[Secure-testing-commits] r22468 - data/CVE

[Moritz Muehlenhoff]

Author: jmm
Date: 2013-06-04 05:22:17 +0000 (Tue, 04 Jun 2013)
New Revision: 22468

Modified:
   data/CVE/list
Log:
one libraw issue doesn't affect any release except experimental
one issue doesn't affect oldstable, minor impact, so no-dsa for stable


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2013-06-04 00:10:00 UTC (rev 22467)
+++ data/CVE/list	2013-06-04 05:22:17 UTC (rev 22468)
@@ -3662,12 +3662,14 @@
 	NOTE: https://git.kernel.org/linus/baff42ab1494528907bf4d5870359e31711746ae
 CVE-2013-2127 [libraw: buffer overflow]
 	RESERVED
-	- libraw <unfixed> (bug #710353)
+	- libraw <not-affected> (Only affects 0.15)
 	NOTE: http://www.openwall.com/lists/oss-security/2013/05/28/3
 	NOTE: https://github.com/LibRaw/LibRaw/commit/2f912f5b33582961b1cdbd9fd828589f8b78f21d
 CVE-2013-2126 [libraw: double-free]
 	RESERVED
-	- libraw <unfixed> (bug #710353)
+	- libraw <unfixed> (low; bug #710353)
+	[wheezy] - libraw <no-dsa> (Not suitable for code injection, minor issue)
+	[squeeze] - libraw <not-affected> (Vulnerable code not present)
 	NOTE: http://www.openwall.com/lists/oss-security/2013/05/28/3
 	NOTE: https://github.com/LibRaw/LibRaw/commit/19ffddb0fe1a4ffdb459b797ffcf7f490d28b5a6
 CVE-2013-2125
@@ -4876,7 +4878,6 @@
 	- poppler 0.18.4-6 (low; bug #702071)
 CVE-2013-1789 (splash/Splash.cc in poppler before 0.22.1 allows context-dependent ...)
 	- poppler <not-affected> (vulnerable code introduced in a later version)
-	TODO: recheck poppler >= 0.22 when it gets uploaded
 CVE-2013-1788 (poppler before 0.22.1 allows context-dependent attackers to cause a ...)
 	- poppler 0.18.4-6 (low; bug #702071)
 CVE-2013-1787 (Cross-site scripting (XSS) vulnerability in the 3 slide gallery in the ...)