[Secure-testing-commits] r33065 - data/CVE

[Moritz Muehlenhoff]

Author: jmm
Date: 2015-03-23 07:52:55 +0000 (Mon, 23 Mar 2015)
New Revision: 33065

Modified:
   data/CVE/list
Log:
librest CVEfied
percona tools unimportant


Modified: data/CVE/list
===================================================================
--- data/CVE/list	2015-03-23 03:57:52 UTC (rev 33064)
+++ data/CVE/list	2015-03-23 07:52:55 UTC (rev 33065)
@@ -556,13 +556,13 @@
 	NOT-FOR-US: fusion_options function in functions.php in the Fusion theme for WordPress
 CVE-2015-2193
 	RESERVED
-CVE-2014-XXXX [Invalid pointer dereference in the GNOME librest library]
+CVE-2015-2675 [Invalid pointer dereference in the GNOME librest library]
 	- librest 0.7.92-3 (bug #780101)
 	[wheezy] - librest <not-affected> (rest_proxy_call_get_url not yet used)
 	[squeeze] - librest <not-affected> (rest_proxy_call_get_url not yet used)
 	NOTE: Upstream bug: https://bugzilla.gnome.org/show_bug.cgi?id=742644
 	NOTE: Commit: https://git.gnome.org/browse/librest/commit/?id=b50ace7738ea038
-	NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2015/03/04/6
+	NOTE: http://www.openwall.com/lists/oss-security/2015/03/04/6
 CVE-2015-2204
 	RESERVED
 	NOT-FOR-US: Evergreen library
@@ -4035,12 +4035,11 @@
 	NOT-FOR-US: D-Link router
 CVE-2015-1027 [MITM vulnerability via version check]
 	RESERVED
-	- percona-toolkit <unfixed>
+	- percona-toolkit <unfixed> (unimportant)
 	[wheezy] - percona-toolkit <not-affected> (version-check introduced in 2.1.4)
-	- percona-xtrabackup <unfixed>
-	NOTE: Effect mitigated because of disabled automatic version check due to CVE-2014-2029
+	- percona-xtrabackup <unfixed> (unimportant)
+	NOTE: Automatic version check is disabled and inherently insecure (CVE-2014-2029)
 	NOTE: Patch applied to OpenSUSE 13.1: https://build.opensuse.org/package/view_file/openSUSE:13.1:Update/xtrabackup/percona-xtrabackup-CVE-2015-1027.patch?expand=1
-	TODO: check details
 CVE-2015-1026 (Multiple cross-site scripting (XSS) vulnerabilities in ZOHO ...)
 	TODO: check
 CVE-2015-1025