[Secure-testing-commits] r37950 - data/CVE

[Salvatore Bonaccorso]

Author: carnil
Date: 2015-11-27 18:48:12 +0000 (Fri, 27 Nov 2015)
New Revision: 37950

Modified:
   data/CVE/list
Log:
Update pcre3 item, mark jessie as no-dsa

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2015-11-27 18:33:44 UTC (rev 37949)
+++ data/CVE/list	2015-11-27 18:48:12 UTC (rev 37950)
@@ -69,6 +69,12 @@
 	NOTE: http://www.openwall.com/lists/oss-security/2015/11/24/6
 CVE-2015-XXXX [heap overflow in pcre_exec]
 	- pcre3 <unfixed> (bug #806467)
+	[jessie] - pcre3 <no-dsa> (Minor issue)
+	[wheezy] - pcre3 <not-affected> (Vulnerable code not present)
+	NOTE: For wheezy: same code looks present around patched lines, though the
+	NOTE: reproducer does not lead to a crash, and just gives
+	NOTE: "Matched, but too many substrings"
+	TODO: double-check wheezy version
 	[squeeze] - pcre3 <not-affected> (Vulnerable code not present)
 	NOTE: Fixed in 8.38 upstream
 	- pcre2 <not-affected>