jmm-guest at alioth.debian.org
2008-Oct-03 20:44 UTC
[Secure-testing-commits] r9978 - / data data/CVE
Author: jmm-guest
Date: 2008-10-03 20:44:02 +0000 (Fri, 03 Oct 2008)
New Revision: 9978
Modified:
data/CVE/list
data/spu-candidates.txt
tmp.txt
Log:
more SPUs
openswan should be fixed
not much point in fixing LTP in Etch, in Lenny it has been documented to only
work for isolated environments
Modified: data/CVE/list
==================================================================---
data/CVE/list 2008-10-03 20:09:35 UTC (rev 9977)
+++ data/CVE/list 2008-10-03 20:44:02 UTC (rev 9978)
@@ -1,3 +1,9 @@
+CVE-2008-XXXX [ltp: insecure temp file]
+ - ltp 20060918-3 (low; bug #496411)
+ [etch] - ltp <no-dsa> (Documented to be only suitable for single
user setups currently)
+CVE-2008-XXXX [fml: insecure temp file]
+ - fml <removed> (low; bug #496370)
+ [etch] - fml <no-dsa> (Minor issue)
CVE-2008-XXXX [gccxml: insecure temp file]
- gccxml <unfixed> (unimportant; bug #496391)
NOTE: Only applies to a script used for an obscure SGI compiler
@@ -1542,6 +1548,7 @@
- nvi 1.81.6-4 (low)
CVE-2008-XXXX [rkhunter: insecure temp file]
- rkhunter 1.3.2-6 (low; bug #496375)
+ [etch] - rkhunter <no-dsa> (Minor issue, only in debug mode)
CVE-2008-XXXX [scratchbox2: insecure temp file]
- scratchbox2 1.99.0.24-2 (low; bug #496409)
CVE-2008-XXXX [realtimebattle: insecure temp file]
@@ -1559,6 +1566,7 @@
[etch] - xen-3 <no-dsa> (Minor issue)
CVE-2008-XXXX [mgetty: insecure temp files]
- mgetty 1.1.36-1.3 (low; bug #496403)
+ [etch] - mgetty <no-dsa> (Minor issue)
CVE-2008-XXXX [sympa: multiple insecure temp files]
- sympa 5.3.4-5.1 (low; bug #496405; bug #494969)
CVE-2008-XXXX [sng: insecure temp file]
Modified: data/spu-candidates.txt
==================================================================---
data/spu-candidates.txt 2008-10-03 20:09:35 UTC (rev 9977)
+++ data/spu-candidates.txt 2008-10-03 20:44:02 UTC (rev 9978)
@@ -140,6 +140,11 @@
--
+fml
+#496370
+
+--
+
gdrae
#496378
notified maintainer
@@ -219,6 +224,11 @@
--
+mgetty
+#496403
+
+--
+
mgt
#496434
notified maintainer
@@ -287,6 +297,11 @@
--
+rkhunter
+#496375)
+
+--
+
rsync (CVE-2007-6200)
#453652
notified maintainer
Modified: tmp.txt
==================================================================--- tmp.txt
2008-10-03 20:09:35 UTC (rev 9977)
+++ tmp.txt 2008-10-03 20:44:02 UTC (rev 9978)
@@ -15,15 +15,10 @@
a point update, oss-security should be better than a CNA pool since
there''s a risk of collisions
- Binary-package: fml (4.0.3.dfsg-2)
- Binary-package: rkhunter (1.3.2-3)
- Binary-package: openswan (1:2.4.12+dfsg-1.1)
Binary-package: ibackup (2.27-4.1)
Binary-package: rancid-util (2.3.2~a8-1)
- Binary-package: ltp-network-test (20060918-2.1)
Binary-package: fwbuilder (2.1.19-3)
Binary-package: sympa (5.3.4-5)
- Binary-package: mgetty-fax (1.1.36-1.2)
Binary-package: aegis (4.24-3)
Binary-package: aegis-web (4.24-3)
@@ -33,9 +28,11 @@
Binary-package: freeradius-dialupadmin (2.0.4+dfsg-4)
Binary-package: mon (0.99.2-12)
Binary-package: qemu (0.9.1-5)
+ Binary-package: openswan (1:2.4.12+dfsg-1.1)
SPU:
+ Binary-package: fml (4.0.3.dfsg-2)
Binary-package: gdrae (0.1-1)
Binary-package: cdrw-taper (0.4-2)
Binary-package: digitaldj (0.7.5-6+b1)
@@ -65,6 +62,8 @@
Binary-package: r-base-core (2.7.1-1)
Binary-package: dist (1:3.5-17-1)
Binary-package: gpsdrive-scripts (2.10~pre4-3)
+ Binary-package: rkhunter (1.3.2-3)
+ Binary-package: mgetty-fax (1.1.36-1.2)
Non-issues (not exploitable, only examples or very exotic use cases,
e.g. only exploitable when debugging a certain option, not present