Author: joeyh Date: 2006-12-20 09:14:20 +0100 (Wed, 20 Dec 2006) New Revision: 5152 Modified: data/CVE/list Log: automatic update Modified: data/CVE/list ==================================================================--- data/CVE/list 2006-12-19 22:53:32 UTC (rev 5151) +++ data/CVE/list 2006-12-20 08:14:20 UTC (rev 5152) @@ -1,3 +1,201 @@ +CVE-2007-0010 + RESERVED +CVE-2007-0009 + RESERVED +CVE-2007-0008 + RESERVED +CVE-2007-0007 + RESERVED +CVE-2007-0006 + RESERVED +CVE-2007-0005 + RESERVED +CVE-2007-0004 + RESERVED +CVE-2007-0003 + RESERVED +CVE-2007-0002 + RESERVED +CVE-2007-0001 + RESERVED +CVE-2006-6659 (The Microsoft Office Outlook Recipient ActiveX control (ole32.dll) in ...) + TODO: check +CVE-2006-6658 (Inktomi Search 4.1.4 allows remote attackers to obtain sensitive ...) + TODO: check +CVE-2006-6657 (The if_clone_list function in NetBSD-current before 20061027, NetBSD ...) + TODO: check +CVE-2006-6656 (Unspecified vulnerability in ptrace in NetBSD-current before 20061027, ...) + TODO: check +CVE-2006-6655 (The procfs implementation in NetBSD-current before 20061023, NetBSD ...) + TODO: check +CVE-2006-6654 (The sendmsg function in NetBSD-current before 20061023, NetBSD 3.0 and ...) + TODO: check +CVE-2006-6653 (The accept function in NetBSD-current before 20061023, NetBSD 3.0 and ...) + TODO: check +CVE-2006-6652 (Buffer overflow in the glob implementation in libc in NetBSD-current ...) + TODO: check +CVE-2006-6651 (Race condition in W29N51.SYS in the Intel 2200BG wireless driver ...) + TODO: check +CVE-2006-6650 (PHP remote file inclusion vulnerability in charts_constants.php in the ...) + TODO: check +CVE-2006-6649 (Cross-site scripting (XSS) vulnerability in display.php in HyperVM 1.2 ...) + TODO: check +CVE-2006-6648 (PHP remote file inclusion vulnerability in main.inc.php in ...) + TODO: check +CVE-2006-6647 (Cross-site scripting (XSS) vulnerability in the MySite 4.7.x before ...) + TODO: check +CVE-2006-6646 (Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) ...) + TODO: check +CVE-2006-6645 (PHP remote file inclusion vulnerability in ...) + TODO: check +CVE-2006-6644 (PHP remote file inclusion vulnerability in pages/meeting_constants.php ...) + TODO: check +CVE-2006-6643 (Fightersoft Multimedia Star FTP server 1.10 allows remote attackers to ...) + TODO: check +CVE-2006-6642 (SQL injection vulnerability in haber.asp in Contra Haber Sistemi 1.0 ...) + TODO: check +CVE-2006-6641 (Unspecified vulnerability in CA CleverPath Portal before maintenance ...) + TODO: check +CVE-2006-6640 (Multiple cross-site scripting (XSS) vulnerabilities in Omniture ...) + TODO: check +CVE-2006-6639 (Multiple unspecified vulnerabilities in chetcpasswd 2.4.1 allow local ...) + TODO: check +CVE-2006-6638 (IBM DB2 8.1 before FixPak 14 allows remote attackers to cause a denial ...) + TODO: check +CVE-2006-6637 (The Servlet Engine and Web Container in IBM WebSphere Application ...) + TODO: check +CVE-2006-6636 (Unspecified vulnerability in the Utility Classes for IBM WebSphere ...) + TODO: check +CVE-2006-6635 (PHP remote file inclusion vulnerability in includes/functions.php in ...) + TODO: check +CVE-2006-6634 (Multiple PHP remote