Author: joeyh
Date: 2007-04-11 21:14:14 +0000 (Wed, 11 Apr 2007)
New Revision: 5647
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
==================================================================---
data/CVE/list 2007-04-11 19:51:12 UTC (rev 5646)
+++ data/CVE/list 2007-04-11 21:14:14 UTC (rev 5647)
@@ -1,3 +1,271 @@
+CVE-2007-1971 (SQL injection vulnerability in fotokategori.asp in Gazi Okul
Sitesi ...)
+ TODO: check
+CVE-2007-1970 (Mozilla Firefox does not warn the user about HTTP elements on an
HTTPS ...)
+ TODO: check
+CVE-2007-1969 (Cross-site scripting (XSS) vulnerability in admin/modify.php in
Sam ...)
+ TODO: check
+CVE-2007-1968 (PHP remote file inclusion vulnerability in games.php in Sam Crew
...)
+ TODO: check
+CVE-2007-1967 (PHP remote file inclusion vulnerability in index.php in stat12
allows ...)
+ TODO: check
+CVE-2007-1966 (Session fixation vulnerability in eXV2 CMS 2.0.4.3 and earlier
allows ...)
+ TODO: check
+CVE-2007-1965 (Multiple cross-site scripting (XSS) vulnerabilities in eXV2 CMS
...)
+ TODO: check
+CVE-2007-1964 (member.php in MyBB (aka MyBulletinBoard), when debug mode is
...)
+ TODO: check
+CVE-2007-1963 (SQL injection vulnerability in the create_session function in
...)
+ TODO: check
+CVE-2007-1962 (SQL injection vulnerability in index.php in the WF-Snippets 1.02
and ...)
+ TODO: check
+CVE-2007-1961 (PHP remote file inclusion vulnerability in mutant_functions.php
in the ...)
+ TODO: check
+CVE-2007-1960 (SQL injection vulnerability in visit.php in the Rha7 Downloads
...)
+ TODO: check
+CVE-2007-1959 (Unspecified vulnerability in the process_cmdent function in ...)
+ TODO: check
+CVE-2007-1958 (Buffer overflow in TinyMUX before 2.4 allows attackers to cause
a ...)
+ TODO: check
+CVE-2007-1957 (Multiple PHP remote file inclusion vulnerabilities in Guernion
Sylvain ...)
+ TODO: check
+CVE-2007-1956 (SQL injection vulnerability in ubbthreads.php in Groupee
UBB.threads ...)
+ TODO: check
+CVE-2007-1955 (Multiple stack-based buffer overflows in the SignKorea SKCrypAX
...)
+ TODO: check
+CVE-2007-1954 (Multiple directory traversal vulnerabilities in ArchiveXpert
2.02 ...)
+ TODO: check
+CVE-2007-1953 (Session fixation vulnerability in onelook courts on-line allows
remote ...)
+ TODO: check
+CVE-2007-1952 (Session fixation vulnerability in onelook onebyone CMS allows
remote ...)
+ TODO: check
+CVE-2007-1951 (Session fixation vulnerability in onelook obo Shop allows remote
...)
+ TODO: check
+CVE-2007-1950 (Cross-site scripting (XSS) vulnerability in index_cms.php in
...)
+ TODO: check
+CVE-2007-1949 (Session fixation vulnerability in WebBlizzard CMS allows remote
...)
+ TODO: check
+CVE-2007-1948 (Buffer overflow in IrfanView 3.99 allows context-dependent
attackers ...)
+ TODO: check
+CVE-2007-1947 (Cross-zone scripting vulnerability in the DOM templates
(domplates) ...)
+ TODO: check
+CVE-2007-1946 (Integer overflow in Windows Explorer in Microsoft Windows XP SP1
might ...)
+ TODO: check
+CVE-2007-1945 (Unspecified vulnerability in the Servlet Engine/Web Container in
IBM ...)
+ TODO: check
+CVE-2007-1944 (The Java Message Service (JMS) in IBM WebSphere Application
Server ...)
+ TODO: check
+CVE-2007-1943 (Integer overflow in ACDSee Photo Manager 9.0 allows
context-dependent ...)
+ TODO: check
+CVE-2007-1942 (Integer overflow in FastStone Image Viewer 2.9 allows ...)
+ TODO: check
+CVE-2007-1941 (Cross-site scripting (XSS) vulnerability in the Active Content
Filter ...)
