[Secure-testing-commits] r19166 - data/CVE

[Moritz Muehlenhoff]

Author: jmm
Date: 2012-05-08 06:59:59 +0000 (Tue, 08 May 2012)
New Revision: 19166

Modified:
   data/CVE/list
Log:
dirmngr and evolution unimportant
bug filed for nspluginwrapper (no-dsa as in contrib)
packagekit fixed, not in stable
glibc hardening bypass fixed
NFUs


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2012-05-08 06:01:54 UTC (rev 19165)
+++ data/CVE/list	2012-05-08 06:59:59 UTC (rev 19166)
@@ -410,49 +410,49 @@
 	NOTE: http://osvdb.org/show/osvdb/81633
 CVE-2012-2310 [Drupal SA-CONTRIB-2012-072 - cctags - XSS ]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2309 [Drupal SA-CONTRIB-2012-071 - Glossify - XSS ]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2308 [Drupal SA-CONTRIB-2012-070 - Taxonomy Grid : Catalog - XSS]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2307 [Drupal SA-CONTRIB-2012-069 - Addressbook - CSRF ]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2306 [Drupal SA-CONTRIB-2012-069 - Addressbook - SQL Injection]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2305 [Drupal SA-CONTRIB-2012-068 - Node Gallery - CSRF]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2304 [Drupal SA-CONTRIB-2012-067 - Linkit - Access bypass]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2303 [Drupal SA-CONTRIB-2012-066 - Spaces and Spaces OG - Access ...]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2302 [Drupal SA-CONTRIB-2012-065 - Sitedoc - Information disclosure]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2301 [Drupal SA-CONTRIB-2012-064 - Ubercart - Arbitrary PHP Execution]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2300 [Drupal SA-CONTRIB-2012-064 - Ubercart - XSS]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2299 [Drupal SA-CONTRIB-2012-064 - Ubercart - failure to encrypt data]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2298 [Drupal SA-CONTRIB-2012-063 - RealName - XSS]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2297 [Drupal SA-CONTRIB-2012-062 - Creative Commons - XSS]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2296 [Drupal SA-CONTRIB-2012-056 - Janrain Engage - Sensitive Data ...]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2295
 	RESERVED
 CVE-2012-2294
@@ -756,10 +756,10 @@
 	NOT-FOR-US: Plume CMS
 CVE-2012-2155 [Drupal SA-CONTRIB-2012-050 - CDN2 Video - CSRF]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2154 [Drupal SA-CONTRIB-2012-050 - CDN2 Video - XSS]
 	RESERVED
-	TODO: check
+	NOT-FOR-US: Drupal addon not packaged
 CVE-2012-2153
 	RESERVED
 CVE-2012-2152 [dhcpcd 3.2.3 remote stack overflow / denial of service]
@@ -3874,7 +3874,7 @@
 	NOT-FOR-US: CubeCart
 CVE-2012-0864 [FORTIFY_SOURCE format string protection bypass]
 	RESERVED
-	- eglibc <unfixed> (low; bug #660611)
+	- eglibc 2.13-31 (low; bug #660611)
 	[squeeze] - eglibc <no-dsa> (Hardening bypass, can be fixed in next point update)
 CVE-2012-0863 (Mumble 1.2.3 and earlier uses world-readable permissions for ...)
 	{DSA-2411-1}
@@ -4139,6 +4139,7 @@
 	RESERVED
 CVE-2012-0779 (Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on ...)
 	TODO: check
+	NOT-FOR-US: Adobe Flash Player
 CVE-2012-0778
 	RESERVED
 CVE-2012-0777 (The JavaScript API in Adobe Reader and Acrobat 9.x before 9.5.1 and ...)
@@ -11642,8 +11643,8 @@
 	NOT-FOR-US: Jcow
 CVE-2011-3201
 	RESERVED
-	- evolution <unfixed>
-	TODO: check
+	- evolution <unfixed> (unimportant)
+	NOTE: Any attacks still involve quite some social engineering
 CVE-2011-3200 (Stack-based buffer overflow in the parseLegacySyslogMsg function in ...)
 	- rsyslog 5.8.5-1 (low)
 	[squeeze] - rsyslog <no-dsa> (Minor issue)
@@ -13790,8 +13791,7 @@
 	- xml-security-c 1.6.1-1 (low; bug #632973)
 CVE-2011-2515
 	RESERVED
-	- packagekit <unfixed>
-	TODO: check
+	- packagekit 0.6.17-1
 CVE-2011-2514
 	RESERVED
 	- openjdk-6 6b21~pre1-1
@@ -13905,8 +13905,8 @@
 	RESERVED
 CVE-2011-2486
 	RESERVED
-	- nspluginwrapper <unfixed>
-	TODO: check
+	- nspluginwrapper <unfixed> (bug #671846)
+	[squeeze] - nspluginwrapper <no-dsa> (Contrib not supported)
 CVE-2011-2485 [excessive memory use due improper checking of certain return values in GIF image loader]
 	RESERVED
 	- gdk-pixbuf 2.23.3-3.1 (bug #631524)
@@ -14580,8 +14580,8 @@
 	- kvm <removed>
 CVE-2011-2207
 	RESERVED
-	- dirmngr <unfixed>
-	TODO: check
+	- dirmngr <unfixed> (unimportant; bug #627377)
+	NOTE: Negligable impact
 CVE-2011-2206 (XMLParser.pm in DJabberd before 0.85 allows remote authenticated users ...)
 	NOT-FOR-US: Djabberd
 CVE-2011-2205 (Prosody before 0.8.1 does not properly detect recursion during entity ...)