Author: jmm-guest
Date: 2005-09-23 22:28:31 +0000 (Fri, 23 Sep 2005)
New Revision: 2138
Modified:
data/CAN/list
Log:
lets start breaking related scripts, first batch of
conversions to the fancy new <unfixed>.
Modified: data/CAN/list
==================================================================---
data/CAN/list 2005-09-23 21:31:57 UTC (rev 2137)
+++ data/CAN/list 2005-09-23 22:28:31 UTC (rev 2138)
@@ -69,7 +69,7 @@
CAN-2005-3012 (The MasterDataCD::createImage function in masterdatacd.cpp for
...)
NOTE: not-for-us (SimpleCDR-X)
CAN-2005-3011 (texindex in texinfo 4.7 and earlier allows local users to
overwrite ...)
- - texinfo (unfixed; bug #328265; low)
+ - texinfo <unfixed> (bug #328265; low)
CAN-2005-3010 (Direct static code injection vulnerability in the flood
protection ...)
NOTE: not-for-us (CuteNews)
CAN-2005-3009 (Cross-site scripting (XSS) vulnerability in CuteNews allows
remote ...)
@@ -108,7 +108,7 @@
CAN-2005-2993 (Unspecified vulnerability in the FTP Daemon (ftpd) for HP Tru64
UNIX ...)
NOTE: not-for-us (HP Tru64)
CAN-2005-2991 (ncompress 4.2.4 and earlier allows local users to overwrite
arbitrary ...)
- - ncompress (unfixed; bug #329052; unimportant)
+ - ncompress <unfixed> (bug #329052; unimportant)
CAN-2005-2992 [Another arc tempfile issue]
NOTE: reserved
- arc 5.21m-1 (low)
@@ -163,9 +163,9 @@
CAN-2005-2969
NOTE: reserved
CAN-2005-2968 (Firefox 1.0.6 and Mozilla 1.7.10 allows attackers to execute
arbitrary ...)
- - mozilla-firefox not-affected (Debian ships a non-vulnerable wrapper script)
- - mozilla not-affected (Debian ships a non-vulnerable wrapper script)
- - mozilla-thunderbird (unfixed; bug #329667; bug #329664; high)
+ - mozilla-firefox <not-affected> (Debian ships a non-vulnerable wrapper
script)
+ - mozilla <not-affected> (Debian ships a non-vulnerable wrapper script)
+ - mozilla-thunderbird <unfixed> (bug #329667; bug #329664; high)
CAN-2005-2967
NOTE: reserved
CAN-2005-2966
@@ -344,10 +344,10 @@
CAN-2005-XXXX [user password file created by gajim is world-redable]
- gajim 0.8.2-1 (bug #325080; low)
CAN-2005-XXXX [mkzopeinstance.py creates world-readable inituser file]
- - zope2.7 (unfixed; bug #313644; low)
+ - zope2.7 <unfixed> (bug #313644; low)
NOTE: first patch was incorrect
CAN-2005-XXXX [wine-safe does not prompt the user/is registered in mailcap]
- - wine (bug #327261; bug #327262; unfixed; high)
+ - wine <unfixed> (bug #327261; bug #327262; high)
TODO: It is not clear what the real bug is.
TODO: Does wine-safe prompt properly? Or should the functionality
TODO: be disabled completely, like Microsoft did some time ago?
@@ -375,12 +375,12 @@
CAN-2005-2874 (The is_path_absolute function in scheduler/client.c for the
daemon in ...)
- cupsys 1.1.23-1 (unknown)
CAN-2005-XXXX [snort vulnerable to DoS attack]
- - snort (unfixed; bug #328134; low)
+ - snort <unfixed> (bug #328134; low)
CAN-2005-2871 (Buffer overflow in the International Domain Name (IDN) support
in ...)
