Author: gilbert-guest
Date: 2009-10-10 05:34:03 +0000 (Sat, 10 Oct 2009)
New Revision: 12971
Modified:
data/CVE/list
Log:
- bug submitted for ffmpeg issue
- track ffmpeg code copy in xmovie
Modified: data/CVE/list
==================================================================---
data/CVE/list 2009-10-10 04:41:15 UTC (rev 12970)
+++ data/CVE/list 2009-10-10 05:34:03 UTC (rev 12971)
@@ -312,9 +312,9 @@
CVE-2009-3447 (Unrestricted file upload vulnerability in RADactive I-Load
before ...)
NOT-FOR-US: RADactive I-Load
CVE-2009-XXXX [ffmpeg missing input sanitization/crashes]
- - ffmpeg <unfixed>
+ - ffmpeg <unfixed> (medium; bug #550442)
+ - xmovie <removed>
- ffmpeg-debian <removed>
- TODO: file bug
NOTE: https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240
NOTE: https://roundup.ffmpeg.org/roundup/ffmpeg/issue1245
CVE-2009-XXXX [xen-tools: world readable disk image files]
@@ -10984,6 +10984,7 @@
{DSA-1782-1 DSA-1781-1}
- ffmpeg-debian 0.svn20080206-16 (medium; bug #524799)
- ffmpeg 0.svn20080206-16
+ - xmovie <removed>
- mplayer 1.0~rc2-14 (medium; bug #524805)
NOTE: MPlayer links against libavformat since 1.0~rc2-14, etch Mplayer still
needs a fix
NOTE:
http://git.ffmpeg.org/?p=ffmpeg;a=commitdiff;h=72e715fb798f2cb79fd24a6d2eaeafb7c6eeda17
@@ -15083,6 +15084,7 @@
NOTE: the ogm issue is a problem in ffmpeg
- ffmpeg-debian <unfixed> (unimportant; bug #509616)
- ffmpeg <unfixed> (unimportant)
+ - xmovie <removed> (unimportant)
NOTE: just a crasher, no security implications known so far
NOTE: http://sam.zoy.org/blog/2007-01-16-exposing-file-parsing-vulnerabilities
CVE-2008-4609 (The TCP implementation in (1) Linux, (2) platforms based on BSD
Unix, ...)
@@ -18512,6 +18514,7 @@
CVE-2008-3230 (The ffmpeg lavf demuxer allows user-assisted attackers to cause
a ...)
- ffmpeg-debian 0.svn20080206-16 (unimportant; bug #498764; bug #498766)
- ffmpeg 0.svn20080206-16 (unimportant)
+ - xmovie <removed> (unimportant)
NOTE: Only a NULL pointer deference, hardly security relevant
CVE-2008-3228 (Joomla! before 1.5.4 does not configure .htaccess to apply
certain ...)
NOT-FOR-US: Joomla
@@ -18678,7 +18681,7 @@
{DSA-1781-1}
- ffmpeg-debian 0.svn20080206-10 (bug #489965; low)
- ffmpeg 0.svn20080206-10
- TODO: Check the various embedders in Etch, horray for librification in Lenny
+ - xmovie <removed>
CVE-2008-3161 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
NOT-FOR-US: IBM Maximo
CVE-2008-3160 (Multiple unspecified vulnerabilities in IBM Data ONTAP 7.1
before ...)
@@ -38997,8 +39000,10 @@
- kdelibs 4:3.5.5a.dfsg.1-8
CVE-2007-XXXX [double-free vulnerability in the Real Media demuxer]
- ffmpeg 0.cvs20060823-8 (low; bug #379922)
+ - xmovie <not-affected> (this is not an issue in the avformat ffmpeg
code copy)
CVE-2007-XXXX [various crashes and infinite loops in ffmpeg]
- ffmpeg 0.cvs20060823-8 (low; bug #407003)
+ - xmovie <removed>
CVE-2007-1782 (CruiseWorks 1.09e and earlier does not properly restrict user
access ...)
NOT-FOR-US: CruiseWorks
CVE-2007-1781 (Minna De Office 1.x and 2.x does not properly restrict user
access to ...)
@@ -42645,6 +42650,7 @@
- gst-ffmpeg 0.8.7-10
[etch] - ffmpeg 0.cvs20060823-5
- ffmpeg 0.cvs20060823-6
+ - xmovie <not-affected> (this is not an issue in the avformat ffmpeg
code copy)
- mplayer 1.0~rc1-12
CVE-2007-0471 (sre/params.php in the Integrity Clientless Security (ICS)
component in ...)
NOT-FOR-US: Check Point
@@ -42906,6 +42912,7 @@
- mplayer 1.0~rc1-12
[etch] - ffmpeg 0.cvs20060823-5
- ffmpeg 0.cvs20060823-6
+ - xmovie <not-affected> (this is not an issue in the avformat ffmpeg
code copy)
CVE-2007-XXXX [netpbm heap corruption]
- netpbm-free 2:10.0-11 (bug #407605)
CVE-2007-0363 (Cross-site scripting (XSS) vulnerability in admin-search.php in
(1) ...)
@@ -48536,6 +48543,7 @@
CVE-2006-4800 (Multiple buffer overflows in libavcodec in ffmpeg before ...)
{DSA-1215}
- ffmpeg 0.cvs20060329-1
+ - xmovie <removed>
- xine-lib 1.1.2-1
- gst-ffmpeg 0.8.7-7 (medium; bug #401304)
- gstreamer0.10-ffmpeg 0.10.1-3 (medium; bug #401311)
@@ -61292,6 +61300,7 @@
CVE-2005-4048 (Heap-based buffer overflow in the avcodec_default_get_buffer
function ...)
{DSA-1005-1 DSA-1004-1 DSA-992-1}
- ffmpeg 0.cvs20050918-5.1 (bug #342207; medium)
+ - xmovie <removed>
- xine-lib 1.0.1-1.5 (bug #342208; medium)
- mplayer <not-affected> (Fixed before initial upload)
- gst-ffmpeg 0.8.7-5 (bug #343503; medium)
@@ -67090,6 +67099,7 @@
NOT-FOR-US: AppWeb HTTP server
CVE-2005-XXXX [Integer overflow in ffmpeg''s MPEG encoding]
- ffmpeg 0.cvs20050811-1 (bug #320150; medium)
+ - xmovie <removed>
CVE-2005-XXXX [xgalaga score file segfault]
- xgalaga 2.0.34-31 (bug #319686; low)
[sarge] - xgalaga <no-dsa> (Minor issue)