[Secure-testing-commits] r49708 - data/CVE

security tracker role sectracker at moszumanska.debian.org
Wed Mar 15 21:10:33 UTC 2017


Author: sectracker
Date: 2017-03-15 21:10:33 +0000 (Wed, 15 Mar 2017)
New Revision: 49708

Modified:
   data/CVE/list
Log:
automatic update

Modified: data/CVE/list
===================================================================
--- data/CVE/list	2017-03-15 20:32:05 UTC (rev 49707)
+++ data/CVE/list	2017-03-15 21:10:33 UTC (rev 49708)
@@ -1,3 +1,19 @@
+CVE-2017-6918 (CSRF exists in BigTree CMS 4.2.16 with the value[#][*] parameter to the ...)
+	TODO: check
+CVE-2017-6917 (CSRF exists in BigTree CMS 4.2.16 with the value parameter to the ...)
+	TODO: check
+CVE-2017-6916 (CSRF exists in BigTree CMS 4.1.18 with the nav-social[#] parameter to ...)
+	TODO: check
+CVE-2017-6915 (CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the ...)
+	TODO: check
+CVE-2017-6914 (CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to ...)
+	TODO: check
+CVE-2017-6913
+	RESERVED
+CVE-2017-6912
+	RESERVED
+CVE-2017-6911
+	RESERVED
 CVE-2017-XXXX [new moodle issues]
 	- moodle 2.7.19+dfsg-1
 CVE-2017-6910
@@ -188,14 +204,12 @@
 	NOTE: https://github.com/mpruett/audiofile/issues/33
 	NOTE: https://blogs.gentoo.org/ago/2017/02/20/audiofile-global-buffer-overflow-in-decodesample-ima-cpp
 	NOTE: https://github.com/mpruett/audiofile/pull/43/commits/25eb00ce913452c2e614548d7df93070bf0d066f
-CVE-2017-6828
-	RESERVED
+CVE-2017-6828 (Heap-based buffer overflow in the readValue function in FileHandle.cpp ...)
 	- audiofile <unfixed> (bug #857651)
 	NOTE: https://github.com/mpruett/audiofile/issues/31
 	NOTE: https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-readvalue-filehandle-cpp
 	NOTE: https://github.com/mpruett/audiofile/commit/c48e4c6503f7dabd41f11d4c9c7b7f8960e7f2c0
-CVE-2017-6827
-	RESERVED
+CVE-2017-6827 (Heap-based buffer overflow in the MSADPCM::initializeCoefficients ...)
 	- audiofile <unfixed> (bug #857651)
 	NOTE: https://github.com/mpruett/audiofile/issues/32
 	NOTE: https://blogs.gentoo.org/ago/2017/02/20/audiofile-heap-based-buffer-overflow-in-msadpcminitializecoefficients-msadpcm-cpp
@@ -204,14 +218,12 @@
 	{DSA-3808-1}
 	- imagemagick 8:6.9.6.2+dfsg-2 (bug #857426)
 	NOTE: Fixed by: http://git.imagemagick.org/repos/ImageMagick/commit/6790815c75bdea0357df5564345847856e995d6b
-CVE-2016-10251 [use of uninitialized value in jpc_pi_nextcprl (jpc_t2cod.c)]
-	RESERVED
+CVE-2016-10251 (Integer overflow in the jpc_pi_nextcprl function in jpc_t2cod.c in ...)
 	- jasper <removed>
 	NOTE: http://www.openwall.com/lists/oss-security/2016/11/04/11
 	NOTE: https://github.com/mdadams/jasper/commit/1f0dfe5a42911b6880a1445f13f6d615ddb55387
 	NOTE: https://github.com/asarubbo/poc/blob/master/00029-jasper-uninitvalue-jpc_pi_nextcprl
-CVE-2016-10248 [NULL pointer dereference in jpc_tsfb_synthesize (jpc_tsfb.c)]
-	RESERVED
+CVE-2016-10248 (The jpc_tsfb_synthesize function in jpc_tsfb.c in JasPer before ...)
 	- jasper <removed> (unimportant)
 	NOTE: http://www.openwall.com/lists/oss-security/2016/10/20/5
 	NOTE: Not suitable for code injection, hardly denial of service
@@ -923,8 +935,7 @@
 	NOTE: http://git.savannah.gnu.org/cgit/wget.git/commit/?id=4d729e322fae359a1aefaafec1144764a54e8ad4
 CVE-2017-6506 (In Azure Data Expert Ultimate 2.2.16, the SMTP verification function ...)
 	NOT-FOR-US: Azure Data Expert Ultimate
-CVE-2017-6505 [usb: an infinite loop issue in ohci_service_ed_list]
-	RESERVED
+CVE-2017-6505 (The ohci_service_ed_list function in hw/usb/hcd-ohci.c in QEMU (aka ...)
 	- qemu <unfixed> (bug #856969)
 	[jessie] - qemu <no-dsa> (Minor issue)
 	- qemu-kvm <removed>
@@ -1113,8 +1124,8 @@
 	NOT-FOR-US: OpenELEC
 CVE-2017-6444 (The MikroTik Router hAP Lite 6.25 has no protection mechanism for ...)
 	NOT-FOR-US: MikroTik Router hAP Lite
-CVE-2017-6443
-	RESERVED
+CVE-2017-6443 (Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 ...)
+	TODO: check
 CVE-2002-2447
 	RESERVED
 CVE-2017-XXXX [dns: out of bound memory read]
@@ -1132,30 +1143,24 @@
 	RESERVED
 CVE-2017-6441
 	RESERVED
-CVE-2017-6440
-	RESERVED
+CVE-2017-6440 (The parse_data_node function in bplist.c in libimobiledevice libplist ...)
 	- libplist <unfixed>
 	NOTE: https://github.com/libimobiledevice/libplist/issues/99
-CVE-2017-6439
-	RESERVED
+CVE-2017-6439 (Heap-based buffer overflow in the parse_string_node function in ...)
 	- libplist <unfixed>
 	NOTE: https://github.com/libimobiledevice/libplist/issues/95
 	NOTE: https://github.com/libimobiledevice/libplist/commit/32ee5213fe64f1e10ec76c1ee861ee6f233120dd
-CVE-2017-6438
-	RESERVED
+CVE-2017-6438 (Heap-based buffer overflow in the parse_unicode_node function in ...)
