[Secure-testing-commits] r8850 - data/CVE

[white at alioth.debian.org]

Author: white
Date: 2008-05-20 13:05:09 +0000 (Tue, 20 May 2008)
New Revision: 8850

Modified:
   data/CVE/list
Log:
Leave note about libvorbis issue

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2008-05-20 12:01:42 UTC (rev 8849)
+++ data/CVE/list	2008-05-20 13:05:09 UTC (rev 8850)
@@ -572,7 +572,9 @@
 CVE-2008-2010 (Unspecified vulnerability in Apple QuickTime Player on Windows XP SP2 ...)
 	NOT-FOR-US: Windows
 CVE-2008-2009 (Xiph.org libvorbis before 1.0 does not properly check for ...)
-	TODO: check
+	NOTE: #482039 has information to inform maintainer about new upstream code and problem
+	NOTE: however, it is not clear that the version is vulnerable
+	TODO: check vulnerability of debian packages and value of upstream patch
 CVE-2008-2008 (Buffer overflow in the Display Names message feature in Cerulean ...)
 	NOT-FOR-US: Cerulean Studios Trillian Basic
 CVE-2008-2007