Author: jmm-guest
Date: 2006-11-16 19:13:25 +0100 (Thu, 16 Nov 2006)
New Revision: 4971
Modified:
data/CVE/list
Log:
avahi CVEfied
libx11 fixed
new texinfo issue
several no-dsa for minor issues
Modified: data/CVE/list
==================================================================---
data/CVE/list 2006-11-15 21:59:18 UTC (rev 4970)
+++ data/CVE/list 2006-11-16 18:13:25 UTC (rev 4971)
@@ -494,8 +494,6 @@
NOT-FOR-US: DigiOz Guestbook
CVE-2006-5650 (The ICQPhone.SipxPhoneManager ActiveX control in America Online
ICQ ...)
NOT-FOR-US: ICQPhone.SipxPhoneManager
-CVE-2006-XXXX [avahi fake netlink message vulnerability ]
- - avahi 0.6.15-1 (low)
CVE-2006-5649
RESERVED
CVE-2006-5648
@@ -920,7 +918,7 @@
- xulrunner <unfixed> (high)
- mozilla-thunderbird <removed> (medium)
CVE-2006-5461 (Avahi before 0.6.15 does not verify the sender identity of
netlink ...)
- TODO: check
+ - avahi 0.6.15-1 (low)
CVE-2006-XXXX [diffmon information leakage]
- diffmon 20020222-2.2 (bug #382132)
CVE-2006-5460 (** DISPUTED ** ...)
@@ -1055,7 +1053,7 @@
CVE-2006-5398 (SQL injection vulnerability in comments.php in Simplog 0.9.3.1
allows ...)
NOT-FOR-US: Simplog
CVE-2006-5397 (The Xinput module (modules/im/ximcp/imLcIm.c) in X.Org libX11
1.0.2 ...)
- - libx11 <unfixed> (low; bug #398460)
+ - libx11 2:1.0.3-3 (low; bug #398460)
CVE-2006-5396 (The tcp_fuse_rcv_drain function in the Sun Solaris 10 kernel
before ...)
NOT-FOR-US: Sun Solaris
CVE-2006-5395 (Buffer overflow in Microsoft Class Package Export Tool (aka ...)
@@ -1271,8 +1269,10 @@
NOT-FOR-US: Gcontact
CVE-2006-5298 (The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and
...)
- mutt <unfixed> (bug #396104; low)
+ [sarge] - mutt <no-dsa> (Minor issue, tmp dirs on NFS cause problems in
many scenarios)
CVE-2006-5297 (Race condition in the safe_open function in the Mutt mail client
...)
- mutt <unfixed> (bug #396104; low)
+ [sarge] - mutt <no-dsa> (Minor issue, tmp dirs on NFS cause problems in
many scenarios)
CVE-2006-5296 (Buffer overflow in Microsoft Office 2003 PowerPoint allows ...)
NOT-FOR-US: Microsoft
CVE-2006-5294 (Cross-site scripting (XSS) vulnerability in index.php in phplist
...)
@@ -1480,7 +1480,7 @@
CVE-2006-5199 (Adobe Contribute Publishing Server leaks the administrator
password in ...)
NOT-FOR-US: Adobe
CVE-2006-5198 (The WZFILEVIEW.FileViewCtrl.61 ActiveX control (aka Sky Software
...)
- TODO: check
+ NOT-FOR-US: WinZip
CVE-2006-5197 (PDshopPro stores sensitive information under the web root with
...)
NOT-FOR-US: PDshopPro
CVE-2006-5196 (The HTTP interface in the Motorola SURFboard SB4200 Cable Modem
allows ...)
@@ -2304,7 +2304,8 @@
- qt-x11-free 3:3.3.7-1 (bug #394192; bug #394313)
- qt4-x11 4.2.1-1 (bug #394192)
CVE-2006-4810 (Buffer overflow in the readline function in util/texindex.c, as
used ...)
- TODO: check
+ - texinfo <unfixed>
+ TODO: File bug
CVE-2006-4809 (Stack-based buffer overflow in loader_pnm.c in imlib2 before
1.2.1, ...)
- imlib2 1.3.0.0debian1-3 (medium; bug #397371)
CVE-2006-4808 (Heap-based buffer overflow in loader_tga.c in imlib2 before
1.2.1, and ...)
@@ -2558,15 +2559,15 @@
CVE-2006-4692 (Argument injection vulnerability in the Windows Object Packager
...)
NOT-FOR-US: Microsoft Word
CVE-2006-4691 (Buffer overflow in the Workstation service in Microsoft Windows
2000 ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2006-4690
RESERVED
CVE-2006-4689 (Unspecified vulnerability in the driver for the Client Service
for ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2006-4688 (Buffer overflow in Client Service for NetWare (CSNW) in
Microsoft ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2006-4687 (Microsoft Internet Explorer 5.01 through 6 allows remote
attackers to ...)
