[Secure-testing-commits] r27488 - in data: . CVE

[Moritz Muehlenhoff]

Author: jmm
Date: 2014-06-27 09:32:25 +0000 (Fri, 27 Jun 2014)
New Revision: 27488

Modified:
   data/CVE/list
   data/dsa-needed.txt
Log:
add lzo2 to dsa-needed


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2014-06-27 09:14:11 UTC (rev 27487)
+++ data/CVE/list	2014-06-27 09:32:25 UTC (rev 27488)
@@ -98,10 +98,11 @@
 	RESERVED
 CVE-2014-4611
 	RESERVED
-	- linux <unfixed>
+	- linux <unfixed> (unimportant)
 	[wheezy] - linux <not-affected> (LZ4 support introduced in 3.11)
 	- linux-2.6 <not-affected> (LZ4 support introduced in 3.11)
 	- lz4 <unfixed>
+	NOTE: Not exploitable for lz* compressed kernel images: http://fastcompression.blogspot.fr/2014/06/debunking-lz4-20-years-old-bug-myth.html
 CVE-2014-4610
 	RESERVED
 	- ffmpeg <end-of-life> (Backports to 0.5.x not useful, too many checks missing)
@@ -113,11 +114,11 @@
 	RESERVED
 	- linux <unfixed>
 	- linux-2.6 <removed>
+	NOTE: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=206a81c18401c0cde6e579164f752c4b147324ce
 CVE-2014-4607
 	RESERVED
 	- lzo <removed>
 	- lzo2 <unfixed>
-	TODO: check
 CVE-2014-4606
 	RESERVED
 CVE-2014-4605

Modified: data/dsa-needed.txt
===================================================================
--- data/dsa-needed.txt	2014-06-27 09:14:11 UTC (rev 27487)
+++ data/dsa-needed.txt	2014-06-27 09:32:25 UTC (rev 27488)
@@ -31,6 +31,8 @@
 --
 libxstream-java
 --
+lzo2
+--
 mantis
 --
 modsecurity-apache (carnil)