[Secure-testing-commits] r31835 - data/CVE

security tracker role sectracker at moszumanska.debian.org
Thu Jan 29 21:10:15 UTC 2015 

Author: sectracker
Date: 2015-01-29 21:10:15 +0000 (Thu, 29 Jan 2015)
New Revision: 31835

Modified:
   data/CVE/list
Log:
automatic update

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2015-01-29 20:39:43 UTC (rev 31834)
+++ data/CVE/list	2015-01-29 21:10:15 UTC (rev 31835)
@@ -1,3 +1,107 @@
+CVE-2015-1419 (Unspecified vulnerability in vsftp 3.0.2 and earlier allows remote ...)
+	TODO: check
+CVE-2015-1418
+	RESERVED
+CVE-2015-1417
+	RESERVED
+CVE-2015-1416
+	RESERVED
+CVE-2015-1415
+	RESERVED
+CVE-2015-1414
+	RESERVED
+CVE-2015-1413
+	RESERVED
+CVE-2015-1412
+	RESERVED
+CVE-2015-1411
+	RESERVED
+CVE-2015-1410
+	RESERVED
+CVE-2015-1409
+	RESERVED
+CVE-2015-1408
+	RESERVED
+CVE-2015-1407
+	RESERVED
+CVE-2015-1406
+	RESERVED
+CVE-2015-1400
+	RESERVED
+CVE-2015-1399
+	RESERVED
+CVE-2015-1398
+	RESERVED
+CVE-2015-1397
+	RESERVED
+CVE-2015-1394
+	RESERVED
+CVE-2015-1393
+	RESERVED
+CVE-2015-1392
+	RESERVED
+CVE-2015-1391
+	RESERVED
+CVE-2015-1390
+	RESERVED
+CVE-2015-1389
+	RESERVED
+CVE-2015-1388
+	RESERVED
+CVE-2015-1387
+	RESERVED
+CVE-2015-1385
+	RESERVED
+CVE-2015-1384
+	RESERVED
+CVE-2015-1383
+	RESERVED
+CVE-2015-1376 (pixabay-images.php in the Pixabay Images plugin before 2.4 for ...)
+	TODO: check
+CVE-2015-1375 (pixabay-images.php in the Pixabay Images plugin before 2.4 for ...)
+	TODO: check
+CVE-2015-1374 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
+	TODO: check
+CVE-2015-1373 (Multiple cross-site scripting (XSS) vulnerabilities in admin.php in ...)
+	TODO: check
+CVE-2015-1372 (SQL injection vulnerability in ferretCMS 1.0.4-alpha allows remote ...)
+	TODO: check
+CVE-2015-1371 (Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows ...)
+	TODO: check
+CVE-2015-1368 (Multiple cross-site scripting (XSS) vulnerabilities in Ansible Tower ...)
+	TODO: check
+CVE-2015-1367 (SQL injection vulnerability in index.php in CatBot 0.4.2 allows remote ...)
+	TODO: check
+CVE-2015-1366 (Cross-site scripting (XSS) vulnerability in pixabay-images.php in the ...)
+	TODO: check
+CVE-2015-1365 (Directory traversal vulnerability in pixabay-images.php in the Pixabay ...)
+	TODO: check
+CVE-2015-1364 (SQL injection vulnerability in the getProfile function in ...)
+	TODO: check
+CVE-2015-1363 (Cross-site scripting (XSS) vulnerability in Free Reprintables ...)
+	TODO: check
+CVE-2015-1362 (Buffer overflow in the Customize 35mm tab in Two Pilots Exif Pilot ...)
+	TODO: check
+CVE-2015-1361 (platform/image-decoders/ImageFrame.h in Blink, as used in Google ...)
+	TODO: check
+CVE-2015-1360 (Skia, as used in Google Chrome before 40.0.2214.91, allows remote ...)
+	TODO: check
+CVE-2015-1359 (Multiple off-by-one errors in fpdfapi/fpdf_font/font_int.h in PDFium, ...)
