Author: jmm
Date: 2011-01-28 17:46:21 +0000 (Fri, 28 Jan 2011)
New Revision: 15999
Modified:
data/CVE/list
data/spu-candidates.txt
Log:
- egroupware/kses not-affected
- liboggz, mercurial, greylistd, dbus-glib no-dsa
- libxml2 issue is actually a php issue
- proftpd fixed
- pixelpost removed
- yet another weborf issue
- new nbd issue
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2011-01-28 10:04:21 UTC (rev 15998)
+++ data/CVE/list 2011-01-28 17:46:21 UTC (rev 15999)
@@ -1,3 +1,7 @@
+CVE-2011-XXXX [Reoccurance of CVE-2005-3534]
+ - nbd 1:2.9.16-8 (bug #611187)
+CVE-2011-XXXX [yet another weborf DoS]
+ - weborf 0.12.5-1
CVE-2011-0649
RESERVED
CVE-2011-0648
@@ -46,10 +50,6 @@
CVE-2010-4704 (libavcodec/vorbis_dec.c in the Vorbis decoder in FFmpeg 0.6.1 and ...)
- ffmpeg <unfixed> (bug #610550)
- ffmpeg-debian <removed>
-CVE-2011-XXXX [xmlTextWriterWriteAttribute heap disclosure]
- - libxml2 <unfixed>
- NOTE: https://bugzilla.gnome.org/show_bug.cgi?id=631551
- NOTE: CVE id requested
CVE-2010-XXXX
- redmine 1.0.5-1 (bug #608397)
NOTE: http://www.redmine.org/news/49
@@ -952,8 +952,12 @@
CVE-2010-4658
RESERVED
- statusnet <itp> (bug #491723)
-CVE-2010-4657
+CVE-2010-4657 [xmlTextWriterWriteAttribute heap disclosure]
RESERVED
+ - php5 <unfixed>
+ NOTE: https://bugzilla.gnome.org/show_bug.cgi?id=631551
+ NOTE: This was initially reported to be a bug in libxml2, but it later showed that PHP
+ NOTE: is using the libxml2 API in an incorrect manner
CVE-2010-4656 [iowarrior usb device heap overflow]
RESERVED
- linux-2.6 <unfixed>
@@ -976,7 +980,7 @@
TODO: check
CVE-2010-4652 [buffer overflow when preparing SQL queries]
RESERVED
- - proftpd-dfsg <unfixed>
+ - proftpd-dfsg 1.3.3a-6
CVE-2010-4651 [patch directory traversal]
RESERVED
- patch <unfixed> (unimportant)
@@ -997,8 +1001,8 @@
CVE-2010-4646 (Cross-site scripting (XSS) vulnerability in Hastymail2 before 1.01 ...)
NOT-FOR-US: Hastymail
CVE-2010-4644 (Multiple memory leaks in rev_hunt.c in Apache Subversion before 1.6.15 ...)
- - subversion 1.6.12dfsg-3 (bug #608989)
- NOTE: http://www.openwall.com/lists/oss-security/2011/01/04/8
+ - subversion 1.6.12dfsg-3 (low; bug #608989)
+ [lenny] - subversion <no-dsa> (Minor issue)
CVE-2010-4643
RESERVED
{DSA-2151-1}
@@ -1787,8 +1791,8 @@
[lenny] - wordpress <not-affected> (vulnerable code not present)
NOTE: http://core.trac.wordpress.org/changeset/16803
CVE-2010-4539 (The walk function in repos.c in the mod_dav_svn module for the Apache ...)
- - subversion 1.6.12dfsg-4 (bug #608989)
- NOTE: http://www.openwall.com/lists/oss-security/2011/01/04/8
+ - subversion 1.6.12dfsg-4 (low; bug #608989)
+ [lenny] - subversion <no-dsa> (Minor issue)
CVE-2010-4538 (Buffer overflow in the sect_enttec_dmx_da function in ...)
{DSA-2144-1}
- wireshark 1.2.11-6 (bug #608990)
@@ -1797,7 +1801,7 @@
CVE-2010-4536 (Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used ...)
- wordpress 3.0.4+dfsg-1
- moodle <not-affected> (Moodle's version of KSES is not affected)
- - egroupware <removed>
+ - egroupware <not-affected> (Only uses a minor subset of KSES)
CVE-2010-4535 (The password reset functionality in django.contrib.auth in Django ...)
- python-django 1.2.4-1
[squeeze] - python-django 1.2.3-3
@@ -3640,6 +3644,7 @@
CVE-2010-4237
RESERVED
- mercurial 1.6.4-1 (low; bug #598841)
+ [lenny] - mercurial <no-dsa> (Minor issue)
CVE-2010-3840 (The Gis_line_string::init_from_wkb function in sql/spatial.cc in MySQL ...)