- mozilla-firefox 1.0.6-5 (medium)
- - mozilla (unfixed; bug #327455; medium)
- - mozilla-thunderbird (unfixed; medium)
- - epiphany-browser (unfixed; bug #327366; medium)
+ - mozilla <unfixed> (bug #327455; medium)
+ - mozilla-thunderbird <unfixed> (medium)
+ - epiphany-browser <unfixed> (bug #327366; medium)
CAN-2005-XXXX [several buffer overflows in MS CHM library before version 0.36]
- chmlib 0.36-1 (bug #327431)
CAN-2005-2802
@@ -409,7 +409,7 @@
CAN-2005-2861 (Cross-site scripting (XSS) vulnerability in N-Stealth Commercial
...)
NOTE: not-for-us (N-Stealth)
CAN-2005-2860 (Cross-site scripting (XSS) vulnerability in Nikto 1.35 and
earlier ...)
- - nikto (unfixed; bug #327339; medium)
+ - nikto <unfixed> (bug #327339; medium)
CAN-2005-2859 (Savant Web Server stores user credentials in plaintext in the
...)
NOTE: not-for-us (Savant Web Server)
CAN-2005-2858 (The Fetch.FetchContact.1 ActiveX control (Fetch.dll) for Rediff
Bol ...)
@@ -531,7 +531,7 @@
NOTE: not-for-us (Linksys routers)
CAN-2005-2798 (sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is
enabled, ...)
- openssh 1:4.2p1-1 (bug #326065; medium)
- - openssh-krb5 (unfixed; bug #327233; medium)
+ - openssh-krb5 <unfixed> (bug #327233; medium)
CAN-2005-2797 (OpenSSH 4.0, and other versions before 4.2, does not properly
handle ...)
- openssh 1:4.2p1-1 (bug #326065; medium)
CAN-2005-2796 (The sslConnectTimeout function in ssl.c for Squid 2.5.STABLE10
and ...)
@@ -667,7 +667,7 @@
NOTE: not-for-us (Simple PHP Blog)
CAN-2005-2732 (AWStats 6.4, and possibly earlier versions, allows remote
attackers to ...)
NOTE: path disclosure, so not very important on debian systems
- - awstats (unfixed; bug #327729; low)
+ - awstats <unfixed> (bug #327729; low)
CAN-2005-2731 (Directory traversal vulnerability in Astaro Security Linux 6.0,
when ...)
NOTE: not-for-us (Astato specific)
CAN-2005-2730 (The HTTP proxy in Astaro Security Linux 6.0 allows remote
attackers to ...)
@@ -718,31 +718,31 @@
CAN-2005-2707 [Firefox: Spoofing through clever construction of windows/tabs]
NOTE: reserved
- mozilla-firefox 1.0.7-1 (bug filed; medium)
- - mozilla (unfixed; bug filed; medium)
+ - mozilla <unfixed> (bug filed; medium)
CAN-2005-2706 [Firefox: Javascript execution with chrome privileges through
about: subcommand]
NOTE: reserved
- mozilla-firefox 1.0.7-1 (bug filed; high)
- - mozilla (unfixed; bug filed; high)
+ - mozilla <unfixed> (bug filed; high)
CAN-2005-2705 [Firefox: Integer overflow in Javascript engine]
NOTE: reserved
- mozilla-firefox 1.0.7-1 (bug filed; high)
- - mozilla (unfixed; bug filed; high)
+ - mozilla <unfixed> (bug filed; high)
CAN-2005-2704 [Firefox: Incorrect chrome/javascript permission handling]
NOTE: reserved
- mozilla-firefox 1.0.7-1 (bug filed; medium)
- - mozilla (unfixed; bug filed; medium)
+ - mozilla <unfixed> (bug filed; medium)
CAN-2005-2703 [Firefox: Incorrect passing of XMLHttp requests]
NOTE: reserved
- mozilla-firefox 1.0.7-1 (bug filed; medium)
- - mozilla (unfixed; bug filed; medium)
+ - mozilla <unfixed> (bug filed; medium)
CAN-2005-2702 [Firefox: Arbitrary code execution through crafted Unicode
sequences]
NOTE: reserved
- mozilla-firefox 1.0.7-1 (bug filed; high)
- - mozilla (unfixed; bug filed; high)
+ - mozilla <unfixed> (bug filed; high)
CAN-2005-2701 [Firefox: Arbitrary code execution through crafted XBM through
unspecified vuln]
NOTE: reserved
- mozilla-firefox 1.0.7-1 (bug filed; medium)
- - mozilla (unfixed; bug filed; medium)
+ - mozilla <unfixed> (bug filed; medium)
CAN-2005-2700 (ssl_engine_kernel.c in mod_ssl before 2.8.24, when using ...)
