Author: jmm-guest
Date: 2005-12-01 11:50:15 +0000 (Thu, 01 Dec 2005)
New Revision: 2916
Modified:
data/CVE/list
Log:
updates on several kernel issues
Modified: data/CVE/list
==================================================================---
data/CVE/list 2005-12-01 10:36:12 UTC (rev 2915)
+++ data/CVE/list 2005-12-01 11:50:15 UTC (rev 2916)
@@ -2122,18 +2122,20 @@
NOTE: see
http://www.apsis.ch/pound/pound_list/archive/2005/2005-10/1129827166000/index_html?fullMode=1#1129827166000
CVE-2005-3276 (The sys_get_thread_area function in process.c in Linux 2.6
before ...)
- linux-2.6 2.6.12-2
- - kernel-source-2.6.8 2.6.8-16sarge1
+ - kernel-source-2.4.27 <not-affected>
+ [sarge] - kernel-source-2.6.8 2.6.8-16sarge1
CVE-2005-3275 (The NAT code (1) ip_nat_proto_tcp.c and (2) ip_nat_proto_udp.c
in ...)
- linux-2.6 2.6.13-1 (low)
- - kernel-source-2.6.8 2.6.8-16sarge1 (low)
- - kernel-source-2.4.27 2.4.27-10sarge1 (low)
+ - kernel-source-2.4.27 2.4.27-11 (low)
+ [sarge] - kernel-source-2.6.8 2.6.8-16sarge1 (low)
+ [sarge] - kernel-source-2.4.27 2.4.27-10sarge1 (low)
CVE-2005-3274 (Race condition in ip_vs_conn_flush in Linux 2.6 before 2.6.13
and 2.4 ...)
- linux-2.6 2.6.13-1 (low)
- - kernel-source-2.6.8 2.6.8-16sarge1 (low)
- - kernel-source-2.4.27 2.4.27-10sarge1 (low)
+ [sarge] - kernel-source-2.6.8 2.6.8-16sarge1 (low)
+ [sarge] - kernel-source-2.4.27 2.4.27-10sarge1 (low)
CVE-2005-3273 (The rose_rt_ioctl function in rose_route.c for ROSE in Linux 2.6
...)
- linux-2.6 2.6.12-1
- - kernel-source-2.6.8 2.6.8-16sarge1
+ [sarge] - kernel-source-2.6.8 2.6.8-16sarge1
CVE-2005-3272 (Linux kernel before 2.6.12 allows remote attackers to poison the
...)
- linux-2.6 2.6.12-1
- kernel-source-2.6.8 2.6.8-16sarge1
@@ -2733,7 +2735,8 @@
- twiki 20040902-2 (bug #330733; high)
CVE-2005-3055 (Linux kernel 2.6.8 to 2.6.14-rc2 allows local users to cause a
denial ...)
- linux-2.6 <unfixed> (bug #330287; bug #332587; medium)
- - kernel-source-2.6.8 <unfixed> (bug #332596)
+ - kernel-source-2.4.27 <not-affected>
+ [sarge] - kernel-source-2.6.8 <unfixed> (bug #332596)
CVE-2005-3054 (fopen_wrappers.c in PHP 4.4.0, and possibly other versions, does
not ...)
- php4 4:4.4.0-3 (bug #353585; medium)
- php5 5.0.5-2 (bug #353585; medium)
@@ -3159,8 +3162,8 @@
- gtkdiskfree 1.9.3-4sarge1 (bug #328566; low)
CVE-2005-3044 (Multiple vulnerabilities in Linux kernel before 2.6.13.2 allow
local ...)
- linux-2.6 2.6.12-7 (medium)
- - kernel-source-2.6.8 2.6.8-16sarge2 (medium)
- NOTE: code is vulnerable but there is no amd64 for 2.4 in Sarge
+ - kernel-source-2.4.27 <not-affected> (code is vulnerable but there is
no amd64 for 2.4 in Sarge)
+ [sarge] - kernel-source-2.6.8 2.6.8-16sarge2 (medium)
CVE-2005-2877 (The history (revision control) function in TWiki 02-Sep-2004 and
...)
NOTE: proactively fixed by the robustness patch
- twiki 20040902-2
@@ -3330,6 +3333,7 @@
- hiki 0.8.3-1
CVE-2005-2800 (Memory leak in the seq_file implemenetation in the SCSI procfs
...)