+	TODO: check
+CVE-2015-1358
+	RESERVED
+CVE-2015-1357
+	RESERVED
+CVE-2015-1356
+	RESERVED
+CVE-2015-1355
+	RESERVED
+CVE-2014-9648 (components/navigation_interception/intercept_navigation_resource_throttle.cc ...)
+	TODO: check
+CVE-2014-9647 (Use-after-free vulnerability in PDFium, as used in Google Chrome ...)
+	TODO: check
+CVE-2014-9646 (Unquoted Windows search path vulnerability in the ...)
+	TODO: check
 CVE-2015-XXXX [XSA-118]
 	- xen <unfixed> (low)
 	[wheezy] - xen <not-affected> (Only affects 4.4 and later on arm)
@@ -7,10 +111,10 @@
 	NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-24676
 	NOTE: http://downloads.digium.com/pub/security/AST-2015-002.html
 CVE-2015-XXXX [AST-2015-001: File descriptor leak when incompatible codecs are offered]
-       - asterisk <unfixed>
-       [jessie] - asterisk <not-affected> (Only affects 12.x and 13.x)
-       [wheezy] - asterisk <not-affected> (Only affects 12.x and 13.x)
-       [squeeze] - asterisk <not-affected> (Only affects 12.x and 13.x)
+	- asterisk <unfixed>
+	[jessie] - asterisk <not-affected> (Only affects 12.x and 13.x)
+	[wheezy] - asterisk <not-affected> (Only affects 12.x and 13.x)
+	[squeeze] - asterisk <not-affected> (Only affects 12.x and 13.x)
 	NOTE: https://issues.asterisk.org/jira/browse/ASTERISK-24666
 	NOTE: http://downloads.digium.com/pub/security/AST-2015-001.html
 CVE-2013-XXXX [don't properly verify SSL certificates]
@@ -35,14 +139,19 @@
 	- linux-2.6 <removed>
 	NOTE: http://marc.info/?l=linux-kernel&m=142247707318982&w=2
 CVE-2015-1405
+	RESERVED
 	NOT-FOR-US: typo3 extension
 CVE-2015-1404
+	RESERVED
 	NOT-FOR-US: typo3 extension
 CVE-2015-1403
+	RESERVED
 	NOT-FOR-US: typo3 extension
 CVE-2015-1402
+	RESERVED
 	NOT-FOR-US: typo3 extension
 CVE-2015-1401
+	RESERVED
 	NOT-FOR-US: typo3 extension
 CVE-2015-XXXX [phpbb3 csrf & css injection]
 	- phpbb3 <unfixed> (low)
@@ -58,7 +167,7 @@
 	- squid3 3.4.8-6 (bug #776464)
 	NOTE: http://bugs.squid-cache.org/show_bug.cgi?id=4066
 	NOTE: Upstream patch for Squid 3.4: http://bazaar.launchpad.net/~squid/squid/3.4/revision/13211
-CVE-2015-1369
+CVE-2015-1369 (SQL injection vulnerability in Sequelize before 2.0.0-rc7 for Node.js ...)