+ TODO: check
+CVE-2007-1940 (IBM Tivoli Business Service Manager (TBSM) 4.1 before Interim
Fix 1 ...)
+ TODO: check
+CVE-2007-1939 (Cross-site scripting (XSS) vulnerability in the embedded
webserver in ...)
+ TODO: check
+CVE-2007-1938 (Ichitaro 2005 through 2007, and possibly related products,
allows ...)
+ TODO: check
+CVE-2007-1937 (PHP remote file inclusion vulnerability in smilies.php in Scorp
Book ...)
+ TODO: check
+CVE-2007-1936 (PHP remote file inclusion vulnerability in scaradcontrol.php in
...)
+ TODO: check
+CVE-2007-1935 (PHP file inclusion vulnerability in admin/index.php in
ScarAdControl ...)
+ TODO: check
+CVE-2007-1934 (Directory traversal vulnerability in member.php in the eBoard
1.0.7 ...)
+ TODO: check
+CVE-2007-1933 (Multiple directory traversal vulnerabilities in PcP-Guestbook
...)
+ TODO: check
+CVE-2007-1932 (Directory traversal vulnerability in scarnews.inc.php in
ScarNews ...)
+ TODO: check
+CVE-2007-1931 (SQL injection vulnerability in index.php in the slownik module
in ...)
+ TODO: check
+CVE-2007-1930 (Directory traversal vulnerability in download2.php in cattaDoc
2.21 ...)
+ TODO: check
+CVE-2007-1929 (Directory traversal vulnerability in downloadpic.php in Beryo
2.0 ...)
+ TODO: check
+CVE-2007-1928 (Directory traversal vulnerability in index.php in witshare 0.9
allows ...)
+ TODO: check
+CVE-2007-1927 (Cross-site scripting (XSS) vulnerability in signup.asp in
CmailServer ...)
+ TODO: check
+CVE-2007-1926 (Cross-site scripting (XSS) vulnerability in JBMC Software
DirectAdmin ...)
+ TODO: check
+CVE-2007-1925 (The borrado function in modules/Your_Account/index.php in
Tru-Zone ...)
+ TODO: check
+CVE-2007-1924 (** DISPUTED ** ...)
+ TODO: check
+CVE-2007-1923 ((1) LedgerSMB and (2) DWS Systems SQL-Ledger implement access
control ...)
+ TODO: check
+CVE-2007-1922 (The Impulse Tracker (IT) and ScreamTracker 3 (S3M) modules in
...)
+ TODO: check
+CVE-2007-1921 (LIBSNDFILE.DLL, as used by AOL Nullsoft Winamp 5.33 and possibly
other ...)
+ TODO: check
+CVE-2007-1920 (SQL injection vulnerability in index.php in the aktualnosci
module in ...)
+ TODO: check
+CVE-2007-1919 (Cross-site scripting (XSS) vulnerability in index.php in Arizona
Dream ...)
+ TODO: check
+CVE-2007-1918 (The RFC_SET_REG_SERVER_PROPERTY function in the SAP RFC Library
6.40 ...)
+ TODO: check
+CVE-2007-1917 (Buffer overflow in the SYSTEM_CREATE_INSTANCE function in the
SAP RFC ...)
+ TODO: check
+CVE-2007-1916 (Buffer overflow in the RFC_START_GUI function in the SAP RFC
Library ...)
+ TODO: check
+CVE-2007-1915 (Buffer overflow in the RFC_START_PROGRAM function in the SAP RFC
...)
+ TODO: check
+CVE-2007-1914 (The RFC_START_PROGRAM function in the SAP RFC Library 6.40 and
7.00 ...)
+ TODO: check
+CVE-2007-1913 (The TRUSTED_SYSTEM_SECURITY function in the SAP RFC Library 6.40
and ...)
+ TODO: check
+CVE-2007-1912 (Heap-based buffer overflow in Microsoft Windows allows
user-assisted ...)
+ TODO: check
+CVE-2007-1911 (Multiple unspecified vulnerabilities in Microsoft Word 2007
allow ...)
+ TODO: check
+CVE-2007-1910 (Buffer overflow in wwlib.dll in Microsoft Word 2007 allows
remote ...)
+ TODO: check
+CVE-2007-1909 (SQL injection vulnerability in login.php in Ryan Haudenschilt
...)
