[Secure-testing-commits] r5428 - data/CVE

Fri Feb 9 00:55:45 CET 2007

Author: jmm-guest
Date: 2007-02-09 00:55:41 +0100 (Fri, 09 Feb 2007)
New Revision: 5428

Modified:
   data/CVE/list
Log:
ffmpeg fixed
snort,w3m,mozilla no-dsa
tdiary already fixed
old kronolith issue doesn't affect kronolith1
NFUify potential 2yo Helix issue
verified some older issues


Modified: data/CVE/list
===================================================================

--- data/CVE/list	2007-02-08 20:36:06 UTC (rev 5427)
+++ data/CVE/list	2007-02-08 23:55:41 UTC (rev 5428)
@@ -674,7 +674,7 @@
 	- gstreamer0.10-ffmpeg 0.10.1-6
 	- gst-ffmpeg 0.8.7-10
 	[etch] - ffmpeg 0.cvs20060823-5
-	- ffmpeg <unfixed>
+	- ffmpeg 0.cvs20060823-6
 	- mplayer 1.0~rc1-12
 CVE-2007-0471 (sre/params.php in the Integrity Clientless Security (ICS) component in ...)
 	NOT-FOR-US: Check Point
@@ -685,7 +685,7 @@
 CVE-2007-0468 (Stack-based buffer overflow in rcdll.dll in msdev.exe in Visual C++ ...)
 	NOT-FOR-US: Visual C++
 CVE-2007-0467 (crashdump in Apple Mac OS X 10.4.8 allows local users in the admin ...)
-	TODO: check
+	NOT-FOR-US: Apple
 CVE-2007-0466 (Telestream Flip4Mac Windows Media Components for Quicktime 2.1.0.33 ...)
 	NOT-FOR-US: Telestream
 CVE-2007-0465 (Format string vulnerability in Apple Installer 2.1.5 on Mac OS X ...)
@@ -930,7 +930,7 @@
 	- gst-ffmpeg 0.8.7-9
 	- mplayer 1.0~rc1-12
 	[etch] - ffmpeg 0.cvs20060823-5
-	- ffmpeg <unfixed>
+	- ffmpeg 0.cvs20060823-6
 CVE-2007-XXXX [netpbm heap corruption]
 	- netpbm-free 2:10.0-11 (bug #407605)
 CVE-2007-0363 (Cross-site scripting (XSS) vulnerability in admin-search.php in (1) ...)
@@ -1300,6 +1300,7 @@
 CVE-2006-6931 (Algorithmic complexity vulnerability in Snort before 2.6.1, during ...)
 	- snort <unfixed> (low; bug #407421)
 	[sarge] - snort <no-dsa> (Minor issue)
+	[etch] - snort <no-dsa> (Minor issue)
 CVE-2006-6930 (SQL injection vulnerability in viewad.asp in Rapid Classified 3.1 ...)
 	NOT-FOR-US: Rapid Classified
 CVE-2006-6929 (Multiple cross-site scripting (XSS) vulnerabilities in Rapid ...)
@@ -2084,7 +2085,7 @@
 	NOT-FOR-US: Fishyshoop
 CVE-2006-6772 (Format string vulnerability in w3m 0.5.1, when run with the dump or ...)
 	- w3m 0.5.1-5.1 (bug #404564; low)
-	NOTE: Only exploitable in dump mode
+	[sarge] w3m <no-dsa> (Minor issue, only exploitable in dump mode)
 	TODO: Check w3mee, is this forked version still needed?
 CVE-2006-6771 (Multiple PHP remote file inclusion vulnerabilities in Irokez CMS 0.7.1 ...)
 	NOT-FOR-US: Irokez CMS
@@ -3151,7 +3152,7 @@
 CVE-2006-6337 (Multiple SQL injection vulnerabilities in giris.asp in Aspee and ...)
 	NOT-FOR-US: Aspee Ziyaretci Defteri
 CVE-2006-6336 (Heap-based buffer overflow in the Mail Management Server (MAILMA.exe) ...)
-	TODO: check
+	NOT-FOR-US: Eudora WorldMail
 CVE-2006-6335 (Multiple buffer overflows in Sophos Anti-Virus scanning engine before ...)
 	NOT-FOR-US: Sophos Anti-Virus
 CVE-2006-6334 (Heap-based buffer overflow in the SendChannelData function in wfica.ocx in ...)
