Author: derevko-guest Date: 2009-05-06 15:04:45 +0000 (Wed, 06 May 2009) New Revision: 11816 Modified: data/CVE/list Log: CVE-2009-1513: cve id assigned to libmodplug CVE-2009-1438: gst-plugins-bad0.10 is vulnerable only in stable and oldstable Modified: data/CVE/list ==================================================================--- data/CVE/list 2009-05-06 14:23:26 UTC (rev 11815) +++ data/CVE/list 2009-05-06 15:04:45 UTC (rev 11816) @@ -5,7 +5,10 @@ NOTE: http://hg.moinmo.in/moin/1.8/rev/269a1fbc3ed7 NOTE: CVE id requested CVE-2009-1513 (Buffer overflow in the PATinst function in src/load_pat.cpp in ...) - TODO: check + - libmodplug <unfixed> (medium; bug #526084) + - gst-plugins-bad0.10 <not-affected> (Vulnerable code not present; bug #527077) + [etch] - libmodplug <not-affected> (Vulnerable code not present) + NOTE: gst-plugins-bad0.10 in testing and unstable builds against an external libmodplug. CVE-2009-XXXX [unsafe temp file in coccinelle] - coccinelle 0.1.7.deb-3 (low) [lenny] - coccinelle <no-dsa> (Minor issue) @@ -34,12 +37,6 @@ [etch] - xorg-server <no-dsa> (minor issue) [lenny] - xorg-server <no-dsa> (minor issue) NOTE: CVE id requested -CVE-2009-XXXX [libmodplug buffer overflow in PAT sampler] - - libmodplug <unfixed> (medium; bug #526084) - - gst-plugins-bad0.10 <not-affected> (Vulnerable code not present; bug #527077) - [etch] - libmodplug <not-affected> (Vulnerable code not present) - NOTE: CVE id requested on oss-sec - NOTE: gst-plugins-bad0.10 in testing and unstable builds against an external libmodplug. CVE-2009-XXXX [clamav milter init script "typo"] - clamav <not-affected> (Vulnerable code not present) NOTE: from what I see this code was never uploaded to the debian archive @@ -277,7 +274,9 @@ - linux-2.6.24 <removed> CVE-2009-1438 (Integer overflow in the CSoundFile::ReadMed function ...) - libmodplug <unfixed> (low; bug #526657; bug #527076) - - gst-plugins-bad0.10 <unfixed> (low; bug #527075) + - gst-plugins-bad0.10 <not-affected> (it builds against an external libmodplug; bug #527075) + [etch] - gst-plugins-bad0.10 <unfixed> (low; bug #527075) + [lenny] - gst-plugins-bad0.10 <unfixed> (low; bug #527075) CVE-2009-1437 (Stack-based buffer overflow in PortableApps CoolPlayer Portable (aka ...) NOT-FOR-US: CoolPlayer CVE-2009-1436 (The db interface in libc in FreeBSD 6.3, 6.4, 7.0, 7.1, and ...)