Author: jmm-guest
Date: 2010-10-14 20:50:56 +0000 (Thu, 14 Oct 2010)
New Revision: 15472
Modified:
data/CVE/list
Log:
- new openconnect issues (fixed in squeeze/sid, not in Lenny, one harmless)
- new midori issue (fixed in sid only, not in Lenny)
- bugzilla fixed in sid
- new kernel issue
- bind CVEfied
- new ettercap issues
- new curl issue doesn''t affect Debian
- new freeradius issues (one affects Lenny)
- new tiff issue (doesn''t affect Lenny)
Modified: data/CVE/list
==================================================================---
data/CVE/list 2010-10-14 06:50:18 UTC (rev 15471)
+++ data/CVE/list 2010-10-14 20:50:56 UTC (rev 15472)
@@ -59,13 +59,14 @@
CVE-2010-3904
RESERVED
CVE-2010-3903 (Unspecified vulnerability in OpenConnect before 2.23 allows
remote ...)
- TODO: check
+ - openconnect 2.25-0.1
CVE-2010-3902 (OpenConnect before 2.26 places the webvpn cookie value in the
...)
- TODO: check
+ - openconnect <unfixed> (unimportant)
+ NOTE: This is an additional safety net for careless users, not a vulnerability
CVE-2010-3901 (OpenConnect before 2.25 does not properly validate X.509
certificates, ...)
- TODO: check
+ - openconnect 2.25-0.1 (bug #590873)
CVE-2010-3900 (Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup
before ...)
- TODO: check
+ - midori 0.2.7-1.1
CVE-2010-3899
RESERVED
CVE-2010-3898
@@ -176,14 +177,19 @@
RESERVED
CVE-2010-3844
RESERVED
+ - ettercap <unfixed> (low; bug #600130)
+ [lenny] - ettercap <no-dsa> (Minor issue)
CVE-2010-3843
RESERVED
+ - ettercap <unfixed> (low; bug #600130)
+ [lenny] - ettercap <no-dsa> (Minor issue)
CVE-2010-3842
RESERVED
+ - curl <not-affected> (Doesn''t affect POSIX systems)
CVE-2010-3841
RESERVED
CVE-2009-5009 (Double free vulnerability in OpenConnect before 1.40 might allow
...)
- TODO: check
+ - openconnect 1.40-1
CVE-2009-5008 (Cisco Secure Desktop (CSD), when used in conjunction with an
...)
TODO: check
CVE-2009-5007 (The Cisco trial client on Linux for Cisco AnyConnect SSL VPN
allows ...)
@@ -377,10 +383,6 @@
NOTE: http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html
NOTE: ACL bypass claimed to only affect >=9.7.2:
https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html
NOTE: The crash with multiple trust anchors affects 9.6 and is fixed in
9.6-ESV-R2.
-CVE-2010-XXXX [bind acl bypass]
- - bind9 <not-affected> (Only affects 9.7.2, which is not yet in the
archive)
- NOTE: http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html
- NOTE: ACL bypass claimed to only affect >=9.7.2:
https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html
CVE-2010-3761 (Unspecified vulnerability in IBM Tivoli Storage Manager (TSM)
FastBack ...)
NOT-FOR-US: IBM Tivoli Storage Manager
CVE-2010-3760 (FastBackMount.exe in the Mount service in IBM Tivoli Storage
Manager ...)
@@ -515,7 +517,6 @@
- xpdf 3.02-9
- poppler <unfixed> (bug #599165)
NOTE:
http://cgit.freedesktop.org/poppler/poppler/commit/?id=39d140bfc0b8239bdd96d6a55842034ae5c05473
- TODO: kdegrahics/okular and xpdf have switched to dynamic linking, Lenny needs
to be checked
CVE-2010-3703
RESERVED
- kdegraphics 4.0
@@ -532,7 +533,6 @@
- xpdf 3.02-9
- poppler <unfixed> (bug #599165)
NOTE:
http://cgit.freedesktop.org/poppler/poppler/commit/?id=e853106b58d6b4b0467dbd6436c9bb1cfbd372cf
- TODO: kdegrahics/okular and xpdf have switched to dynamic linking, Lenny needs
to be checked
CVE-2010-3701 (lib/MessageStoreImpl.cpp in Red Hat Enterprise MRG before 1.2.2
allows ...)
TODO: check
CVE-2010-3700
@@ -542,9 +542,10 @@
CVE-2010-3698
RESERVED
CVE-2010-3697 (The wait_for_child_to_die function in main/event.c in FreeRADIUS
2.1.x ...)
- TODO: check
+ - freeradius <unfixed> (bug #600176)
CVE-2010-3696 (The fr_dhcp_decode function in lib/dhcp.c in FreeRADIUS 2.1.9,
in ...)