 	- libplist <unfixed>
 	NOTE: https://github.com/libimobiledevice/libplist/issues/98
-CVE-2017-6437
-	RESERVED
+CVE-2017-6437 (The base64encode function in base64.c in libimobiledevice libplist ...)
 	- libplist <unfixed>
 	NOTE: https://github.com/libimobiledevice/libplist/issues/100
-CVE-2017-6436
-	RESERVED
+CVE-2017-6436 (The parse_string_node function in bplist.c in libimobiledevice ...)
 	- libplist <unfixed>
 	NOTE: https://github.com/libimobiledevice/libplist/issues/94
 	NOTE: https://github.com/libimobiledevice/libplist/commit/32ee5213fe64f1e10ec76c1ee861ee6f233120dd
-CVE-2017-6435
-	RESERVED
+CVE-2017-6435 (The parse_string_node function in bplist.c in libimobiledevice ...)
 	- libplist <unfixed>
 	NOTE: https://github.com/libimobiledevice/libplist/issues/93
 	NOTE: https://github.com/libimobiledevice/libplist/commit/fbd8494d5e4e46bf2e90cb6116903e404374fb56
@@ -1167,14 +1172,12 @@
 	NOT-FOR-US: Dahua DVR
 CVE-2017-6431
 	RESERVED
-CVE-2017-6430 [Out-of-bounds read in etterfilter utility]
-	RESERVED
+CVE-2017-6430 (The compile_tree function in ef_compiler.c in the Etterfilter utility ...)
 	- ettercap 1:0.8.2-4 (bug #857035)
 	[jessie] - ettercap <no-dsa> (Minor issue)
 	NOTE: https://github.com/Ettercap/ettercap/issues/782
 	NOTE: Patch: https://github.com/LocutusOfBorg/ettercap/commit/626dc56686f15f2dda13c48f78c2a666cb6d8506
-CVE-2017-6429 [Buffer overflow in Tcpcapinfo utility]
-	RESERVED
+CVE-2017-6429 (Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 ...)
 	- tcpreplay <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/appneta/tcpreplay/issues/278
 	NOTE: https://github.com/appneta/tcpreplay/commit/d689d14dbcd768c028eab2fb378d849e543dcfe9
@@ -1182,53 +1185,43 @@
 	RESERVED
 CVE-2017-6427 (A Buffer Overflow was discovered in EvoStream Media Server 1.7.1. A ...)
 	NOT-FOR-US: EvoStream Media Server
-CVE-2017-6849 [NULL pointer dereference in PoDoFo::PdfColorGray::~PdfColorGray (PdfColor.cpp)]
-	RESERVED
+CVE-2017-6849 (The PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor.cpp in ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/10
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcolorgraypdfcolorgray-pdfcolor-cpp
-CVE-2017-6848 [NULL pointer dereference in PoDoFo::PdfXObject::PdfXObject (PdfXObject.cpp)]
-	RESERVED
+CVE-2017-6848 (The PoDoFo::PdfXObject::PdfXObject function in PdfXObject.cpp in ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/9
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfxobjectpdfxobject-pdfxobject-cpp
-CVE-2017-6847 [NULL pointer dereference in PoDoFo::PdfVariant::DelayedLoad (PdfVariant.h)]
-	RESERVED
+CVE-2017-6847 (The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/8
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfvariantdelayedload-pdfvariant-h
-CVE-2017-6846 [NULL pointer dereference in GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace (graphicsstack.h)]
-	RESERVED
+CVE-2017-6846 (The GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/7
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcoloroperator-pdfcolor-cpp
-CVE-2017-6845 [NULL pointer dereference in PoDoFo::PdfColor::operator= (PdfColor.cpp)]
-	RESERVED
+CVE-2017-6845 (The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/6
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcoloroperator-pdfcolor-cpp
-CVE-2017-6844 [global buffer overflow in PoDoFo::PdfParser::ReadXRefSubsection (PdfParser.cpp)]
-	RESERVED
+CVE-2017-6844 (Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/5
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-global-buffer-overflow-in-podofopdfparserreadxrefsubsection-pdfparser-cpp
-CVE-2017-6843 [heap-based buffer overflow in PoDoFo::PdfVariant::DelayedLoad (PdfVariant.h)]
-	RESERVED
+CVE-2017-6843 (Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/4
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-heap-based-buffer-overflow-in-podofopdfvariantdelayedload-pdfvariant-h
-CVE-2017-6842 [NULL pointer dereference in ColorChanger::GetColorFromStack (colorchanger.cpp)]
-	RESERVED
+CVE-2017-6842 (The ColorChanger::GetColorFromStack function in colorchanger.cpp in ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/3
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-colorchangergetcolorfromstack-colorchanger-cpp
-CVE-2017-6841 [NULL pointer dereference in GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement (graphicsstack.h)]
-	RESERVED
+CVE-2017-6841 (The GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/2
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-graphicsstacktgraphicsstackelementtgraphicsstackelement-graphicsstack-h
-CVE-2017-6840 [invalid memory read in ColorChanger::GetColorFromStack (colorchanger.cpp)]
-	RESERVED
+CVE-2017-6840 (The ColorChanger::GetColorFromStack function in colorchanger.cpp in ...)
 	- libpodofo <unfixed> (bug #856592)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/1
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-invalid-memory-read-in-colorchangergetcolorfromstack-colorchanger-cpp
@@ -1336,8 +1329,7 @@
 	- radare2 1.1.0+dfsg-3 (bug #856572)
 	NOTE: https://github.com/radare/radare2/issues/6872
 	NOTE: https://github.com/radare/radare2/commit/252afb1cff9676f3ae1f341a28448bf2c8b6e308
-CVE-2017-6414 [libcacard: host memory leakage while creating new APDU]
-	RESERVED
+CVE-2017-6414 (Memory leak in the vcard_apdu_new function in card_7816.c in libcacard ...)
 	- libcacard 1:2.5.0-3 (bug #856501)
 	NOTE: Fixed by: https://cgit.freedesktop.org/spice/libcacard/commit/?id=9113dc6a303604a2d9812ac70c17d076ef11886c
 CVE-2017-6413 (The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka ...)
@@ -1402,8 +1394,7 @@
 	- radare2 1.1.0+dfsg-3 (bug #856574)
 	NOTE: https://github.com/radare/radare2/commit/ead645853a63bf83d8386702cad0cf23b31d7eeb
 	NOTE: https://github.com/radare/radare2/issues/6857
-CVE-2017-6386 [memory leakage while in vrend_create_vertex_elements_state]
-	RESERVED
+CVE-2017-6386 (Memory leak in the vrend_create_vertex_elements_state function in ...)
