[Secure-testing-commits] r29355 - data/CVE

[Sebastien Delafond]

Author: seb
Date: 2014-10-10 09:11:16 +0000 (Fri, 10 Oct 2014)
New Revision: 29355

Modified:
   data/CVE/list
Log:
Record that libxstream-java in both wheezy and squeeze is not vulnerable
to CVE-2013-7285

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2014-10-10 07:50:50 UTC (rev 29354)
+++ data/CVE/list	2014-10-10 09:11:16 UTC (rev 29355)
@@ -17593,6 +17593,8 @@
 CVE-2013-7285 [remote code execution via deserialization in XStream]
 	RESERVED
 	- libxstream-java 1.4.7-1 (bug #734821)
+        [wheezy] - libxstream-java <not-affected> (Vulnerability introduced in 1.4.6)
+        [squeeze] - libxstream-java <not-affected> (Vulnerability introduced in 1.4.6)
 	NOTE: http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
 	NOTE: http://markmail.org/message/kfqoqdfj5fnup5co?q=list:org.codehaus.xstream.dev&page=3
 	NOTE: initial patch: https://fisheye.codehaus.org/changelog/xstream?cs=2210