+ TODO: check
+CVE-2007-1908 (PHP file inclusion vulnerability in php121db.php in PHP121
Instant ...)
+ TODO: check
+CVE-2007-1907 (PHP remote file inclusion vulnerability in warn.php in Pathos
Content ...)
+ TODO: check
+CVE-2007-1906 (Directory traversal vulnerability in richedit/keyboard.php in
eCardMAX ...)
+ TODO: check
+CVE-2007-1905 (Cross-site scripting (XSS) vulnerability in auth.php in
Pineapple ...)
+ TODO: check
+CVE-2007-1904 (Directory traversal vulnerability in AOL Instant Messenger (AIM)
5.9 ...)
+ TODO: check
+CVE-2007-1903
+ RESERVED
+CVE-2007-1902
+ RESERVED
+CVE-2007-1901
+ RESERVED
+CVE-2007-1900 (CRLF injection vulnerability in the FILTER_VALIDATE_EMAIL filter
in ...)
+ TODO: check
+CVE-2007-1899
+ RESERVED
+CVE-2007-1898
+ RESERVED
+CVE-2007-1897 (SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress
2.1.2, ...)
+ TODO: check
+CVE-2007-1896 (Directory traversal vulnerability in chat.php in Sky GUNNING
MySpeach ...)
+ TODO: check
+CVE-2007-1895 (PHP remote file inclusion vulnerability in chat.php in Sky
GUNNING ...)
+ TODO: check
+CVE-2007-1894 (Cross-site scripting (XSS) vulnerability in ...)
+ TODO: check
+CVE-2007-1893 (xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier,
allows ...)
+ TODO: check
+CVE-2007-1892
+ RESERVED
+CVE-2007-1891
+ RESERVED
+CVE-2007-1890 (Integer overflow in the msg_receive function in PHP 4 before
4.4.5 and ...)
+ TODO: check
+CVE-2007-1889 (Integer signedness error in the _zend_mm_alloc_int function in
the ...)
+ TODO: check
+CVE-2007-1888 (Buffer overflow in the sqlite_decode_binary function in
src/encode.c ...)
+ TODO: check
+CVE-2007-1887 (Buffer overflow in the sqlite_decode_binary function in the
bundled ...)
+ TODO: check
+CVE-2007-1886 (Integer overflow in the str_replace function in PHP 4.4.5 and
PHP ...)
+ TODO: check
+CVE-2007-1885 (Integer overflow in the str_replace function in PHP 4 before
4.4.5 and ...)
+ TODO: check
+CVE-2007-1884 (Multiple integer signedness errors in the printf function family
in ...)
+ TODO: check
+CVE-2007-1883 (PHP 4.0.0 through 4.4.6 and 5.0.0 through 5.2.1 allows ...)
+ TODO: check
+CVE-2007-1882 (qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment in HP Mercury
...)
+ TODO: check
+CVE-2007-1881 (Unspecified vulnerability in KLIF (klif.sys) in Kaspersky
Anti-Virus, ...)
+ TODO: check
+CVE-2007-1880 (Integer overflow in the _NtSetValueKey function in klif.sys in
...)
+ TODO: check
+CVE-2007-1879 (The StartUploading function in KL.SysInfo ActiveX control ...)
+ TODO: check
+CVE-2007-1878 (Cross-zone scripting vulnerability in the DOM templates
(domplates) ...)
+ TODO: check
+CVE-2007-1877
+ RESERVED
+CVE-2007-1876
+ RESERVED
+CVE-2007-1875
+ RESERVED
+CVE-2007-1874
+ RESERVED
+CVE-2007-1873
+ RESERVED
+CVE-2007-1872
+ RESERVED
+CVE-2007-1871
+ RESERVED
+CVE-2007-1870
+ RESERVED
+CVE-2007-1869
+ RESERVED
+CVE-2007-1868 (The management service in IBM Tivoli Provisioning Manager for OS
...)
+ TODO: check
+CVE-2007-1867 (Buffer overflow in IrfanView 3.99 allows remote attackers to
execute ...)
+ TODO: check
+CVE-2007-1866 (Stack-based buffer overflow in the dns_decode_reverse_name
function in ...)