 	- virglrenderer <unfixed>
 	NOTE: Fixed by: https://cgit.freedesktop.org/virglrenderer/commit/?id=737c3350850ca4dbc5633b3bdb4118176ce59920
 CVE-2017-6385
@@ -1442,8 +1433,8 @@
 	RESERVED
 CVE-2017-6367 (In Cerberus FTP Server 8.0.10.1, a crafted HTTP request causes the ...)
 	TODO: check
-CVE-2017-6366
-	RESERVED
+CVE-2017-6366 (Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 ...)
+	TODO: check
 CVE-2017-6365
 	RESERVED
 CVE-2017-6364
@@ -1604,8 +1595,7 @@
 CVE-2017-6335 (The QuantumTransferMode function in coders/tiff.c in GraphicsMagick ...)
 	- graphicsmagick 1.3.25-8
 	NOTE: Fixed by: https://sourceforge.net/p/graphicsmagick/code/ci/6156b4c2992d855ece6079653b3b93c3229fc4b8/
-CVE-2017-6317 [memory leakage issue in add_shader_program]
-	RESERVED
+CVE-2017-6317 (Memory leak in the add_shader_program function in vrend_renderer.c in ...)
 	- virglrenderer <unfixed>
 	NOTE: https://cgit.freedesktop.org/virglrenderer/commit/?id=a2f12a1b0f95b13b6f8dc3d05d7b74b4386394e4 (0.6.0)
 CVE-2017-6314 (The make_available_at_least function in io-tiff.c in gdk-pixbuf allows ...)
@@ -1870,12 +1860,10 @@
 	{DSA-3804-1 DLA-849-1}
 	- linux 4.9.13-1
 	NOTE: Fixed by: https://git.kernel.org/linus/ccf7abb93af09ad0868ae9033d1ca8108bdaec82 (v4.10-rc8)
-CVE-2017-6210 [null pointer dereference in vrend_decode_reset]
-	RESERVED
+CVE-2017-6210 (The vrend_decode_reset function in vrend_decode.c in virglrenderer ...)
 	- virglrenderer <unfixed>
 	NOTE: Fixed by: https://cgit.freedesktop.org/virglrenderer/commit/?id=0a5dff15912207b83018485f83e067474e818bab (0.6.0)
-CVE-2017-6209 [stack buffer oveflow in parse_identifier]
-	RESERVED
+CVE-2017-6209 (Stack-based buffer overflow in the parse_identifier function in ...)
 	- virglrenderer <unfixed>
 	NOTE: Fixed by: https://cgit.freedesktop.org/virglrenderer/commit/?id=e534b51ca3c3cd25f3990589932a9ed711c59b27 (0.6.0)
 CVE-2017-6208
@@ -1927,8 +1915,8 @@
 	RESERVED
 CVE-2017-6190
 	RESERVED
-CVE-2017-6189
-	RESERVED
+CVE-2017-6189 (Untrusted search path vulnerability in Amazon Kindle for PC before ...)
+	TODO: check
 CVE-2017-6187 (Buffer overflow in the built-in web server in DiskSavvy Enterprise ...)
 	NOT-FOR-US: DiskSavvy Enterprise
 CVE-2017-6186
@@ -2202,8 +2190,7 @@
 	RESERVED
 CVE-2017-6061
 	RESERVED
-CVE-2017-6060 [stack-based buffer overflow in main (jstest_main.c)]
-	RESERVED
+CVE-2017-6060 (Stack-based buffer overflow in jstest_main.c in mujstest in Artifex ...)
 	- mupdf <unfixed> (unimportant)
 	NOTE: Although jstest_main.c compiled during build and mujstest is created
 	NOTE: it is not included in the produced binary packages
@@ -2373,13 +2360,11 @@
 	[jessie] - xen <no-dsa> (Minor issue)
 	[wheezy] - xen <no-dsa> (Minor issue)
 	NOTE: https://xenbits.xen.org/xsa/advisory-207.html
-CVE-2017-5994 [out-of-bounds access in vrend_create_vertex_elements_state]
-	RESERVED
+CVE-2017-5994 (Heap-based buffer overflow in the vrend_create_vertex_elements_state ...)
 	- virglrenderer <unfixed>
 	NOTE: https://cgit.freedesktop.org/virglrenderer/commit/?id=114688c526fe45f341d75ccd1d85473c3b08f7a7 (0.6.0)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1422452
-CVE-2017-5993 [host memory leakage when initialising blitter context]
-	RESERVED
+CVE-2017-5993 (Memory leak in the vrend_renderer_init_blit_ctx function in ...)
 	- virglrenderer <unfixed>
 	NOTE: https://cgit.freedesktop.org/virglrenderer/commit/?id=6eb13f7a2dcf391ec9e19b4c2a79e68305f63c22 (0.6.0)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1422438
@@ -2582,8 +2567,7 @@
 CVE-2017-5936
 	RESERVED
 	NOT-FOR-US: Nova-LXD
-CVE-2017-5937
-	RESERVED
+CVE-2017-5937 (The util_format_is_pure_uint function in vrend_renderer.c in Virgil 3d ...)
 	- virglrenderer <unfixed> (bug #854728)
 	NOTE: https://cgit.freedesktop.org/virglrenderer/commit/?id=48f67f60967f963b698ec8df57ec6912a43d6282 (0.6.0)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1420246
@@ -2707,8 +2691,7 @@
 	RESERVED
 CVE-2017-5891
 	RESERVED
-CVE-2017-5898 [Qemu: usb: integer overflow in emulated_apdu_from_guest]
-	RESERVED
+CVE-2017-5898 (Integer overflow in the emulated_apdu_from_guest function in ...)
 	{DLA-845-1 DLA-842-1}
 	- qemu 1:2.8+dfsg-3 (bug #854729)
 	[jessie] - qemu <not-affected> (Vulnerable code not present)
@@ -2761,8 +2744,7 @@
 CVE-2016-10200 (Race condition in the L2TPv3 IP Encapsulation feature in the Linux ...)
 	- linux 4.8.15-1
 	NOTE: Fixed by: https://git.kernel.org/linus/32c231164b762dddefa13af5a0101032c70b50ef (v4.9-rc7)
-CVE-2017-5938 [viewc Cross-Site Scripting (XSS) vulnerability]
-	RESERVED
+CVE-2017-5938 (Cross-site scripting (XSS) vulnerability in the nav_path function in ...)