 	NOT-FOR-US: sequelize
 CVE-2015-1354
 	RESERVED
@@ -153,44 +262,55 @@
 CVE-2014-9632
 	RESERVED
 CVE-2015-1386 [directory traversal]
+	RESERVED
 	- unshield <unfixed> (low; bug #776193)
 	[wheezy] - unshield <no-dsa> (Minor issue)
 	[squeeze] - unshield <no-dsa> (Minor issue)
 CVE-2015-1382 [invalid read]
+	RESERVED
+	{DLA-142-1}
 	- privoxy 3.0.21-7 (bug #776490)
 	NOTE: http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/parsers.c?r1=1.297&r2=1.298
 CVE-2015-1381 [multiple segmentation faults and memory leaks in the pcrs code]
+	RESERVED
+	{DLA-142-1}
 	- privoxy 3.0.21-7 (bug #776490)
 	NOTE: http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/pcrs.c?r1=1.46&r2=1.47
 CVE-2015-1380 [DoS]
+	RESERVED
 	- privoxy 3.0.21-7 (bug #776490)
 	[wheezy] - privoxy <not-affected> (Vulnerable code introduced in 3.0.20)
 	[squeeze] - privoxy <not-affected> (Vulnerable code introduced in 3.0.20)
 	NOTE: http://ijbswa.cvs.sourceforge.net/viewvc/ijbswa/current/jcc.c?r1=1.433&r2=1.434
 CVE-2015-1379 [DoS with fork]
+	RESERVED
 	- socat <unfixed> (bug #776234)
 	[wheezy] - socat <no-dsa> (Minor issue)
 	[squeeze] - socat <no-dsa> (Minor issue)
 	NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/01/24/6
 	NOTE: Upstream advisory: http://www.dest-unreach.org/socat/contrib/socat-secadv6.txt
 CVE-2015-1378 [Issues with sourcing cmdlineopts.clp from current working directory]
+	RESERVED
 	- grml-debootstrap <unfixed> (low; bug #776502)
 	[wheezy] - grml-debootstrap <no-dsa> (Minor issue)
 	NOTE: https://github.com/grml/grml-debootstrap/issues/59
 CVE-2015-1377 [Read Mail Module Vulnerability]
+	RESERVED
 	NOT-FOR-US: Webmin
 CVE-2015-1395 [directory traversal via file rename]
+	RESERVED
 	- patch 2.7.3-1 (bug #775873)
 	[wheezy] - patch <not-affected> (Support for git-style patches added in 2.7)
 	[squeeze] - patch <not-affected> (Support for git-style patches added in 2.7)
 	NOTE: Upstream report: https://savannah.gnu.org/bugs/?44059
 	NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/01/24/2
-CVE-2015-1370
+CVE-2015-1370 (Incomplete blacklist vulnerability in marked 0.3.2 and earlier for ...)
 	- node-marked <unfixed> (unimportant)
 	NOTE: https://nodesecurity.io/advisories/marked_vbscript_injection
 	NOTE: https://github.com/chjj/marked/issues/492
 	NOTE: libv8 is not covered by security support
 CVE-2013-7423 [getaddrinfo() writes DNS queries to random file descriptors under high load]
+	RESERVED
 	- glibc <unfixed>
 	- eglibc <removed>
 	NOTE: https://sourceware.org/bugzilla/show_bug.cgi?id=15946
@@ -216,6 +336,7 @@
 	NOTE: https://bugs.busybox.net/show_bug.cgi?id=7652
 	NOTE: http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b
 CVE-2013-7422 [Segfault from bad backreference]
+	RESERVED
 	- perl 5.20.0-1 (bug #776046)
 	[wheezy] - perl <no-dsa> (Minor issue)
 	[squeeze] - perl <no-dsa> (Minor issue)
@@ -441,10 +562,10 @@
 	RESERVED
 CVE-2015-1180 (Cross-site scripting (XSS) vulnerability in the Web Reports in ...)
 	TODO: check
-CVE-2015-1179
-	RESERVED
-CVE-2015-1178
-	RESERVED
+CVE-2015-1179 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
+	TODO: check
+CVE-2015-1178 (Multiple cross-site scripting (XSS) vulnerabilities in cart.php in ...)
+	TODO: check
 CVE-2015-1177
 	RESERVED
 CVE-2015-1176 (Cross-site scripting (XSS) vulnerability in upload/scp/tickets.php in ...)
@@ -499,16 +620,17 @@
 	[squeeze] - vorbis-tools <no-dsa> (Minor issue)
 	NOTE: https://trac.xiph.org/ticket/2009
 	NOTE: Upstream fix: https://trac.xiph.org/changeset/19117
-CVE-2014-9649 [Bug 26437 - prevent /api/* from returning text/html error messages which could act as an XSS vector]
+CVE-2014-9649 (Cross-site scripting (XSS) vulnerability in the management plugin in ...)
 	- rabbitmq-server 3.4.1-1
 	NOTE: https://groups.google.com/forum/#!topic/rabbitmq-users/-3Z2FyGtXhs
 	NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/01/21/13
-CVE-2014-9650 [Bug 26433 - fix response-splitting vulnerability in /api/downloads]
+CVE-2014-9650 (CRLF injection vulnerability in the management plugin in RabbitMQ ...)
