[Secure-testing-commits] r21401 - in data: . CVE
Thijs Kinkhorst
thijs at alioth.debian.org
Sat Feb 23 16:21:30 UTC 2013
Author: thijs
Date: 2013-02-23 16:21:30 +0000 (Sat, 23 Feb 2013)
New Revision: 21401
Modified:
data/CVE/list
data/next-point-update.txt
Log:
6.0.7 released
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2013-02-23 15:40:31 UTC (rev 21400)
+++ data/CVE/list 2013-02-23 16:21:30 UTC (rev 21401)
@@ -1904,7 +1904,7 @@
NOT-FOR-US: uTorrent
CVE-2013-XXXX [buffer overflow in commandline parsing]
- swath 0.4.3-3 (low; bug #698189)
- [squeeze] - swath <no-dsa> (Minor issue)
+ [squeeze] - swath 0.4.0-4+squeeze1
CVE-2013-0243 [Basic constraints vulnerability]
RESERVED
- haskell-tls-extra 0.4.6.1-1 (bug #698545)
@@ -1983,7 +1983,7 @@
CVE-2012-6110 [bcron file descriptors not closed]
RESERVED
- bcron 0.09-13 (low; bug #686650)
- [squeeze] - bcron <no-dsa> (Minor issue)
+ [squeeze] - bcron 0.09-11+squeeze1
CVE-2013-1364 [possible to override LDAP configuration parameters via the API]
RESERVED
- zabbix 1:2.0.4+dfsg-2 (bug #698541)
@@ -3421,7 +3421,7 @@
RESERVED
CVE-2013-0722 (Stack-based buffer overflow in the scan_load_hosts function in ...)
- ettercap 1:0.7.5.1-2 (low; bug #697987)
- [squeeze] - ettercap <no-dsa> (Minor issue)
+ [squeeze] - ettercap 1:0.7.3-2.1+squeeze1
NOTE: http://www.openwall.com/lists/oss-security/2013/01/10/2
NOTE: http://www.exploit-db.com/exploits/23945/
NOTE: https://secunia.com/advisories/51731/
@@ -4312,6 +4312,7 @@
- foswiki <itp> (bug #509864)
CVE-2012-6329 (The _compile function in Maketext.pm in the Locale::Maketext ...)
- perl 5.14.2-16 (bug #695224)
+ [squeeze] - perl 5.10.1-17squeeze5
- foswiki <itp> (bug #509864)
CVE-2012-6328
RESERVED
@@ -4761,7 +4762,7 @@
CVE-2013-0292 [Local privilege escalation due improper filtering of message sender when NameOwnerChanged signal received]
RESERVED
- dbus-glib 0.100.1-1 (bug #700638; high)
- [squeeze] - dbus-glib <no-dsa> (6.0.7 point release scheduled soon)
+ [squeeze] - dbus-glib 0.88-2.1+squeeze1
CVE-2013-0291
RESERVED
CVE-2013-0290 (The __skb_recv_datagram function in net/core/datagram.c in the Linux ...)
@@ -5115,7 +5116,7 @@
CVE-2013-0191 [pam-pgsql NULL password handling issue]
RESERVED
- pam-pgsql 0.7.3.1-4 (bug #698241)
- [squeeze] - pam-pgsql <no-dsa> (Minor issue)
+ [squeeze] - pam-pgsql 0.7.1-4+squeeze2
NOTE: patch: https://sourceforge.net/u/lvella/pam-pgsql/ci/9361f5970e5dd90a747319995b67c2f73b91448c/
NOTE: bugreport: https://sourceforge.net/p/pam-pgsql/bugs/13/
CVE-2013-0187
@@ -5899,12 +5900,12 @@
RESERVED
CVE-2012-6090 (Multiple stack-based buffer overflows in the expand function in ...)