 	{DSA-3784-1 DLA-820-1}
 	- viewvc 1.1.26-1 (bug #854681)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/02/08/7
@@ -3180,20 +3162,17 @@
 	NOT-FOR-US: Intel PSET
 CVE-2017-5680
 	RESERVED
-CVE-2016-10197
-	RESERVED
+CVE-2016-10197 (The search_make_new function in evdns.c in libevent before 2.1.6-beta ...)
 	{DSA-3789-1 DLA-824-1}
 	- libevent 2.0.21-stable-3 (bug #854092)
 	NOTE: https://github.com/libevent/libevent/issues/332
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/31/17
-CVE-2016-10196
-	RESERVED
+CVE-2016-10196 (Stack-based buffer overflow in the evutil_parse_sockaddr_port function ...)
 	{DSA-3789-1 DLA-824-1}
 	- libevent 2.0.21-stable-3 (bug #854092)
 	NOTE: https://github.com/libevent/libevent/issues/318
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/31/17
-CVE-2016-10195
-	RESERVED
+CVE-2016-10195 (The name_parse function in evdns.c in libevent before 2.1.6-beta ...)
 	{DSA-3789-1 DLA-824-1}
 	- libevent 2.0.21-stable-3 (bug #854092)
 	NOTE: https://github.com/libevent/libevent/issues/317
@@ -3377,8 +3356,7 @@
 	[wheezy] - libpodofo <no-dsa> (Minor issue)
 	NOTE: https://blogs.gentoo.org/ago/2017/02/01/podofo-infinite-loop-in-podofopdfpagegetinheritedkeyfromobject-pdfpage-cpp
 	NOTE: https://sourceforge.net/p/podofo/mailman/podofo-users/thread/12497325.VLNgGImML2%40blackgate/#msg35640936
-CVE-2017-5849 [Out-of-Bound read and write issues in put1bitbwtile() and putgreytile()]
-	RESERVED
+CVE-2017-5849 (tiffttopnm in netpbm 10.47.63 does not properly use the libtiff ...)
 	- netpbm-free <not-affected> (vulnerable code not present)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/02/02/2
 	NOTE: Debian uses an unaffected fork:
@@ -3696,15 +3674,13 @@
 	[wheezy] - wavpack <not-affected> (Vulnerable code not present)
 	NOTE: https://sourceforge.net/p/wavpack/mailman/message/35557889/
 	NOTE: Fixed by: https://github.com/dbry/WavPack/commit/4bc05fc490b66ef2d45b1de26abf1455b486b0dc (5.1.0)
-CVE-2016-10166 [Fix potential unsigned underflow]
-	RESERVED
+CVE-2016-10166 (Integer underflow in the _gdContributionsAlloc function in ...)
 	{DSA-3777-1}
 	- libgd2 2.2.4-1
 	[wheezy] - libgd2 <not-affected> (Vulnerable code not present)
 	NOTE: https://github.com/libgd/libgd/commit/60bfb401ad5a4a8ae995dcd36372fe15c71e1a35
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/26/1
-CVE-2016-10167 [Fix DOS vulnerability in gdImageCreateFromGd2Ctx()]
-	RESERVED
+CVE-2016-10167 (The gdImageCreateFromGd2Ctx function in gd_gd2.c in the GD Graphics ...)
 	{DSA-3777-1 DLA-804-1}
 	- php7.1 7.1.1-1 (unimportant)
 	- php7.0 7.0.15-1 (unimportant)
@@ -3715,8 +3691,7 @@
 	- libgd2 2.2.4-1
 	NOTE: https://github.com/libgd/libgd/commit/fe9ed49dafa993e3af96b6a5a589efeea9bfb36f
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/26/1
-CVE-2016-10168 [Fix #354: Signed Integer Overflow gd_io.c]
-	RESERVED
+CVE-2016-10168 (Integer overflow in gd_io.c in the GD Graphics Library (aka libgd) ...)
 	{DSA-3777-1 DLA-804-1}
 	- php7.1 7.1.1-1 (unimportant)
 	- php7.0 7.0.15-1 (unimportant)
@@ -3735,24 +3710,22 @@
 	NOT-FOR-US: OpenText Documentum D2
 CVE-2017-5585 (OpenText Documentum Content Server (formerly EMC Documentum Content ...)
 	NOT-FOR-US: OpenText Documentum Content Server
-CVE-2017-5584
-	RESERVED
-CVE-2017-5583
-	RESERVED
+CVE-2017-5584 (Cross-site scripting (XSS) vulnerability in the Management Web ...)
+	TODO: check
+CVE-2017-5583 (The Management Web Interface in Palo Alto Networks PAN-OS before ...)
+	TODO: check
 CVE-2017-5582
 	RESERVED
-CVE-2017-6852 [jasper: heap-based buffer overflow in jpc_dec_decodepkt (jpc_t2dec.c)]
-	RESERVED
+CVE-2017-6852 (Heap-based buffer overflow in the jpc_dec_decodepkt function in ...)
 	- jasper <unfixed>
 	NOTE: Upstream bug: https://github.com/mdadams/jasper/issues/114
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/25/10
-CVE-2017-6850 [jasper: NULL pointer dereference in jp2_cdef_destroy (jp2_cod.c)]
-	RESERVED
+CVE-2017-6850 (The jp2_cdef_destroy function in jp2_cod.c in JasPer before 2.0.13 ...)
 	- jasper <unfixed> (unimportant)
 	NOTE: Upstream bug: https://github.com/mdadams/jasper/issues/112
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/25/8
 	NOTE: Not suitable for code injection, hardly denial of service
-CVE-2017-6851 [jasper: invalid memory read in jas_matrix_bindsub (jas_seq.c)]
+CVE-2017-6851 (The jas_matrix_bindsub function in jas_seq.c in JasPer 2.0.10 allows ...)
 	- jasper <unfixed> (unimportant)
 	NOTE: Upstream bug: https://github.com/mdadams/jasper/issues/113
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/25/9
@@ -3793,8 +3766,7 @@
 	- libxpm 1:3.5.12-1
 	NOTE: Fixed by: https://cgit.freedesktop.org/xorg/lib/libXpm/commit/?id=d1167418f0fd02a27f617ec5afd6db053afbe185
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/22/2
-CVE-2016-10163 [host memory leakage when creating decode context]
-	RESERVED
+CVE-2016-10163 (Memory leak in the vrend_renderer_context_create_internal function in ...)