 	- rabbitmq-server 3.4.1-1
 	NOTE: https://groups.google.com/forum/#!topic/rabbitmq-users/-3Z2FyGtXhs
 	NOTE: Fixed by: https://github.com/rabbitmq/rabbitmq-management/commit/b5a5fc31bd49ad821a655ea9e2fe920d670a62ad
 	NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/01/21/13
 CVE-2015-1396 [(another) directory traversal via symlinks -- incomplete fix for CVE-2015-1196]
+	RESERVED
 	- patch 2.7.3-1 (bug #775901)
 	[wheezy] - patch <not-affected> (Not affected by CVE-2015-1196 and no incomplete fix applied)
 	[squeeze] - patch <not-affected>  (Not affected by CVE-2015-1196 and no incomplete fix applied)
@@ -562,9 +684,8 @@
 	- gtk+3.0 3.11.8-1 (bug #759145)
 	[wheezy] - gtk+3.0 <not-affected> (Vulnerable code not present)
 	NOTE: http://www.ubuntu.com/usn/USN-2475-1/
-CVE-2015-1182 [Remote attack using crafted certificates]
-	RESERVED
-	{DSA-3136-1}
+CVE-2015-1182 (The asn1_get_sequence_of function in library/asn1parse.c in PolarSSL ...)
+	{DSA-3136-1 DLA-144-1}
 	- polarssl 1.3.9-2.1 (bug #775776)
 	NOTE: https://polarssl.org/tech-updates/security-advisories/polarssl-security-advisory-2014-04
 CVE-2015-1175 (Cross-site scripting (XSS) vulnerability in blocklayered-ajax.php in ...)
@@ -916,13 +1037,11 @@
 	NOT-FOR-US: SAP NetWeaver
 CVE-2014-9593 (Apache CloudStack before 4.3.2 and 4.4.x before 4.4.2 allows remote ...)
 	NOT-FOR-US: Apache CloudStack
-CVE-2015-1308 [X11 clients can eavesdrop input events while screen is locked]
-	RESERVED
+CVE-2015-1308 (kde-workspace 4.2.0 and plasma-workspace before 5.1.95 allows remote ...)
 	- kde-workspace <unfixed> (low)
 	[wheezy] - kde-workspace <no-dsa> (Minor issue)
 	[jessie] - kde-workspace <no-dsa> (Minor issue)
-CVE-2015-1307 [plasma-workspace: Network access from screen locker]
-	RESERVED
+CVE-2015-1307 (plasma-workspace before 5.1.95 allows remote attackers to obtain ...)
 	NOT-FOR-US: KDE Plasma 5 desktop, not yet packaged
 CVE-2015-1306 (The newsletter posting area in the web interface in Sympa 6.0.x before ...)
 	{DSA-3134-1}
@@ -1448,6 +1567,7 @@
 	[wheezy] - patch <not-affected> (Support for git-style patches added in 2.7)
 	[squeeze] - patch <not-affected> (Support for git-style patches added in 2.7)
 CVE-2014-9651 [buffer overrun in CHICKEN Scheme's substring-index[-ci] procedures]
+	RESERVED
 	- chicken <unfixed> (bug #775346)
 	[wheezy] - chicken <no-dsa> (Minor issue)
 	[squeeze] - chicken <no-dsa> (Minor issue)
@@ -2169,8 +2289,8 @@
 	NOT-FOR-US: Cisco Unified Communications Domain Manager
 CVE-2015-0587
 	RESERVED
-CVE-2015-0586
-	RESERVED
+CVE-2015-0586 (The Network-Based Application Recognition (NBAR) protocol ...)
+	TODO: check
 CVE-2015-0585
 	RESERVED
 CVE-2015-0584
@@ -2179,8 +2299,8 @@
 	NOT-FOR-US: Cisco WebEx Meeting Center
 CVE-2015-0582 (The High Availability (HA) subsystem in Cisco NX-OS on MDS 9000 ...)
 	NOT-FOR-US: Cisco NX-OS
-CVE-2015-0581
-	RESERVED
+CVE-2015-0581 (The XML parser in Cisco Prime Service Catalog before 10.1 allows ...)