@@ -3492,9 +3493,9 @@
 	NOT-FOR-US: Blogn
 CVE-2006-6175 (Directory traversal vulnerability in lib/FBView.php in Horde Kronolith ...)
 	- kronolith2 2.1.4-1 (bug #400899; bug #401061)
-	TODO: check kronolith 1.x
+	- kronolith <not-affected> (Vulnerable code not present)
 CVE-2006-6174 (Cross-site scripting (XSS) vulnerability in tDiary before 2.0.3 and ...)
-	- tdiary 2.1.4-4 (bug #400447; bug #400650)
+	- tdiary 2.0.2+20060303-4.1 (bug #400447; bug #400650)
 CVE-2006-6173 (Buffer overflow in the shared_region_make_private_np function in ...)
 	NOT-FOR-US: Mac OS X
 CVE-2006-6172 (Buffer overflow in the asmrp_eval function for Real Media input plugin ...)
@@ -4806,7 +4807,7 @@
 CVE-2006-5575
 	RESERVED
 CVE-2006-5574 (Unspecified vulnerability in the Brazilian Portuguese Grammar Checker ...)
-	TODO: check
+	NOT-FOR-US: Microsoft
 CVE-2006-5573
 	RESERVED
 CVE-2006-5572
@@ -6404,6 +6405,7 @@
 CVE-2006-4842 (The Netscape Portable Runtime (NSPR) API 4.6.1 and 4.6.2, as used in ...)
 	- xulrunner 1.8.0.9-1 (low; bug #405062)
 	[sarge] - mozilla <unfixed> (low)
+	[sarge] - mozilla <no-dsa> (Minor issue)
 	NOTE: could not find setuid binary in sid, but evolution-data-server has a setgid mail binary
 	NOTE: see https://bugzilla.mozilla.org/show_bug.cgi?id=351470
 	TODO: check whether sarge has a setuid/setgid binary linking against libnspr
@@ -19046,7 +19048,7 @@
 CVE-2005-4131 (Unspecified vulnerability in Microsoft Excel 2000, 2002, and 2003, in ...)
 	NOT-FOR-US: Excel
 CVE-2005-4130 (** UNVERIFIABLE, PRERELEASE ** ...)
-	TODO: Once dislosed, check, whether this affects Helix
+	NOT-FOR-US: Pre-Notification for RealMedia vulnerability, which never appeared
 CVE-2005-4129
 	REJECTED
 CVE-2005-4128
@@ -19056,7 +19058,7 @@
 	REJECTED
 	NOT-FOR-US: iTunes
 CVE-2005-4126 (** UNVERIFIABLE, PRERELEASE ** ...)
-	TODO: Once dislosed, check, whether this affects Helix
+	NOT-FOR-US: Pre-Notification for RealMedia vulnerability, which never appeared
 CVE-2005-4125
 	RESERVED
 CVE-2005-4124
@@ -21848,8 +21850,6 @@
 	NOTE: Sarge is vulnerable
 CVE-2005-3245 (Unspecified vulnerability in the ONC RPC dissector in Ethereal 0.10.3 ...)
 	- ethereal 0.10.13-1 (bug #334880; medium)
-	NOTE: This affects Woody and Sarge
-	TODO: This is disabled by default, if this is a compile-time option change to "unimportant"
 CVE-2005-3244 (The BER dissector in Ethereal 0.10.3 to 0.10.12 allows remote ...)
 	{DSA-1171}
 	[woody] - ethereal <not-affected> (This only affects Ethereal 0.10.3 to 0.10.12)
@@ -26567,7 +26567,6 @@
 	NOT-FOR-US: ViRobot
 CVE-2005-2040 (Multiple buffer overflows in the getterminaltype function in telnetd ...)
 	{DSA-758-1}
-	TODO: Check telnetd from netkit, krb4, krb5, as they all seem to be derived from the same BSD code base
 	- heimdal 0.6.3-11 (bug #315065; bug #315086; high)
 CVE-2005-2039 (Unknown vulnerability in &quot;various plugins&quot; for NanoBlogger 3.2.1 and ...)
 	- nanoblogger <not-affected> (3.1 version in Debian was not affected by this vulnerability, see #315492)