 	- virglrenderer <unfixed> (bug #852603)
 	NOTE: https://cgit.freedesktop.org/virglrenderer/commit/?id=747a293ff6055203e529f083896b823e22523fe7 (0.6.0)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1415944
@@ -3802,14 +3774,12 @@
 	- tigervnc 1.7.0+dfsg-3 (bug #852213)
 	NOTE: https://github.com/TigerVNC/tigervnc/pull/399
 	NOTE: https://github.com/TigerVNC/tigervnc/commit/18c020124ff1b2441f714da2017f63dba50720ba
-CVE-2017-5580 [OOB access while parsing texture instruction]
-	RESERVED
+CVE-2017-5580 (The parse_instruction function in gallium/auxiliary/tgsi/tgsi_text.c ...)
 	- virglrenderer <unfixed> (bug #852604)
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1415986
 	NOTE: https://cgit.freedesktop.org/virglrenderer/commit/?id=28894a30a17a84529be102b21118e55d6c9f23fa (0.6.0)
 	NOTE: https://lists.freedesktop.org/archives/virglrenderer-devel/2017-January/000105.html
-CVE-2017-5579 [serial: host memory leakage in 16550A UART emulation]
-	RESERVED
+CVE-2017-5579 (Memory leak in the serial_exit_core function in hw/char/serial.c in ...)
 	- qemu 1:2.8+dfsg-3 (bug #853002)
 	[jessie] - qemu <no-dsa> (Minor issue)
 	[wheezy] - qemu <no-dsa> (Minor issue)
@@ -3817,8 +3787,7 @@
 	[wheezy] - qemu-kvm <no-dsa> (Minor issue)
 	NOTE: http://git.qemu.org/?p=qemu.git;a=commit;h=8409dc884a201bf74b30a9d232b6bbdd00cb7e2b
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1416157
-CVE-2017-5578 [display: virtio-gpu: host memory leakage in virtio_gpu_resource_attach_backing]
-	RESERVED
+CVE-2017-5578 (Memory leak in the virtio_gpu_resource_attach_backing function in ...)
 	- qemu <unfixed> (unimportant)
 	[jessie] - qemu <not-affected> (Vulnerable code introduced later)
 	[wheezy] - qemu <not-affected> (Vulnerable code introduced later)
@@ -3984,8 +3953,7 @@
 	- cgiemail <removed> (bug #852031)
 	[jessie] - cgiemail <no-dsa> (Will be removed in next point update)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/20/6
-CVE-2016-10155 [watchdog: memory leakage in virtual hardware watchdog wdt_i6300esb; CVE for the memory consumption issue, not an information disclosure issue]
-	RESERVED
+CVE-2016-10155 (Memory leak in hw/watchdog/wdt_i6300esb.c in QEMU (aka Quick Emulator) ...)
 	- qemu 1:2.8+dfsg-2 (low; bug #852232)
 	[jessie] - qemu <no-dsa> (Minor issue)
 	[wheezy] - qemu <no-dsa> (Minor issue)
@@ -4030,8 +3998,7 @@
 	[wheezy] - wordpress <not-affected> (wp_ajax_update_plugin function introduced in 4.2)
 	NOTE: https://core.trac.wordpress.org/ticket/37490
 	NOTE: https://core.trac.wordpress.org/changeset/38168
-CVE-2017-5552 [display: virtio-gpu-3d: memory leakage in virgl_resource_attach_backing; CVE for the memory consumption issue, not an information disclosure issue]
-	RESERVED
+CVE-2017-5552 (Memory leak in the virgl_resource_attach_backing function in ...)
 	- qemu <unfixed> (bug #852119; unimportant)
 	[jessie] - qemu <not-affected> (Vulnerable code not present)
 	[wheezy] - qemu <not-affected> (Vulnerable code not present)
@@ -4079,12 +4046,10 @@
 CVE-2017-5524
 	RESERVED
 	NOT-FOR-US: Plone
-CVE-2017-5537 [weblate information leak]
-	RESERVED
+CVE-2017-5537 (The password reset form in Weblate before 2.10.1 provides different ...)
 	- weblate <itp> (bug #745661)
 	NOTE: http://www.openwall.com/lists/oss-security/2017/01/18/11
-CVE-2017-5526 [audio: memory leakage in es1370 device; CVE for the memory consumption issue]
-	RESERVED
+CVE-2017-5526 (Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows ...)
 	- qemu 1:2.8+dfsg-2 (bug #851910)
 	[jessie] - qemu <no-dsa> (Minor issue)
 	[wheezy] - qemu <no-dsa> (Minor issue)
@@ -4094,8 +4059,7 @@
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1414209
 	NOTE: http://git.qemu.org/?p=qemu.git;a=commit;h=069eb7b2b8fc47c7cb52e5a4af23ea98d939e3da
 	NOTE: Sound device hotplug not supported by libvirt
-CVE-2017-5525 [audio: memory leakage in ac97 device; CVE for the memory consumption issue]
-	RESERVED
+CVE-2017-5525 (Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows ...)
 	- qemu 1:2.8+dfsg-2 (bug #852021)
 	[jessie] - qemu <no-dsa> (Minor issue)
 	[wheezy] - qemu <no-dsa> (Minor issue)
@@ -4106,8 +4070,7 @@
 	NOTE: Sound device hotplug not supported by libvirt
 CVE-2017-5523
 	RESERVED
-CVE-2017-5522 [stack buffer overflow]
-	RESERVED
+CVE-2017-5522 (Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before ...)
 	{DSA-3766-1 DLA-790-1}
 	- mapserver 7.0.4-1
 	NOTE: https://lists.osgeo.org/pipermail/mapserver-dev/2017-January/015007.html
@@ -4140,8 +4103,8 @@
 	RESERVED
 CVE-2017-5497
 	RESERVED
-CVE-2017-5496
-	RESERVED
+CVE-2017-5496 (Sawmill Enterprise 8.7.9 allows remote attackers to gain login access ...)
+	TODO: check
 CVE-2017-5495 (All versions of Quagga, 0.93 through 1.1.0, are vulnerable to an ...)
