thr3ads.net - Secure testing commits - [Secure-testing-commits] r14605

If this information is useful, please help other people find it:
Share via:

Raphael Geissert

2010-May-05 18:59 UTC

[Secure-testing-commits] r14605 - data/CVE

Author: geissert
Date: 2010-05-05 18:59:40 +0000 (Wed, 05 May 2010)
New Revision: 14605

Modified:
   data/CVE/list
Log:
chromium-browser is now in experimental, oh dear


Modified: data/CVE/list
==================================================================---
data/CVE/list	2010-05-04 16:42:46 UTC (rev 14604)
+++ data/CVE/list	2010-05-05 18:59:40 UTC (rev 14605)
@@ -445,31 +445,31 @@
 CVE-2010-1507
 	RESERVED
 CVE-2010-1506 (The Google V8 bindings in Google Chrome before 4.1.249.1059
allow ...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	- webkit <not-affected> (doesn''t use v8 bindings yet)
 	TODO: recheck newer webkits
 CVE-2010-1505 (Google Chrome before 4.1.249.1059 does not prevent pages from
loading ...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	- webkit <undetermined>
 	TODO: check
 CVE-2010-1504 (Cross-site scripting (XSS) vulnerability in Google Chrome before
...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	- webkit <undetermined>
 	TODO: check
 CVE-2010-1503 (Cross-site scripting (XSS) vulnerability in Google Chrome before
...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	- webkit <undetermined>
 	TODO: check
 CVE-2010-1502 (Unspecified vulnerability in Google Chrome before 4.1.249.1059
allows ...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	- webkit <undetermined>
 	TODO: check
 CVE-2010-1501 (Cross-site request forgery (CSRF) vulnerability in Google Chrome
...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	- webkit <undetermined>
 	TODO: check
 CVE-2010-1500 (Google Chrome before 4.1.249.1059 does not properly support
forms, ...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	- webkit <undetermined>
 	TODO: check
 CVE-2010-1499 (SQL injection vulnerability in genre_artists.php in MusicBox 3.3
...)
@@ -1214,23 +1214,23 @@
 	- kdelibs <undetermined>
 	- kde4libs <undetermined>
 	- qt4-x11 <undetermined>
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	NOTE: http://trac.webkit.org/changeset/55511
 	NOTE: evidence of memory corruption
http://code.google.com/p/chromium/issues/detail?id=37061
 CVE-2010-1236 (Google Chrome before 4.1.249.1036 does not properly restrict
...)
 	- webkit <not-affected> (bug #577457; proof-of-concepts are not
effective against webkit)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	NOTE: http://trac.webkit.org/changeset/55822
 	NOTE: vulnerable code is in KURL.cpp even though the changeset says it is in
KURLGoogle.cpp
 CVE-2010-1235 (Unspecified vulnerability in Google Chrome before 4.1.249.1036
allows ...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	NOTE: issue in chrome-specific download dialog
 CVE-2010-1234 (Unspecified vulnerability in Google Chrome before 4.1.249.1036
allows ...)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	NOTE: chrome-specific and claimed windows-only
 CVE-2010-1233 (Multiple integer overflows in Google Chrome before 4.1.249.1036
allow ...)
 	- webkit <not-affected> (v8 and webgl not yet included)
-	- chromium-browser <itp> (bug #520324) 
+	- chromium-browser <undetermined> 
 	NOTE: http://trac.webkit.org/changeset/55376
 	TODO: recheck as newer webkits get uploaded
 CVE-2010-1232 (Google Chrome before 4.1.249.1036 allows remote attackers to
cause a ...)
@@ -1238,23 +1238,23 @@
 	- kdelibs <undetermined>
 	- kde4libs <undetermined>
 	- qt4-x11 <undetermined>
