[Secure-testing-commits] r11693 - data/CVE

Wed Apr 22 18:53:18 UTC 2009

Author: jmm-guest
Date: 2009-04-22 18:53:18 +0000 (Wed, 22 Apr 2009)
New Revision: 11693

Modified:
   data/CVE/list
Log:
- wireshark fixed
- poppler fixed
- udev fixed
- kdegraphics 4 no longer uses xpdf copy
- cups doesn't use xpdf code
- cups fixed
- adjust /dev/mem severity


Modified: data/CVE/list
===================================================================

--- data/CVE/list	2009-04-22 16:52:50 UTC (rev 11692)
+++ data/CVE/list	2009-04-22 18:53:18 UTC (rev 11693)
@@ -52,10 +52,8 @@
 CVE-2009-1331 (Integer overflow in Microsoft Windows Media Player (WMP) ...)
 	NOT-FOR-US: Windows Media Player
 CVE-2009-XXXX [linux-2.6: /dev/mem rootkit vulnerability]
-	- linux-2.6 2.6.29-1 (low; bug #524373)
-	NOTE: according to the kernel team (see bug report), they have no interest in backporting a
-	NOTE:   fix for the stable releases because it could potentially cause compatibility problems
-	NOTE: should a DSA be issued stating that no action will be taken to address the issue?
+        - linux-2.6 2.6.29-1 (unimportant; bug #524373)
+        NOTE: This is about an additional hardening feature, not a security issue
 CVE-2009-XXXX [pptp-linux: unrestrictive pptpsetup permissions]
 	- pptp-linux <unfixed> (low; bug #523476)
 CVE-2009-XXXX [slurm-llnl doesn't drop supplementary groups]
@@ -293,11 +291,11 @@
 	- php4 <not-affected> (the JSON extension was introduced in php5.2)
 	- php-json-ext <unfixed>
 CVE-2009-1269 (Unspecified vulnerability in Wireshark 0.99.6 through 1.0.6 allows ...)
-	- wireshark <unfixed>
+	- wireshark 1.0.7-1
 CVE-2009-1268 (The Check Point High-Availability Protocol (CPHAP) dissector in ...)
-	- wireshark <unfixed>
+	- wireshark 1.0.7-1
 CVE-2009-1267 (Unspecified vulnerability in the LDAP dissector in Wireshark 0.99.2 ...)
-	- wireshark <unfixed>
+	- wireshark 1.0.7-1
 CVE-2009-1266
 	RESERVED
 CVE-2009-1265 (Integer overflow in rose_sendmsg (sys/net/af_rose.c) in the Linux ...)
@@ -670,7 +668,7 @@
 CVE-2009-1211 (Blue Coat ProxySG, when transparent interception mode is enabled, uses ...)
 	NOT-FOR-US: Blue Coat ProxySG
 CVE-2009-1210 (Format string vulnerability in the PROFINET/DCP (PN-DCP) dissector in ...)
-	- wireshark <unfixed>
+	- wireshark 1.0.7-1
 	[etch] - wireshark <not-affected> (Vulnerable code not present, introduced in 0.99.6)
 CVE-2009-1209 (Stack-based buffer overflow in W3C Amaya Web Browser 11.1 allows ...)
 	- amaya <removed>
@@ -717,48 +715,43 @@
 	RESERVED
 CVE-2009-1188 [pdf vulnerabilities]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
+	- poppler 0.10.6-1 (medium; bug #524806)
 CVE-2009-1187 [pdf vulnerabilities]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
+	- poppler 0.10.6-1 (medium; bug #524806)
 CVE-2009-1186 (Buffer overflow in the util_path_encode function in ...)
 	{DSA-1772-1}
-	- udev <unfixed> (medium)
+	- udev 0.141-1 (medium)
 CVE-2009-1185 (udev before 1.4.1 does not verify whether a NETLINK message originates ...)
 	{DSA-1772-1}
-	- udev <unfixed> (medium)
+	- udev 0.141-1 (medium)
 CVE-2009-1184
 	RESERVED
 CVE-2009-1183 [pdf vulnerabilities]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