- swi-prolog 5.10.4-5 (low; bug #697416)
- [squeeze] - swi-prolog <no-dsa> (Minor issue)
+ [squeeze] - swi-prolog 5.10.1-1+squeeze1
NOTE: https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html
NOTE: http://www.swi-prolog.org/git/pl.git/commitdiff/b2c88972e7515ada025e97e7d3ce3e34f81cf33e
CVE-2012-6089 (Multiple stack-based buffer overflows in the canoniseFileName function ...)
- swi-prolog 5.10.4-5 (low; bug #697416)
- [squeeze] - swi-prolog <no-dsa> (Minor issue)
+ [squeeze] - swi-prolog 5.10.1-1+squeeze1
NOTE: https://lists.iai.uni-bonn.de/pipermail/swi-prolog/2012/009428.html
NOTE: http://www.swi-prolog.org/git/pl.git/commitdiff/a9a6fc8a2a9cf3b9154b490a4b1ffaa8be4d723c
CVE-2012-6088 (The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 ...)
@@ -7991,6 +7992,7 @@
CVE-2012-5391
RESERVED
- mediawiki 1:1.19.3-1 (bug #694998)
+ [squeeze] - mediawiki 1:1.15.5-2squeeze5
CVE-2012-5390 [Possible privilege escalation]
RESERVED
- condor <not-affected> (standard universe is disabled in the Debian package, see bug #697936)
@@ -10268,6 +10270,7 @@
- kfreebsd-8 8.3-6 (bug #694096)
- kfreebsd-9 9.0-9 (bug #694097)
- kfreebsd-10 <unfixed> (bug #694098)
+ [squeeze] - kfreebsd-8 8.1+dfsg-8+squeeze4
CVE-2012-4575 (The add_database function in objects.c in the pgbouncer pooler 1.5.2 ...)
- pgbouncer 1.5.2-4
CVE-2012-4574 (Pulp in Red Hat CloudForms before 1.1 uses world-readable permissions ...)
@@ -10467,7 +10470,7 @@
CVE-2012-4507 (The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 ...)
- claws-mail 3.8.1-2 (low; bug #690151)
[squeeze] - claws-mail <no-dsa> (Minor issue)
- NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=862578
+ [squeeze] - claws-mail 3.7.6-4+squeeze1
NOTE: http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=2743
NOTE: www.thewildbeast.co.uk/claws-mail/bugzilla/attachment.cgi?id=1165
CVE-2012-4506 (Directory traversal vulnerability in gitolite 3.x before 3.1, when ...)
@@ -13479,7 +13482,7 @@
- jbossas4 <not-affected> (Only builds a few libraries, not the full application server, #581226)
CVE-2012-3368 (Integer signedness error in attach.c in dtach 0.8 allows remote ...)
- dtach 0.8-2.1 (low; bug #625302)
- [squeeze] - dtach <no-dsa> (Minor issue)
+ [squeeze] - dtach 0.8-2+squeeze1
NOTE: http://sourceforge.net/tracker/?func=detail&aid=3517812&group_id=36489&atid=417357
NOTE: http://sourceforge.net/tracker/download.php?group_id=36489&atid=417357&file_id=441195&aid=3517812
NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=812551
@@ -15782,7 +15785,7 @@
CVE-2010-5107 [openssh: DoS]
RESERVED
- openssh 1:6.0p1-4 (low; bug #700102)
- [squeeze] - openssh <no-dsa> (will be fixed via pu)
+ [squeeze] - openssh 1:5.5p1-6+squeeze3
CVE-2010-5106 (The XML-RPC remote publishing interface in xmlrpc.php in WordPress ...)
- wordpress 3.0.3-1
CVE-2010-5105 [blender /tmp/quit.blend temp file issue]
@@ -15940,6 +15943,7 @@
NOT-FOR-US: Bytemark Symbiosis
CVE-2012-2367 (Moodle 1.9.x before 1.9.18, 2.0.x before 2.0.9, 2.1.x before 2.1.6, ...)
- moodle 2.2.3.dfsg-1 (low; bug #674163)
+ [squeeze] - moodle 1.9.9.dfsg2-2.1+squeeze4
CVE-2012-2366 (mod/data/preset.php in Moodle 2.1.x before 2.1.6 and 2.2.x before ...)