{DSA-2143-1}
- mysql-5.1 5.1.49-3 (bug #599937)
@@ -4817,6 +4822,7 @@
- dpkg 1.15.1 (unimportant; bug #592115)
CVE-2008-XXXX [greylistd bypass]
- greylistd 0.8.7+nmu2 (low; bug #464084)
+ [lenny] - greylistd <no-dsa> (Minor issue)
CVE-2010-XXXX [numpy memory corruption]
- python-numpy 1:1.4.1-5 (bug #581058)
NOTE: http://projects.scipy.org/numpy/changeset/8364
@@ -7856,11 +7862,11 @@
NOTE: http://trac.webkit.org/changeset/58829
CVE-2009-4900 [pixelpost XSS]
RESERVED
- - pixelpost <unfixed> (bug #597224)
+ - pixelpost <removed> (bug #597224)
NOTE: http://www.pixelpost.org/blog/2009/09/02/pixelpost-173-security-update/
CVE-2009-4899 [pixelpost SQL injection]
RESERVED
- - pixelpost <unfixed> (bug #597224)
+ - pixelpost <removed> (bug #597224)
NOTE: http://www.pixelpost.org/blog/2009/09/02/pixelpost-173-security-update/
CVE-2009-4898 (Cross-site request forgery (CSRF) vulnerability in TWiki before 4.3.2 ...)
NOT-FOR-US: TWiki
@@ -8056,8 +8062,7 @@
{DSA-2115-1}
- moodle 1.9.9-1 (bug #586280)
- wordpress 3.0.4+dfsg-1
- - egroupware <removed>
- TODO: check
+ - egroupware <not-affected> (Only forks a minor subset of KSES)
CVE-2010-2229 (Multiple cross-site scripting (XSS) vulnerabilities in blog/index.php ...)
{DSA-2115-1}
- moodle 1.9.9-1 (bug #586280)
@@ -9798,8 +9803,7 @@
{DSA-2115-1}
- moodle 1.9.8-1 (low; bug #585425)
- wordpress <not-affected> (Vulnerable code not present)
- - egroupware <removed>
- TODO: check
+ - egroupware <not-affected> (Vulneable code not present)
CVE-2010-1618 (Cross-site scripting (XSS) vulnerability in the phpCAS client library ...)
{DSA-2115-1}
- libphp-cas <itp> (bug #495542)
@@ -11225,7 +11229,8 @@
{DSA-2053-1}
- linux-2.6 2.6.32-12
CVE-2010-1172 (DBus-GLib 0.73 disregards the access flag of exported GObject ...)
- - dbus-glib 0.88-1 (bug #592753)
+ - dbus-glib 0.88-1 (low; bug #592753)
+ [lenny] - dbus-glib <no-dsa> (Minor issue)
CVE-2010-1171
RESERVED
CVE-2010-1170 (The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0 before ...)
@@ -18247,7 +18252,8 @@
- xulrunner 1.9.1.4-1
[lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
[etch] - xulrunner <not-affected> (Only affects Firefox 3.5)
- - liboggz 0.9.9-1 (medium)
+ - liboggz 0.9.9-1 (low)
+ [lenny] - liboggz <no-dsa> (Too intrusive to backport, needs to be updated to 0.9.9. Requires additional rebuild of rev dep)
CVE-2009-3376 (Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey ...)
{DSA-1922-1}
- xulrunner 1.9.1.4-1
Modified: data/spu-candidates.txt
===================================================================
--- data/spu-candidates.txt 2011-01-28 10:04:21 UTC (rev 15998)
+++ data/spu-candidates.txt 2011-01-28 17:46:21 UTC (rev 15999)
@@ -100,6 +100,11 @@
--
+dbus-glib (CVE-2010-1172)
+#592753
+
+--
+
devil (CVE-2009-3994)
#560080
notified maintainer
@@ -162,6 +167,11 @@
--
+CVE-2008-XXXX [greylistd bypass]
+#464084
+
+--
+
ika (CVE-2010-3361)
#5982925B
notified maintainer
@@ -295,6 +305,12 @@
--
+liboggz (CVE-2009-3377)
+Fixed in 0.9.9-1
+Too intrusive to backport, needs to be updated to 0.9.9. Requires additional rebuild of rev dep.
+
+--
+
libpam-ssh (CVE-2009-1273)
#535877
maintainer notified through initial bug report, said he would work on an update
@@ -373,6 +389,11 @@
--
+mercurial (CVE-2010-4237)
+#598841
+
+--
+
mimedecode
potential dos/crash due to invalid input
orphaned