file inclusion vulnerabilities in the ExtCalThai ...) + TODO: check +CVE-2006-6633 (PHP remote file inclusion vulnerability in include/yapbb_session.php ...) + TODO: check +CVE-2006-6632 (PHP remote file inclusion vulnerability in genepi.php in Genepi 1.6 ...) + TODO: check +CVE-2006-6631 (PHP remote file inclusion vulnerability in lib/xml/oai/GetRecord.php ...) + TODO: check +CVE-2006-6630 (PHP remote file inclusion vulnerability in ListRecords.php in osprey ...) + TODO: check +CVE-2006-6629 (lib/WeBWorK/PG/Translator.pm in WeBWorK Program Generation (PG) ...) + TODO: check +CVE-2006-6628 (Integer overflow in OpenOffice.org (OOo) 2.1 allows user-assisted ...) + TODO: check +CVE-2006-6627 (Integer overflow in the packed PE file parsing implementation in ...) + TODO: check +CVE-2006-6626 (Cross-site scripting (XSS) vulnerability in an unspecified component ...) + TODO: check +CVE-2006-6625 (Cross-site scripting (XSS) vulnerability in mod/forum/discuss.php in ...) + TODO: check +CVE-2006-6624 (The FTP Server in Sambar Server 6.4 allows remote authenticated users ...) + TODO: check +CVE-2006-6623 (Sygate Personal Firewall 5.6.2808 relies on the Process Environment ...) + TODO: check +CVE-2006-6622 (Soft4Ever Look ''n'' Stop (LnS) 2.05p2 before 20061215 relies on the ...) + TODO: check +CVE-2006-6621 (Filseclab Personal Firewall 3.0.0.8686 relies on the Process ...) + TODO: check +CVE-2006-6620 (Comodo Personal Firewall 2.3.6.81 relies on the Process Environment ...) + TODO: check +CVE-2006-6619 (AVG Anti-Virus plus Firewall 7.5.431 relies on the Process Environment ...) + TODO: check +CVE-2006-6618 (AntiHook 3.0.0.23 - Desktop relies on the Process Environment Block ...) + TODO: check +CVE-2006-6617 (projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 ...) + TODO: check +CVE-2006-6616 (index.php in w00t Gallery 1.4.0 allows remote authenticated users with ...) + TODO: check +CVE-2006-6615 (PHP remote file inclusion vulnerability in includes/act_constants.php ...) + TODO: check +CVE-2006-6614 (The save_log_local function in Fully Automatic Installation (FAI) ...) + TODO: check +CVE-2006-6613 (Directory traversal vulnerability in language.php in phpAlbum 0.4.1 ...) + TODO: check +CVE-2006-6612 (PHP remote file inclusion vulnerability in basic.inc.php in PhpMyCms ...) + TODO: check +CVE-2006-6611 (PHP remote file inclusion vulnerability in interface.php in Barman ...) + TODO: check +CVE-2006-6610 (clientcommands in Nexuiz before 2.2.1 has unknown impact and remote ...) + TODO: check +CVE-2006-6609 (Nexuiz before 2.2.1 allows remote attackers to cause a denial of ...) + TODO: check +CVE-2006-6608 (Unspecified vulnerability in SSH key based authentication in HP ...) + TODO: check +CVE-2006-6607 (The Java Key Store (JKS) for WebSphere Application Server (WAS) for ...) + TODO: check +CVE-2006-6606 (Multiple SQL injection vulnerabilities in Clarens jclarens before ...) + TODO: check +CVE-2006-6605 (Stack-based buffer overflow in the POP service in MailEnable Standard ...) + TODO: check +CVE-2006-6604 (Directory traversal vulnerability in downloaddetails.php in ...) + TODO: check +CVE-2006-6603 (Buffer overflow in the YMMAPI.YMailAttach