- TODO: check
+ - freeradius <unfixed> (bug #600176)
+ [lenny] - freeradius <not-affected> (Vulnerable code not present)
CVE-2010-3695 [XSS vulnerability in the Fetchmail configuration]
RESERVED
- imp4 <unfixed> (bug #598584)
@@ -1699,7 +1700,6 @@
- mailscanner <unfixed> (bug #596396; low)
CVE-2010-3278
REJECTED
- NOT-FOR-US: novfs kernel module (only included in SUSE it seems)
CVE-2010-3277 (The installer in VMware Workstation 7.x before 7.1.2 build
301548 and ...)
NOT-FOR-US: VMware Workstation
CVE-2010-3276
@@ -2171,7 +2171,7 @@
- chromium-browser 5.0.375.127~r55887-1
- webkit <not-affected> (chromium specific)
CVE-2010-3110 (Multiple buffer overflows in the Novell Client novfs module for
the ...)
- TODO: check
+ NOT-FOR-US: novfs kernel module (only included in SUSE it seems)
CVE-2010-2948 (Stack-based buffer overflow in the bgp_route_refresh_receive
function ...)
{DSA-2104-1}
- quagga 0.99.17-1 (bug #594262)
@@ -2229,7 +2229,8 @@
CVE-2010-3088 (The notify function in pidgin-knotify.c in the pidgin-knotify
plugin ...)
TODO: check
CVE-2010-3087 (LibTIFF before 3.9.2-5.2.1 in SUSE openSUSE 11.3 allows remote
...)
- TODO: check
+ - tiff <unfixed> (bug #600188)
+ [lenny] - tiff <not-affected> (Vulnerable code not present)
CVE-2010-3086
RESERVED
CVE-2010-3085 (The network-play implementation in Mednafen before 0.8.D might
allow ...)
@@ -2700,7 +2701,7 @@
CVE-2010-2891
RESERVED
CVE-2010-2890 (Adobe Reader and Acrobat 9.x before 9.4, and 8.x before 8.2.5 on
...)
- TODO: check
+ NOT-FOR-US: Adobe Reader and Acrobat
CVE-2010-2889 (Unspecified vulnerability in Adobe Reader and Acrobat 9.x before
9.4, ...)
NOT-FOR-US: Adobe Reader and Acrobat
CVE-2010-2888 (Multiple unspecified vulnerabilities in an ActiveX control in
Adobe ...)
@@ -3130,13 +3131,13 @@
- iceape 2.0.7-1
[lenny] - iceape <not-affected> (Only a stub package)
CVE-2010-2759 (Bugzilla 2.23.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1
through ...)
- - bugzilla <unfixed> (bug #595015; medium)
+ - bugzilla 3.6.2.0-1 (bug #595015; medium)
CVE-2010-2758 (Bugzilla 2.17.1 through 3.2.7, 3.3.1 through 3.4.7, 3.5.1
through ...)
- - bugzilla <unfixed> (bug #595015; low)
+ - bugzilla 3.6.2.0-1 (bug #595015; low)
CVE-2010-2757 (The sudo feature in Bugzilla 2.22rc1 through 3.2.7, 3.3.1
through ...)
- - bugzilla <unfixed> (bug #595015; low)
+ - bugzilla 3.6.2.0-1 (bug #595015; low)
CVE-2010-2756 (Search.pm in Bugzilla 2.19.1 through 3.2.7, 3.3.1 through 3.4.7,
3.5.1 ...)
- - bugzilla <unfixed> (bug #595015; low)
+ - bugzilla 3.6.2.0-1 (bug #595015; low)
CVE-2010-2755 (layout/generic/nsObjectFrame.cpp in Mozilla Firefox 3.6.7 does
not ...)
- xulrunner <not-affected> (Only exploitable in Firefox 3.6.x and above)
- iceweasel <not-affected> (Only exploitable in Firefox 3.6.x and above)
@@ -3372,7 +3373,7 @@
CVE-2010-2654 (Multiple cross-site scripting (XSS) vulnerabilities on the IBM
...)
NOT-FOR-US: BladeCenter software
CVE-2010-2653 (Race condition in the hvc_close function in
drivers/char/hvc_console.c ...)
- TODO: check
+ - linux-2.6 <unfixed>
CVE-2009-4935 (SQL injection vulnerability in ogp_show.php in Online Guestbook
Pro ...)
NOT-FOR-US: Online Guestbook Pro
CVE-2009-4934 (Cross-site scripting (XSS) vulnerability in index.php in Online
Photo ...)
@@ -10482,7 +10483,9 @@
CVE-2010-0219
RESERVED
CVE-2010-0218 (ISC BIND 9.7.2 through 9.7.2-P1 uses an incorrect ACL to
restrict the ...)
- TODO: check
+ - bind9 <not-affected> (Only affects 9.7.2, which is not yet in the
archive)
+ NOTE: http://ftp.isc.org/isc/bind9/9.7.2-P2/RELEASE-NOTES-BIND-9.7.2-P2.html
+ NOTE: ACL bypass claimed to only affect >=9.7.2:
https://lists.isc.org/pipermail/bind-announce/2010-September/000655.html
CVE-2010-0217
RESERVED
CVE-2010-0216