+	TODO: check
 CVE-2015-0580
 	RESERVED
 CVE-2015-0579 (Cisco TelePresence Video Communication Server (VCS) and Cisco ...)
@@ -2238,22 +2358,19 @@
 	NOT-FOR-US: VDG Security SENSE
 CVE-2014-9574
 	RESERVED
-CVE-2014-9573
-	RESERVED
+CVE-2014-9573 (SQL injection vulnerability in manage_user_page.php in MantisBT before ...)
 	- mantis <removed>
 	[wheezy] - mantis <no-dsa> (Minor issue)
 	[squeeze] - mantis <end-of-life> (Unsupported in squeeze-lts)
 	NOTE: Upstream patch: http://github.com/mantisbt/mantisbt/commit/69c2d28d (1.2.x)
 	NOTE: https://www.mantisbt.org/bugs/view.php?id=17940
-CVE-2014-9572
-	RESERVED
+CVE-2014-9572 (MantisBT before 1.2.19 and 1.3.x before 1.3.0-beta.2 does not properly ...)
 	- mantis <removed>
 	[wheezy] - mantis <no-dsa> (Minor issue)
 	[squeeze] - mantis <end-of-life> (Unsupported in squeeze-lts)
 	NOTE: Upstream patch: http://github.com/mantisbt/mantisbt/commit/5571bcf9 (1.2.x)
 	NOTE: https://www.mantisbt.org/bugs/view.php?id=17939
-CVE-2014-9571
-	RESERVED
+CVE-2014-9571 (Cross-site scripting (XSS) vulnerability in admin/install.php in ...)
 	- mantis <removed>
 	[wheezy] - mantis <no-dsa> (Minor issue)
 	[squeeze] - mantis <end-of-life> (Unsupported in squeeze-lts)
@@ -2391,7 +2508,7 @@
 	NOTE: http://github.com/mantisbt/mantisbt/commit/d95f070d
 CVE-2015-1031 [use-after-free]
 	RESERVED
-	{DSA-3133-1}
+	{DSA-3133-1 DLA-142-1}
 	- privoxy 3.0.21-5 (bug #775167)
 	NOTE: http://www.privoxy.org/announce.txt
 CVE-2015-1030 (Memory leak in the rfc2553_connect_to function in jbsocket.c in ...)
@@ -2875,6 +2992,7 @@
 	[wheezy] - cabextract <no-dsa> (Minor issue)
 	[squeeze] - cabextract <no-dsa> (Minor issue)
 CVE-2012-6686 [unbound alloca use in glob_in_dir]
+	RESERVED
 	- glibc <unfixed>
 	- eglibc <removed>
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=797096
@@ -3909,10 +4027,10 @@
 	RESERVED
 CVE-2014-9199 (The Clorius Controls Java web client before 01.00.0009g allows remote ...)
 	TODO: check
-CVE-2014-9198
-	RESERVED
-CVE-2014-9197
-	RESERVED
+CVE-2014-9198 (The FTP server on the Schneider Electric ETG3000 FactoryCast HMI ...)
+	TODO: check
+CVE-2014-9197 (The Schneider Electric ETG3000 FactoryCast HMI Gateway with firmware ...)
+	TODO: check
 CVE-2014-9196
 	RESERVED
 CVE-2014-9195 (Phoenix Contact ProConOs and MultiProg do not require authentication, ...)
@@ -4063,8 +4181,7 @@
 	RESERVED
 CVE-2015-0313
 	RESERVED
-CVE-2015-0312
-	RESERVED
+CVE-2015-0312 (Double free vulnerability in Adobe Flash Player before 13.0.0.264 and ...)
 	NOT-FOR-US: Adobe Flash
 CVE-2015-0311 (Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and ...)