ActiveX control (ymmapi.dll) ...) + TODO: check +CVE-2006-6602 (explorer.exe in Windows Explorer 6.00.2900.2180 in Microsoft Windows ...) + TODO: check +CVE-2006-6601 (Windows Media Player 10.00.00.4036 in Microsoft Windows XP SP2 allows ...) + TODO: check +CVE-2006-6600 (Cross-site scripting (XSS) vulnerability in dir.php in TorrentFlux ...) + TODO: check +CVE-2006-6599 (maketorrent.php in TorrentFlux 2.2 allows remote authenticated users ...) + TODO: check +CVE-2006-6598 (Directory traversal vulnerability in viewnfo.php in (1) TorrentFlux ...) + TODO: check +CVE-2006-6597 (Argument injection vulnerability in HyperAccess 8.4 allows ...) + TODO: check +CVE-2006-6596 (HyperAccess 8.4 allows user-assisted remote attackers to execute ...) + TODO: check +CVE-2006-6595 (Multiple SQL injection vulnerabilities in ScriptMate User Manager 2.1 ...) + TODO: check +CVE-2006-6594 (SQL injection vulnerability in utilities/usermessages.asp in ...) + TODO: check +CVE-2006-6593 (PHP remote file inclusion vulnerability in zufallscodepart.php in ...) + TODO: check +CVE-2006-6592 (Multiple PHP remote file inclusion vulnerabilities in Bloq 0.5.4 allow ...) + TODO: check +CVE-2006-6591 (PHP remote file inclusion vulnerability in fonctions/template.php in ...) + TODO: check +CVE-2006-6590 (PHP remote file inclusion vulnerability in usercp_menu.php in AR ...) + TODO: check +CVE-2006-6589 (Cross-site scripting (XSS) vulnerability in ...) + TODO: check +CVE-2006-6588 (The forum implementation in the ecommerce component in the Apache Open ...) + TODO: check +CVE-2006-6587 (Cross-site scripting (XSS) vulnerability in the forum implementation ...) + TODO: check +CVE-2006-6586 (Multiple PHP remote file inclusion vulnerabilities in Vortex Blog ...) + TODO: check +CVE-2006-6585 (The Extensions manager in Mozilla Firefox 2.0 does not properly ...) + TODO: check +CVE-2006-6584 (Multiple buffer overflows in italkplus (Italk+) before 0.92.1 allow ...) + TODO: check +CVE-2006-6583 (ScriptMate User Manager 2.1 and earlier allow remote attackers to ...) + TODO: check +CVE-2006-6582 (Multiple cross-site scripting (XSS) vulnerabilities in ScriptMate User ...) + TODO: check +CVE-2006-6581 (PHP remote file inclusion vulnerability in tests/debug_test.php in ...) + TODO: check +CVE-2006-6580 (admin/change.php in ProNews 1.5 does not check whether a user is ...) + TODO: check +CVE-2006-6579 (Microsoft Windows XP has weak permissions (FILE_WRITE_DATA and ...) + TODO: check +CVE-2006-6578 (Microsoft Internet Information Services (IIS) 5.1 permits the ...) + TODO: check +CVE-2006-6577 (SQL injection vulnerability in polls.php in Neocrome Land Down Under ...) + TODO: check +CVE-2006-6576 (Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 ...) + TODO: check +CVE-2006-6575 (PHP remote file inclusion vulnerability in ldap.php in Brian Drawert ...) + TODO: check +CVE-2006-6574 (Mantis before 1.1.0a2 does not implement per-item access control for ...) + TODO: check +CVE-2004-2666 (Mantis before 20041016 provides a complete Issue History (Bug History) ...) + TODO: check +CVE-2003-1312 (siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder places a ...) + TODO: check +CVE-2003-1311 (siteminderagent/SmMakeCookie.ccc in Netegrity SiteMinder does not ...) + TODO: check CVE-2006-XXXX [gaim crash when receiving an invalid UPnP response] - gaim 1:2.0.0+beta5-9 (low) [sarge] - gaim <no-dsa> (minor issue) @@ -49,7 +247,7 @@ [sarge] - proftpd <not-affected> (Vulnerable code not activated in binary build) CVE-2006-6562 RESERVED -CVE-2006-6561 (Unspecified vulnerability in Microsoft Word allows user-assisted ...) +CVE-2006-6561 (Unspecified vulnerability in Microsoft Word 2000, 2002, and Word ...) NOT-FOR-US: Microsoft CVE-2006-6560 (PHP remote file inclusion vulnerability in includes/common.php in the ...) NOT-FOR-US: mx_modsdb 1.0.0 module for MxBBmx_modsdb 1.0.0 module for MxBB @@ -158,25 +356,21 @@ NOT-FOR-US: SiteKiosk CVE-2006-6508 (Cross-site request forgery (CSRF) vulnerability in phpBB 2.0.21 allows ...) - phpbb2 <unfixed> (bug #402140) -CVE-2006-6507 [XSS using outer window''s Function object] - RESERVED +CVE-2006-6507 (Mozilla Firefox 2.0 before 2.0.0.1 allows remote attackers to bypass ...) NOTE: MFSA-2006-76 - iceweasel <unfixed> (high) - xulrunner <unfixed> (high) - iceape <unfixed> (high) -CVE-2006-6506 [ RSS Feed-preview referrer leak] - RESERVED +CVE-2006-6506 (The "Feed Preview" feature in Mozilla Firefox 2.0 before 2.0.0.1 sends ...) NOTE: MFSA-2006-75 - iceweasel <unfixed> (low) - xulrunner <unfixed> (low) - iceape <unfixed> (low) -CVE-2006-6505 [Mail header processing heap overflows] - RESERVED +CVE-2006-6505 (Multiple heap-based buffer overflows in Mozilla Thunderbird before ...) NOTE: MFSA-2006-74 - mozilla-thunderbird <removed> (high) - icedove <unfixed> (high) -CVE-2006-6504 [Mozilla SVG Processing Remote Code Execution] - RESERVED +CVE-2006-6504 (Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, and ...) NOTE: MFSA-2006-73 - iceweasel <unfixed> (high) - xulrunner <unfixed> (high) @@ -184,8 +378,7 @@ - firefox <removed> (high) - mozilla <removed> (high) - mozilla-firefox <removed> (high) -CVE-2006-6503 [XSS by setting img.src to javascript: URI] - RESERVED +CVE-2006-6503 (Mozilla Firefox 2.x before 2.0.0.1, 1.5.x before 1.5.0.9, Thunderbird ...) NOTE: MFSA-2006-72 - iceweasel <unfixed> (high) - xulrunner <unfixed> (high) @@ -193,8 +386,7 @@ - firefox <removed> (high) - mozilla <removed> (high) - mozilla-firefox <removed> (high) -CVE-2006-6502 [LiveConnect crash finalizing JS objects] - RESERVED +CVE-2006-6502 (Use-after-free vulnerability in the LiveConnect bridge code for ...) NOTE: MFSA-2006-71 - iceweasel <unfixed> (high) - xulrunner <unfixed> (high) @@ -204,8 +396,7 @@ - mozilla-firefox <removed> (high) - mozilla-thunderbird <removed> (low) - icedove <unfixed> (low) -CVE-2006-6501 [Privilege escallation using watch point] - RESERVED +CVE-2006-6501 (Unspecified vulnerability in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x ...) NOTE: MFSA-2006-70 - iceweasel <unfixed> (high) - xulrunner <unfixed> (high) @@ -215,8 +406,7 @@ - mozilla-firefox <removed> (high) - mozilla-thunderbird <removed> (low) - icedove <unfixed> (low) -CVE-2006-6500 [CSS cursor image buffer overflow (Windows only)] - RESERVED +CVE-2006-6500 (Heap-based buffer overflow in Mozilla Firefox 2.x