Moritz Muehlenhoff
2005-Dec-14 22:02 UTC
[Secure-testing-commits] r3046 - in data: CVE DSA
Author: jmm-guest
Date: 2005-12-14 22:02:11 +0000 (Wed, 14 Dec 2005)
New Revision: 3046
Modified:
data/CVE/list
data/DSA/list
Log:
two more months of DSAs converted
Modified: data/CVE/list
==================================================================---
data/CVE/list 2005-12-14 21:14:19 UTC (rev 3045)
+++ data/CVE/list 2005-12-14 22:02:11 UTC (rev 3046)
@@ -20054,7 +20054,7 @@
CVE-2002-1566 (netris 0.5, and possibly other versions before 0.52, when
running with ...)
- netris 0.52-1
CVE-2002-1565 (Buffer overflow in url_filename function for wget 1.8.1 allows
...)
- - wget 1.8.1-6.1
+ - wget 1.8.2-8
CVE-2002-1564 (Internet Explorer 5.5 and 6.0 allows remote attackers to steal
...)
NOT-FOR-US: microsoft
CVE-2002-1563 (stunnel 4.0.3 and earlier allows attackers to cause a denial of
...)
@@ -20332,7 +20332,7 @@
TODO: check wget, ftp, ncftp, etc.
CVE-2002-1344 (Directory traversal vulnerability in wget before 1.8.2-4 allows
a ...)
{DSA-209}
- - wget 1.8.1-6.1
+ - wget 1.8.2-8
CVE-2002-1343
RESERVED
CVE-2002-1342 (Unknown vulnerability in smb2www 980804-16 and earlier allows
remote ...)
@@ -20433,8 +20433,10 @@
NOT-FOR-US: Novell iManager (eMFrame)
CVE-2002-1282 (Unknown vulnerability in the telnet KIO subsystem
(telnet.protocol) of ...)
{DSA-204}
+ - kdelibs 4:3.1.0-1
CVE-2002-1281 (Unknown vulnerability in the rlogin KIO subsystem
(rlogin.protocol) of ...)
{DSA-204}
+ - kdelibs 4:3.1.0-1
CVE-2002-1280 (Memory leak in RealSecure Event Collector 6.5 allows attackers
to ...)
NOT-FOR-US: RealSecure Event Collector
CVE-2002-1279 (Multiple buffer overflows in conf.c for Masqmail 0.1.x before
0.1.17, ...)
@@ -21129,6 +21131,7 @@
NOT-FOR-US: no_package
CVE-2002-0666 (IPSEC implementations including (1) FreeS/WAN and (2) KAME do
not ...)
{DSA-201}
+ - freeswan 1.99-1
CVE-2002-0664 (The default Access Control Lists (ACLs) of the administration
database ...)
NOT-FOR-US: ZMerge
CVE-2002-0661 (Directory traversal vulnerability in Apache 2.0 through 2.0.39
on ...)
@@ -21676,6 +21679,9 @@
{DSA-210}
- lynx 2.8.4.1b-4
- lynx-ssl 1:2.8.4.1b-3.1
+CVE-2002-XXXX [Cross-Site-Scripting in Bugzilla]
+ {DSA-218}
+ - bugzilla 2.16.2-1
CVE-2002-1403 (dhcpcd DHCP client daemon 1.3.22 and earlier allows local users
to ...)
{DSA-219}
- dhcpcd 1:1.3.22pl2-2
@@ -21686,8 +21692,7 @@
NOTE: woody is not vulnerable
CVE-2002-1394 (Apache Tomcat 4.0.5 and earlier, when using both the invoker
servlet ...)
{DSA-225}
- - tomcat4 4.1.9-1
- NOTE: no problem in sarge packages
+ - tomcat4 4.1.16-1
CVE-2002-1392 (faxspool in mgetty before 1.1.29 uses a world-writable spool
directory ...)
- mgetty 1.1.30-1
NOTE: woody version seems to be vulnerable see bug #199351
@@ -21729,16 +21734,13 @@
NOTE: Martin Schulze don''t consider this as an issue for updating
woody.
CVE-2002-1375 (The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x
to ...)
{DSA-212}
- - mysql-dfsg 4.0.7.gamma-1
- NOTE: bug in mysql 3, sarge uses mysql 4
+ - mysql <removed>
CVE-2002-1374 (The COM_CHANGE_USER command in MySQL 3.x before 3.23.54, and 4.x
...)
{DSA-212}
- - mysql-dfsg 4.0.7.gamma-1
- NOTE: bug in mysql 3, sarge uses mysql 4
+ - mysql <removed>
CVE-2002-1373 (Signed integer vulnerability in the COM_TABLE_DUMP package for
MySQL ...)