{DSA-807-1 DSA-805-1}
- libapache-mod-ssl 2.8.24-1 (medium)
@@ -776,9 +776,9 @@
TODO: check what version of linux-2.6 fixed this. (See bug #328395)
NOTE: http://lists.debian.org/debian-kernel/2005/08/msg00238.html
CAN-2005-2873 (The ipt_recent kernel module (ipt_recent.c) in Linux kernel
2.6.12 and ...)
- - kernel-source-2.4.27 (unfixed; low)
- - kernel-source-2.6.8 (unfixed; low)
- - linux-2.6 (unfixed; low)
+ - kernel-source-2.4.27 <unfixed> (low)
+ - kernel-source-2.6.8 <unfixed> (low)
+ - linux-2.6 <unfixed> (low)
NOTE: Dave Miller didn''t like the proposed fix and considers a
complete rewrite
NOTE: of ipt_recent the best solution, which seems to occur soon
CAN-2005-2872 (The ipt_recent kernel module (ipt_recent.c) in Linux kernel
before ...)
@@ -858,9 +858,9 @@
CAN-2005-2664 (Whisper 32 1.16, and possibly earlier versions, stores passwords
in ...)
NOTE: not-for-us (Whisper)
CAN-2005-2663 (masqmail before 0.2.18 allows local users to overwrite arbitrary
files ...)
- - masqmail (unfixed; low; bug #329307)
+ - masqmail <unfixed> (low; bug #329307)
CAN-2005-2662 (masqmail before 0.2.18 allows remote attackers to execute
arbitrary ...)
- - masqmail (unfixed; high; bug #329307)
+ - masqmail <unfixed> (high; bug #329307)
CAN-2005-2661
NOTE: reserved
CAN-2005-2660
@@ -910,7 +910,7 @@
CAN-2005-2643 (Tor 0.1.0.13 and earlier, and experimental versions
0.1.1.4-alpha and ...)
- tor 0.1.0.14-1 (medium)
CAN-2005-2642 (Buffer overflow in the mutt_decode_xbit function in Handler.c
for Mutt ...)
- - mutt (unfixed; bug #323956; high)
+ - mutt <unfixed> (bug #323956; high)
NOTE: Status is not clear; upstream is unresponsive.
CAN-2005-2641 (Unknown vulnerability in pam_ldap before 180 does not properly
handle ...)
{DSA-785-1}
@@ -1197,13 +1197,13 @@
CAN-2005-2603 (Cross-site scripting (XSS) vulnerability in index.php for My
Image ...)
NOTE: not-for-us (My Image Gallery (Mig))
CAN-2005-2602 (Mozilla Thunderbird 1.0 and Firefox 1.0.6 allows remote
attackers to ...)
- - mozilla-firefox (unfixed; bug #324907; low)
+ - mozilla-firefox <unfixed> (bug #324907; low)
TODO: file/clone bugs for mozilla-browser and mozilla-thunderbird
CAN-2005-2601 (SQL injection vulnerability in MidiCart allows remote attackers
to ...)
NOTE: not-for-us (MidiCart)
CAN-2005-2600 (FUDForum 2.6.15 with "Tree View" enabled, as
used in other products ...)
{DSA-798-1}
- - egroupware-fudforum (unfixed; bug #323928; medium)
+ - egroupware-fudforum <unfixed> (bug #323928; medium)
- phpgroupware 0.9.16.008-1 (bug #323929; medium)
CAN-2005-2599 (Hummingbird FTP for Connectivity 10.0 uses weak encryption
(trivial ...)
NOTE: not-for-us (Hummingbird FTP for Connectivity)
@@ -1294,7 +1294,7 @@
CAN-2005-2558 (Stack-based buffer overflow in the init_syms function in MySQL
4.0 ...)