before 2.0.0.1, ...) NOTE: MFSA-2006-69 - iceweasel <not-affected> (windows only) - xulrunner <not-affected> (windows only) @@ -226,8 +416,7 @@ - mozilla-firefox <not-affected> (windows only) - mozilla-thunderbird <not-affected> (windows only) - icedove <not-affected> (windows only) -CVE-2006-6499 [Crashes with evidence of memory corruption] - RESERVED +CVE-2006-6499 (The js_dtoa function in Mozilla Firefox 2.x before 2.0.0.1, 1.5.x ...) NOTE: MFSA-2006-68 - iceweasel <unfixed> (high) - xulrunner <unfixed> (high) @@ -237,8 +426,7 @@ - mozilla-firefox <removed> (high) - mozilla-thunderbird <removed> (low) - icedove <unfixed> (low) -CVE-2006-6498 [Crashes with evidence of memory corruption] - RESERVED +CVE-2006-6498 (Multiple unspecified vulnerabilities in the JavaScript engine for ...) NOTE: MFSA-2006-68 - iceweasel <unfixed> (high) - xulrunner <unfixed> (high) @@ -248,8 +436,7 @@ - mozilla-firefox <removed> (high) - mozilla-thunderbird <removed> (low) - icedove <unfixed> (low) -CVE-2006-6497 [Crashes with evidence of memory corruption] - RESERVED +CVE-2006-6497 (Multiple unspecified vulnerabilities in the layout engine for Mozilla ...) NOTE: MFSA-2006-68 - iceweasel <unfixed> (medium) - xulrunner <unfixed> (medium) @@ -298,12 +485,12 @@ NOT-FOR-US: AnnonceScriptHP CVE-2006-6478 (Multiple SQL injection vulnerabilities in AnnonceScriptHP 2.0 allow ...) NOT-FOR-US: AnnonceScriptHP -CVE-2006-6477 - RESERVED -CVE-2006-6476 - RESERVED -CVE-2006-6475 - RESERVED +CVE-2006-6477 (FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in ...) + TODO: check +CVE-2006-6476 (FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in ...) + TODO: check +CVE-2006-6475 (FRAgent.exe in Mandiant First Response (MFR) before 1.1.1, when run in ...) + TODO: check CVE-2006-6474 (Untrusted search path vulnerability in McAfee VirusScan for Linux ...) NOT-FOR-US: McAfee CVE-2006-6473 (Multiple unspecified vulnerabilities in Xerox WorkCentre and ...) @@ -584,7 +771,7 @@ NOT-FOR-US: deV!L`z Clanportal CVE-2006-6338 (Unrestricted file upload vulnerability in upload/index.php in deV!L`z ...) NOT-FOR-US: deV!L`z Clanportal -CVE-2006-6337 (Multiple SQL injection vulnerabilities in giris.asp in Aspee Ziyaretci ...) +CVE-2006-6337 (Multiple SQL injection vulnerabilities in giris.asp in Aspee and ...) NOT-FOR-US: Aspee Ziyaretci Defteri CVE-2006-6336 RESERVED @@ -683,7 +870,7 @@ NOT-FOR-US: MailEnable CVE-2006-6289 (Woltlab Burning Board (wBB) Lite 1.0.2 does not properly unset ...) NOT-FOR-US: Woltlab Burning Board -CVE-2006-6288 (Multiple buffer overflows in Niek Albers CoolPlayer 215 and earlier ...) +CVE-2006-6288 (Multiple buffer overflows in Niek Albers CoolPlayer 216 and earlier ...) NOT-FOR-US: Niek Albers CoolPlayer CVE-2006-6287 (Stack-based buffer overflow in AtomixMP3 2.3 and earlier allows remote ...) NOT-FOR-US: AtomixMP3 @@ -1079,8 +1266,7 @@ NOT-FOR-US: EC-CUBE CVE-2006-6107 (Unspecified vulnerability in the match_rule_equal function in ...) - dbus 1.0.2-1 -CVE-2006-6106 [kernel bluetooth CAPI issue] - RESERVED +CVE-2006-6106 (Multiple buffer overflows in the cmtp_recv_interopmsg function in the ...) - linux-2.6 <unfixed> CVE-2006-6105 (Format string