+ TODO: check
+CVE-2007-1865
+ RESERVED
+CVE-2007-1864
+ RESERVED
+CVE-2007-1863
+ RESERVED
+CVE-2007-1862
+ RESERVED
+CVE-2007-1861
+ RESERVED
+CVE-2007-1860
+ RESERVED
+CVE-2007-1859
+ RESERVED
+CVE-2007-1858
+ RESERVED
+CVE-2007-1857
+ RESERVED
+CVE-2007-1856
+ RESERVED
+CVE-2007-1855 (Multiple PHP remote file inclusion vulnerabilities in ...)
+ TODO: check
+CVE-2007-1854 (Unspecified vulnerability in Hitachi Cosminexus Component
Container ...)
+ TODO: check
+CVE-2007-1853 (Unspecified vulnerability in Hitachi JP1/HiCommand
DeviceManager, ...)
+ TODO: check
+CVE-2007-1852 (Multiple PHP remote file inclusion vulnerabilities in 2BGal
3.1.1 ...)
+ TODO: check
+CVE-2007-1851 (Multiple directory traversal vulnerabilities in Really Simple
PHP and ...)
+ TODO: check
+CVE-2007-1850 (Directory traversal vulnerability in
classes/captcha/captcha.jpg.php ...)
+ TODO: check
+CVE-2007-1849 (Directory traversal vulnerability in 404.php in Drake CMS allows
...)
+ TODO: check
+CVE-2007-1848 (Cross-site scripting (XSS) vulnerability in
admin/classes/ui.dta.php ...)
+ TODO: check
+CVE-2007-1847 (SQL injection vulnerability in viewcat.php in the Repository
module ...)
+ TODO: check
+CVE-2007-1846 (SQL injection vulnerability in index.php in the MyAds 2.04jp and
...)
+ TODO: check
+CVE-2007-1845 (SQL injection vulnerability in show_event.php in the Expanded
Calendar ...)
+ TODO: check
+CVE-2007-1844 (Multiple PHP remote file inclusion vulnerabilities in Aardvark
...)
+ TODO: check
+CVE-2007-1843 (PHP remote file inclusion vulnerability in
gmapfactory/params.php in ...)
+ TODO: check
+CVE-2007-1842 (Directory traversal vulnerability in login.php in JSBoard before
...)
+ TODO: check
+CVE-2007-1841 (The isakmp_info_recv function in src/racoon/isakmp_inf.c in
racoon in ...)
+ TODO: check
+CVE-2006-7192 (Microsoft ASP .NET Framework 2.0.50727.42 does not properly
handle ...)
+ TODO: check
+CVE-2005-4837 (snmp_api.c in snmpd in Net-SNMP 5.2.x before 5.2.2, and 5.1.x
before ...)
+ TODO: check
+CVE-2005-4836
+ RESERVED
CVE-2007-XXXX [Dos in quagga''s bgpd through MP_REACH_NLRI and
MP_UNREACH_NLRI]
- quagga <unfixed> (low; bug #418323)
NOTE: The attributes are non-transitive, which means that they
@@ -53,7 +321,7 @@
NOT-FOR-US: Sprint Nextel
CVE-2007-1820 (Nortel Networks CallPilot and Meridian Mail voicemail systems,
when a ...)
NOT-FOR-US: Nortel Networks
-CVE-2007-1819 (Unspecified vulnerability in a certain ActiveX control in
TestDirector ...)
+CVE-2007-1819 (Stack-based buffer overflow in the SPIDERLib.Loader ActiveX
control ...)
NOT-FOR-US: ActiveX control in TestDirector
CVE-2007-1818 (PHP remote file inclusion vulnerability in
MOD_forum_fields_parse.php ...)
NOT-FOR-US: Forum picture and META tags module for phpBB
@@ -95,7 +363,7 @@
NOT-FOR-US: Cisco Secure ACS
CVE-2007-1799 (Directory traversal vulnerability in torrent.cpp in KTorrent
before ...)
- ktorrent <unfixed> (medium)
-CVE-2007-1798 (Buffer overflow in the drmgr command for IBM AIX 5.2 and 5.3
allows ...)
+CVE-2007-1798 (Buffer overflow in the drmgr command in IBM AIX 5.2 and 5.3
allows ...)
NOT-FOR-US: IBM AIX
CVE-2007-1797 (Multiple integer overflows in ImageMagick before 6.3.3-5 allow
remote ...)