{DSA-212}
- - mysql-dfsg 4.0.7.gamma-1
- NOTE: bug in mysql 3, sarge uses mysql 4
+ - mysql <removed>
CVE-2002-1372 (Common Unix Printing System (CUPS) 1.1.14 through 1.1.17 does
not ...)
{DSA-232}
- cupsys 1.1.18-1
@@ -21767,14 +21769,15 @@
CVE-2002-1362 (mICQ 0.4.9 and earlier allows remote attackers to cause a denial
of ...)
{DSA-211}
- micq 0.4.9.4-1
- NOTE: micq not in sarge
CVE-2002-1361 (overflow.cgi CGI script in Sun Cobalt RaQ 4 with the SHP
(Security ...)
NOT-FOR-US: sun
CVE-2002-1350 (The BGP decoding routines in tcpdump 3.6.x before 3.7 do not
properly ...)
{DSA-206}
- - tcpdump 3.7.1-1
- NOTE: 3.7.1-1.2 fixes a different issue.
+ - tcpdump 3.7.2-1
NOTE: The fix from 3.6.2-2.2 was not upload to unstable.
+CVE-2002-XXXX [Multiple buffer overflows in gtetrinet]
+ {DSA-205}
+ - gtetrinet 0.4.4-1
CVE-2002-1349 (Buffer overflow in pop3trap.exe for PC-cillin 2000, 2002, and
2003 ...)
NOT-FOR-US: PC-cillin
CVE-2002-1348 (w3m before 0.3.2.2 does not properly escape HTML tags in the ALT
...)
@@ -21955,8 +21958,10 @@
NOT-FOR-US: pam_xauth
CVE-2002-1159 (Canna 3.6 and earlier does not properly validate requests, which
...)
{DSA-224}
+ - canna 3.6p1-1
CVE-2002-1158 (Buffer overflow in the irw_through function for Canna 3.5b2 and
...)
{DSA-224}
+ - canna 3.6p1-1
CVE-2002-1157 (Cross-site scripting vulnerability in the mod_ssl Apache module
2.8.9 ...)
{DSA-181}
CVE-2002-1156 (Apache 2.0.42 allows remote attackers to view the source code of
a CGI ...)
@@ -22227,6 +22232,7 @@
- apache 1.3.27-0.1
CVE-2002-0836 (dvips converter for Postscript files in the tetex package calls
the ...)
{DSA-207}
+ - tetex-bin 1.0.7+20021025-4
CVE-2002-0835 (Preboot eXecution Environment (PXE) server allows remote
attackers to ...)
NOT-FOR-US: RedHat/Intel PXE daemon
NOTE: this is not the one in Debian
Modified: data/DSA/list
==================================================================---
data/DSA/list 2005-12-14 21:14:19 UTC (rev 3045)
+++ data/DSA/list 2005-12-14 22:02:11 UTC (rev 3046)
@@ -2604,93 +2604,85 @@
[woody] - libmcrypt 2.5.0-1woody1
[13 Jan 2003] DSA-227 openldap2 - buffer overflows and other bugs
{CVE-2002-1378 CVE-2002-1379 CVE-2002-1508}
- - openldap2 2.0.27-3
+ [woody] - openldap2 2.0.23-6.3
[10 Jan 2003] DSA-226 xpdf-i - integer overflow
{CVE-2002-1384}
- - xpdf 2.01-2
+ [woody] - xpdf <not-affected> (xpdf-i is only a dummy package)
[09 Jan 2003] DSA-225 tomcat4 - source disclosure
{CVE-2002-1394}
- - tomcat4 4.1.16-1
- NOTE: another RC (unreproducible?) bug and missing deps (#263201)
- NOTE: are keeping the fix out of testing
- NOTE: this is the second unfixed security hole in tomcat4 in testing..
+ [woody] - tomcat4 4.0.3-3woody2
[08 Jan 2003] DSA-224 canna - buffer overflow and more
{CVE-2002-1158 CVE-2002-1159}
- - canna 3.6p1-1
+ [woody] - canna 3.5b2-46.2
[07 Jan 2003] DSA-223 geneweb - information exposure
{CVE-2002-1390}
- - geneweb 4.09-1
+ [woody] - geneweb 4.06-2
[06 Jan 2003] DSA-222 xpdf - integer overflow
{CVE-2002-1384}
- - xpdf 2.01-2
+ [woody] - xpdf 1.00-3.1
[03 Jan 2003] DSA-221 mhonarc - cross site scripting
{CVE-2002-1388}
- - mhonarc 2.5.14-1
+ [woody] - mhonarc 2.5.2-1.3
[02 Jan 2003] DSA-220 squirrelmail - cross site scripting
{CVE-2002-1341}
- - squirrelmail 1:1.3.2-2
-
-------- These processed by Djoum? SALVETTI <salvetti@crans.org> -----
-
+ [woody] - squirrelmail 1.2.6-1.3
[31 Dec 2002] DSA-219 dhcpcd - remote command execution
{CVE-2002-1403}
- - dhcpcd 1:1.3.22pl2-2
+ NOTE: Woody doesn''t have dhcpd
[30 Dec 2002] DSA-218 bugzilla - cross site scripting
- NOTE: not in testing, fixed in unstable (bugzilla 2.16.2-1).
