[Secure-testing-commits] r9978 - / data data/CVE

[jmm-guest at alioth.debian.org]

Author: jmm-guest
Date: 2008-10-03 20:44:02 +0000 (Fri, 03 Oct 2008)
New Revision: 9978

Modified:
   data/CVE/list
   data/spu-candidates.txt
   tmp.txt
Log:
more SPUs
openswan should be fixed
not much point in fixing LTP in Etch, in Lenny it has been documented to only
   work for isolated environments


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2008-10-03 20:09:35 UTC (rev 9977)
+++ data/CVE/list	2008-10-03 20:44:02 UTC (rev 9978)
@@ -1,3 +1,9 @@
+CVE-2008-XXXX [ltp: insecure temp file]
+	- ltp 20060918-3 (low; bug #496411)
+        [etch] - ltp <no-dsa> (Documented to be only suitable for single user setups currently)
+CVE-2008-XXXX [fml: insecure temp file]
+	- fml <removed> (low; bug #496370)
+        [etch] - fml <no-dsa> (Minor issue)
 CVE-2008-XXXX [gccxml: insecure temp file]
 	- gccxml <unfixed> (unimportant; bug #496391)
         NOTE: Only applies to a script used for an obscure SGI compiler
@@ -1542,6 +1548,7 @@
 	- nvi 1.81.6-4 (low)
 CVE-2008-XXXX [rkhunter: insecure temp file]
 	- rkhunter 1.3.2-6 (low; bug #496375)
+        [etch] - rkhunter <no-dsa> (Minor issue, only in debug mode)
 CVE-2008-XXXX [scratchbox2: insecure temp file]
 	- scratchbox2 1.99.0.24-2 (low; bug #496409)
 CVE-2008-XXXX [realtimebattle: insecure temp file]
@@ -1559,6 +1566,7 @@
         [etch] - xen-3 <no-dsa> (Minor issue)
 CVE-2008-XXXX [mgetty: insecure temp files]
 	- mgetty 1.1.36-1.3 (low; bug #496403)
+        [etch] - mgetty <no-dsa> (Minor issue)
 CVE-2008-XXXX [sympa: multiple insecure temp files]
 	- sympa 5.3.4-5.1 (low; bug #496405; bug #494969)
 CVE-2008-XXXX [sng: insecure temp file]

Modified: data/spu-candidates.txt
===================================================================
--- data/spu-candidates.txt	2008-10-03 20:09:35 UTC (rev 9977)
+++ data/spu-candidates.txt	2008-10-03 20:44:02 UTC (rev 9978)
@@ -140,6 +140,11 @@
 
 --
 
+fml
+#496370
+
+--
+
 gdrae
 #496378
 notified maintainer
@@ -219,6 +224,11 @@
 
 --
 
+mgetty
+#496403
+
+--
+
 mgt
 #496434
 notified maintainer
@@ -287,6 +297,11 @@
 
 --
 
+rkhunter
+#496375)
+
+--
+
 rsync (CVE-2007-6200)
 #453652
 notified maintainer

Modified: tmp.txt
===================================================================
--- tmp.txt	2008-10-03 20:09:35 UTC (rev 9977)
+++ tmp.txt	2008-10-03 20:44:02 UTC (rev 9978)
@@ -15,15 +15,10 @@
   a point update, oss-security should be better than a CNA pool since
   there's a risk of collisions
 
- Binary-package: fml (4.0.3.dfsg-2)
- Binary-package: rkhunter (1.3.2-3)
- Binary-package: openswan (1:2.4.12+dfsg-1.1)
  Binary-package: ibackup (2.27-4.1)
  Binary-package: rancid-util (2.3.2~a8-1)
- Binary-package: ltp-network-test (20060918-2.1)
  Binary-package: fwbuilder (2.1.19-3)
  Binary-package: sympa (5.3.4-5)
- Binary-package: mgetty-fax (1.1.36-1.2)
  Binary-package: aegis (4.24-3)
  Binary-package: aegis-web (4.24-3)
 
@@ -33,9 +28,11 @@
  Binary-package: freeradius-dialupadmin (2.0.4+dfsg-4)
  Binary-package: mon (0.99.2-12)
  Binary-package: qemu (0.9.1-5)
+ Binary-package: openswan (1:2.4.12+dfsg-1.1)
 
 
 SPU:
+ Binary-package: fml (4.0.3.dfsg-2)
  Binary-package: gdrae (0.1-1)
  Binary-package: cdrw-taper (0.4-2)
  Binary-package: digitaldj (0.7.5-6+b1)
@@ -65,6 +62,8 @@
  Binary-package: r-base-core (2.7.1-1)
  Binary-package: dist (1:3.5-17-1)
  Binary-package: gpsdrive-scripts (2.10~pre4-3)
+ Binary-package: rkhunter (1.3.2-3)
+ Binary-package: mgetty-fax (1.1.36-1.2)
 
 Non-issues (not exploitable, only examples or very exotic use cases,
 e.g. only exploitable when debugging a certain option, not present