 	NOT-FOR-US: Adobe Flash
@@ -4860,8 +4977,7 @@
 	NOTE: Upstream fix: http://libvirt.org/git/?p=libvirt.git;a=commit;h=b347c0c2a321ec5c20aae214927949832a288c5a
 	NOTE: Introduced by: http://libvirt.org/git/?p=libvirt.git;a=commit;h=e341435e5090677c67a0d3d4ca0393102054841f (v1.1.0-rc1)
 	NOTE: http://security.libvirt.org/2015/0001.html
-CVE-2015-0235 [glibc: buffer overflow in gethostbyname]
-	RESERVED
+CVE-2015-0235 (Heap-based buffer overflow in the __nss_hostname_digits_dots function ...)
 	{DSA-3142-1 DLA-139-1}
 	- eglibc <removed> (high; bug #776391)
 	- glibc 2.18-1 (high)
@@ -4874,13 +4990,11 @@
 	RESERVED
 	- 389-admin <unfixed> (unimportant)
 	NOTE: Rendered unexploitable by /tmp hardening in Debian kernel
-CVE-2015-0232 [Free called on unitialized pointer in exif.c]
-	RESERVED
+CVE-2015-0232 (The exif_process_unicode function in ext/exif/exif.c in PHP before ...)
 	- php5 5.6.5+dfsg-1
 	NOTE: https://bugs.php.net/patch-display.php?bug=68799&patch=bug68799fix&revision=1420966468
 	NOTE: https://bugs.php.net/bug.php?id=68799
-CVE-2015-0231 [use after free vulnerability in unserialize() (inclomplete fix of CVE-2014-8142)]
-	RESERVED
+CVE-2015-0231 (Use-after-free vulnerability in the process_nested_data function in ...)
 	- php5 5.6.5+dfsg-1
 	NOTE: https://bugs.php.net/bug.php?id=68710
 	NOTE: Upstream fix: https://github.com/php/php-src/commit/b585a3aed7880a5fa5c18e2b838fc96f40e075bd
@@ -4910,12 +5024,15 @@
 	[wheezy] - python-django <not-affected> (1.4.x not affected)
 	NOTE: https://www.djangoproject.com/weblog/2015/jan/13/security/
 CVE-2015-0221 (The django.views.static.serve view in Django before 1.4.18, 1.6.x ...)
+	{DLA-143-1}
 	- python-django 1.7.1-1.1 (bug #775375)
 	NOTE: https://www.djangoproject.com/weblog/2015/jan/13/security/
 CVE-2015-0220 (The django.util.http.is_safe_url function in Django before 1.4.18, ...)
+	{DLA-143-1}
 	- python-django 1.7.1-1.1 (bug #775375)
 	NOTE: https://www.djangoproject.com/weblog/2015/jan/13/security/
 CVE-2015-0219 (Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 ...)
+	{DLA-143-1}
 	- python-django 1.7.1-1.1 (bug #775375)
 	NOTE: https://www.djangoproject.com/weblog/2015/jan/13/security/
 CVE-2015-0218
@@ -5557,14 +5674,14 @@
 	RESERVED
 CVE-2014-8921
 	RESERVED
-CVE-2014-8920
-	RESERVED
+CVE-2014-8920 (Buffer overflow in the Data Transfer Program in IBM i Access 5770-XE1 ...)
+	TODO: check
 CVE-2014-8919
 	RESERVED
 CVE-2014-8918
 	RESERVED
-CVE-2014-8917
-	RESERVED
+CVE-2014-8917 (Multiple cross-site scripting (XSS) vulnerabilities in (1) ...)
+	TODO: check
 CVE-2014-8916
 	RESERVED
 CVE-2014-8915
@@ -5607,12 +5724,12 @@
 	NOT-FOR-US: IBM
 CVE-2014-8896 (The Collaboration Server in IBM InfoSphere Master Data Management ...)
 	NOT-FOR-US: IBM
-CVE-2014-8895
-	RESERVED
-CVE-2014-8894
-	RESERVED
-CVE-2014-8893
-	RESERVED
+CVE-2014-8895 (IBM TRIRIGA Application Platform 3.2.1.x, 3.3.2 before 3.3.2.3, and ...)
+	TODO: check
+CVE-2014-8894 (Open redirect vulnerability in IBM TRIRIGA Application Platform ...)
+	TODO: check
+CVE-2014-8893 (Multiple cross-site scripting (XSS) vulnerabilities in (1) ...)