- imagemagick <unfixed> (medium)
@@ -180,7 +448,7 @@
NOT-FOR-US: HP JetDirect
CVE-2007-1771 (PHP remote file inclusion vulnerability in ...)
NOT-FOR-US: Ay System Solutions Web Content System
-CVE-2007-1770 (ESRI ArcSDE 8.3, 9.0, and 9.1 before 20070327, when using three
tiered ...)
+CVE-2007-1770 (Buffer overflow in the ArcSDE service (giomgr) in Environmental
...)
NOT-FOR-US: ArcSDE
CVE-2007-1769 (Cross-site scripting (XSS) vulnerability in /search in Mephisto
0.7.3 ...)
NOT-FOR-US: Mephisto
@@ -357,22 +625,22 @@
RESERVED
CVE-2007-1688
RESERVED
-CVE-2007-1687
- RESERVED
+CVE-2007-1687 (Multiple buffer overflows in the Internet Pictures Corporation
iPIX ...)
+ TODO: check
CVE-2007-1686
RESERVED
CVE-2007-1685
RESERVED
-CVE-2007-1684
- RESERVED
+CVE-2007-1684 (The Run function in SolidWorks sldimdownload ActiveX control in
...)
+ TODO: check
CVE-2007-1683
RESERVED
CVE-2007-1682
RESERVED
CVE-2007-1681
RESERVED
-CVE-2007-1680
- RESERVED
+CVE-2007-1680 (Stack-based buffer overflow in the createAndJoinConference
function in ...)
+ TODO: check
CVE-2007-1679 (** DISPUTED ** ...)
TODO: check
CVE-2007-1678 (Cross-site scripting (XSS) vulnerability in the Fizzle 0.5
extension ...)
@@ -694,7 +962,7 @@
- sql-ledger <unfixed> (unimportant; bug #409703)
NOTE: It''s documented behaviour that SQL-Ledger should only be run in
an
NOTE: authenticated HTTP zone and without untrusted users
-CVE-2007-1540 (Directory traversal vulnerability in am.pl in SQL-Ledger 2.6.27
and ...)
+CVE-2007-1540 (Directory traversal vulnerability in am.pl in (1) SQL-Ledger
2.6.27 ...)
- sql-ledger <unfixed> (unimportant; bug #409703)
NOTE: It''s documented behaviour that SQL-Ledger should only be run in
an
NOTE: authenticated HTTP zone and without untrusted users
@@ -717,7 +985,7 @@
NOT-FOR-US: Microsoft
CVE-2007-1532 (The neighbor discovery implementation in Microsoft Windows Vista
...)
NOT-FOR-US: Microsoft
-CVE-2007-1531 (Microsoft Windows Vista overwrites ARP table entries included in
...)
+CVE-2007-1531 (Microsoft Windows XP and Vista overwrites ARP table entries
included ...)
NOT-FOR-US: Microsoft
CVE-2007-1530 (The LLTD Mapper in Microsoft Windows Vista does not properly
gather ...)
NOT-FOR-US: Microsoft
@@ -1130,8 +1398,7 @@
- libapache-mod-security <removed>
CVE-2007-1358
RESERVED
-CVE-2007-1357 [linux kernel appletalk remote DoS]
- RESERVED
+CVE-2007-1357 (The atalk_sum_skb function in AppleTalk for Linux kernel 2.6.x
before ...)
- linux-2.6 2.6.20-1
CVE-2007-1356
RESERVED
@@ -1141,11 +1408,9 @@
RESERVED
CVE-2007-1353
RESERVED
-CVE-2007-1352
- RESERVED
+CVE-2007-1352 (Integer overflow in the FontFileInitTable function in X.Org
libXfont ...)
- libxfont 1:1.2.2-2 (medium)
-CVE-2007-1351
- RESERVED
+CVE-2007-1351 (Integer overflow in the bdfReadCharacters function in bdfread.c
in (1) ...)
- libxfont 1:1.2.2-2 (medium)
CVE-2007-1350 (Stack-based buffer overflow in webadmin.exe in Novell NetMail
3.5.2 ...)
NOT-FOR-US: Novell NetMail
@@ -1433,10 +1698,10 @@
NOT-FOR-US: NetBSD Kernel
CVE-2007-1272
RESERVED
-CVE-2007-1271
- RESERVED
-CVE-2007-1270
- RESERVED
+CVE-2007-1271 (Buffer overflow in VMware ESX Server 3.0.0 and 3.0.1 might allow
...)