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 	NOTE: http://code.google.com/p/chromium/issues/detail?id=34978
 CVE-2010-1231 (Google Chrome before 4.1.249.1036 processes HTTP headers before
...)
 	- webkit <undetermined>
 	- kdelibs <undetermined>
 	- kde4libs <undetermined>
 	- qt4-x11 <undetermined>
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 	TODO: check
 CVE-2010-1230 (Google Chrome before 4.1.249.1036 does not have the expected
behavior ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 	NOTE: chrome-specific issue
 CVE-2010-1229 (The sandbox infrastructure in Google Chrome before 4.1.249.1036
does ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 	NOTE: chrome-specific sandboxing issue
 CVE-2010-1228 (Multiple race conditions in the sandbox infrastructure in Google
...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 	NOTE: chrome-specific sandboxing issue
 CVE-2010-1227 (Cross-site scripting (XSS) vulnerability in Sun Java System ...)
 	NOT-FOR-US: Sun Java System Communication Express
@@ -2890,36 +2890,36 @@
 	[lenny] - konversation <not-affected> (Doesn''t affect the
combination of kdelibs/QT in Lenny)
 	NOTE: http://bugs.kde.org/show_bug.cgi?id=219985
 CVE-2010-0664 (Stack consumption vulnerability in the ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0663 (The ParamTraits&lt;SkBitmap&gt;::Read function in ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0662 (The ParamTraits&lt;SkBitmap&gt;::Read function in ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0661 (WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp in WebKit
before ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 	- webkit <not-affected> (no v8 code included yet)
 	TODO: recheck as newer webkits are uploaded
 CVE-2010-0660 (Google Chrome before 4.0.249.78 sends an https URL in the
Referer ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0659 (The image decoder in WebKit before r52833, as used in Google
Chrome ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 	- webkit 1.1.21-1 (low)
 	- qt4-x11 <undetermined> (low)
 	- kdelibs <undetermined> (low)
 	- kde4libs <undetermined> (low)
 CVE-2010-0658 (Multiple integer overflows in Skia, as used in Google Chrome
before ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0657 (Google Chrome before 4.0.249.78 on Windows does not perform the
...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 	NOTE: claimed to be a windows-only issue
 CVE-2010-0656 (WebKit before r51295, as used in Google Chrome before
4.0.249.78, ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 	- webkit 1.1.21-1 (low)
 	- qt4-x11 <undetermined> (low)
 	- kdelibs <undetermined> (low)
 	- kde4libs <undetermined> (low)
 CVE-2010-0655 (Use-after-free vulnerability in Google Chrome before 4.0.249.78
allows ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0654 (Mozilla Firefox permits cross-origin loading of CSS stylesheets
even ...)
 	- xulrunner <undetermined> (bug #570743)
 CVE-2010-0653 (Opera permits cross-origin loading of CSS stylesheets even when
the ...)
@@ -2927,7 +2927,7 @@
 CVE-2010-0652 (Microsoft Internet Explorer permits cross-origin loading of CSS
...)
 	NOT-FOR-US: Microsoft Internet Explorer
 CVE-2010-0651 (WebKit before r52784, as used in Google Chrome before 4.0.249.78
and ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 	- webkit 1.1.21-1 (low)
 	[lenny] - webkit <no-dsa> (Too intrusive to backport, disk of regression
higher than impact at hand)
 	- qt4-x11 <undetermined> (low)
@@ -2935,7 +2935,7 @@
 	- kde4libs <undetermined> (low)
 	NOTE: http://trac.webkit.org/changeset/52784