+	TODO: check
 CVE-2014-8892
 	RESERVED
 CVE-2014-8891
@@ -7524,13 +7641,11 @@
 	NOTE: http://www.spinics.net/lists/netfilter-devel/msg33430.html
 CVE-2014-8159
 	RESERVED
-CVE-2014-8158 [stack overflow]
-	RESERVED
+CVE-2014-8158 (Multiple stack-based buffer overflows in jpc_qmfb.c in JasPer 1.900.1 ...)
 	{DSA-3138-1 DLA-138-1}
 	- jasper 1.900.1-debian1-2.4 (bug #775970)
 	NOTE: http://www.ocert.org/advisories/ocert-2015-001.html
-CVE-2014-8157 [off-by-one heap buffer overflow]
-	RESERVED
+CVE-2014-8157 (Off-by-one error in the jpc_dec_process_sot function in JasPer 1.900.1 ...)
 	{DSA-3138-1 DLA-138-1}
 	- jasper 1.900.1-debian1-2.4 (bug #775970)
 	NOTE: http://www.ocert.org/advisories/ocert-2015-001.html
@@ -7550,8 +7665,7 @@
 	[wheezy] - phonefsod <no-dsa> (Minor issue)
 CVE-2014-8155
 	RESERVED
-CVE-2014-8154 [Heap-buffer overflow in vala-gstreamer bindings at Gst.MapInfo()]
-	RESERVED
+CVE-2014-8154 (The Gst.MapInfo function in Vala 0.26.0 and 0.26.1 uses an incorrect ...)
 	- vala-0.26 <unfixed> (bug #775913)
 	- vala-0.16 <not-affected> (MapInfo not yet present)
 	- vala-0.14 <not-affected> (MapInfo not yet present)
@@ -7573,8 +7687,7 @@
 	NOTE: http://curl.haxx.se/docs/adv_20150108B.html
 CVE-2014-8149
 	RESERVED
-CVE-2014-8148 [midgard-core configures D-Bus system bus to be insecure]
-	RESERVED
+CVE-2014-8148 (The default D-Bus access control rule in Midgard2 10.05.7.1 allows ...)
 	- midgard2-core <unfixed> (bug #774630)
 CVE-2014-8147
 	RESERVED
@@ -14497,8 +14610,8 @@
 	NOT-FOR-US: Novell eDirectory
 CVE-2014-5212 (Cross-site scripting (XSS) vulnerability in nds/search/data in ...)
 	NOT-FOR-US: Novell eDirectory
-CVE-2014-5211
-	RESERVED
+CVE-2014-5211 (Stack-based buffer overflow in the Attachmate Reflection FTP Client ...)
+	TODO: check
 CVE-2014-5210 (The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows ...)
 	NOT-FOR-US: AlienVault OSSIM
 CVE-2014-5209
@@ -28624,7 +28737,7 @@
 	- netty <not-affected> (WebSocket08FrameDecoder function not present; bug #746639)
 CVE-2014-0192 (Foreman 1.4.0 before 1.5.0 does not properly restrict access to ...)
 	- foreman <itp> (bug #663101)
-CVE-2014-0191 (Unspecified vulnerability in the Oracle HTTP Server component in ...)
+CVE-2014-0191 (The xmlParserHandlePEReference function in parser.c in libxml2 before ...)
 	- libxml2 2.9.1+dfsg1-4 (bug #747309)
 	NOTE: The upstream patch we used in DSA-2978-1 and DLA-16-1 is only half of the fix. The other half is likely https://git.gnome.org/browse/libxml2/commit/?id=4629ee02ac649c27f9c0cf98ba017c6b5526070f which is only in libxml 2.9 and newer. This was found out with the test case given in https://github.com/sparklemotion/nokogiri/issues/693#issuecomment-8935085.
 	NOTE: First patches: https://git.gnome.org/browse/libxml2/commit/?id=9cd1c3cfbd32655d60572c0a413e017260c854df https://git.gnome.org/browse/libxml2/commit/?id=dd8367da17c2948981a51e52c8a6beb445edf825

More information about the Secure-testing-commits mailing list