- moodle 2.2.3.dfsg-1 (bug #674163)
[squeeze] - moodle <not-affected> (Only affects 2.1 to 2.2)
@@ -15951,9 +15955,11 @@
[squeeze] - moodle <not-affected> (Only affects 2.0 to 2.2)
CVE-2012-2363 (SQL injection vulnerability in calendar/event.php in the calendar ...)
- moodle 2.0-1 (bug #674163)
+ [squeeze] - moodle 1.9.9.dfsg2-2.1+squeeze4
NOTE: Only affects Moodle 1.9.x
CVE-2012-2362 (Cross-site scripting (XSS) vulnerability in blog/lib.php in the blog ...)
- moodle 2.0-1 (bug #674163)
+ [squeeze] - moodle 1.9.9.dfsg2-2.1+squeeze4
NOTE: Only affects Moodle 1.9.x
CVE-2012-2361 (Cross-site scripting (XSS) vulnerability in admin/webservice/forms.php ...)
- moodle 2.2.3.dfsg-1 (bug #674163)
@@ -17940,7 +17946,7 @@
- file 5.11-1 (low; bug #664263)
CVE-2012-1570 (The resolver in MaraDNS before 1.3.0.7.15 and 1.4.x before 1.4.12 ...)
- maradns 1.4.12-1 (bug #665012)
- [squeeze] - maradns <no-dsa> (Minor DNS protocol flaw)
+ [squeeze] - maradns 1.4.03-1.1+squeeze1
CVE-2012-1569 (The asn1_get_length_der function in decoding.c in GNU Libtasn1 before ...)
{DSA-2440-1}
- libtasn1-3 2.12-1 (high)
@@ -18863,6 +18869,7 @@
RESERVED
- moodle 1.9.9.dfsg2-6 (low; bug #668411)
[squeeze] - moodle <no-dsa> (Minor issue)
+ [squeeze] - moodle 1.9.9.dfsg2-2.1+squeeze4
CVE-2012-1154 (mod_cluster 1.0.10 before 1.0.10 CP03 and 1.1.x before 1.1.4, as used ...)
NOT-FOR-US: mod_cluster
CVE-2012-1153 (Unrestricted file upload vulnerability in ...)
@@ -23701,7 +23708,7 @@
NOTE: http://git.libav.org/?p=libav.git;a=commitdiff;h=494cfacdb9ba3f0549e37f76b3a2f86a7aeeac3c
CVE-2011-4363 (ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when ...)
- libproc-processtable-perl 0.45-6 (low; bug #650500)
- [squeeze] - libproc-processtable-perl <no-dsa> (Minor issue)
+ [squeeze] - libproc-processtable-perl 0.45-1+squeeze1
CVE-2011-4362 (Integer signedness error in the base64_decode function in the HTTP ...)
{DSA-2368-1}
- lighttpd 1.4.30-1 (low; bug #652726)
@@ -35846,7 +35853,7 @@
- xpdf 3.02-9
- poppler 0.16.3-1 (low)
[lenny] - poppler <no-dsa> (minor issue)
- [squeeze] - poppler <no-dsa> (minor issue)
+ [squeeze] - poppler 0.12.4-1.2+squeeze1
NOTE: http://cgit.freedesktop.org/poppler/poppler/commit/?id=cad66a7d25abdb6aa15f3aa94a35737b119b2659
CVE-2010-4652 (Heap-based buffer overflow in the sql_prepare_where function ...)
