[Secure-testing-commits] r6023 - in data: CVE DSA

Sat Jun 16 20:44:18 UTC 2007

Author: jmm-guest
Date: 2007-06-16 20:44:18 +0000 (Sat, 16 Jun 2007)
New Revision: 6023

Modified:
   data/CVE/list
   data/DSA/list
Log:
add missing CVE ID to iceape
webpy not an issue
iceweasel issue false alarm
rhapsody has been yanked from the archive
apache and bind 8 are gone too
asterisk-chan-capi unimportant
fix some icefoo severities
sarge not affected by minor slocate information disclosure
linux-2.6 no-dsa


Modified: data/CVE/list
===================================================================

--- data/CVE/list	2007-06-16 18:26:09 UTC (rev 6022)
+++ data/CVE/list	2007-06-16 20:44:18 UTC (rev 6023)
@@ -590,7 +590,10 @@
 CVE-2000-1243 (Privacy leak in Dansie Shopping Cart 3.04, and probably earlier ...)
 	TODO: check
 CVE-2007-XXXX [webpy HTTP response splitting vulnerability]
-	- webpy 0.210-1 (bug #427715)
+	- webpy 0.210-1 (bug #427715; unimportant)
+	NOTE: This is not a vulnerability, but an additional precaution function for
+	NOTE: a development framework. If someone wants to have this updated in Etch, this
+	NOTE: needs to go through a point update
 CVE-2007-XXXX [dar choosing weak IV when encrypting]
 	- dar 2.3.3-1 (bug #425335; low)
 	[sarge] - dar <no-dsa> (minor issue)
@@ -2369,7 +2372,7 @@
 CVE-2007-2177 (Stack-based buffer overflow in the Microgaming Download Helper ActiveX ...)
 	NOT-FOR-US: Microgaming Download Helper
 CVE-2007-2176 (Unspecified vulnerability in Mozilla Firefox allows remote attackers ...)
-	- iceweasel <unfixed> (low)
+	NOT-FOR-US: Related to Apple QuickTime as well, no information about Mozilla being affected is available
 CVE-2007-2175 (Apple QuickTime Java extensions (QTJava.dll), as used in Safari and ...)
 	NOT-FOR-US: Apple QuickTime
 CVE-2007-2174 (The IOCTL handling in srescan.sys in the ZoneAlarm Spyware Removal ...)
@@ -3941,11 +3944,9 @@
 CVE-2007-1504 (Cross-site scripting (XSS) vulnerability in the Servlet Service in ...)
 	NOT-FOR-US: Fujitsu Interstage Application Server
 CVE-2007-1503 (Multiple format string vulnerabilities in comm.c in Rhapsody IRC 0.28b ...)
-	- rhapsody <unfixed> (medium)
-	NOTE: Removal from Etch requested
+	- rhapsody <removed> (medium)
 CVE-2007-1502 (Multiple buffer overflows in Rhapsody IRC 0.28b allow remote attackers ...)
-	- rhapsody <unfixed> (medium)
-	NOTE: Removal from Etch requested
+	- rhapsody <removed> (medium)
 CVE-2007-1501 (Stack-based buffer overflow in Avant Browser 11.0 build 26 allows ...)
 	NOT-FOR-US: Avant Browse
 CVE-2007-1500 (The Linux Security Auditing Tool (LSAT) allows local users to ...)
@@ -4324,7 +4325,7 @@
 CVE-2007-1350 (Stack-based buffer overflow in webadmin.exe in Novell NetMail 3.5.2 ...)
 	NOT-FOR-US: Novell NetMail
 CVE-2007-1349 (PerlRun.pm in Apache mod_perl before 1.30, and RegistryCooker.pm in ...)
-	- apache <unfixed> (low)
+	- apache <removed> (low)
 	- libapache2-mod-perl2 <unfixed> (low)
 CVE-2007-1348
 	RESERVED
@@ -4742,7 +4743,7 @@
 CVE-2007-1217 (Buffer overflow in the bufprint function in capiutil.c in libcapi, as ...)
 	- isdnutils 1:3.9.20060704-3 (bug #408530; low)
 	[sarge] - isdnutils <no-dsa> (Not exploitable over ISDN network)
-	- asterisk-chan-capi 0.7.1-1.1 (bug #411293)
+	- asterisk-chan-capi 0.7.1-1.1 (bug #411293; unimportant)
 	- linux-2.6 <unfixed> (bug #411294; unimportant)
 	NOTE: Not exploitable over ISDN network, only theoretically through a dedicated CAPI server
 CVE-2007-1216 (Double-free vulnerability in the GSS-API library ...)
@@ -4994,12 +4995,11 @@
