Author: jmm-guest
Date: 2005-12-12 23:42:15 +0000 (Mon, 12 Dec 2005)
New Revision: 3021
Modified:
data/CVE/list
Log:
more kernel and syntax updates
Modified: data/CVE/list
==================================================================---
data/CVE/list 2005-12-12 23:18:07 UTC (rev 3020)
+++ data/CVE/list 2005-12-12 23:42:15 UTC (rev 3021)
@@ -14682,27 +14682,23 @@
CVE-2004-1338 (The triggers in Oracle 9i and 10g allow local users to gain
privileges ...)
NOT-FOR-US: oracle
CVE-2004-1337 (The POSIX Capability Linux Security Module (LSM) for Linux
kernel 2.6 ...)
- - kernel-source-2.6.8 2.6.8-14
- - kernel-source-2.6.9 2.6.9-6
- - kernel-source-2.6.10 2.6.10-1
+ - linux-2.6 <not-affected> (Fixed before upload into archive)
+ [sarge] - kernel-source-2.6.8 2.6.8-14
+ TODO: Check, when this was fixed
CVE-2004-1336 (The xdvizilla script in tetex-bin 2.0.2 creates temporary files
with ...)
- tetex-bin 2.0.2-25
CVE-2004-1335 (Memory leak in the ip_options_get function in the Linux kernel
before ...)
- NOTE: Fixed in upstream 2.6.10
- - kernel-source-2.6.8 2.6.8-11
- - kernel-source-2.6.9 2.6.9-4
+ - linux-2.6 <not-affected> (Fixed before upload into archive; 2.6.10)
+ [sarge] - kernel-source-2.6.8 2.6.8-11
- kernel-source-2.4.27 2.4.27-9
CVE-2004-1334 (Integer overflow in the ip_options_get function in the Linux
kernel ...)
- NOTE: apparantly 2.6 only
- NOTE: Fixed in upstream 2.6.10
- - kernel-source-2.6.8 2.6.8-11
- - kernel-source-2.6.9 2.6.9-4
+ - linux-2.6 <not-affected> (Fixed before upload into archive; 2.6.10)
+ [sarge] - kernel-source-2.6.8 2.6.8-11
+ - kernel-source-2.4.27 <not-affected>
CVE-2004-1333 (Integer overflow in the vc_resize function in the Linux kernel
2.4 and ...)
- NOTE: Fixed in upstream 2.6.10
- - kernel-source-2.6.8 2.6.8-11
- - kernel-source-2.6.9 2.6.9-4
+ - linux-2.6 <not-affected> (Fixed before upload into archive; 2.6.10)
+ [sarge] - kernel-source-2.6.8 2.6.8-11
- kernel-source-2.4.27 2.4.27-9
- NOTE: will be fixed in 2.4.27-9
CVE-2004-1332 (Stack-based buffer overflow in the FTP daemon in HP-UX 11.11i,
with ...)
NOT-FOR-US: hpux
CVE-2004-1331 (The execCommand method in Microsoft Internet Explorer 6.0 SP2
allows ...)
@@ -14735,7 +14731,7 @@
{DSA-627-1}
- namazu2 2.0.14-1
CVE-2004-1317 (Stack-based buffer overflow in doexec.c in Netcat for Windows
1.1, ...)
- NOTE: apparently only affects netcat in windows
+ - netcat <not-affected> (only affects netcat in Windows)
CVE-2004-1316 (Heap-based buffer overflow in MSG_UnEscapeSearchUrl in ...)
- mozilla 2:1.7.5-1 (bug #288047)
CVE-2004-1315 (viewtopic.php in phpBB 2.x before 2.0.11 improperly URL decodes
the ...)
@@ -14747,11 +14743,11 @@
CVE-2004-1312 (A bug in the HTML parser in a certain Microsoft HTML library, as
used ...)
NOT-FOR-US: Microsoft
CVE-2004-1311 (Integer overflow in the real_setup_and_get_header function in
real.c ...)
- NOT-FOR-US: mplayer
+ - mplayer <itp>
CVE-2004-1310 (Stack-based buffer overflow in the asf_mmst_streaming.c
functionality ...)
- NOT-FOR-US: mplayer
+ - mplayer <itp>
CVE-2004-1309 (Heap-based buffer overflow in the demux_open_bmp function in
...)
- NOT-FOR-US: mplayer
+ - mplayer <itp>
CVE-2004-1308 (Integer overflow in (1) tif_dirread.c and (2) tif_fax3.c for
libtiff ...)
{DSA-617-1}
- tiff 3.6.1-4
@@ -14781,8 +14777,7 @@
CVE-2004-1296 (The (1) eqn2graph and (2) pic2graph scripts in groff 1.18.1
allow ...)
- groff 1.18.1.1-5
CVE-2004-1295 (The slip_down function in slip.c for the uml_net program in ...)
- NOTE: uml_net is only executable by users in group uml-net in Debian
- NOTE: uml-utilities-20040406 does not seem to be vulnerable, tried exploit
+ - uml-utilities <not-affected> (uml_net is only executable by users in
group uml-net)
CVE-2004-1294 (The mget function in cmds.c for tnftp 20030825 allows remote FTP
...)
- tnftp <unfixed> (bug #285902; medium)
CVE-2004-1293 (Buffer overflow in the ReadFontTbl function in reader.c for ...)
@@ -14806,7 +14801,6 @@
CVE-2004-1285 (Buffer overflow in the get_header function in
asf_mmst_streaming.c for ...)
NOT-FOR-US: mplayer
CVE-2004-1284 (Buffer overflow in the find_next_file function in playlist.c for
...)
- NOTE: non-free
NOTE: Previous fix 0.59r-18 introduced new integer overflows and caused
regressions
- mpg123 0.59r-20 (bug #287043)
CVE-2004-1283 (Buffer overflow in the Mesh::type method in mesh.c for the mview
...)
@@ -14906,14 +14900,15 @@
CVE-2004-1238
REJECTED
CVE-2004-1237 (Unknown vulnerability in the system call filtering code in the
audit ...)
- NOTE: apparently redhat specific
+ - linux-2.6 <not-affected> (Apparently Red Hat specific)
CVE-2004-1236 (Buffer overflow in the LDAP component for Netscape Directory
Server ...)
NOT-FOR-US: Netscape Directory Server on HP-UX
CVE-2004-1235 (Race condition in the (1) load_elf_library and (2) binfmt_aout
...)
- - linux-2.6 2.6.12-1 (bug #289202; high)
+ - linux-2.6 <not-affected> (Fixed before upload into archive)
+ TODO: Check, when this was fixed
- kernel-source-2.4.27 2.4.27-8 (bug #289202; bug #289708; bug #291053; high)
CVE-2004-1234 (load_elf_binary in Linux before 2.4.26 allows local users to
cause a ...)
- NOTE: fixed after 2.4.25
+ - kernel-source-2.4.27 <not-affected> (Fixed before upload into archive;
2.4.26)
CVE-2004-1233 (Integer overflow in Gadu-Gadu allows remote attackers to cause a
...)
NOT-FOR-US: Gadu-Gadu
CVE-2004-1232 (Stack-based buffer overflow in the code that sends images in
Gadu-Gadu ...)