[Secure-testing-commits] r15472 - data/CVE

Moritz Muehlenhoff jmm-guest at alioth.debian.org
Thu Oct 14 20:51:01 UTC 2010 

Author: jmm-guest
Date: 2010-10-14 20:50:56 +0000 (Thu, 14 Oct 2010)
New Revision: 15472

Modified:
   data/CVE/list
Log:
- new openconnect issues (fixed in squeeze/sid, not in Lenny, one harmless)
- new midori issue (fixed in sid only, not in Lenny)
- bugzilla fixed in sid
- new kernel issue
- bind CVEfied
- new ettercap issues
- new curl issue doesn't affect Debian
- new freeradius issues (one affects Lenny)
- new tiff issue (doesn't affect Lenny)


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2010-10-14 06:50:18 UTC (rev 15471)
+++ data/CVE/list	2010-10-14 20:50:56 UTC (rev 15472)
@@ -59,13 +59,14 @@
 CVE-2010-3904
 	RESERVED
 CVE-2010-3903 (Unspecified vulnerability in OpenConnect before 2.23 allows remote ...)
-	TODO: check
+	- openconnect 2.25-0.1
 CVE-2010-3902 (OpenConnect before 2.26 places the webvpn cookie value in the ...)
-	TODO: check
+	- openconnect <unfixed> (unimportant)
+	NOTE: This is an additional safety net for careless users, not a vulnerability
 CVE-2010-3901 (OpenConnect before 2.25 does not properly validate X.509 certificates, ...)
-	TODO: check
+	- openconnect 2.25-0.1 (bug #590873)
 CVE-2010-3900 (Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before ...)
-	TODO: check
+	- midori 0.2.7-1.1
 CVE-2010-3899
 	RESERVED
 CVE-2010-3898
@@ -176,14 +177,19 @@
 	RESERVED
 CVE-2010-3844
 	RESERVED
+	- ettercap <unfixed> (low; bug #600130)
+	[lenny] - ettercap <no-dsa> (Minor issue)
 CVE-2010-3843
 	RESERVED
+	- ettercap <unfixed> (low; bug #600130)
+	[lenny] - ettercap <no-dsa> (Minor issue)
 CVE-2010-3842
 	RESERVED
+	- curl <not-affected> (Doesn't affect POSIX systems)
 CVE-2010-3841
 	RESERVED
 CVE-2009-5009 (Double free vulnerability in OpenConnect before 1.40 might allow ...)
-	TODO: check
+	- openconnect 1.40-1
 CVE-2009-5008 (Cisco Secure Desktop (CSD), when used in conjunction with an ...)
 	TODO: check
 CVE-2009-5007 (The Cisco trial client on Linux for Cisco AnyConnect SSL VPN allows ...)
@@ -377,10 +383,6 @@
 	NOTE: http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html
 	NOTE: ACL bypass claimed to only affect >=9.7.2: https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html
 	NOTE: The crash with multiple trust anchors affects 9.6 and is fixed in 9.6-ESV-R2.
-CVE-2010-XXXX [bind acl bypass]
-	- bind9 <not-affected> (Only affects 9.7.2, which is not yet in the archive)
-	NOTE: http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html
-	NOTE: ACL bypass claimed to only affect >=9.7.2: https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html
 CVE-2010-3761 (Unspecified vulnerability in IBM Tivoli Storage Manager (TSM) FastBack ...)
 	NOT-FOR-US: IBM Tivoli Storage Manager
 CVE-2010-3760 (FastBackMount.exe in the Mount service in IBM Tivoli Storage Manager ...)
@@ -515,7 +517,6 @@
 	- xpdf 3.02-9
 	- poppler <unfixed> (bug #599165)
 	NOTE: http://cgit.freedesktop.org/poppler/poppler/commit/?id=39d140bfc0b8239bdd96d6a55842034ae5c05473
-	TODO: kdegrahics/okular and xpdf have switched to dynamic linking, Lenny needs to be checked
 CVE-2010-3703
 	RESERVED
 	- kdegraphics 4.0
@@ -532,7 +533,6 @@
 	- xpdf 3.02-9
 	- poppler <unfixed> (bug #599165)
 	NOTE: http://cgit.freedesktop.org/poppler/poppler/commit/?id=e853106b58d6b4b0467dbd6436c9bb1cfbd372cf
-	TODO: kdegrahics/okular and xpdf have switched to dynamic linking, Lenny needs to be checked
 CVE-2010-3701 (lib/MessageStoreImpl.cpp in Red Hat Enterprise MRG before 1.2.2 allows ...)
 	TODO: check
 CVE-2010-3700
@@ -542,9 +542,10 @@
 CVE-2010-3698
 	RESERVED
 CVE-2010-3697 (The wait_for_child_to_die function in main/event.c in FreeRADIUS 2.1.x ...)
-	TODO: check
+	- freeradius <unfixed> (bug #600176)