 CVE-2010-0650 (WebKit, as used in Google Chrome before 4.0.249.78 and Apple
Safari, ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 	- webkit 1.1.21-1 (unimportant)
 	NOTE: http://code.google.com/p/chromium/issues/detail?id=3275
 	- qt4-x11 <undetermined> (unimportant)
@@ -2943,23 +2943,23 @@
 	- kde4libs <undetermined> (unimportant)
 	NOTE: unimportant because this is just a popup blocker bypass
 CVE-2010-0649 (Integer overflow in the CrossCallParamsEx::CreateFromBuffer
function ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0648 (Mozilla Firefox, possibly before 3.6, allows remote attackers to
...)
 	- xulrunner <undetermined> (bug #570743)
 CVE-2010-0647 (WebKit before r53525, as used in Google Chrome before
4.0.249.89, ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 	- webkit 1.1.21-1 (medium)
 	- qt4-x11 <undetermined> (medium)
 	- kdelibs <undetermined> (medium)
 	- kde4libs <undetermined> (medium)
 CVE-2010-0646 (Multiple integer signedness errors in factory.cc in Google V8
before ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0645 (Multiple integer overflows in factory.cc in Google V8 before
r3560, as ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0644 (Google Chrome before 4.0.249.89, when a SOCKS 5 proxy server is
...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0643 (Google Chrome before 4.0.249.89 attempts to make direct
connections to ...)
-	- chromium-browser <itp> (bug #520334)
+	- chromium-browser <undetermined>
 CVE-2010-0642 (Cisco Collaboration Server (CCS) 5 allows remote attackers to
read the ...)
 	NOT-FOR-US: Cisco Collaboration Server
 CVE-2010-0641 (Cross-site scripting (XSS) vulnerability in ...)
@@ -3229,7 +3229,7 @@
 CVE-2010-0557 (IBM Cognos Express 9.0 allows attackers to obtain unspecified
access ...)
 	NOT-FOR-US: IBM Cognos Express
 CVE-2010-0556 (browser/login/login_prompt.cc in Google Chrome before 4.0.249.89
...)
-	- chromium-browser <itp> (low; bug #520334)
+	- chromium-browser <undetermined> (low)
 CVE-2003-1587 (Cross-site scripting (XSS) vulnerability in LoganPro allows
remote ...)
 	NOT-FOR-US: LoganPro
 CVE-2003-1586 (Cross-site scripting (XSS) vulnerability in WebExpert allows
remote ...)
@@ -3941,7 +3941,7 @@
 CVE-2010-0316 (Integer overflow in Google SketchUp before 7.1 M2 allows remote
...)
 	NOT-FOR-US: Google SketchUp
 CVE-2010-0315 (WebKit before r53607, as used in Google Chrome before
4.0.249.89, ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 	- webkit 1.1.21-1 (low)
 	[lenny] - webkit <no-dsa> (Too intrusive to backport, disk of regression
higher than impact at hand)
 	- qt4-x11 <undetermined>
@@ -6563,18 +6563,18 @@
 CVE-2009-3935 (Multiple unspecified vulnerabilities in the Advanced Management
Module ...)
 	NOT-FOR-US: IBM BladeCenter
 CVE-2009-3934 (The WebFrameLoaderClient::dispatchDidChangeLocationWithinPage
function ...)
-	- chromium-browser <itp> (low; bug #520324)
+	- chromium-browser <undetermined> (low)
 CVE-2009-3933 (WebKit before r50173, as used in Google Chrome before
3.0.195.32, ...)
 	- webkit <not-affected> (chromium-specific issue in their timer)
 	- qt4-x11 <not-affected> (chromium-specific issue in their timer)
 	- kdelibs <not-affected> (chromium-specific issue in their timer)
 	- kde4libs <not-affected> (chromium-specific issue in their timer)
-	- chromium-browser <itp> (low; bug #520324)
+	- chromium-browser <undetermined> (low)
 CVE-2009-3932 (The Gears plugin in Google Chrome before 3.0.195.32 allows ...)
-	- chromium-browser <itp> (low; bug #520324)
+	- chromium-browser <undetermined> (low)
