Moritz Muehlenhoff
2009-Dec-03 18:34 UTC
[Secure-testing-commits] r13440 - in data: . CVE DSA
Author: jmm-guest
Date: 2009-12-03 18:34:22 +0000 (Thu, 03 Dec 2009)
New Revision: 13440
Modified:
data/CVE/list
data/DSA/list
data/embedded-code-copies
Log:
- evolution unimportant
- two BSD issues NFU
- only one CVE ID is used for the dtoa issue
- mark two browser RNG issues as unimportant
- xen fixed
- libhtml-prototype-perl fixed, also fixes
code copies
Modified: data/CVE/list
==================================================================---
data/CVE/list 2009-12-03 12:51:46 UTC (rev 13439)
+++ data/CVE/list 2009-12-03 18:34:22 UTC (rev 13440)
@@ -2529,7 +2529,7 @@
[lenny] - otrs2 <not-affected> (prototype.js not present)
- webcalendar <unfixed> (low; bug #555268)
[lenny] - webcalendar <not-affected> (prototype.js not present)
- - libhtml-prototype-perl <unfixed> (low; bug #558977)
+ - libhtml-prototype-perl 1.48-3 (low; bug #558977)
[etch] - libhtml-prototype-perl <no-dsa> (minor issue)
[lenny] - libhtml-prototype-perl <no-dsa> (minor issue)
- plone3 <unfixed> (low; bug #555274)
@@ -6538,13 +6538,11 @@
- kdebase <unfixed> (low; bug #532519)
[lenny] - kdebase <no-dsa> (Minor issue)
[etch] - kdebase <no-dsa> (Minor issue)
- - w3m <unfixed> (low; bug #532521)
- [lenny] - w3m <no-dsa> (Minor issue)
- [etch] - w3m <no-dsa> (Minor issue)
+ - w3m <unfixed> (unimportant; bug #532521)
+ NOTE: w3m doesn''t have Javascript support and the boundary issue is
harmles
- chromium-browser <itp> (low; bug #520324)
- - lynx 2.8.7rel.1-1 (low; bug #532520)
- [lenny] - lynx <no-dsa> (Minor issue)
- [etch] - lynx <no-dsa> (Minor issue)
+ - lynx 2.8.7rel.1-1 (unimportant; bug #532520)
+ NOTE: lynx doesn''t have Javascript and form-data support
- dillo <unfixed> (low; bug #532522)
[lenny] - dillo <no-dsa> (Minor issue)
[etch] - dillo <no-dsa> (Minor issue)
@@ -7454,9 +7452,8 @@
{DSA-1804-1}
- ipsec-tools 1:0.7.1-1.5 (medium; bug #528933)
CVE-2009-1631 (The Mailer component in Evolution 2.26.1 and earlier uses ...)
- - evolution <unfixed> (low; bug #526409)
- [lenny] - evolution <no-dsa> (Minor issue, only for local users/mail and
open homedirs)
- [etch] - evolution <no-dsa> (Minor issue, only for local users/mail and
open homedirs)
+ - evolution <unfixed> (unimportant; bug #526409)
+ NOTE: Mostly a security enhancement, only for local users/mail and open
homedirs
CVE-2009-1630 (The nfs_permission function in fs/nfs/dir.c in the NFS client
...)
{DSA-1865-1 DSA-1844-1 DSA-1809-1}
- linux-2.6 2.6.30-1
@@ -7658,9 +7655,7 @@
CVE-2009-1564
RESERVED
CVE-2009-1563 (Array index error in Mozilla Firefox 3.0.x before 3.0.15 and
3.5.x ...)
- {DSA-1931-1}
- - nspr 4.8-2
- [etch] - nspr <no-dsa> (Mozilla packages from oldstable no longer
covered by security support)
+ NOTE: Tracked as CVE-2009-0689
CVE-2009-1562
RESERVED
CVE-2009-1561 (Cross-site request forgery (CSRF) vulnerability in
administration.cgi ...)
@@ -11016,8 +11011,13 @@
CVE-2009-0690 (The Foxit JPEG2000/JBIG2 Decoder add-on before 2.0.2009.616 for
Foxit ...)
NOT-FOR-US: Foxit JPEG2000/JBIG2 Decoder add-on
CVE-2009-0689 (The gdtoa (aka new dtoa) implementation in gdtoa/misc.c in libc
in ...)
+ {DSA-1931-1}
+ - nspr 4.8-2
+ [etch] - nspr <no-dsa> (Mozilla packages from oldstable no longer
covered by security support)
- kdelibs <unfixed> (medium; bug #559265)
- kde4libs <unfixed> (medium; bug #559266)
+ TODO: check and merge with 2009-1563?
+ TODO: Someone posted a long list of dtoa embedded to debian-devel some time
ago
NOTE: CVE-2009-1563 will be marked REJECTED by MITRE.
NOTE: http://securityreason.com/achievement_securityalert/74
CVE-2009-0688 (Multiple buffer overflows in the CMU Cyrus SASL library before
2.1.23 ...)