- linux-2.6 2.6.12-6 (low)
+ - kernel-source-2.4.27 <not-affected> (seq_file introduced in 2.6)
CVE-2005-2799 (Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6,
and ...)
NOT-FOR-US: Linksys routers
CVE-2005-2798 (sshd in OpenSSH before 4.2, when GSSAPIDelegateCredentials is
enabled, ...)
@@ -4701,9 +4705,9 @@
CVE-2005-2457 (The driver for compressed ISO file systems (zisofs) in the Linux
...)
{DTSA-16-1}
- linux-2.6 2.6.12-3 (medium)
- - kernel-source-2.6.8 2.6.8-16sarge2 (medium)
- kernel-source-2.4.27 2.4.27-12 (medium)
- - kernel-source-2.4.27 2.4.27-10sarge2 (medium)
+ [sarge] - kernel-source-2.6.8 2.6.8-16sarge2 (medium)
+ [sarge] - kernel-source-2.4.27 2.4.27-10sarge2 (medium)
CVE-2005-2456 (Array index overflow in the xfrm_sk_policy_insert function in
...)
{DTSA-16-1}
- linux-2.6 2.6.12-2 (bug #321401; medium)
@@ -12611,12 +12615,10 @@
CVE-2005-0450 (Directory traversal vulnerability in Sami HTTP Server 1.0.5
allows ...)
NOT-FOR-US: Sami HTTP Server
CVE-2005-0449 (The netfilter/iptables module in Linux before 2.6.8.1 allows
remote ...)
- NOTE: According to Herbert Xu, 2.4 is not vulnerable :
http://oss.sgi.com/archives/netdev/2005-01/msg01107.html
- NOTE: The vulnerable code has been removed from the kernel in favor of a
better
- NOTE: fix between 2.6.11 and 2.6.12, see
NOTE:
http://kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1e01441051dda3bb01c455b6e20bce6d00563d82"
- kernel-source-2.6.8 2.6.8-14 (bug #295949; high)
- linux-2.6 <not-affected> (Vulnerable code was removed betwen 2.6.11
and 2.6.12)
+ - kernel-source-2.4.27 <not-affected> (Per Herbet Xu:
http://oss.sgi.com/archives/netdev/2005-01/msg01107.html)
CVE-2005-0448 (Race condition in the rmtree function in File::Path.pm in Perl
before ...)
{DSA-696-1}
- perl 5.8.4-7
@@ -13422,11 +13424,9 @@
{DSA-667-1}
- squid 2.5.7-6
CVE-2005-0210 (Netfilter in the Linux kernel 2.6.8.1 allows local users to
cause a ...)
- NOTE: fixed in ubuntu kernels
- NOTE: 2.6.11 is not affected, apparantly 2.6.10 is no longer relevant
- NOTE: was bug #300838
- - kernel-source-2.6.8 2.6.8-15
- - kernel-source-2.4.27 2.4.27-9
+ - linux-2.6 <not-affected> (Fixed before upload into archive)
+ [sarge] - kernel-source-2.6.8 2.6.8-15
+ - kernel-source-2.4.27 2.4.27-9 (bug #300838)
CVE-2005-0209 (Netfilter in Linux kernel 2.6.8.1 allows remote attackers to
cause a ...)
NOTE: <horms> all kernels seem to be clear with regards to 2005-0209
NOTE: <dilinger>
http://oss.sgi.com/archives/netdev/2005-01/msg01072.html resolves this and it is
in all our kernels
@@ -13496,9 +13496,8 @@
CVE-2005-0181
RESERVED
CVE-2005-0180 (Multiple integer signedness errors in the sg_scsi_ioctl function
in ...)
- - kernel-source-2.6.8 2.6.8-12
- - kernel-source-2.6.9 2.6.9-5
- - kernel-source-2.6.10 2.6.10-2
+ [sarge] - kernel-source-2.6.8 2.6.8-12
+ - linux-2.6 <not-affected> (Fixed before upload into archive)
CVE-2005-0179 (Linux kernel 2.4.x and 2.6.x allows local users to cause a
denial of ...)
NOTE: Does not apply to 2.6.8
NOTE: Fix in 2.6.9-6 pending upload