-	- cups <unfixed> (medium; bug #524807)
-	- xpdf <unfixed> (medium; bug #524809)
-	- kdegraphics <unfixed> (medium; bug #524810)
+        - poppler 0.10.6-1 (medium; bug #524806)
+        - xpdf <unfixed> (medium; bug #524809)
+        - kdegraphics 4.0-1 (medium; bug #524810)
 CVE-2009-1182 [pdf vulnerabilites]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
-	- cups <unfixed> (medium; bug #524807)
-	- xpdf <unfixed> (medium; bug #524809)
-	- kdegraphics <unfixed> (medium; bug #524810)
+        - poppler 0.10.6-1 (medium; bug #524806)
+        - xpdf <unfixed> (medium; bug #524809)
+        - kdegraphics 4.0-1 (medium; bug #524810)
 CVE-2009-1181 [pdf vulnerabilities]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
-	- cups <unfixed> (medium; bug #524807)
-	- xpdf <unfixed> (medium; bug #524809)
-	- kdegraphics <unfixed> (medium; bug #524810)
+        - poppler 0.10.6-1 (medium; bug #524806)
+        - xpdf <unfixed> (medium; bug #524809)
+        - kdegraphics 4.0-1 (medium; bug #524810)
 CVE-2009-1180 [pdf vulnerabilities]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
-	- cups <unfixed> (medium; bug #524807)
-	- xpdf <unfixed> (medium; bug #524809)
-	- kdegraphics <unfixed> (medium; bug #524810)
+        - poppler 0.10.6-1 (medium; bug #524806)
+        - xpdf <unfixed> (medium; bug #524809)
+        - kdegraphics 4.0-1 (medium; bug #524810)
 CVE-2009-1179 [pdf vulnerabilities]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
-	- cups <unfixed> (medium; bug #524807)
-	- xpdf <unfixed> (medium; bug #524809)
-	- kdegraphics <unfixed> (medium; bug #524810)
+        - poppler 0.10.6-1 (medium; bug #524806)
+        - xpdf <unfixed> (medium; bug #524809)
+        - kdegraphics 4.0-1 (medium; bug #524810)
 CVE-2009-1178 (Unspecified vulnerability in the server in IBM Tivoli Storage Manager ...)
 	NOT-FOR-US: Tivoli
 CVE-2009-1177 (Multiple stack-based buffer overflows in maptemplate.c in mapserv in ...)
@@ -2004,16 +1997,14 @@
 	- squid3 <unfixed> (low; bug #521052)
 CVE-2009-0800 [pdf vulnerabilities]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
-	- cups <unfixed> (medium; bug #524807)
-	- xpdf <unfixed> (medium; bug #524809)
-	- kdegraphics <unfixed> (medium; bug #524810)
+        - poppler 0.10.6-1 (medium; bug #524806)
+        - xpdf <unfixed> (medium; bug #524809)
+        - kdegraphics 4.0  (medium; bug #524810)
 CVE-2009-0799 [pdf vulnerabilities]
 	RESERVED
-	- poppler <unfixed> (medium; bug #524806)
-	- cups <unfixed> (medium; bug #524807)
-	- xpdf <unfixed> (medium; bug #524809)
-	- kdegraphics <unfixed> (medium; bug #524810)
+        - poppler 0.10.6-1 (medium; bug #524806)
+        - xpdf <unfixed> (medium; bug #524809)
+        - kdegraphics 4.0 (medium; bug #524810)
 CVE-2009-0798
 	RESERVED
 CVE-2009-0797
@@ -4576,11 +4567,13 @@
 	RESERVED
 CVE-2009-0164 [cups web interface DNS rebinding issue]
 	RESERVED
-	- cups <unfixed> (low)
+	- cups 1.3.10-1 (low)
+	- cupsys <removed>
 CVE-2009-0163 [integer overflow in cups imagetops filter]
 	RESERVED
 	{DSA-1773-1}
-	- cups <unfixed>
+	- cups 1.3.10-1
+	- cupsys <removed>
 CVE-2009-0162
 	RESERVED
 CVE-2009-0161