 	- quagga 1.1.1-1 (bug #852454)
 	[jessie] - quagga <no-dsa> (Minor issue)
@@ -4621,10 +4584,10 @@
 	RESERVED
 CVE-2017-5360
 	RESERVED
-CVE-2017-5359
-	RESERVED
-CVE-2017-5358
-	RESERVED
+CVE-2017-5359 (EasyCom SQL iPlug allows remote attackers to cause a denial of service ...)
+	TODO: check
+CVE-2017-5358 (Stack-based buffer overflows in php_Easycom5_3_0.dll in EasyCom for ...)
+	TODO: check
 CVE-2016-10147 (crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users ...)
 	- linux 4.8.15-1
 	[jessie] - linux <not-affected> (Vulnerable code not present)
@@ -5601,78 +5564,96 @@
 	RESERVED
 CVE-2017-5046
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5045
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5044
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5043
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5042
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5041
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5040
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 	- libv8 <unfixed> (unimportant)
 	NOTE: libv8 not covered by security support
 CVE-2017-5039
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5038
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5037
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5036
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5035
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5034
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5033
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5032
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5031
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 CVE-2017-5030
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 	- libv8 <unfixed> (unimportant)
 	NOTE: libv8 not covered by security support
 CVE-2017-5029
 	RESERVED
+	{DSA-3810-1}
 	- chromium-browser 57.0.2987.98-1
 	[wheezy] - chromium-browser <end-of-life> (Not supported in Wheezy)
 	- libxslt <unfixed>
@@ -8275,8 +8256,8 @@
 	RESERVED
 CVE-2017-3855
 	RESERVED
-CVE-2017-3854
-	RESERVED
+CVE-2017-3854 (A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) ...)
+	TODO: check
 CVE-2017-3853
 	RESERVED
 CVE-2017-3852
@@ -8291,8 +8272,8 @@
 	RESERVED
 CVE-2017-3847 (A vulnerability in the web framework of Cisco Firepower Management ...)
 	NOT-FOR-US: Cisco
-CVE-2017-3846
-	RESERVED
+CVE-2017-3846 (A vulnerability in the Client Manager Server of Cisco Workload ...)
+	TODO: check
 CVE-2017-3845 (A vulnerability in the web-based management interface of Cisco Prime ...)
 	NOT-FOR-US: Cisco
 CVE-2017-3844 (A vulnerability in exporting functions of the user interface for Cisco ...)
@@ -8321,8 +8302,8 @@
 	NOT-FOR-US: Cisco
 CVE-2017-3832
 	RESERVED
-CVE-2017-3831
-	RESERVED
+CVE-2017-3831 (A vulnerability in the web-based GUI of Cisco Mobility Express 1800 ...)
+	TODO: check
 CVE-2017-3830 (A vulnerability in an internal API of the Cisco Meeting Server (CMS) ...)
 	NOT-FOR-US: Cisco
 CVE-2017-3829 (A vulnerability in the web-based management interface of Cisco Unified ...)
@@ -8345,8 +8326,8 @@
 	NOT-FOR-US: Cisco
 CVE-2017-3820 (A vulnerability in Simple Network Management Protocol (SNMP) functions ...)
 	NOT-FOR-US: Cisco IOS XE
-CVE-2017-3819
-	RESERVED
+CVE-2017-3819 (A privilege escalation vulnerability in the Secure Shell (SSH) ...)
+	TODO: check
 CVE-2017-3818 (A vulnerability in the Multipurpose Internet Mail Extensions (MIME) ...)
 	NOT-FOR-US: Cisco Email Security Appliances
 CVE-2017-3817
@@ -20142,16 +20123,14 @@
 	NOTE: This is strongly related to the problem described in CVE-2016-7543 and the correction
 	NOTE: is very similar.
 	NOTE: https://lists.gnu.org/archive/html/bug-bash/2015-12/msg00112.html
-CVE-2016-10249 [heap-based buffer overflow in jpc_dec_tiledecode (jpc_dec.c)]
-	RESERVED
+CVE-2016-10249 (Integer overflow in the jpc_dec_tiledecode function in jpc_dec.c in ...)
 	{DLA-739-1}
 	- jasper <removed>
 	NOTE: Fixed by: https://github.com/mdadams/jasper/commit/988f8365f7d8ad8073b6786e433d34c553ecf568 (version-1.900.12)
 	NOTE: https://blogs.gentoo.org/ago/2016/10/23/jasper-heap-based-buffer-overflow-in-jpc_dec_tiledecode-jpc_dec-c/
 	NOTE: Reproducer: https://github.com/asarubbo/poc/blob/master/00001-jasper-heapoverflow-jpc_dec_tiledecode
 	NOTE: http://www.openwall.com/lists/oss-security/2016/10/23/7
-CVE-2016-10250 [NULL pointer dereference in jp2_colr_destroy (jp2_cod.c) (incomplete fix for CVE-2016-8887)]
-	RESERVED
+CVE-2016-10250 (The jp2_colr_destroy function in jp2_cod.c in JasPer before 1.900.13 ...)
 	- jasper <not-affected> (Incomplete fix for CVE-206-8887 not applied)
 	NOTE: Reproducer: https://github.com/asarubbo/poc/blob/master/00002-jasper-NULLptr-jp2_colr_destroy
 	NOTE: https://blogs.gentoo.org/ago/2016/10/23/jasper-null-pointer-dereference-in-jp2_colr_destroy-jp2_cod-c-incomplete-fix-for-cve-2016-8887
@@ -22883,7 +22862,7 @@
 CVE-2016-8003
 	RESERVED
 CVE-2016-8002
-	RESERVED
+	REJECTED
 CVE-2016-8001
 	RESERVED
 CVE-2016-7999 (ecrire/exec/valider_xml.php in SPIP 3.1.2 and earlier allows remote ...)
@@ -23071,8 +23050,8 @@
 	RESERVED
 CVE-2016-7956
 	RESERVED
-CVE-2016-7955
-	RESERVED
+CVE-2016-7955 (The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, ...)
+	TODO: check
 CVE-2016-7954 (Bundler 1.x might allow remote attackers to inject arbitrary Ruby code ...)
 	- bundler <unfixed> (bug #842504)
 	[jessie] - bundler <no-dsa> (Minor issue, too intrusive to backport)
@@ -25444,8 +25423,7 @@
 	- mantis <not-affected> (Vulnerable code introduced in 1.3.0-rc.2)
 	NOTE: https://github.com/mantisbt/mantisbt/commit/b3511d2feb47eaee41feb5f69cf3c8a2c9acd229
 	NOTE: https://mantisbt.org/bugs/view.php?id=21263
-CVE-2016-7103
-	RESERVED
+CVE-2016-7103 (Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 ...)
