[Secure-testing-commits] r13407 - in data: . CVE
Moritz Muehlenhoff
jmm-guest at alioth.debian.org
Mon Nov 30 18:18:21 UTC 2009
Author: jmm-guest
Date: 2009-11-30 18:18:21 +0000 (Mon, 30 Nov 2009)
New Revision: 13407
Modified:
data/CVE/list
data/problematic-packages
Log:
* cleanup of open issues for unstable:
- dovecot, acidbase, iodine fixed
- one bugzilla issue doesn't affect Debian versions
- treat apache issue as enhancement bug, not a security issue
- two more java issues fixed
- hex-a-hop issue hardly a security issue
- add bug for open-iscsi
- mark dnspython as not-affected for the DNS issue, since it
provides only a stub resolver, which is fine in combination
with kernel randomisation
* some older kernel issues don't affect etch
* xpdf has been removed from Squeeze, yeah!
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2009-11-29 21:14:18 UTC (rev 13406)
+++ data/CVE/list 2009-11-30 18:18:21 UTC (rev 13407)
@@ -272,10 +272,9 @@
[etch] - nginx <no-dsa> (upload rights required)
[lenny] - nginx <no-dsa> (upload rights required)
CVE-2009-3897 (Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of ...)
- - dovecot <unfixed> (medium; bug #557601)
+ - dovecot 1:1.2.8-1 (medium; bug #557601)
[lenny] - dovecot <not-affected> (Only affects 1.2.x)
[etch] - dovecot <not-affected> (Only affects 1.2.x)
- NOTE: http://www.dovecot.org/list/dovecot-news/2009-November/000143.html, CVE requested on oss-sec
CVE-2009-4017 (PHP 5.2.11, and 5.3.x before 5.3.1, does not restrict the number of ...)
{DSA-1940-1}
- php5 5.2.11.dfsg.1-2 (medium)
@@ -342,6 +341,7 @@
- virtualbox-guest-additions 3.0.10-1
CVE-2009-3939 (The poll_mode_io file for the megaraid_sas driver in the Linux kernel ...)
- linux-2.6 <unfixed> (low)
+ [etch] - linux-2.6 <not-affected> (Vulnerable code not present)
- linux-2.6.24 <removed> (low)
CVE-2009-4004 (Buffer overflow in the kvm_vcpu_ioctl_x86_setup_mce function in ...)
- linux-2.6 <unfixed> (medium)
@@ -460,6 +460,7 @@
- wordpress 2.8.6-1 (low)
CVE-2009-3889 (The dbg_lvl file for the megaraid_sas driver in the Linux kernel ...)
- linux-2.6 2.6.27-1 (low)
+ [etch] - linux-2.6 <not-affected> (Vulnerable code not present)
- linux-2.6.24 <removed> (low)
CVE-2009-3888 (The do_mmap_pgoff function in mm/nommu.c in the Linux kernel before ...)
- linux-2.6 <unfixed> (unimportant)
@@ -736,7 +737,7 @@
- ghostscript <unfixed> (unimportant)
- xpdf <unfixed> (unimportant)
CVE-2009-XXXX [multiple vulnerabilities in acidbase; XSS + possible sql injection]
- - acidbase <unfixed> (bug #552235)
+ - acidbase 1.4.4-1 (bug #552235)
CVE-2009-XXXX [multiple vulnerabilities in jetty]
- jetty <unfixed> (bug #553644)
TODO: check
@@ -1786,8 +1787,8 @@
CVE-2009-3387
RESERVED
CVE-2009-3386 (Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 ...)
- - bugzilla <unfixed>
- TODO: check
+ - bugzilla <not-affected> (Only 3.3 onwards are affected)
+ TODO: recheck, once a more recent (3.3.x or 3.4.x) version has been uploaded
CVE-2009-3385
RESERVED
CVE-2009-3384 (Multiple unspecified vulnerabilities in WebKit in Apple Safari before ...)
@@ -1994,7 +1995,7 @@
CVE-2009-3300 (Multiple cross-site scripting (XSS) vulnerabilities in the Identity ...)
- shibboleth-sp2 2.3+dfsg-1 (medium; bug #555608)
- shibboleth-sp <removed> (medium)
- NOTE: xmltooling also needs to be updated, changed in sid in 1.3.1-1
+ NOTE: xmltooling/opensaml2 also needs to be updated, changed in sid in 1.3.1-1/2.3-1
CVE-2009-3299 (Cross-site scripting (XSS) vulnerability in the resume blocktype in ...)
{DSA-1924-1}
- mahara 1.1.7-1 (low)
@@ -4287,9 +4288,8 @@
[lenny] - groff <not-affected> (pdfroff not yet present)
NOTE: requested CVE ids
CVE-2009-XXXX [apache2: only first 8 characters used to validate password]
- - apache2 <unfixed> (low; bug #539246)
- [lenny] - apache2 <no-dsa> (Standard behaviour of crypt)
- [etch] - apache2 <no-dsa> (Standard behaviour of crypt)
+ - apache2 <unfixed> (unimportant; bug #539246)
+ NOTE: Standard behaviour of crypt, enhancement bug for stronger method
CVE-2009-XXXX [gnudips: remote privilege escalation]
- gnudip <unfixed> (medium; bug #539452)
TODO: request CVE id
@@ -5262,7 +5262,7 @@
- openssl 0.9.8k-4 (low; bug #539899)
- gnutls26 2.4.2-5 (low; bug #539901)
- gnutls13 <removed>
- - sun-java6 <unfixed>
+ - sun-java6 6-17-1
[lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-2407 (Heap-based buffer overflow in the parse_tag_3_packet function in ...)