- TODO: check
+ NOT-FOR-US: Microsoft
CVE-2006-4686 (Buffer overflow in the Extensible Stylesheet Language
Transformations ...)
NOT-FOR-US: Microsoft
CVE-2006-4685 (The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML
Core ...)
@@ -6860,7 +6861,9 @@
- squirrelmail 2:1.4.7-1 (unimportant; bug #373731)
NOTE: Only exploitable with register_globals enabled
CVE-2006-XXXX [webalizer: symlink vulnerability]
- - webalizer 2.01.10-29 (bug #359745)
+ - webalizer 2.01.10-29 (low; bug #359745)
+ [sarge] - webalizer <no-dsa> (Minor issue)
+ NOTE: Only exploitable in far-fetched scenarios, running it as root is
insecure anyway
CVE-2006-2805 (SQL injection vulnerability in VBulletin 3.0.10 allows remote
...)
NOT-FOR-US: vBulletin
CVE-2006-2804 (Cross-site scripting (XSS) vulnerability in index.cfm in Goss
...)
@@ -10619,9 +10622,11 @@
CVE-2006-1281 (Cross-site scripting (XSS) vulnerability in member.php in ...)
NOT-FOR-US: MyBB
CVE-2006-1280 (CGI::Session 4.03-1 does not set proper permissions on temporary
files ...)
- - libcgi-session-perl 4.07-1 (bug #356555)
+ - libcgi-session-perl 4.07-1 (low; bug #356555)
+ [sarge] - libcgi-session-perl <no-dsa> (Minor issues)
CVE-2006-1279 (CGI::Session 4.03-1 allows local users to overwrite arbitrary
files ...)
- - libcgi-session-perl 4.11-1 (bug #356555)
+ - libcgi-session-perl 4.11-1 (low; bug #356555)
+ [sarge] - libcgi-session-perl <no-dsa> (Minor issues)
CVE-2006-1278 (SQL injection vulnerability in @1 File Store 2006.03.07 allows
remote ...)
NOT-FOR-US: @1 File Store
CVE-2006-1277 (Cross-site scripting (XSS) vulnerability in signup.php in @1
File ...)
@@ -11385,6 +11390,7 @@
NOT-FOR-US: NOD32
CVE-2006-0950 (unalz 0.53 allows user-assisted attackers to overwrite arbitrary
...)
- unalz 0.55-1 (bug #356832; low)
+ [sarge] - unalz <no-dsa> (Minor issue)
CVE-2006-0949 (RaidenHTTPD 1.1.47 allows remote attackers to obtain source code
of ...)
NOT-FOR-US: RaidenHTTPD
CVE-2006-0948 (AOL 9.0 Security Edition revision 4184.2340, and probably other
...)
@@ -12155,6 +12161,7 @@
NOT-FOR-US: Invision Power Board
CVE-2006-0632 (The gen_rand_string function in phpBB 2.0.19 uses insufficiently
...)
- phpbb2 2.0.20 (low)
+ [sarge] - phpbb2 <no-dsa> (Minor issue)
NOTE: According to maintainers phpbb2 doesn''t have useful
countermeasures against
NOTE: brute-force password guessing and as password seeding is based on
milliseconds
NOTE: NTP-timed attacks may even be in the area of a couple thousands attempts
@@ -23268,9 +23275,9 @@
NOT-FOR-US: sysreport
CVE-2005-1759 (Race condition in shtool 2.0.1 and earlier allows local users to
...)
- shtool 2.0.1-2 (low)
+ [sarge] - shtool <no-dsa> (Minor issue)
- mysql-ocaml 1.0.3-6 (unimportant)
- php4 4:4.4.0-1 (low)
- [sarge] - php4 4:4.3.10-16 (low)
CVE-2005-1758 (Buffer overflow in the IMAP command continuation function in
Novell ...)
NOT-FOR-US: Novell
CVE-2005-1757 (Buffer overflow in the Modweb agent for Novell NetMail 3.52
before ...)
@@ -23280,9 +23287,9 @@
CVE-2005-1751 (Race condition in shtool 2.0.1 and earlier allows local users to
...)
{DSA-789-1 DTSA-15-1}
- shtool 2.0.1-2 (bug #311206; low)
+ [sarge] - shtool <no-dsa> (Minor issue)
- mysql-ocaml 1.0.3-6 (bug #314464; unimportant)
- php4 4:4.3.10-16 (low)
- [sarge] - php4 4:4.3.10-16 (low)
CVE-2004-2136 (dm-crypt on Linux kernel 2.6.x, when used on certain file
systems ...)
TODO: This looks like a minor issue, the paper is from Feb 2004, check whether
this still applies
CVE-2004-2135 (cryptoloop on Linux kernel 2.6.x, when used on certain file
systems ...)