+ [woody] - bugzilla 2.14.2-0woody3
[27 Dec 2002] DSA-217 typespeed - buffer overflow
{CVE-2002-1389}
- - typespeed 0.4.2-2
+ [woody] - typespeed 0.4.1-2.1
[24 Dec 2002] DSA-216 fetchmail - buffer overflow
{CVE-2002-1365}
- - fetchmail 6.2.0-1
+ [woody] - fetchmail 5.9.11-6.2
[23 Dec 2002] DSA-215 cyrus-imapd - buffer overflow
{CVE-2002-1580}
- - cyrus-imapd 1.5.19-9.10
-[20 Dec 2002] DSA-214 kdnetwork - buffer overflows
+ [woody] - cyrus-imapd 1.5.19-9.1
+[20 Dec 2002] DSA-214 kdenetwork - buffer overflows
{CVE-2002-1306}
- - kdenetwork 4:2.2.2-14.20
- NOTE: there is a typo in the DSA, the name of the package is kdenetwork.
+ [woody] - kdenetwork 2.2.2-14.5
[19 Dec 2002] DSA-213 libpng - buffer overflow
{CVE-2002-1363}
- - libpng 1.0.12-7
- - libpng3 1.2.5-8
+ [woody] - libpng 1.0.12-3.woody.3
+ [woody] - libpng3 1.2.1-1.1.woody.3
[17 Dec 2002] DSA-212 mysql - multiple problems
{CVE-2002-1373 CVE-2002-1374 CVE-2002-1375 CVE-2002-1376}
- - mysql-dfsg 4.0.7.gamma-1
+ [woody] - mysql 3.23.49-8.2
[13 Dec 2002] DSA-211 micq - denial of service
{CVE-2002-1362}
- NOTE: not in testing nor unstable (was fixed in 0.4.9.4-1)
+ [woody] - micq 0.4.9-0woody3
[13 Dec 2002] DSA-210 lynx - CRLF injection
{CVE-2002-1405}
- - lynx 2.8.4.1b-4
- NOTE: lynx-ssl not in testing nor unstable.
+ [woody] - lynx 2.8.3-1.1
+ [woody] - lynx-ssl 2.8.3.1-1.1
[12 Dec 2002] DSA-209 wget - directory traversal
{CVE-2002-1344}
- - wget 1.8.2-8
+ [woody] - wget 1.8.1-6.1
[12 Dec 2002] DSA-208 perl - broken safe compartment
{CVE-2002-1323}
- - perl 5.8.0-14
+ [woody] - perl 5.6.1-8.2
[11 Dec 2002] DSA-207 tetex-bin - arbitrary command execution
{CVE-2002-0836}
- - tetex-bin 1.0.7+20021025-4
+ [woody] - tetex-bin 1.0.7+20011202-7.1
[10 Dec 2002] DSA-206 tcpdump - denial of service
{CVE-2002-1350}
- - tcpdump 3.7.2-1
+ [woody] - tcpdump 3.6.2-2.2
[10 Dec 2002] DSA-205 gtetrinet - buffer overflow
- - gtetrinet 0.4.4-1
- NOTE: no CVE for this one
+ [woody] - gtetrinet 0.4.1-9woody1.1
[05 Dec 2002] DSA-204 kdelibs - arbitrary program execution
{CVE-2002-1281 CVE-2002-1282}
- - kdelibs 4:3.1.0-1
+ [woody] - kdelibs 2.2.2-13.woody.5
[04 Dec 2002] DSA-203 smb2www - arbitrary command execution
{CVE-2002-1342}
- - smb2www 980804-17
+ [woody] - smb2www 980804-16.1
[03 Dec 2002] DSA-202 im - insecure temporary files
{CVE-2002-1395}
- - im 1:141-20
+ [woody] - im 141-18.1
[02 Dec 2002] DSA-201 freeswan - denial of service
- {CVE-2002-0666 VU#459371}
- - freeswan 1.99-1
+ {CVE-2002-0666}
+ [woody] - freeswan 1.96-1.4
[22 Nov 2002] DSA-200 samba - remote exploit
{CVE-2002-1318}
- samba 2.99.cvs.20020713-1