 CVE-2010-3696 (The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9, in ...)
-	TODO: check
+	- freeradius <unfixed> (bug #600176)
+	[lenny] - freeradius <not-affected> (Vulnerable code not present)
 CVE-2010-3695 [XSS vulnerability in the Fetchmail configuration]
 	RESERVED
 	- imp4 <unfixed> (bug #598584)
@@ -1699,7 +1700,6 @@
 	- mailscanner <unfixed> (bug #596396; low)
 CVE-2010-3278
 	REJECTED
-	NOT-FOR-US: novfs kernel module (only included in SUSE it seems)
 CVE-2010-3277 (The installer in VMware Workstation 7.x before 7.1.2 build 301548 and ...)
 	NOT-FOR-US: VMware Workstation
 CVE-2010-3276
@@ -2171,7 +2171,7 @@
 	- chromium-browser 5.0.375.127~r55887-1
 	- webkit <not-affected> (chromium specific)
 CVE-2010-3110 (Multiple buffer overflows in the Novell Client novfs module for the ...)
-	TODO: check
+	NOT-FOR-US: novfs kernel module (only included in SUSE it seems)
 CVE-2010-2948 (Stack-based buffer overflow in the bgp_route_refresh_receive function ...)
 	{DSA-2104-1}
 	- quagga 0.99.17-1 (bug #594262)
@@ -2229,7 +2229,8 @@
 CVE-2010-3088 (The notify function in pidgin-knotify.c in the pidgin-knotify plugin ...)
 	TODO: check
 CVE-2010-3087 (LibTIFF before 3.9.2-5.2.1 in SUSE openSUSE 11.3 allows remote ...)
-	TODO: check
+	- tiff <unfixed> (bug #600188)
+	[lenny] - tiff <not-affected> (Vulnerable code not present)
 CVE-2010-3086
 	RESERVED
 CVE-2010-3085 (The network-play implementation in Mednafen before 0.8.D might allow ...)
@@ -2700,7 +2701,7 @@
 CVE-2010-2891
 	RESERVED
 CVE-2010-2890 (Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on ...)
-	TODO: check
+	NOT-FOR-US: Adobe Reader and Acrobat
 CVE-2010-2889 (Unspecified vulnerability in Adobe Reader and Acrobat 9.x before 9.4, ...)
 	NOT-FOR-US: Adobe Reader and Acrobat
 CVE-2010-2888 (Multiple unspecified vulnerabilities in an ActiveX control in Adobe ...)
@@ -3130,13 +3131,13 @@
 	- iceape 2.0.7-1
 	[lenny] - iceape <not-affected> (Only a stub package)
 CVE-2010-2759 (Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through ...)
-	- bugzilla <unfixed> (bug #595015; medium)
+	- bugzilla 3.6.2.0-1 (bug #595015; medium)
 CVE-2010-2758 (Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 through ...)
-	- bugzilla <unfixed> (bug #595015; low)
+	- bugzilla 3.6.2.0-1 (bug #595015; low)
 CVE-2010-2757 (The sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1 through ...)
-	- bugzilla <unfixed> (bug #595015; low)
+	- bugzilla 3.6.2.0-1 (bug #595015; low)
 CVE-2010-2756 (Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1 ...)
-	- bugzilla <unfixed> (bug #595015; low)
+	- bugzilla 3.6.2.0-1 (bug #595015; low)
 CVE-2010-2755 (layout/generic/nsObjectFrame.cpp in Mozilla Firefox 3.6.7 does not ...)
 	- xulrunner <not-affected> (Only exploitable in Firefox 3.6.x and above)
 	- iceweasel <not-affected> (Only exploitable in Firefox 3.6.x and above)
@@ -3372,7 +3373,7 @@
 CVE-2010-2654 (Multiple cross-site scripting (XSS) vulnerabilities on the IBM ...)
 	NOT-FOR-US: BladeCenter software
 CVE-2010-2653 (Race condition in the hvc_close function in drivers/char/hvc_console.c ...)
-	TODO: check
+	- linux-2.6 <unfixed>
 CVE-2009-4935 (SQL injection vulnerability in ogp_show.php in Online Guestbook Pro ...)
 	NOT-FOR-US: Online Guestbook Pro
 CVE-2009-4934 (Cross-site scripting (XSS) vulnerability in index.php in Online Photo ...)
@@ -10482,7 +10483,9 @@
 CVE-2010-0219
 	RESERVED
 CVE-2010-0218 (ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to restrict the ...)
-	TODO: check
+	- bind9 <not-affected> (Only affects 9.7.2, which is not yet in the archive)
+	NOTE: http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html
+	NOTE: ACL bypass claimed to only affect >=9.7.2: https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html
 CVE-2010-0217
 	RESERVED
 CVE-2010-0216

More information about the Secure-testing-commits mailing list