 	- jqueryui 1.12.1+dfsg-1
 	[jessie] - jqueryui <no-dsa> (Minor issue)
 	[wheezy] - jqueryui <no-dsa> (Minor issue)
@@ -25967,8 +25945,7 @@
 	NOT-FOR-US: Opera
 CVE-2016-6907
 	RESERVED
-CVE-2016-6906 [OOB reads of the TGA decompression buffer]
-	RESERVED
+CVE-2016-6906 (The read_image_tga function in gd_tga.c in the GD Graphics Library ...)
 	{DSA-3777-1}
 	- libgd2 2.2.4-1
 	[wheezy] - libgd2 <not-affected> (Vulnerable code introduced later)
@@ -32210,8 +32187,7 @@
 	NOTE: https://0xacab.org/mat/mat/issues/11067
 	NOTE: Patch in 0.6.1-3 disabled PDF support
 	NOTE: CVE Request: http://www.openwall.com/lists/oss-security/2016/06/02/5
-CVE-2016-5239 [ImageMagick, GraphicsMagick: Gnuplot delegate vulnerability allowing command injection]
-	RESERVED
+CVE-2016-5239 (The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and ...)
 	{DSA-3580-1 DLA-486-1 DLA-484-1}
 	- graphicsmagick 1.3.24-1
 	- imagemagick 8:6.9.6.2+dfsg-2
@@ -32670,22 +32646,19 @@
 	NOTE: Fixed by: http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=41a8d9e99be9f2cc8b02051dd322cb45e0faac87 (v2.76rc1)
 	NOTE: Introduced by: http://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=cbc652423403e3cef00e00240f6beef713142246 (v2.73rc1)
 	NOTE: https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/1581181
-CVE-2015-8898 [Prevent null pointer access in magick/constitute.c]
-	RESERVED
+CVE-2015-8898 (The WriteImages function in magick/constitute.c in ImageMagick before ...)
 	- imagemagick 8:6.8.9.9-7
 	[jessie] - imagemagick 8:6.8.9.9-5+deb8u1
 	[wheezy] - imagemagick 8:6.7.7.10-5+deb7u4
 	NOTE: https://github.com/ImageMagick/ImageMagick/pull/34
 	NOTE: https://github.com/ImageMagick/ImageMagick/commit/5b4bebaa91849c592a8448bc353ab25a54ff8c44
-CVE-2015-8897 [Out of bounds error in SpliceImage]
-	RESERVED
+CVE-2015-8897 (The SpliceImage function in MagickCore/transform.c in ImageMagick ...)
 	- imagemagick 8:6.8.9.9-7
 	[jessie] - imagemagick 8:6.8.9.9-5+deb8u1
 	[wheezy] - imagemagick 8:6.7.7.10-5+deb7u4
 	NOTE: http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=28466
 	NOTE: https://github.com/ImageMagick/ImageMagick/commit/7b1cf5784b5bcd85aa9293ecf56769f68c037231
-CVE-2015-8896 [integer truncation issue]
-	RESERVED
+CVE-2015-8896 (Integer truncation issue in coders/pict.c in ImageMagick before ...)
 	{DLA-353-1}
 	- imagemagick 8:6.8.9.9-7 (bug #806441)
 	[jessie] - imagemagick 8:6.8.9.9-5+deb8u1
@@ -32694,8 +32667,7 @@
 	NOTE: https://github.com/ImageMagick/ImageMagick/commit/0f6fc2d5bf8f500820c3dbcf0d23ee14f2d9f734
 	NOTE: http://www.openwall.com/lists/oss-security/2015/10/07/2
 	NOTE: http://www.openwall.com/lists/oss-security/2016/02/22/4
-CVE-2015-8895 [pict/icon processing issues: Integer and Buffer overflow in coders/icon.c]
-	RESERVED
+CVE-2015-8895 (Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later ...)
 	{DLA-353-1}
 	- imagemagick 8:6.8.9.9-7 (bug #806441)
 	[jessie] - imagemagick 8:6.8.9.9-5+deb8u1
@@ -32705,8 +32677,7 @@
 	NOTE: http://www.openwall.com/lists/oss-security/2015/10/07/2
 	NOTE: http://www.openwall.com/lists/oss-security/2016/02/22/4
 	NOTE: The issue is only exploitable on 32 bit architectures.
-CVE-2015-8894 [tga processing issue: double free in coders/tga.c:221]
-	RESERVED
+CVE-2015-8894 (Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and ...)
 	- imagemagick 8:6.8.9.9-6 (bug #806442; bug #799524)
 	[jessie] - imagemagick <not-affected> (Can't reproduce crash with file)
 	[wheezy] - imagemagick <not-affected> (Can't reproduce crash with file)
@@ -50899,8 +50870,7 @@
 	NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=1257962
 	NOTE: http://www.openwall.com/lists/oss-security/2015/10/27/10
 	NOTE: https://git.gnome.org/browse/libxslt/commit/?id=7ca19df892ca22d9314e95d59ce2abdeff46b617 (v1.1.29-rc1)
-CVE-2015-8982 [multiple overflows in strxfrm()]
-	RESERVED
+CVE-2015-8982 (Integer overflow in the strxfrm function in the GNU C Library (aka ...)
 	- glibc 2.21-1 (bug #803927)
 	[jessie] - glibc 2.19-18+deb8u2
 	[wheezy] - eglibc 2.13-38+deb7u9
@@ -111514,7 +111484,7 @@
 CVE-2013-2816 (The DNP3 component in Cooper Power Systems SMP 4, 4/DP, and 16 ...)
 	NOT-FOR-US: Cooper Power Systems
 CVE-2013-2815
-	RESERVED
+	REJECTED
 CVE-2013-2814 (Cooper Power Systems Cybectec DNP3 Master OPC Server allows remote ...)
 	NOT-FOR-US: Cooper Power Systems
 CVE-2013-2813 (The DNP3 component in Cooper Power Systems SMP 4, 4/DP, and 16 ...)
@@ -115357,7 +115327,7 @@
 	[wheezy] - python-virtualenv <no-dsa> (Minor issue)
 	[squeeze] - python-virtualenv <no-dsa> (Minor issue)
 CVE-2013-1628
-	RESERVED
+	REJECTED
 CVE-2013-1627 (Absolute path traversal vulnerability in NTWebServer.exe in Indusoft ...)