@@ -23003,7 +23003,7 @@
{DTSA-133-1}
- qemu 0.9.1-5
- kvm 66+dfsg-1.1 (bug #481204)
- - xen-3 <unfixed> (bug #490409)
+ - xen-3 3.4.0-1 (bug #490409)
- xen-unstable <unfixed> (bug #490411)
- xen-3.0 <removed>
CVE-2008-2003 (BadBlue 2.72 Personal Edition stores multiple programs in the
web ...)
@@ -25082,12 +25082,7 @@
NOTE: you must be able to create pages in the same cookie domain, which seems
NOTE: rare and unwise. low priority.
CVE-2008-1148 (A certain pseudo-random number generator (PRNG) algorithm that
uses ...)
- - kfreebsd-5 <removed>
- [etch] - kfreebsd-5 <no-dsa> (KFreebsd not supported)
- - kfreebsd-6 <unfixed>
- [lenny] - kfreebsd-6 <no-dsa> (KFreebsd not supported)
- - kfreebsd-7 <unfixed> (bug #483152)
- [lenny] - kfreebsd-7 <no-dsa> (KFreebsd not supported)
+ NOT-FOR-US: OpenBSD / NetBSD
CVE-2008-1147 (A certain pseudo-random number generator (PRNG) algorithm that
uses ...)
- kfreebsd-5 <removed>
[etch] - kfreebsd-5 <no-dsa> (KFreebsd not supported)
@@ -25096,12 +25091,7 @@
- kfreebsd-7 <unfixed> (bug #483152)
[lenny] - kfreebsd-7 <no-dsa> (KFreebsd not supported)
CVE-2008-1146 (A certain pseudo-random number generator (PRNG) algorithm that
uses ...)
- - kfreebsd-5 <removed>
- [etch] - kfreebsd-5 <no-dsa> (KFreebsd not supported)
- - kfreebsd-6 <unfixed> (bug #483152)
- [lenny] - kfreebsd-6 <no-dsa> (KFreebsd not supported)
- - kfreebsd-7 <unfixed> (bug #483152)
- [lenny] - kfreebsd-7 <no-dsa> (KFreebsd not supported)
+ NOT-FOR-US: OpenBSD
CVE-2008-1144 (The Marvell driver for the Netgear WN802T Wi-Fi access point
with ...)
NOT-FOR-US: Marvell driver for the Netgear WN802T Wi-Fi access point
CVE-2008-1143
@@ -39253,7 +39243,7 @@
[lenny] - webcalendar <not-affected> (prototype.js not present)
- plone3 <unfixed> (low; bug #555274)
- wesnoth <not-affected> (fixed since initial inclusion)
- - libhtml-prototype-perl <unfixed> (low; bug #558977)
+ - libhtml-prototype-perl 1.48-3 (low; bug #558977)
[etch] - libhtml-prototype-perl <no-dsa> (minor issue)
[lenny] - libhtml-prototype-perl <no-dsa> (minor issue)
NOTE: see
http://www.fortifysoftware.com/servlet/downloads/public/JavaScript_Hijacking.pdf
Modified: data/DSA/list
==================================================================---
data/DSA/list 2009-12-03 12:51:46 UTC (rev 13439)
+++ data/DSA/list 2009-12-03 18:34:22 UTC (rev 13440)
@@ -54,7 +54,7 @@
{CVE-2009-3615}
[lenny] - pidgin 2.4.3-4lenny5
[08 Nov 2009] DSA-1931-1 nspr - several vulnerabilities
- {CVE-2009-1563 CVE-2009-2463}
+ {CVE-2009-2463 CVE-2009-0689}
[lenny] - nspr 4.7.1-5
[07 Nov 2009] DSA-1930-1 drupal6 - several vulnerabilities
{CVE-2009-2372 CVE-2009-2373 CVE-2009-2374}
Modified: data/embedded-code-copies
==================================================================---
data/embedded-code-copies 2009-12-03 12:51:46 UTC (rev 13439)
+++ data/embedded-code-copies 2009-12-03 18:34:22 UTC (rev 13440)
@@ -692,7 +692,7 @@
- passenger 2.2.5debian1-1 (embed; bug #555273)
- plone3 <unfixed> (embed; bug #555275)
- wesnoth <not-affected> (prototype.js not included in any of the binary
packages; bug #555277)
- - libhtml-prototype-perl <unfixed> (embed; bug #538920)
+ - libhtml-prototype-perl 1.48-3 (embed; bug #538920)
- xulrunner <unfixed> (embed)
NOTE: included in iceweasel/xulrunner unit tests directory, so may not be
security-relevant
@@ -785,6 +785,7 @@
- request-tracker3.8 <unfixed> (embed)
- rt-extension-emailcompletion <not-affected> (prototype.js not included
in the binary package)
- wordpress 2.5.0-2 (embed)
+ - libhtml-prototype-perl 1.48-3 (embed)
libmarkdown-php
- moodle <unfixed> (embed; bug #507185)