{DSA-1845-1 DSA-1844-1}
@@ -7450,8 +7450,8 @@
CVE-2009-1588 (Cross-site scripting (XSS) vulnerability in CGI RESCUE MiniBBS 8t ...)
NOT-FOR-US: CGI RESCUE MiniBBS
CVE-2009-XXXX [hex-a-hop: buffer overflow in loading save games]
- - hex-a-hop <unfixed> (low; bug #528250)
- [lenny] - hex-a-hop <no-dsa> (Minor issue, very obscure attack vector)
+ - hex-a-hop <unfixed> (unimportant; bug #528250)
+ NOTE: That's a simple bug, it's silly to treat this as a security issue
CVE-2009-1587 (index.php in PHP Site Lock 2.0 allows remote attackers to bypass ...)
NOT-FOR-US: PHP Site Lock
CVE-2009-1586 (Stack-based buffer overflow in the NZB importer feature in GrabIt ...)
@@ -7981,7 +7981,7 @@
CVE-2009-1412 (Argument injection vulnerability in the chromehtml: protocol handler ...)
- chromium-browser <itp> (bug #520324)
CVE-2009-XXXX [iodine: DoS against iodined triggerable by authenticated users]
- - iodine <unfixed> (low)
+ - iodine 0.5.1 (low)
[lenny] - iodine 0.4.2-2~lenny1
CVE-2009-XXXX [ntop: access.log permissions]
- ntop <not-affected> (fedora-specific configuration issue; debian package not affected)
@@ -8391,7 +8391,7 @@
CVE-2009-1298
RESERVED
CVE-2009-1297 (iscsi_discovery in open-iscsi in SUSE openSUSE 10.3 through 11.1 and ...)
- - open-iscsi <unfixed> (low; bug filed)
+ - open-iscsi <unfixed> (low; bug #547011)
[lenny] - open-iscsi <no-dsa> (Minor issue)
[etch] - open-iscsi <not-affected> (Vulnerable script not yet present)
CVE-2009-1296 (The eCryptfs support utilities (ecryptfs-utils) 73-0ubuntu6.1 on ...)
@@ -15307,9 +15307,6 @@
- openssh <unfixed> (low; bug #506115)
[etch] - openssh <no-dsa> (Minor issue, see http://www.openssh.org/txt/cbc.adv)
[lenny] - openssh <no-dsa> (Minor issue, see http://www.openssh.org/txt/cbc.adv)
- NOTE: I don't see this as being minor (a 1 in 262,144 chance of recovering 32 plaintext bits is rather good)
- NOTE: See http://www.theregister.co.uk/2009/05/19/open_ssh_hack/
- TODO: reassess severity
CVE-2008-5185 (The highlighting functionality in geshi.php in GeSHi before 1.0.8 ...)
{DTSA-179-1}
- geshi 1.0.8.1-1 (medium)
@@ -22707,7 +22704,7 @@
- sun-java5 <unfixed>
[etch] - sun-java5 <no-dsa> (Non-free not supported)
[lenny] - sun-java5 <no-dsa> (Non-free not supported)
- - sun-java6 <unfixed>
+ - sun-java6 6-10-1
[lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2008-2084 (SQL injection vulnerability in topics.php in the MyArticles 0.6 beta-1 ...)
NOT-FOR-US: MyArticles
@@ -24207,10 +24204,8 @@
- dnsmasq 2.43-1 (medium; bug #490123)
- pdnsd 1.2.6-par-11 (bug #502275)
- python-dns 2.3.1-5 (low; bug #490217)
- - dnspython <unfixed> (low; bug #492465)
- [etch] - dnspython <no-dsa> (Just a stub resolver, 2.6.24 kernel from 4.0r4 provides source port randomisation)
- [lenny] - dnspython <no-dsa> (Just a stub resolver, Linux kernel provides source port randomisation)
- NOTE: Upstream is planning to add its own randomisation
+ - dnspython <unfixed> (unimportant; bug #492465)
+ NOTE: Just a stub resolver Linux kernel provides source port randomisation
- adns 1.4-2 (unimportant; bug #492698)
NOTE: adns is not suitable to use with untrusted responses, documented in README.Debian
- udns <unfixed> (bug #493599)
Modified: data/problematic-packages
===================================================================
--- data/problematic-packages 2009-11-29 21:14:18 UTC (rev 13406)
+++ data/problematic-packages 2009-11-30 18:18:21 UTC (rev 13407)
@@ -13,8 +13,8 @@
----
-bugzilla: (June 2009)
-No reply to security bugs #514143 in unstable in 4 months.
+bugzilla: (Nov 2009)
+Maintainer active again, package is still quite old, though 3.2
----
@@ -30,6 +30,7 @@
----
-xpdf: (May 2009)
+xpdf: (Nov 2009)
No maintainer upload for two years, frequent security issues.
-Filed RC bug about maintenance status: #527840
+Removed from Squeeze, remaining packages using xpdf-* have been
+NMUed to use poppler
\ No newline at end of file
More information about the Secure-testing-commits
mailing list