Author: jmm-guest
Date: 2010-05-07 17:40:57 +0000 (Fri, 07 May 2010)
New Revision: 14621
Modified:
data/CVE/list
Log:
- jboss in the archive, needs to be checked
- new texlive issues
- new dvipng issue
- yui unimportant
- new unimportant wireshark issue
- gdomap CVEfied
Modified: data/CVE/list
==================================================================---
data/CVE/list 2010-05-07 17:40:07 UTC (rev 14620)
+++ data/CVE/list 2010-05-07 17:40:57 UTC (rev 14621)
@@ -1,7 +1,3 @@
-CVE-2010-XXXX [gdomap file disclosure]
- - gnustep-base-runtime <unfixed>
- [lenny] - gnustep-base-runtime <not-affected> (Not installed setuid
root)
- NOTE: http://thread.gmane.org/gmane.comp.lib.gnustep.bugs/12336
CVE-2010-1723 (Directory traversal vulnerability in the iNetLanka Contact Us
Draw ...)
TODO: check
CVE-2010-1722 (Directory traversal vulnerability in the Online Market
(com_market) ...)
@@ -243,7 +239,7 @@
CVE-2010-1597 (Stack-based buffer overflow in zgtips.dll in ZipGenius
6.3.1.2552 ...)
NOT-FOR-US: ZipGenius
CVE-2009-4834 (lib.php in Zeroboard 4.1 pl7 allows remote attackers to execute
...)
- TODO: check
+ NOT-FOR-US: Zeroboard
CVE-2009-4833 (MySQL Connector/NET before 6.0.4, when using encryption, does
not ...)
NOT-FOR-US: MySQL Connector/NET
CVE-2009-4832 (The dlpcrypt.sys kernel driver 0.1.1.27 in DESlock+ 4.0.2 allows
local ...)
@@ -715,12 +711,17 @@
[lenny] - fetchmail <no-dsa> (only vulnerable when run under debug
verbosity level)
NOTE: http://www.fetchmail.info/fetchmail-SA-2010-02.txt
NOTE: http://gitorious.org/fetchmail/fetchmail/commit/ec06293
-CVE-2010-1457
+CVE-2010-1457 [gdomap file disclosure]
RESERVED
+ - gnustep-base-runtime <unfixed>
+ [lenny] - gnustep-base-runtime <not-affected> (Not installed setuid
root)
+ NOTE: http://thread.gmane.org/gmane.comp.lib.gnustep.bugs/12336
CVE-2010-1456
RESERVED
-CVE-2010-1455
+CVE-2010-1455 [DOCSIS wireshark]
RESERVED
+ - wireshark <unfixed> (unimportant)
+ NOTE: Not triggerable remotely
CVE-2010-1454
RESERVED
CVE-2010-1453
@@ -766,6 +767,7 @@
NOTE: http://www.videolan.org/security/sa1003.html
CVE-2010-1440
RESERVED
+ - texlive-bin <unfixed> (low)
CVE-2010-1439
RESERVED
CVE-2010-1438
@@ -1101,6 +1103,7 @@
RESERVED
CVE-2010-1284
RESERVED
+ - texlive-bin <unfixed> (low)
CVE-2010-1283
RESERVED
CVE-2010-1282
@@ -2441,8 +2444,9 @@
RESERVED
CVE-2010-0830
RESERVED
-CVE-2010-0829
+CVE-2010-0829
RESERVED
+ - dvipng <unfixed> (low; bug filed)
CVE-2010-0828 (Cross-site scripting (XSS) vulnerability in action/Despam.py in
the ...)
{DSA-2024-1}
- moin 1.9.2-3 (low; bug #575995)
@@ -2724,7 +2728,7 @@
- texlive-bin <unfixed> (low)
[lenny] - texlive-bin <no-dsa> (minor issue)
CVE-2010-0738 (The JMX-Console web application in JBossAs in Red Hat JBoss
Enterprise ...)
- NOT-FOR-US: Red Hat JBoss Enterprise Application Platform
+ - jbossas4 <undetermined>
CVE-2010-0737
RESERVED
CVE-2010-0736 (Cross-site scripting (XSS) vulnerability in the view_queryform
...)
@@ -3899,7 +3903,7 @@
CVE-2010-XXXX [makepasswd: insecure passwords generated with default settings]
- makepasswd 1.10-5 (low; bug #564559)
[lenny] - makepasswd <no-dsa> (Minor issue)
-CVE-2010-XXXX [mydms multiple issues]
+CVE-2010-XXXX [mydm multiple issues]
- mydms <unfixed> (low)
TODO: write bug report
NOTE: http://seclists.org/fulldisclosure/2010/Jan/267
@@ -8822,7 +8826,8 @@
[etch] - libaws <no-dsa> (minor issue)
[lenny] - libaws <no-dsa> (minor issue)
- libjson-ruby 1.1.4-1 (low; bug #555223)
- [lenny] - libjson-ruby 1.1.2-1+lenny1
+ [lenny] - libjson-ruby <no-dsa> (Minor issue)
+ TODO: next point update [lenny] - libjson-ruby 1.1.2-1+lenny1
- lucene2 2.9.1+ds1-2 (unimportant; bug #555225)
[etch] - lucene2 <not-affected> (prototype.js not present)
NOTE: prototype.js copy unused per #555225
@@ -45910,7 +45915,7 @@
CVE-2007-2386 (Buffer overflow in mDNSResponder in Apple Mac OS X 10.4 up to
10.4.9 ...)
NOT-FOR-US: Apple mDNSResponder
CVE-2007-2385 (The Yahoo! UI framework exchanges data using JavaScript Object
...)
- - yui <unfixed> (low; bug #557745)
+ - yui <unfixed> (unimportant; bug #557745)
- bcfg2 <not-affected> (present in source but not included in any binary
files)
- serendipity <unfixed> (low; bug #557746)
- moodle <not-affected> (uses system libjs-yui)