 	NOTE: gears is only implemented in chromium
 CVE-2009-3931 (Incomplete blacklist vulnerability in
browser/download/download_exe.cc ...)
-	- chromium-browser <itp> (low; bug #520324)
+	- chromium-browser <undetermined> (low)
 CVE-2009-3930 (Multiple integer overflows in Christos Zoulas file before 5.02
allow ...)
 	- file 5.03-1
 	[lenny] - file <not-affected>
@@ -8021,7 +8021,7 @@
 CVE-2009-3457 (Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall
(WAF) ...)
 	NOT-FOR-US: Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF)
 CVE-2009-3456 (Google Chrome, possibly 3.0.195.21 and earlier, does not
properly ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-3455 (Apple Safari, possibly before 4.0.3, on Mac OS X does not
properly ...)
 	NOT-FOR-US: Apple Safari
 CVE-2009-3454
@@ -8521,7 +8521,7 @@
 CVE-2009-3269 (Opera 9.52 and earlier allows remote attackers to cause a denial
of ...)
 	NOT-FOR-US: Opera
 CVE-2009-3268 (Google Chrome 1.0.154.48 and earlier allows remote attackers to
cause ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-3267 (Microsoft Internet Explorer 6 through 6.0.2900.2180, and ...)
 	NOT-FOR-US: Microsoft Internet Explorer
 CVE-2009-3266 (Opera before 10.01 does not properly restrict HTML in a (1) RSS
or (2) ...)
@@ -8529,9 +8529,9 @@
 CVE-2009-3265 (Cross-site scripting (XSS) vulnerability in Opera 9 and 10
allows ...)
 	NOT-FOR-US: Opera
 CVE-2009-3264 (The getSVGDocument method in Google Chrome before 3.0.195.21
omits an ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-3263 (Cross-site scripting (XSS) vulnerability in Google Chrome 2.x
and 3.x ...)
-	- chromium-browser <itp> (low; bug #520324)
+	- chromium-browser <undetermined> (low)
 	NOTE: http://seclists.org/fulldisclosure/2009/Sep/201
 	NOTE: other browsers are not affected (only chrome and opera)
 CVE-2009-3262 (Cross-site scripting (XSS) vulnerability in the Self Service UI
(SSUI) ...)
@@ -8569,7 +8569,7 @@
 CVE-2009-3246 (SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX
...)
 	NOT-FOR-US: MyBuxScript PTC-BUX
 CVE-2008-7246 (Google Chrome 0.2.149.29 and earlier allows remote attackers to
cause ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-7245 (Opera 9.52 and earlier allows remote attackers to cause a denial
of ...)
 	NOT-FOR-US: Opera
 CVE-2008-7244 (Mozilla Firefox 3.0.1 and earlier allows remote attackers to
cause a ...)
@@ -9460,7 +9460,7 @@
 CVE-2009-3012 (Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1
pre ...)
 	NOTE: This is a web site issue (open redirector), not a browser problem.
 CVE-2009-3011 (Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37,
and ...)
-	- chromium-browser <itp> (bug #520324; unimportant)
+	- chromium-browser <undetermined> (unimportant)
 	NOTE: This is a web site issue (open redirector), not a browser problem.
 CVE-2009-3010 (Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1
pre; ...)
 	NOTE: This is a web site issue (open redirector), not a browser problem.
@@ -9613,9 +9613,9 @@
 	NOTE: browser crashes not treated as security issues
 	NOTE: not reproducible, probably only Firefox in Windows XP is affected
 CVE-2009-2974 (Google Chrome 1.0.154.65, 1.0.154.48, and earlier allows remote
...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2973 (Google Chrome before 2.0.172.43 does not prevent SSL connections
to a ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2972 (in.lpd in the print service in Sun Solaris 8 and 9 allows remote
...)
 	NOT-FOR-US: Sun Solaris
 CVE-2008-7106 (The installation of Sophos PureMessage for Microsoft Exchange
3.0 ...)
@@ -9703,7 +9703,7 @@