 CVE-2007-1117 (Unspecified vulnerability in Publisher 2007 in Microsoft Office 2007 ...)
 	NOT-FOR-US: Microsoft Office
 CVE-2007-1116 (The CheckLoadURI function in Mozilla Firefox 1.8 lists the about: URI ...)
-	- iceweasel <unfixed> (medium)
-	- iceape <unfixed> (medium)
-	- xulrunner 1.8.1.4-1 (bug #415919; bug #415944; bug #415945; medium)
+	- iceweasel 2.0.0.4-1 (low)
+	- iceape 1.1.2-1 (low)
+	- xulrunner 1.8.1.4-1 (bug #415919; bug #415944; bug #415945; low)
 	NOTE: according to a blog comment at http://www.gnucitizen.org/projects/hscan-redux/,
 	NOTE: older mozillas are not vulnerable
-	TODO: this should be checked
 CVE-2007-1115 (The child frames in Opera 9 before 9.20 inherit the default charset ...)
 	NOT-FOR-US: Opera
 CVE-2007-1114 (The child frames in Microsoft Internet Explorer 7 inherit the default ...)
@@ -5067,9 +5067,9 @@
 CVE-2007-1085 (Cross-site scripting (XSS) vulnerability in Google Desktop allows ...)
 	NOT-FOR-US: Google Desktop
 CVE-2007-1084 (Mozilla Firefox 2.0.0.1 and earlier does not prompt users before ...)
-	- iceweasel <unfixed> (medium)
-	- iceape <unfixed> (medium)
-	NOTE: xulrunner by itself is not affecte, but other browsers based on xulrunner may be affected
+	- iceweasel <unfixed> (low)
+	- iceape <unfixed> (low)
+	NOTE: xulrunner by itself is not affeced, but other browsers based on xulrunner may be affected
 	TODO: check epiphany, galeon and kazehakase
 CVE-2007-1083 (Buffer overflow in the Configuration Checker (ConfigChk) ActiveX ...)
 	NOT-FOR-US: ConfigChk ActiveX control
@@ -5248,7 +5248,8 @@
 CVE-2006-7052 (Multiple PHP remote file inclusion vulnerabilities in DotWidget For ...)
 	NOT-FOR-US: DotWidget
 CVE-2006-7051 (The sys_timer_create function in posix-timers.c for Linux kernel 2.6.x ...)
-	- linux-2.6 <unfixed> (medium)
+	- linux-2.6 <unfixed> (low)
+	[etch] - linux-2.6 <no-dsa> (Design limitation, use resource limits if it poses a problem)
 CVE-2006-7050 (Cross-site scripting (XSS) vulnerability in WikkaWiki (Wikka Wiki) ...)
 	NOT-FOR-US: WikkaWiki
 CVE-2006-7049 (The Method method in WikkaWiki (Wikka Wiki) before 1.1.6.2 calls the ...)
@@ -7401,6 +7402,7 @@
 	NOT-FOR-US: EIQ Networks Network Security Analyzer
 CVE-2007-0227 (slocate 3.1 does not properly manage database entries that specify ...)
 	- slocate <unfixed> (bug #411937; low)
+	[sarge] - slocate <not-affected> (Performs correct access checks)
 	NOTE: slocate will allow users to find files in directories with the
 	NOTE: executable bit set but without the readable bit set.  This is
 	NOTE: an information leak.
@@ -17879,7 +17881,7 @@
 CVE-2002-2212 (The DNS resolver in unspecified versions of Fujitsu UXP/V, when ...)
 	NOT-FOR-US: Fujitsu UXP/V
 CVE-2002-2211 (BIND 4 and BIND 8, when resolving recursive DNS queries for arbitrary ...)
-	- bind <unfixed> (unimportant)
+	- bind <removed> (unimportant)
 	- bind9 <not-affected> (does not send parallel queries)
 	NOTE: Disabling recursion does not close all attack vectors.
 	NOTE: Browser reflection attacks will still work.

Modified: data/DSA/list
===================================================================
--- data/DSA/list	2007-06-16 18:26:09 UTC (rev 6022)
+++ data/DSA/list	2007-06-16 20:44:18 UTC (rev 6023)
@@ -22,7 +22,7 @@
 	[sarge] - gimp 2.2.6-1sarge2
 	[etch] - gimp 2.2.13-1etch1
 [07 Jun 2007] DSA-1300-1 iceape
-	{CVE-2007-1362 CVE-2007-1558 CVE-2007-2867 CVE-2007-2868 CVE-2007-2870 CVE-2007-2871}
+	{CVE-2007-1116 CVE-2007-1362 CVE-2007-1558 CVE-2007-2867 CVE-2007-2868 CVE-2007-2870 CVE-2007-2871}
 	[etch] - iceape 1.0.9-0etch1
 [07 Jun 2007] DSA-1299-1 ipsec-tools
 	{CVE-2007-1841}


