)
-	TODO: check
+	- sleuthkit 2.09-1 (low)
 CVE-2007-4195 (Use-after-free vulnerability in ext2fs.c in Brian Carrier The Sleuth ...)
-	TODO: check
+	- sleuthkit 2.09-1 (low)
 CVE-2007-4194 (Guidance Software EnCase 5.0 allows user-assisted remote attackers to ...)
-	TODO: check
+	NOT-FOR-US: Guidance Software EnCase
 CVE-2007-4193 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
-	TODO: check
+	NOT-FOR-US: DVD Rental System
 CVE-2007-4192 (Multiple cross-site scripting (XSS) vulnerabilities in IDE Group DVD ...)
-	TODO: check
+	NOT-FOR-US: DVD Rental System
 CVE-2007-4191 (Panda Antivirus 2008 stores service executables under the product's ...)
-	TODO: check
+	NOT-FOR-US: Panda Antivirus
 CVE-2007-4190 (CRLF injection vulnerability in Joomla! before 1.0.13 (aka Sunglow) ...)
 	NOT-FOR-US: Joomla!
 CVE-2007-4189 (Multiple cross-site scripting (XSS) vulnerabilities in Joomla! before ...)
@@ -172,17 +172,17 @@
 CVE-2007-4185 (Joomla! 1.0.12 allows remote attackers to obtain sensitive information ...)
 	NOT-FOR-US: Joomla!
 CVE-2007-4184 (SQL injection vulnerability in administrator/popups/pollwindow.php in ...)
-	TODO: check
+	NOT-FOR-US: Joomla!
 CVE-2007-4183 (SQL injection vulnerability in main.php in paBugs 2.0 Beta 3 and ...)
-	TODO: check
+	NOT-FOR-US: paBugs
 CVE-2007-4182 (Unrestricted file upload vulnerability in index.php in WikiWebWeaver ...)
-	TODO: check
+	NOT-FOR-US: WikiWebWeaver
 CVE-2007-4181 (** DISPUTED ** ...)
-	TODO: check
+	NOT-FOR-US: Pluck
 CVE-2007-4180 (** DISPUTED ** ...)
-	TODO: check
+	NOT-FOR-US: Pluck
 CVE-2007-4179 (Unspecified vulnerability in the Address and Routing Parameter Area ...)
-	TODO: check
+	NOT-FOR-US: HPUX
 CVE-2007-4178 (Cross-site scripting (XSS) vulnerability in index.php in WebDirector ...)
 	TODO: check
 CVE-2007-4177 (Multiple cross-site scripting (XSS) vulnerabilities in Interact before ...)
@@ -306,7 +306,7 @@
 CVE-2007-4117 (** DISPUTED ** ...)
 	TODO: check
 CVE-2005-4860 (Spectrum Cash Receipting System before 6.504 uses weak cryptography ...)
-	TODO: check
+	NOT-FOR-US: Spectrum Cash Receipting System
 CVE-2007-XXXX [teamspeak-server arbitrary file disclosure]
 	- teamspeak-server 2.0.23.19-1 (bug #435707; medium)
 CVE-2007-XXXX [tor insufficient authentication on control port]
@@ -819,7 +819,7 @@
 CVE-2007-3871
 	RESERVED
 CVE-2006-7221 (Multiple off-by-one errors in fsplib.c in fsplib before 0.8 allow ...)
-	TODO: check
+	- gftp <unfixed> (low; bug #437710)
 CVE-2007-XXXX [dokuwiki XSS in spellchecker]
 	- dokuwiki 0.0.20070626b-1 (unimportant; bug #434134)
 	NOTE: IE browser bug are not treated as security issues in packages applications
@@ -1604,7 +1604,7 @@
 CVE-2007-3515 (SQL injection vulnerability in view_event.php in TotalCalendar 2.402 ...)
 	NOT-FOR-US: TotalCalendar
 CVE-2006-7220 (Unspecified vulnerability in SAP SAPLPD and SAPSPRINT allows remote ...)
-	TODO: check
+	NOT-FOR-US: SAP SAPLPD
 CVE-2006-7219 (eZ publish before 3.8.5 does not properly enforce permissions for ...)
 	- ezpublish <not-affected> (Debian's version is too old)
 CVE-2006-7218 (eZ publish before 3.8.1 does not properly enforce permissions for ...)
@@ -2631,14 +2631,14 @@
 CVE-2007-3109 (The CERN Image Map Dispatcher (htimage.exe) in Microsoft FrontPage ...)
 	NOT-FOR-US: Microsoft FrontPage
 CVE-2007-3108 (The BN_from_montgomery function in crypto/bn/bn_mont.c in OpenSSL ...)
-	TODO: check
+	- openssl <unfixed> (low)