 	NOT-FOR-US: Indusoft Studio, Advantech Studio
 CVE-2013-1626
@@ -118135,13 +118105,13 @@
 CVE-2013-0699 (The Galil RIO-47100 Pocket PLC allows remote attackers to cause a ...)
 	NOT-FOR-US: Galil RIO-47100
 CVE-2013-0698
-	RESERVED
+	REJECTED
 CVE-2013-0697
-	RESERVED
+	REJECTED
 CVE-2013-0696
-	RESERVED
+	REJECTED
 CVE-2013-0695
-	RESERVED
+	REJECTED
 CVE-2013-0694 (The Emerson Process Management ROC800 RTU with software 3.50 and ...)
 	NOT-FOR-US: Emerson Process Management
 CVE-2013-0693 (The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU ...)
@@ -118149,9 +118119,9 @@
 CVE-2013-0692 (The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU ...)
 	NOT-FOR-US: Emerson Process Management
 CVE-2013-0691
-	RESERVED
+	REJECTED
 CVE-2013-0690
-	RESERVED
+	REJECTED
 CVE-2013-0689 (The TFTP server on the Emerson Process Management ROC800 RTU with ...)
 	NOT-FOR-US: Emerson Process Management
 CVE-2013-0688 (Cross-site scripting (XSS) vulnerability in Invensys Wonderware ...)
@@ -123823,9 +123793,9 @@
 CVE-2011-5162 (Stack-based buffer overflow in GOM Player 2.1.33.5071 allows ...)
 	NOT-FOR-US: GOM Player
 CVE-2012-4911
-	RESERVED
+	REJECTED
 CVE-2012-4910
-	RESERVED
+	REJECTED
 CVE-2012-4909 (Google Chrome before 18.0.1025308 on Android allows remote attackers ...)
 	- chromium-browser <not-affected> (Chrome on Android)
 CVE-2012-4908 (Google Chrome before 18.0.1025308 on Android allows remote attackers ...)
@@ -124427,25 +124397,25 @@
 CVE-2012-4727
 	RESERVED
 CVE-2012-4726
-	RESERVED
+	REJECTED
 CVE-2012-4725
-	RESERVED
+	REJECTED
 CVE-2012-4724
-	RESERVED
+	REJECTED
 CVE-2012-4723
-	RESERVED
+	REJECTED
 CVE-2012-4722
-	RESERVED
+	REJECTED
 CVE-2012-4721
-	RESERVED
+	REJECTED
 CVE-2012-4720
-	RESERVED
+	REJECTED
 CVE-2012-4719
-	RESERVED
+	REJECTED
 CVE-2012-4718
-	RESERVED
+	REJECTED
 CVE-2012-4717
-	RESERVED
+	REJECTED
 CVE-2012-4716 (N-Tron 702-W Industrial Wireless Access Point devices use the same (1) ...)
 	NOT-FOR-US: N-Tron 702-W Industrial Wireless Access Point
 CVE-2012-4715 (Buffer overflow in LogReceiver.exe in Rockwell Automation RSLinx ...)
@@ -124481,7 +124451,7 @@
 CVE-2012-4700 (Multiple buffer overflows in an ActiveX control in PE3DO32A.ocx in ...)
 	NOT-FOR-US: IntegraXor SCADA Server
 CVE-2012-4699
-	RESERVED
+	REJECTED
 CVE-2012-4698 (Siemens RuggedCom Rugged Operating System (ROS) before 3.12, ROX I OS ...)
 	NOT-FOR-US: Siemens RuggedCom Rugged Operating System
 CVE-2012-4697 (TURCK BL20 Programmable Gateway and BL67 Programmable Gateway have ...)
@@ -124495,7 +124465,7 @@
 CVE-2012-4693 (Invensys Wonderware InTouch 2012 R2 and earlier and Siemens ...)
 	NOT-FOR-US: Invensys Wonderware InTouch
 CVE-2012-4692
-	RESERVED
+	REJECTED
 CVE-2012-4691 (Memory leak in Siemens Automation License Manager (ALM) 4.x and 5.x ...)
 	NOT-FOR-US: Siemens Automation License Manager
 CVE-2012-4690 (Rockwell Automation Allen-Bradley MicroLogix controller 1100, 1200, ...)
@@ -128945,7 +128915,7 @@
 CVE-2012-3043
 	RESERVED
 CVE-2012-3042
-	RESERVED
+	REJECTED
 CVE-2012-3041
 	RESERVED
 CVE-2012-3040 (Cross-site scripting (XSS) vulnerability in the web server on Siemens ...)
@@ -128957,13 +128927,13 @@
 CVE-2012-3037 (The Siemens SIMATIC S7-1200 2.x PLC does not properly protect the ...)
 	NOT-FOR-US: Siemens SIMATIC PLC
 CVE-2012-3036
-	RESERVED
+	REJECTED
 CVE-2012-3035 (Buffer overflow in Emerson DeltaV 9.3.1 and 10.3 through 11.3.1 allows ...)
 	NOT-FOR-US: Emerson DeltaV
 CVE-2012-3034 (WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC ...)
 	NOT-FOR-US: Siemens WinCC
 CVE-2012-3033
-	RESERVED
+	REJECTED
 CVE-2012-3032 (SQL injection vulnerability in WebNavigator in Siemens WinCC 7.0 SP3 ...)
 	NOT-FOR-US: Siemens WinCC
 CVE-2012-3031 (Multiple cross-site scripting (XSS) vulnerabilities in WebNavigator in ...)
@@ -128971,11 +128941,11 @@
 CVE-2012-3030 (WebNavigator in Siemens WinCC 7.0 SP3 and earlier, as used in SIMATIC ...)
 	NOT-FOR-US: Siemens WinCC
 CVE-2012-3029
-	RESERVED
+	REJECTED
 CVE-2012-3028 (Cross-site request forgery (CSRF) vulnerability in WebNavigator in ...)
 	NOT-FOR-US: Siemens WinCC
 CVE-2012-3027
-	RESERVED
+	REJECTED
 CVE-2012-3026 (rifsrvd.exe in the Remote Interface Service in GE Intelligent ...)
 	NOT-FOR-US: GE Intelligent Platforms Proficy Real-Time Information Portal
 CVE-2012-3025 (The default configuration of Tridium Niagara AX Framework through 3.6 ...)




More information about the Secure-testing-commits mailing list