{DSA-2191-1}
@@ -49407,6 +49414,7 @@
- kdegraphics 4.0 (unimportant)
- xpdf <unfixed> (unimportant)
- poppler 0.16.3-1 (unimportant)
+ [squeeze] - poppler 0.12.4-1.2+squeeze1
NOTE: https://bugs.freedesktop.org/show_bug.cgi?id=28172
NOTE: Just a crasher, not treated as a security issue
CVE-2010-0206 [xpdf: Invalid pointer dereference by processing JBIG2 PDF stream objects]
@@ -49414,6 +49422,7 @@
- kdegraphics 4.0 (unimportant)
- xpdf <unfixed> (unimportant)
- poppler 0.16.3-1 (unimportant)
+ [squeeze] - poppler 0.12.4-1.2+squeeze1
NOTE: https://bugzilla.redhat.com/CVE-2010-0206
NOTE: Just a crasher, not treated as a security issue
CVE-2010-0205 (The png_decompress_chunk function in pngrutil.c in libpng 1.0.x before ...)
Modified: data/next-point-update.txt
===================================================================
--- data/next-point-update.txt 2013-02-23 15:40:31 UTC (rev 21400)
+++ data/next-point-update.txt 2013-02-23 16:21:30 UTC (rev 21401)
@@ -1,48 +0,0 @@
-CVE-2012-6090 (Multiple stack-based buffer overflows in the expand function in ...)
- [squeeze] - swi-prolog 5.10.1-1+squeeze1
-CVE-2012-6089
- [squeeze] - swi-prolog 5.10.1-1+squeeze1
-CVE-2012-4507 (The strchr function in procmime.c in Claws Mail (aka claws-mail) 3.8.1 ...)
- [squeeze] - claws-mail 3.7.6-4+squeeze1
-CVE-2013-0191 [pam-pgsql NULL password handling issue]
- [squeeze] - pam-pgsql 0.7.1-4+squeeze2
-CVE-2012-6110 [bcron file descriptors not closed]
- [squeeze] - bcron 0.09-11+squeeze1
-CVE-2011-4363 (ProcessTable.pm in the Proc::ProcessTable module 0.45 for Perl, when ...)
- [squeeze] - libproc-processtable-perl 0.45-1+squeeze1
-CVE-2012-3368 (Integer signedness error in attach.c in dtach 0.8 allows remote ...)
- [squeeze] - dtach 0.8-2+squeeze1
-CVE-2010-5107 [openssh: DoS]
- [squeeze] - openssh 1:5.5p1-6+squeeze3
-CVE-2010-0206
- [squeeze] - poppler 0.12.4-1.2+squeeze1
-CVE-2010-0207
- [squeeze] - poppler 0.12.4-1.2+squeeze1
-CVE-2010-4653
- [squeeze] - poppler 0.12.4-1.2+squeeze1
-CVE-2012-3524
- [squeeze] - dbus 1.2.24-4+squeeze2
-CVE-2012-1570
- [squeeze] - maradns 1.4.03-1.1+squeeze1
-CVE-2012-5391
- [squeeze] - mediawiki 1:1.15.5-2squeeze5
-CVE-2012-1155
- [squeeze] - moodle 1.9.9.dfsg2-2.1+squeeze4
-CVE-2012-2362
- [squeeze] - moodle 1.9.9.dfsg2-2.1+squeeze4
-CVE-2012-2363
- [squeeze] - moodle 1.9.9.dfsg2-2.1+squeeze4
-CVE-2012-2367
- [squeeze] - moodle 1.9.9.dfsg2-2.1+squeeze4
-CVE-2012-6303
- [squeeze] - snack 2.2.10-dfsg1-9+squeeze1
-CVE-2012-XXXX [TEMP-0698189-BE9FC4]
- [squeeze] - swath 0.4.0-4+squeeze1
-CVE-2013-0722
- [squeeze] - ettercap 1:0.7.3-2.1+squeeze1
-CVE-2012-6329 (The _compile function in Maketext.pm in the Locale::Maketext ...)
- [squeeze] - perl 5.10.1-17squeeze5
-CVE-2012-4576
- [squeeze] - kfreebsd-8 8.1+dfsg-8+squeeze4
-CVE-2013-0292 [Local privilege escalation due improper filtering of message sender when NameOwnerChanged signal received]
- [squeeze] - dbus-glib 0.88-2.1+squeeze1
More information about the Secure-testing-commits
mailing list