 CVE-2007-3107 (The signal handling in the Linux kernel 2.6.2 and later, when run on ...)
 	- linux-2.6 <unfixed> (unimportant)
 	NOTE: Not reproducibly reliably by an attacker, mostly a bug
 CVE-2007-3106 (libvorbis 1.1.2, and possibly other versions before 1.2.0, allows ...)
-	TODO: check
+	- libvorbis 1.2.0.dfsg-1 (medium)
 CVE-2007-3105 (Stack-based buffer overflow in the random number generator (RNG) ...)
-	TODO: check
+	- linux-2.6 <unfixed>
 CVE-2007-3104 (The sysfs_readdir function in the Linux kernel in Red Hat Enterprise ...)
 	- linux-2.6 <unfixed>
 CVE-2007-3103 (The init.d script for the X.Org X11 xfs font server on Red Hat ...)
@@ -2977,7 +2977,7 @@
 CVE-2007-2954
 	RESERVED
 CVE-2007-2953 (Format string vulnerability in the helptags_one function in ...)
-	TODO: check
+	- vim 1:7.1-056+1 (low)
 CVE-2007-2952
 	RESERVED
 CVE-2007-2951 (The parseIrcUrl function in src/kvirc/kernel/kvi_ircurl.cpp in KVIrc ...)
@@ -3033,7 +3033,7 @@
 CVE-2007-2928
 	RESERVED
 CVE-2007-2927 (Unspecified vulnerability in Atheros 802.11 a/b/g wireless adapter ...)
-	TODO: check
+	NOT-FOR-US: Windows Atheros drivers
 CVE-2007-2926 (ISC BIND 9 through 9.5.0a5 uses a weak random number generator during ...)
 	{DSA-1341-2}
 	- bind9 1:9.4.1-P1-1
@@ -3143,7 +3143,7 @@
 CVE-2007-2875 (Integer underflow in the cpuset_tasks_read function in the Linux ...)
 	- linux-2.6 2.6.21-5 (medium)
 CVE-2007-2874 (Buffer overflow in the wpa_printf function in the debugging code in ...)
-	TODO: check
+	- wpasupplicant <not-affected> (Fedora-only issue)
 CVE-2007-2873 (SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as ...)
 	- spamassassin 3.2.1-1 (low)
 CVE-2007-2872 (Multiple integer overflows in the chunk_split function in PHP 5 before ...)
@@ -4248,7 +4248,7 @@
 CVE-2007-2409 (Cross-domain vulnerability in WebCore on Apple Mac OS X 10.3.9 and ...)
 	TODO: check
 CVE-2007-2408 (WebKit in Apple Safari 3 Beta before Update 3.0.3 does not properly ...)
-	TODO: check
+	NOT-FOR-US: Apple Safari
 CVE-2007-2407 (The Samba server on Apple Mac OS X 10.3.9 and 10.4.10, when Windows ...)
 	- samba <not-affected> (MacOS/Apple-specific vulnerability)
 CVE-2007-2406 (Quartz Composer on Apple Mac OS X 10.4.10 does not initialize a ...)
@@ -6745,7 +6745,7 @@
 	- tomcat5 <unfixed> (low)
 	- tomcat5.5 <unfixed> (low)
 CVE-2007-1354 (The Access Control functionality (JMXOpsAccessControlFilter) in JMX ...)
-	TODO: check
+	NOT-FOR-US: JBoss Application Server
 CVE-2007-1353 (The setsockopt function in the L2CAP and HCI Bluetooth support in the ...)
 	- linux-2.6 <unfixed> (low)
 CVE-2007-1352 (Integer overflow in the FontFileInitTable function in X.Org libXfont ...)
@@ -16640,7 +16640,7 @@
 CVE-2006-4170
 	REJECTED
 CVE-2006-4169 (Multiple directory traversal vulnerabilities in the G/PGP (GPG) Plugin ...)
-	TODO: check
+	NOT-FOR-US: G/PGP (GPG) plugin for Squirrelmail
 CVE-2006-4168 (Integer overflow in the exif_data_load_data_entry function in ...)
 	{DSA-1310-1}
 	- libexif 0.6.16-1 (bug #430012)

Modified: data/embedded-code-copies
===================================================================
--- data/embedded-code-copies	2007-08-13 21:14:14 UTC (rev 6297)
+++ data/embedded-code-copies	2007-08-13 21:30:43 UTC (rev 6298)
@@ -259,3 +259,6 @@
 
 libwpd (WordPerfect converter):
 openoffice.org
+
+fsplib (http://sourceforge.net/projects/fsp/):
+gftp (lib/fsplib version 0.3)

More information about the Secure-testing-commits mailing list