 CVE-2009-2956 (The (1) Net.Commerce and (2) Net.Data components in IBM
WebSphere ...)
 	NOT-FOR-US: IBM WebSphere
 CVE-2009-2955 (Google Chrome 1.0.154.48 and earlier allows remote attackers to
cause ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2954 (Microsoft Internet Explorer 6.0.2900.2180 and earlier allows
remote ...)
 	NOT-FOR-US: Microsoft
 CVE-2009-2953 (Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote
...)
@@ -9762,7 +9762,7 @@
 CVE-2008-7062 (Unrestricted file upload vulnerability in admin/index.php in
Download ...)
 	NOT-FOR-US: Download Manager module 1.0 for LoveCMS
 CVE-2008-7061 (The tooltip manager (chrome/views/tooltip_manager.cc) in Google
Chrome ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-7060 (Multiple cross-site scripting (XSS) vulnerabilities in One-News
Beta 2 ...)
 	NOT-FOR-US: One-News
 CVE-2008-7059 (SQL injection vulnerability in index.php in One-News Beta 2
allows ...)
@@ -9831,7 +9831,7 @@
 	- varnish 2.1.0-2 (unimportant)
 	NOTE: Only a security issue if used against best practices
 CVE-2009-2935 (Google V8, as used in Google Chrome before 2.0.172.43, allows
remote ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2934 (Multiple stack-based buffer overflows in xaudio.dll in
Programmed ...)
 	NOT-FOR-US: Programmed Integration PIPL
 CVE-2009-2933 (SQL injection vulnerability in comments.php in Piwigo before
2.0.3 ...)
@@ -10338,15 +10338,15 @@
 CVE-2008-6999 (phpAuction 3.2, and possibly 3.3.0 GPL Basic edition, allows
remote ...)
 	NOT-FOR-US: phpAuction
 CVE-2008-6998 (Stack-based buffer overflow in chrome/common/gfx/url_elider.cc
in ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-6997 (Google Chrome 0.2.149.27 allows user-assisted remote attackers
to ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-6996 (Google Chrome BETA (0.2.149.27) does not prompt the user before
saving ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-6995 (Integer underflow in net/base/escape.cc in chrome.dll in Google
Chrome ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-6994 (Stack-based buffer overflow in the SaveAs feature ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-6993 (Siemens Gigaset WLAN Camera 1.27 has an insecure default
password, ...)
 	NOT-FOR-US: Siemens Gigaset WLAN Camera
 CVE-2008-6992 (GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4,
...)
@@ -11243,7 +11243,7 @@
 CVE-2009-2579 (SQL injection vulnerability in reward_points.post.php in the
Reward ...)
 	NOT-FOR-US: CS-Cart
 CVE-2009-2578 (Google Chrome 2.x through 2.0.172 allows remote attackers to
cause a ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2577 (Opera 9.52 and earlier allows remote attackers to cause a denial
of ...)
 	NOT-FOR-US: Opera
 CVE-2009-2576 (Microsoft Internet Explorer 6.0.2900.2180 and earlier allows
remote ...)
@@ -11309,9 +11309,9 @@
 CVE-2009-2557 (Directory traversal vulnerability in system/download.php in
Admin News ...)
 	NOT-FOR-US: Admin News Tools 
 CVE-2009-2556 (Google Chrome before 2.0.172.37 allows attackers to leverage
renderer ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2555 (Heap-based buffer overflow in src/jsregexp.cc in Google V8
before ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2658 (Directory traversal vulnerability in ZNC before 0.072 allows
remote ...)
 	{DSA-1848-1}
 	- znc 0.074-1 (medium; bug #537977)
@@ -11857,7 +11857,7 @@
 CVE-2009-2353 (encoder.php in eAccelerator allows remote attackers to execute
...)
 	- eaccelerator-src <itp> (bug #460341)
 CVE-2009-2352 (Google Chrome 1.0.154.48 and earlier does not block javascript:
URIs ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2351 (Opera 9.52 and earlier does not block javascript: URIs in
Refresh ...)
 	NOT-FOR-US: Opera
 CVE-2009-2350 (Microsoft Internet Explorer 6.0.2900.2180 and earlier does not
block ...)
@@ -12510,7 +12510,7 @@
 CVE-2009-2122 (SQL injection vulnerability in viewimg.php in the Paolo
Palmonari ...)
 	NOT-FOR-US: Photoracer plugin for WordPress
 CVE-2009-2121 (Buffer overflow in the browser kernel in Google Chrome before
...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2170 (Multiple cross-site scripting (XSS) vulnerabilities in Mahara
1.0 ...)
 	{DSA-1822-1}
 	- mahara 1.1.5-1 (low)
@@ -12654,13 +12654,13 @@
 CVE-2009-2072 (Apple Safari does not require a cached certificate before
displaying a ...)
 	NOT-FOR-US: Apple Safari
 CVE-2009-2071 (Google Chrome before 1.0.154.53 displays a cached certificate
for a ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2070 (Opera displays a cached certificate for a (1) 4xx or (2) 5xx
CONNECT ...)
 	NOT-FOR-US: Opera
 CVE-2009-2069 (Microsoft Internet Explorer before 8 displays a cached
certificate for ...)
 	NOT-FOR-US: Microsoft Internet Explorer
 CVE-2009-2068 (Google Chrome detects http content in https web pages only when
the ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2067 (Opera detects http content in https web pages only when the
top-level ...)
 	NOT-FOR-US: Opera
 CVE-2009-2066 (Apple Safari detects http content in https web pages only when
the ...)
@@ -12676,7 +12676,7 @@
 CVE-2009-2061 (Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT
response ...)
 	- xulrunner <undetermined> (bug #565521)
 CVE-2009-2060 (src/net/http/http_transaction_winhttp.cc in Google Chrome before
...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-2059 (Opera, possibly before 9.25, uses the HTTP Host header to
determine ...)
 	NOT-FOR-US: Opera
 CVE-2009-2058 (Apple Safari before 3.2.2 uses the HTTP Host header to determine
the ...)
@@ -12907,7 +12907,7 @@
 	[etch] - kdebase <no-dsa> (Minor issue)
 	- w3m <unfixed> (unimportant; bug #532521)
 	NOTE: w3m doesn''t have Javascript support and the boundary issue is
harmles
-	- chromium-browser <itp> (low; bug #520324)
+	- chromium-browser <undetermined> (bug #520324)
 	- lynx 2.8.7rel.1-1 (unimportant; bug #532520)
 	NOTE: lynx doesn''t have Javascript and form-data support
 	- dillo <not-affected> (bug #532522)
@@ -14037,7 +14037,7 @@
 CVE-2009-1599 (Opera executes DOM calls in response to a javascript: URI in the
...)
 	NOT-FOR-US: Opera
 CVE-2009-1598 (Google Chrome executes DOM calls in response to a javascript:
URI in ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-1597 (Mozilla Firefox executes DOM calls in response to a javascript:
URI in ...)
 	- xulrunner <undetermined> (bug #565521)
 CVE-2009-1596 (Ignite Realtime Openfire before 3.6.5 does not properly
implement the ...)
@@ -14281,7 +14281,7 @@
 CVE-2009-1516 (Stack-based buffer overflow in the IceWarpServer.APIObject
ActiveX ...)
 	NOT-FOR-US: ActiveX
 CVE-2009-1514 (Google Chrome 1.0.154.53 allows remote attackers to cause a
denial of ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 	- webkit <unfixed> (bug #578982)
 	- qt4-x11 <undetermined>
 	- kdebase <undetermined>
@@ -14529,7 +14529,7 @@
 CVE-2009-1442 (Multiple integer overflows in Skia, as used in Google Chrome 1.x
...)
 	NOT-FOR-US: skia
 CVE-2009-1441 (Heap-based buffer overflow in the
ParamTraits&lt;SkBitmap&gt;::Read function ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-1439 (Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel
...)
 	{DSA-1800-1 DSA-1794-1 DSA-1787-1}