+ TODO: check
+CVE-2007-1270 (Double free vulnerability in VMware ESX Server 3.0.0 and 3.0.1
allows ...)
+ TODO: check
CVE-2007-1269 (GNUMail 1.1.2 and earlier does not properly use the --status-fd
...)
- gnumail <unfixed> (unimportant)
NOTE: this is a "feature request", since gnupg is fixed from
CVE-2007-1263
@@ -1560,34 +1825,33 @@
- asterisk-chan-capi 0.7.1-1.1 (bug #411293)
- linux-2.6 <unfixed> (bug #411294; low)
NOTE: Not exploitable over ISDN network, only through a CAPI server
-CVE-2007-1216
- RESERVED
+CVE-2007-1216 (Double-free vulnerability in the GSS-API library, as used by the
...)
{DSA-1276-1}
- krb5 1.4.4-8 (high)
-CVE-2007-1215
- RESERVED
+CVE-2007-1215 (Buffer overflow in the Graphics Device Interface (GDI) in
Microsoft ...)
+ TODO: check
CVE-2007-1214
RESERVED
-CVE-2007-1213
- RESERVED
-CVE-2007-1212
- RESERVED
-CVE-2007-1211
- RESERVED
+CVE-2007-1213 (The TrueType Fonts rasterizer in Microsoft Windows 2000 SP4
allows ...)
+ TODO: check
+CVE-2007-1212 (Buffer overflow in the Graphics Device Interface (GDI) in
Microsoft ...)
+ TODO: check
+CVE-2007-1211 (Microsoft Windows 2000 SP4; XP SP2; and Server 2003 Gold, SP1,
and SP2 ...)
+ TODO: check
CVE-2007-1210
RESERVED
-CVE-2007-1209
- RESERVED
+CVE-2007-1209 (Use-after-free vulnerability in the Client/Server Run-time
Subsystem ...)
+ TODO: check
CVE-2007-1208
RESERVED
CVE-2007-1207
RESERVED
-CVE-2007-1206
- RESERVED
-CVE-2007-1205
- RESERVED
-CVE-2007-1204
- RESERVED
+CVE-2007-1206 (The Windows Kernel in Microsoft Windows 2000 SP4, XP SP2, and
Server ...)
+ TODO: check
+CVE-2007-1205 (Unspecified vulnerability in Microsoft Agent
(msagent\agentsvr.exe) in ...)
+ TODO: check
+CVE-2007-1204 (Unspecified vulnerability in the Universal Plug and Play (UPnP)
...)
+ TODO: check
CVE-2007-1203
RESERVED
CVE-2007-1202
@@ -1821,8 +2085,8 @@
NOT-FOR-US: Microsoft IE
CVE-2007-1113
RESERVED
-CVE-2007-1112
- RESERVED
+CVE-2007-1112 (Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes
unsafe ...)
+ TODO: check
CVE-2007-1111 (Multiple cross-site scripting (XSS) vulnerabilities in
ActiveCalendar ...)
NOT-FOR-US: ActiveCalendar
CVE-2007-1110 (Directory traversal vulnerability in data/showcode.php in ...)
@@ -2227,14 +2491,13 @@
- iceape <unfixed> (low)
- xulrunner <unfixed> (low)
NOTE: maintainer notes that this may affect browsers based on xulrunner
-CVE-2007-1003 [X.org resource management memory corruption]
- RESERVED
+CVE-2007-1003 (Integer overflow in ALLOCATE_LOCAL in the ProcXCMiscGetXIDList
...)
- xorg-server 2:1.1.1-21 (medium)
CVE-2007-1002 (Format string vulnerability in the write_html function in ...)
- evolution <unfixed>
[sarge] - evolution <not-affected> (Vulnerable code not present)
-CVE-2007-1001
- RESERVED
+CVE-2007-1001 (Multiple integer overflows in the (1) createwbmp and (2)
readwbmp ...)
+ TODO: check
CVE-2007-1000 (The ipv6_getsockopt_sticky function in net/ipv6/ipv6_sockglue.c
in the ...)
- linux-2.6 2.6.18.dfsg.1-12 (medium)
CVE-2007-0999 (Format string vulnerability in Ekiga 2.0.3, and probably other
...)
