[Secure-testing-commits] r47335 - data/CVE

Thu Dec 22 10:20:46 UTC 2016

Author: pere
Date: 2016-12-22 10:20:46 +0000 (Thu, 22 Dec 2016)
New Revision: 47335

Modified:
   data/CVE/list
Log:
Mark CVE-2015-4016 not-for-us, with notes explaining why.

Modified: data/CVE/list
===================================================================

--- data/CVE/list	2016-12-22 09:51:08 UTC (rev 47334)
+++ data/CVE/list	2016-12-22 10:20:46 UTC (rev 47335)
@@ -53627,9 +53627,10 @@
 CVE-2015-4018 (SQL injection vulnerability in feedwordpresssyndicationpage.class.php ...)
 	NOT-FOR-US: FeedWordPress plugin for WordPress
 CVE-2015-4016 (The client detection protocol in Valve Steam allows remote attackers ...)
-	- steam <unfixed>
-	NOTE: client detection protocol in Valve Steam
+	NOT-FOR-US: Related to non-free steam package.  
+	NOTE: The affected code is believed to be downloaded from Valve on startup.
 	NOTE: http://store.steampowered.com/news/16801/
+	NOTE: http://www.zerodayinitiative.com/advisories/ZDI-15-233/
 CVE-2015-4015
 	RESERVED
 CVE-2015-4014


