[Secure-testing-commits] r35601 - data/CVE

[Salvatore Bonaccorso]

Author: carnil
Date: 2015-07-21 14:57:55 +0000 (Tue, 21 Jul 2015)
New Revision: 35601

Modified:
   data/CVE/list
Log:
Update CVE-2015-5400/squid3

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2015-07-21 13:46:37 UTC (rev 35600)
+++ data/CVE/list	2015-07-21 14:57:55 UTC (rev 35601)
@@ -500,15 +500,13 @@
 	NOTE: http://trac.roundcube.net/ticket/1490417
 CVE-2015-5400 [Do not blindly forward cache peer CONNECT responses]
 	RESERVED
-	- squid <removed>
-	- squid3 <unfixed>
-	[squeeze] - squid <not-affected> (Vulnerable code not present)
+	- squid <not-affected> (Vulnerable code not present)
+	- squid3 <unfixed> (bug #793128)
 	NOTE: http://www.squid-cache.org/Versions/v3/3.5/changesets/squid-3.5-13856.patch (3.5)
 	NOTE: http://www.squid-cache.org/Versions/v3/3.4/changesets/squid-3.4-13225.patch (3.4)
 	NOTE: http://www.squid-cache.org/Advisories/SQUID-2015_2.txt
 	NOTE: http://www.openwall.com/lists/oss-security/2015/07/06/8
 	NOTE: In squeeze's squid3 the code is structured differently but the bug still appears to be present.
-	TODO: check
 CVE-2015-5380 (The Utf8DecoderBase::WriteUtf16Slow function in unicode-decoder.cc in ...)
 	- nodejs <not-affected> (Only affects 0.12.x)
 	NOTE: http://www.openwall.com/lists/oss-security/2015/07/05/1