@@ -2267,7 +2530,7 @@
RESERVED
CVE-2007-0989
RESERVED
-CVE-2007-0988 (The zend_hash_init function in PHP, when running on a 64-bit
platform, ...)
+CVE-2007-0988 (The zend_hash_init function in PHP 5 before 5.2.1 and PHP 4
before ...)
{DSA-1264-1}
- php4 6:4.4.4-9
- php5 5.2.0-9
@@ -2337,12 +2600,10 @@
NOT-FOR-US: Cisco PIX
CVE-2007-0958 (Linux kernel 2.6.x before 2.6.20 allows local users to read
unreadable ...)
- linux-2.6 <unfixed> (unimportant)
-CVE-2007-0957
- RESERVED
+CVE-2007-0957 (Stack-based buffer overflow in the krb5_klog_syslog function in
the ...)
{DSA-1276-1}
- krb5 1.4.4-8 (high)
-CVE-2007-0956
- RESERVED
+CVE-2007-0956 (The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows
remote ...)
{DSA-1276-1}
- krb5 1.4.4-8 (high)
CVE-2007-0955 (The NTLM_UnPack_Type3 function in MENTLM.dll in MailEnable ...)
@@ -2377,10 +2638,10 @@
RESERVED
CVE-2007-0940
RESERVED
-CVE-2007-0939
- RESERVED
-CVE-2007-0938
- RESERVED
+CVE-2007-0939 (Cross-site scripting (XSS) vulnerability in Microsoft Content
...)
+ TODO: check
+CVE-2007-0938 (Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2
does ...)
+ TODO: check
CVE-2007-0937
RESERVED
CVE-2007-0936
@@ -2485,7 +2746,7 @@
NOTE: other half is possibly CHECKME-printfstuff-maybecve.diff and
NOTE: CHECKME-formattedprint-maybecve.diff and
NOTE: CHECKME-main.c-precision-maybecve.diff in the same place.
-CVE-2007-0908 (The wddx extension in PHP before 5.2.1 allows remote attackers
to ...)
+CVE-2007-0908 (The WDDX deserializer in the wddx extension in PHP 5 before
5.2.1 and ...)
- php5 5.2.0-9 (unimportant)
- php4 6:4.4.4-9 (unimportant)
NOTE: this extension is not enabled in the php packages
@@ -3031,8 +3292,8 @@
RESERVED
CVE-2007-0735
RESERVED
-CVE-2007-0734
- RESERVED
+CVE-2007-0734 (The AirPort Disk feature of the AirPort Extreme Base Station
with ...)
+ TODO: check
CVE-2007-0733 (Unspecified vulnerability in ImageIO in Apple Mac OS X 10.3.9
and 10.4 ...)
NOT-FOR-US: Apple Mac ImageIO
CVE-2007-0732
@@ -3708,8 +3969,8 @@
RESERVED
CVE-2007-0446 (Stack-based buffer overflow in magentproc.exe for
Hewlett-Packard ...)
NOT-FOR-US: HP Mercury
-CVE-2007-0445
- RESERVED
+CVE-2007-0445 (Heap-based buffer overflow in the arj.ppl module in the OnDemand
...)
+ TODO: check
CVE-2007-0444 (Stack-based buffer overflow in the print provider library
(cpprov.dll) ...)
NOT-FOR-US: Citrix
CVE-2007-0443
@@ -4173,8 +4434,7 @@
RESERVED
CVE-2007-0243 (Buffer overflow in Sun JDK and Java Runtime Environment (JRE)
5.0 ...)
- sun-java5 1.5.0-10-1
-CVE-2007-0242 [too lenient UTF-8 decoder in src/codecs/qutfcodec.cpp]
- RESERVED
+CVE-2007-0242 (The UTF-8 decoder in codecs/qutfcodec.cpp in Qt 3.3.8 and 4.2.3
does ...)
- qt4-x11 4.2.2-2
- qt-x11-free 3:3.3.7-4
CVE-2007-0241
@@ -4188,7 +4448,7 @@
{DSA-1270-1}
- openoffice.org 2.0.4.dfsg.2-6
[etch] - openoffice.org 2.0.4.dfsg.2-5etch1
-CVE-2007-0238 (Stack-based buffer overflow in the StarCalc parser in
OpenOffice.org ...)
+CVE-2007-0238 (Stack-based buffer overflow in filter\starcalc\scflt.cxx in the
...)
