Author: gilbert-guest
Date: 2009-11-10 18:17:17 +0000 (Tue, 10 Nov 2009)
New Revision: 13269
Modified:
data/CVE/list
data/DSA/list
Log:
xulrunner triage
Modified: data/CVE/list
==================================================================---
data/CVE/list 2009-11-10 17:47:22 UTC (rev 13268)
+++ data/CVE/list 2009-11-10 18:17:17 UTC (rev 13269)
@@ -1349,18 +1349,20 @@
- xulrunner 1.9.1.4-1
[etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer
covered by security support)
CVE-2009-3379 (Multiple unspecified vulnerabilities in libvorbis, as used in
Mozilla ...)
- - libvorbis 1.2.3-1
+ - libvorbis 1.2.3-1 (medium)
- xulrunner 1.9.1.4-1
[lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
[etch] - xulrunner <not-affected> (Only affects Firefox 3.5)
CVE-2009-3378 (The oggplay_data_handle_theora_frame function in ...)
- xulrunner 1.9.1.4-1
- - liboggplay <unfixed> (bug filed)
+ [etch] - xulrunner <not-affected> (ogg support added in firefox 3.5)
+ [lenny] - xulrunner <not-affected> (ogg support added in firefox 3.5)
+ - liboggplay <unfixed> (medium; bug #552743)
CVE-2009-3377 (Multiple unspecified vulnerabilities in liboggz before ...)
- xulrunner 1.9.1.4-1
[lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
[etch] - xulrunner <not-affected> (Only affects Firefox 3.5)
- - liboggz 0.9.9-1
+ - liboggz 0.9.9-1 (medium)
CVE-2009-3376 (Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and
SeaMonkey ...)
{DSA-1922-1}
- xulrunner 1.9.1.4-1
@@ -1384,7 +1386,11 @@
CVE-2009-3371 (Use-after-free vulnerability in Mozilla Firefox 3.5.x before
3.5.4 ...)
- icedove <unfixed> (bug #555313)
- iceweasel 3.5.4-1
+ [etch] - iceweasel <not-affected> (web workers introduced in firefox
3.5)
+ [lenny] - iceweasel <not-affected> (web workers introduced in firefox
3.5)
- xulrunner 1.9.1.4-1
+ [etch] - xulrunner <not-affected> (web workers introduced in firefox
3.5)
+ [lenny] - xulrunner <not-affected> (web workers introduced in firefox
3.5)
- kompozer <unfixed> (unimportant; bug #555326)
NOTE: kompozer shares the browser engine with Firefox, but JavaScript is not
enabled
CVE-2009-3370 (Mozilla Firefox before 3.0.15, and 3.5.x before 3.5.4, allows
remote ...)
Modified: data/DSA/list
==================================================================---
data/DSA/list 2009-11-10 17:47:22 UTC (rev 13268)
+++ data/DSA/list 2009-11-10 18:17:17 UTC (rev 13269)
@@ -373,7 +373,7 @@
[etch] - git-core 1:1.4.4.4-4+etch3
[lenny] - git-core 1:1.5.6.5-3+lenny2
[23 Jul 2009] DSA-1840-1 xulrunner - several vulnerabilities
- {CVE-2009-2462 CVE-2009-2463 CVE-2009-2464 CVE-2009-2465 CVE-2009-2466
CVE-2009-2467 CVE-2009-2469 CVE-2009-2470 CVE-2009-2471 CVE-2009-2472}
+ {CVE-2009-2462 CVE-2009-2464 CVE-2009-2465 CVE-2009-2466 CVE-2009-2467
CVE-2009-2469 CVE-2009-2470 CVE-2009-2471 CVE-2009-2472}
[lenny] - xulrunner 1.9.0.12-0lenny1
[19 Jul 2009] DSA-1839-1 gst-plugins-good0.10 - arbitrary code execution
{CVE-2009-1932}