vulnerability in the host chooser window (gdmchooser) in ...) - gdm 2.16.4-1 (medium; bug #403219) @@ -1567,7 +1753,7 @@ NOT-FOR-US: Munch Pro CVE-2006-5879 (SQL injection vulnerability in default1.asp in ASPPortal 4.0.0 beta ...) NOT-FOR-US: ASPPortal -CVE-2006-5878 (Cross-site Request Forgery (CSRF) vulnerability in Trac before 0.10.1 ...) +CVE-2006-5878 (Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 ...) NOT-FOR-US: Dupe of CVE-2006-5848 CVE-2006-5877 RESERVED @@ -1583,8 +1769,7 @@ {DSA-1230-1} - l2tpns 2.1.21-1 (medium; bug #401742) NOTE: http://secunia.com/advisories/23230/ -CVE-2006-5872 - RESERVED +CVE-2006-5872 (Unspecified vulnerability in login.pl in SQL Ledger before 2.6.21 ...) {DSA-1239-1} CVE-2006-5871 (smbfs in Linux kernel 2.6.8 and other versions, and 2.4.x before ...) {DSA-1237 DSA-1233} @@ -1633,7 +1818,8 @@ NOT-FOR-US: Essentia Web Server CVE-2006-5849 (PHP remote file inclusion vulnerability in inc/irayofuncs.php in ...) NOT-FOR-US: IrayoBlog -CVE-2006-5848 (Cross-site request forgery (CSRF) vulnerability in Edgewall Trac 0.10 ...) +CVE-2006-5848 + REJECTED {DSA-1209} - trac 0.10.1-1 (bug #397683) CVE-2006-5847 (Cross-site scripting (XSS) vulnerability in index.php in FreeWebshop ...) @@ -2000,8 +2186,8 @@ RESERVED CVE-2006-5682 RESERVED -CVE-2006-5681 - RESERVED +CVE-2006-5681 (QuickTime for Java on Mac OS X 10.4 through 10.4.8, when used with ...) + TODO: check CVE-2006-5680 (The libarchive library in FreeBSD 6-STABLE after 2006-09-05 and before ...) - libarchive 1.3.1-1 CVE-2006-5679 (Integer overflow in the ffs_mountfs function in FreeBSD 6.1 allows ...) @@ -3871,8 +4057,8 @@ RESERVED CVE-2006-4815 RESERVED -CVE-2006-4814 - RESERVED +CVE-2006-4814 (The mincore function in the Linux kernel before 2.4.33.6 does not ...) + TODO: check CVE-2006-4813 (The __block_prepare_write function in fs/buffer.c for Linux kernel ...) {DSA-1233} - linux-2.6 2.6.13-1 @@ -5986,8 +6172,8 @@ NOT-FOR-US: Microsoft CVE-2006-3897 (Stack overflow in Microsoft Internet Explorer 6 on Windows 2000 allows ...) NOT-FOR-US: Microsoft -CVE-2006-3896 - RESERVED +CVE-2006-3896 (The NeoScale Systems CryptoStor 700 series appliance before 2.6 relies ...) + TODO: check CVE-2006-3895 RESERVED CVE-2006-3894 @@ -28775,7 +28961,7 @@ NOT-FOR-US: Foxmail CVE-2005-0635 (Buffer overflow in Foxmail Server 2.0 allows remote attackers to ...) NOT-FOR-US: Foxmail -CVE-2005-0634 (Buffer overflow in Golden FTP Server 1.92 allows remote attackers to ...) +CVE-2005-0634 (Buffer overflow in Golden FTP Server 1.92 allows ...) NOT-FOR-US: Golden FTP Server CVE-2005-0633 (Buffer overflow in Trillian 3.0 and Pro 3.0 allows remote attackers to ...) NOT-FOR-US: Trillian @@ -28938,7 +29124,7 @@ NOT-FOR-US: Soldier of Fortune II CVE-2005-0567 (Multiple PHP remote file inclusion vulnerabilities in phpMyAdmin 2.6.1 ...) - phpmyadmin 3:2.6.1-pl2-1 -CVE-2005-0566 (Buffer overflow in Golden FTP Server Pro 2.x allows remote attackers ...) +CVE-2005-0566 (Buffer overflow in Golden FTP Server Pro (goldenftpd) 2.x allows ...) NOT-FOR-US: Golden FTP Server CVE-2005-0565 (The Announce module in phpWebSite 0.10.0 and earlier allows remote ...) NOT-FOR-US: phpWebSite