{DSA-1270-1}
- openoffice.org 2.0.4.dfsg.2-6
[etch] - openoffice.org 2.0.4.dfsg.2-5etch1
@@ -7017,7 +7277,8 @@
NOT-FOR-US: Less Inventory Manager
CVE-2006-5942 (Cross-site scripting (XSS) vulnerability in ...)
NOT-FOR-US: Less Inventory Manager
-CVE-2006-5941 (snmpd in (1) the SUNWsmagt package in Solaris 10 before 20061122
and ...)
+CVE-2006-5941
+ REJECTED
NOT-FOR-US: Solaris, see #400557
CVE-2006-5940 (Unspecified vulnerability in Grisoft AVG Anti-Virus before
7.1.407 has ...)
NOT-FOR-US: Grisoft AVG Anti-Virus
@@ -7412,7 +7673,7 @@
NOT-FOR-US: phpDynaSite
CVE-2006-5759 (index.php in Rhadrix If-CMS, possibly 1.01 and 2.07, allows
remote ...)
NOT-FOR-US: Rhadrix If-CMS
-CVE-2006-5758 (Microsoft Windows 2000 through 2000 SP4 and Windows XP through
SP2 ...)
+CVE-2006-5758 (The Graphics Rendering Engine in Microsoft Windows 2000 through
2000 ...)
NOT-FOR-US: Microsoft
CVE-2006-5757 (Race condition in the __find_get_block_slow function in the
ISO9660 ...)
- linux-2.6 2.6.18.dfsg.1-10 (low)
@@ -7793,8 +8054,8 @@
NOT-FOR-US: CMS Faethon
CVE-2006-5587 (Multiple PHP remote file inclusion vulnerabilities in MDweb 1.3
and ...)
NOT-FOR-US: MDweb
-CVE-2006-5586
- RESERVED
+CVE-2006-5586 (The Graphics Rendering Engine in Microsoft Windows 2000 SP4 and
XP SP2 ...)
+ TODO: check
CVE-2006-5585 (The Client-Server Run-time Subsystem in Microsoft Windows XP SP2
and ...)
NOT-FOR-US: Microsoft
CVE-2006-5584 (The Remote Installation Service (RIS) in Microsoft Windows 2000
SP4 ...)
@@ -10800,8 +11061,7 @@
{DSA-1211}
- pdns-recursor 3.1.4-1 (bug #398557; high)
- pdns <not-affected> (Recursor module has been moved to pdns-recursor)
-CVE-2006-4250 [buffer overflow in man-db]
- RESERVED
+CVE-2006-4250 (Buffer overflow in man and man-db 2.4.3 and earlier allows local
users ...)
{DSA-1278-1}
- man-db 2.4.3-5
CVE-2006-4249 (Unspecified vulnerability in PlonePAS in Plone 2.5 and 2.5.1,
when ...)
@@ -11931,7 +12191,7 @@
NOT-FOR-US: IDevSpot PhpLinkExchange
CVE-2006-3776 (PHP remote file inclusion vulnerability in order/index.php in
IDevSpot ...)
NOT-FOR-US: IDevSpot (1) PhpHostBot 1.0 and (2) AutoHost 3.0
-CVE-2006-3775 (SQL injection vulnerability in class_session.php in MyBB (aka
...)
+CVE-2006-3775 (SQL injection vulnerability in the init function in
class_session.php ...)
NOT-FOR-US: MyBB
CVE-2006-3774 (PHP remote file inclusion vulnerability in performs.php in the
...)
NOT-FOR-US: perForms component (com_performs) for Joomla!
@@ -28644,7 +28904,7 @@
CVE-2005-2178 (probe.cgi allows remote attackers to execute arbitrary commands
via ...)
NOTE: How bizarre, they assign a CVE Id without knowing which product contains
NOTE: the affected probe.cgi
-CVE-2005-2177 (Unknown vulnerability in Net-SNMP 5.0.x before 5.0.10.2, 5.2.x
before ...)
+CVE-2005-2177 (Net-SNMP 5.0.x before 5.0.10.2, 5.2.x before 5.2.1.2, and 5.1.3,
when ...)
{DSA-873-1}
- net-snmp 5.2.1.2-1 (bug #318420; low)
- ucd-snmp 4.2.5-5.1 (bug #337394; low)