[Git][security-tracker-team/security-tracker][master] Add further notes on CVE-2004-2687/distcc

[Salvatore Bonaccorso]

Salvatore Bonaccorso pushed to branch master at Debian Security Tracker / security-tracker


Commits:
521ee9de by Salvatore Bonaccorso at 2018-12-15T07:43:44Z
Add further notes on CVE-2004-2687/distcc

The 2.18.1-1 upload already made the --allow option mandatory for daemon
mode, thus distccd would refuse to run without an IP access control
list.

Upstream bug https://github.com/distcc/distcc/issues/155

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -294317,6 +294317,9 @@ CVE-2007-5020 (Unspecified vulnerability in Adobe Acrobat and Reader 8.1 on Wind
 CVE-2004-2687 (distcc 2.x, as used in XCode 1.5 and others, when not configured to ...)
 	- distcc 2.18.1-1 (low)
 	NOTE: since 2.18.1-1 there is the --allow switch to control network access
+	NOTE: https://github.com/distcc/distcc/issues/155
+	NOTE: Fix in depth is only in later version 3.3, cf.
+	NOTE: https://bugs.debian.org/892973
 CVE-2004-2686 (Directory traversal vulnerability in the vfs_getvfssw function in ...)
 	NOT-FOR-US: Solaris
 CVE-2003-1339 (Stack-based buffer overflow in eZnet.exe, as used in eZ (a) ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/521ee9dedb48df239c399d571314493098395af8

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/521ee9dedb48df239c399d571314493098395af8
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20181215/811a893c/attachment.html>