- mysql-dfsg-4.1 4.1.13 (medium)
- mysql-dfsg-5.0 5.0.7beta-1 (medium)
- - mysql-dfsg (unfixed; bug #322133; medium)
+ - mysql-dfsg <unfixed> (bug #322133; medium)
CAN-2005-2557
NOTE: reserved
{DSA-778-1}
@@ -1505,7 +1505,7 @@
CAN-2005-2554 (The web server for Network Associates ePolicy Orchestrator Agent
3.5.0 ...)
NOTE: not-for-us (Network Associated ePolicy Orchestrator Agent)
CAN-2005-2553 (The find_target function in ptrace32.c in the Linux kernel 2.4.x
...)
- - kernel-source-2.4.27 (unfixed; bug #323363; medium)
+ - kernel-source-2.4.27 <unfixed> (bug #323363; medium)
CAN-2005-2552 (Unknown vulnerability in HP ProLiant DL585 servers running
Integrated ...)
NOTE: not-for-us (Integrated Light Out in HP servers)
CAN-2005-2551 (Buffer overflow in dhost.exe in iMonitor for Novell eDirectory
8.7.3 ...)
@@ -1526,7 +1526,7 @@
CAN-2005-2541 (Tar 1.15.1 does not properly warn the user when extracting
setuid or ...)
NOTE: This is intended behaviour, after all tar is an archiving tool and you
NOTE: need to give -p as a command line flag
- - tar (unfixed; bug #328228; unimportant)
+ - tar <unfixed> (bug #328228; unimportant)
CAN-2005-2540 (CRLF injection vulnerability in FlatNuke 2.5.5 and possibly
earlier ...)
NOTE: not-for-us (FlatNuke)
CAN-2005-2539 (Multiple cross-site scripting (XSS) vulnerabilities in FlatNuke
2.5.5 ...)
@@ -1612,7 +1612,7 @@
NOTE: Does not affect 2.6.8 or 2.4.27, fixed in current 2.6.12 kernels
- linux-2.6 2.6.12-1 (medium)
CAN-2005-2499 (slocate before 2.7 does not properly process very long paths,
which ...)
- - slocate (unfixed; bug #324951; low)
+ - slocate <unfixed> (bug #324951; low)
CAN-2005-2498 (Eval injection vulnerability in PHPXMLRPC 1.1.1 and earlier
(PEAR ...)
{DSA-798-1 DSA-789-1 DTSA-15-1}
- drupal 4.5.5-1 (bug #323347; high)
@@ -1647,19 +1647,19 @@
- linux-2.6 2.6.12-7 (bug #327416; medium)
CAN-2004-2302 (Race condition in the sysfs_read_file and sysfs_write_file
functions ...)
{DTSA-16-1}
- - kernel-source-2.6.8 (unfixed; bug #322339; medium)
+ - kernel-source-2.6.8 <unfixed> (bug #322339; medium)
- linux-2.6 2.6.12-1 (bug #322339; medium)
NOTE: 2.4.27 not affected
CAN-2005-XXXX [Buffer overflow in Description parsing]
- - bidwatcher (unfixed; bug #319489; high)
+ - bidwatcher <unfixed> (bug #319489; high)
CAN-2005-XXXX [Does not do escaping in mysql version - both a worrying flaw and
stops adduser working]
- - dbmail (unfixed; bug #303991; medium)
+ - dbmail <unfixed> (bug #303991; medium)
CAN-2005-XXXX [downloads.ini writable by group users, world-readable]
- mldonkey 2.5.28.1-1 (bug #300560; low)
CAN-2005-XXXX [Should include "UNRESTRICTED access to your computer"
warning somewhere]
- - gcjwebplugin (unfixed; bug #267040; high)
+ - gcjwebplugin <unfixed> (bug #267040; high)
CAN-2005-XXXX [Inconsistent escaping of user supplied data in dbauthpgsql.c]
- - dbmail-pgsql (unfixed; bug #290833; medium)
+ - dbmail-pgsql <unfixed> (bug #290833; medium)
CAN-2005-XXXX [time delay of password check proves account existence to
attackers]
NOTE: unknown if really a bug; if it is it''s different than the
NOTE: previous ssh delay bugs