Author: sf
Date: 2009-06-01 10:55:37 +0000 (Mon, 01 Jun 2009)
New Revision: 12005
Modified:
data/CVE/list
Log:
add some bug references
Modified: data/CVE/list
==================================================================---
data/CVE/list 2009-06-01 10:53:06 UTC (rev 12004)
+++ data/CVE/list 2009-06-01 10:55:37 UTC (rev 12005)
@@ -379,7 +379,7 @@
- libsndfile 1.0.20-1 (medium; bug #528650)
CVE-2009-XXXX [drupal: cross-site scripting vulnerability]
- drupal5 5.17-1.1 (low; bug #529191)
- - drupal6 6.11-1.1 (low; bug #529190)
+ - drupal6 6.11-1.1 (low; bug #529190; bug #531386)
CVE-2009-XXXX [kdebase: potential digital certificate deficiencies in konqueror
4]
- kdebase <unfixed> (low; bug #526985)
[etch] - kdebase <not-affected> (vulnerability introduced in konqueror
4)
@@ -972,7 +972,7 @@
- chromium-browser <itp> (bug #520324)
CVE-2009-1439 (Buffer overflow in fs/cifs/connect.c in CIFS in the Linux kernel
...)
{DSA-1800-1 DSA-1794-1 DSA-1787-1}
- - linux-2.6 <unfixed>
+ - linux-2.6 2.6.29-2 (bug #523365)
- linux-2.6.24 <removed>
CVE-2009-1438 (Integer overflow in the CSoundFile::ReadMed function ...)
- libmodplug 1:0.8.7-1 (low; bug #526657; bug #527076)
@@ -3370,7 +3370,7 @@
CVE-2009-0793 (cmsxform.c in LittleCMS (aka lcms or liblcms) 1.18, as used in
OpenJDK ...)
{DSA-1769-1}
- openjdk-6 <unfixed>
- - lcms <unfixed> (low; bug filed)
+ - lcms <unfixed> (low; bug #530785)
[lenny] - lcms <no-dsa> (Minor issue)
[etch] - lcms <no-dsa> (Minor issue)
CVE-2009-0792 (Multiple integer overflows in icc.c in the International Color
...)
@@ -3844,7 +3844,7 @@
CVE-2009-0699 (Cross-site scripting (XSS) vulnerability in ...)
NOT-FOR-US: Plunet BusinessManager
CVE-2009-0698 (Integer overflow in the 4xm demuxer (demuxers/demux_4xm.c) in
xine-lib ...)
- - xine-lib 1.1.16.2-1 (bug #517792; medium)
+ - xine-lib 1.1.16.2-1 (bug #517792; bug #523475; medium)
CVE-2009-0697
RESERVED
CVE-2009-0696
@@ -4455,7 +4455,7 @@
NOTE: their previous password; thus violating the security policy as defined
by
NOTE: the administrator)
CVE-2009-0578 (GNOME NetworkManager before 0.7.0.99 does not properly verify
...)
- - network-manager-applet 0.7.0.99-1 (medium)
+ - network-manager-applet 0.7.0.99-1 (medium; bug #519801)
CVE-2009-0577 (Integer overflow in the WriteProlog function in texttops in CUPS
...)
NOT-FOR-US: RedHat specific, because they had a problem applying the fix for
CVE-2008-3640
CVE-2009-0576 (Unspecified vulnerability in Sun Java System Directory Server
5.2 p6 ...)
@@ -5249,7 +5249,7 @@
{DSA-1737-1}
- wesnoth 1:1.4.7-4
CVE-2009-0365 (nm-applet.conf in GNOME NetworkManager before 0.7.0.99 contains
an ...)
- - network-manager-applet 0.7.0.99-1 (medium)
+ - network-manager-applet 0.7.0.99-1 (medium; bug #519801)
- network-manager 0.7.0.99-1 (medium)
CVE-2009-0364 (Format string vulnerability in the mini_calendar component in
...)
{DSA-1752-1}
@@ -6720,7 +6720,7 @@
CVE-2008-5696 (Novell NetWare 6.5 before Support Pack 8, when an OES2 Linux
server is ...)
NOT-FOR-US: Novell NetWare
CVE-2008-5695 (wp-admin/options.php in WordPress MU before 1.3.2, and WordPress
2.3.2 ...)
- - wordpress 2.3.2 (low; bug #510786)
+ - wordpress 2.3.2 (low; bug #510786; bug #513959)
NOTE: only the admin has manage_options capabilities by default and only
editors
NOTE: have upload_files capabilities
NOTE: Only versions prior to 2.3.2 are affected according to the Debian
maintainer
@@ -7544,7 +7544,7 @@
CVE-2008-5381 (Buffer overflow in the URL processing in ffdshow (aka
ffdshow-tryout) ...)
NOT-FOR-US: ffdshow
CVE-2008-5380 (gpsdrive (aka gpsdrive-scripts) 2.09 allows local users to
overwrite ...)
- - gpsdrive 2.10~pre4-6.dfsg-2 (low)
+ - gpsdrive 2.10~pre4-6.dfsg-2 (low; bug #508595)
[etch] - gpsdrive <no-dsa> (Minor issue)
[lenny] - gpsdrive 2.10~pre4-6.dfsg-1+lenny1
CVE-2008-5379 (netdisco-mibs-installer 1.0 allows local users to overwrite
arbitrary ...)
@@ -31170,7 +31170,7 @@
CVE-2007-2722 (Unspecified vulnerability in NewzCrawler 1.8 allows remote
attackers ...)
NOT-FOR-US: NewzCrawler
CVE-2007-2721 (The jpc_qcx_getcompparms function in jpc/jpc_cs.c for the JasPer
...)
- - jasper <unfixed> (medium; bug #413033)
+ - jasper <unfixed> (medium; bug #413033; bug #528543)
NOTE: Jasper was initially fixed in 1.900.1-3, but the fix got dropped later,
see #528543
- ghostscript 8.61.dfsg.1~svn8187-1.1 (medium; bug #447188)
NOTE: see http://ghostscript.com/pipermail/gs-cvs/2007-October/007877.html