Author: jmm
Date: 2011-12-08 18:20:25 +0000 (Thu, 08 Dec 2011)
New Revision: 17765
Modified:
data/CVE/list
Log:
updates/CVE assignments on libav/ffmpeg
new krb issue only affecting testing and sid
Modified: data/CVE/list
==================================================================---
data/CVE/list 2011-12-08 06:21:52 UTC (rev 17764)
+++ data/CVE/list 2011-12-08 18:20:25 UTC (rev 17765)
@@ -19,18 +19,9 @@
CVE-2011-4670 (Multiple cross-site scripting (XSS) vulnerabilities in vTiger
CRM ...)
NOT-FOR-US: vTiger CRM
CVE-2011-4669 (SQL injection vulnerability in wp-users.php in WordPress Users
plugin ...)
- TODO: check
-CVE-2011-XXXX [FFmpeg Libavcodec memory corruption remote code execution]
- - libav <unfixed>
- - mplayer <unfixed>
- - kino <unfixed>
- - chromium-browser <unfixed>
- - ffmpeg <removed>
- - ffmpeg-debian <end-of-life>
- NOTE: http://www.openwall.com/lists/oss-security/2011/12/04/1
- TODO: evaluate severity
+ NOT-FOR-US: Wordpress plugin
CVE-2011-4668 (IBM Tivoli Netcool/Reporter 2.2 before 2.2.0.8 allows remote
attackers ...)
- TODO: check
+ NOT-FOR-US: Tivoli
CVE-2011-4667
RESERVED
CVE-2011-4666
@@ -212,8 +203,12 @@
RESERVED
CVE-2011-4580
RESERVED
-CVE-2011-4579
+CVE-2011-4579 [SVQ1 issue]
RESERVED
+ - libav <unfixed>
+ - ffmpeg <removed>
+ - ffmpeg-debian <end-of-life>
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=4931c8f0f10bf8dedcf626104a6b85bfefadc6f2
CVE-2011-4578 [acpid insecure umasks for calling external scripts]
RESERVED
- acpid 1:2.0.11-1
@@ -737,7 +732,7 @@
CVE-2011-4365
RESERVED
NOTE: duplicate of CVE-2011-4090
-CVE-2011-4364
+CVE-2011-4364 [vmd_decode buffer overflow]
RESERVED
- libav <unfixed>
- ffmpeg <removed>
@@ -787,16 +782,25 @@
- libav <unfixed>
- ffmpeg <removed>
- ffmpeg-debian <end-of-life>
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=c693aa6f71b4f539cf9df67ba42f4b1932981687
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=bb4b0ad83b13c3af57675e80163f3f333adef96f
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=e0966eb140b3569b3d6b5b5008961944ef229c06
CVE-2011-4352 [VP3 integer overflow]
RESERVED
- libav <unfixed>
- ffmpeg <removed>
- ffmpeg-debian <end-of-life>
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commit;h=eef5c35b4352ec49ca41f6198bee8a976b1f81e5
CVE-2011-4351 [QDM2 buffer overflow]
RESERVED
- libav <unfixed>
- ffmpeg <removed>
- ffmpeg-debian <end-of-life>
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=491eaf35ae1f9b619441314bec33766e31580184
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=291d74a46d32183653db07818c7b3407fd50a288
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=7d49f79f1cd47783a963a757a6563b9cac29db62
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=14db3af4f26dad8e6ddf2147e96ccc710952ad4d
+ NOTE:
http://git.videolan.org/?p=ffmpeg.git;a=commitdiff;h=895d258e9ba065d035dd30dbc622423031f0185c
CVE-2011-4350
RESERVED
- yaws 1.91-2 (bug #650009)
@@ -1509,7 +1513,6 @@
{DSA-2346-2 DSA-2346-1}
- proftpd-dfsg 1.3.4~rc3-2 (high; bug #648373)
[lenny] - proftpd-dfsg <not-affected> (vulnerable functionality not
present)
- [squeeze] - proftpd-dfsg 1.3.3a-6squeeze4
NOTE: http://bugs.proftpd.org/show_bug.cgi?id=3711
CVE-2011-4129
RESERVED
@@ -8844,6 +8847,9 @@
NOT-FOR-US: HP Photosmart
CVE-2011-1530
RESERVED
+ - krb5 <unfixed>
+ [squeeze] - krb5 <not-affected> (Only affecs 1.9 and higher)
+ [lenny] - krb5 <not-affected> (Only affecs 1.9 and higher)
CVE-2011-1529 (The lookup_lockout_policy function in the Key Distribution
Center ...)
- krb5 1.10+dfsg~alpha1-1 (low; bug #646367)
[lenny] - krb5 <not-affected> (Introduced in 1.8)