 	- linux-2.6 2.6.29-2 (bug #523365)
@@ -14605,11 +14605,11 @@
 	[etch] - gnutls26 <not-affected> (Vulnerable code not present)
 	[etch] - gnutls13 <not-affected> (Vulnerable code not present, only
affects 2.6.x)
 CVE-2009-1414 (Google Chrome 2.0.x lets modifications to the global object
persist ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-1413 (Google Chrome 1.0.x does not cancel timeouts upon a page
transition, ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-1412 (Argument injection vulnerability in the chromehtml: protocol
handler ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-XXXX [iodine: DoS against iodined triggerable by authenticated users]
 	- iodine 0.5.1 (low)
 	[lenny] - iodine 0.4.2-2~lenny1 
@@ -18772,7 +18772,7 @@
 CVE-2009-0412 (The ProcessLogin function in class.auth.php in Interspire
Shopping ...)
 	NOT-FOR-US: Interspire Shopping Cart
 CVE-2009-0411 (Google Chrome before 1.0.154.46 does not properly restrict
access from ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-0410 (Off-by-one error in the SMTP daemon in GroupWise Internet Agent
(GWIA) ...)
 	NOT-FOR-US: Novell GroupWise
 CVE-2009-0409 (SQL injection vulnerability in offline_auth.php in Max.Blog
1.0.6 and ...)
@@ -18859,7 +18859,7 @@
 CVE-2009-0375 (Buffer overflow in a DLL file in RealNetworks RealPlayer 10,
...)
 	NOT-FOR-US: RealPlayer
 CVE-2009-0374 (** DISPUTED ** ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-0373 (SQL injection vulnerability in the ElearningForce Flash Magazine
...)
 	NOT-FOR-US: Joomla
 CVE-2009-0372 (Unrestricted file upload vulnerability in index.php in
Miltenovik ...)
@@ -19301,7 +19301,7 @@
 	- moin 1.8.1-1.1 (low)
 	NOTE: http://hg.moinmo.in/moin/1.7/rev/89b91bf87dad
 CVE-2009-0276 (Cross-domain vulnerability in the V8 JavaScript engine in Google
...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2009-0274 (Unspecified vulnerability in WebAccess in Novell GroupWise 6.5,
7.0, ...)
 	NOT-FOR-US: Novell GroupWise
 CVE-2009-0273 (Multiple cross-site scripting (XSS) vulnerabilities in Novell
...)
@@ -20377,7 +20377,7 @@
 CVE-2008-5750 (Argument injection vulnerability in Microsoft Internet Explorer
8 beta ...)
 	NOT-FOR-US: Microsoft
 CVE-2008-5749 (** DISPUTED ** ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-5748 (Directory traversal vulnerability in
plugins/spaw2/dialogs/dialog.php ...)
 	NOT-FOR-US: BloofoxCMS
 CVE-2008-5747 (F-Prot 4.6.8 for GNU/Linux allows remote attackers to bypass
...)
@@ -23975,7 +23975,7 @@
 CVE-2008-4341 (add.php in MyBlog 0.9.8 and earlier allows remote attackers to
bypass ...)
 	NOT-FOR-US: MyBlog
 CVE-2008-4340 (Google Chrome 0.2.149.29 and 0.2.149.30 allows remote attackers
to ...)
-	- chromium-browser <itp> (bug #520324)
+	- chromium-browser <undetermined>
 CVE-2008-4339 (Unspecified vulnerability in the Java Administration GUI (jnbSA)
in ...)
 	NOT-FOR-US: Symantec Veritas NetBackup Server
 CVE-2008-4338 (SQL injection vulnerability in the
brilliant_gallery_checklist_save ...)

Giuseppe Iuculano

2010-May-05 19:03 UTC

head link

[Secure-testing-commits] r14605 - data/CVE

Il 05/05/2010 20:59, Raphael Geissert ha scritto:> chromium-browser is now in experimental,
I will check all issues in the next days.
> oh dear
:)

Cheers,
Giuseppe.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 198 bytes
Desc: OpenPGP digital signature
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20100505/4f9a75c9/attachment.pgp>

Secure testing commits - May 2010 - r14605 - data/CVE

[Secure-testing-commits] r14605 - data/CVE

[Secure-testing-commits] r14605 - data/CVE