Secure testing team - Oct 2009 - r13076 - data/CVE

Author: derevko-guest
Date: 2009-10-23 08:54:12 +0000 (Fri, 23 Oct 2009)
New Revision: 13076

Modified:
   data/CVE/list
Log:
- CVE-2009-3622 no-dsa
- CVE-2009-3575: etch and lenny not-affected


Modified: data/CVE/list
==================================================================---
data/CVE/list	2009-10-23 03:15:14 UTC (rev 13075)
+++ data/CVE/list	2009-10-23 08:54:12 UTC (rev 13076)
@@ -249,6 +249,8 @@
 CVE-2009-3622 [wordpress: Trackback DoS]
 	RESERVED
 	- wordpress 2.8.5-1
+	[lenny] - wordpress <no-dsa> (Minor issue)
+	[etch] - wordpress <no-dsa> (Minor issue)
 	NOTE: http://seclists.org/fulldisclosure/2009/Oct/263
 CVE-2009-3621 [linux-2.6: denial-of-service via deadlock]
 	RESERVED
@@ -331,6 +333,8 @@
 	RESERVED
 CVE-2009-3575 (Buffer overflow in DHTRoutingTableDeserializer.cc in aria2
0.15.3, ...)
 	- aria2 1.2.0-1 (low; bug #551070)
+	[etch] - aria2 <not-affected> (Vulnerable code not present)
+	[lenny] - aria2 <not-affected> (Vulnerable code not present)
 CVE-2009-3571 (Unspecified vulnerability in OpenOffice.org (OOo) has unknown
impact ...)
 	- openoffice.org <unfixed> (medium; bug #551068)
 	NOTE: details are unknown

Giuseppe Iuculano wrote:
>  CVE-2009-3622 [wordpress: Trackback DoS]
>  RESERVED
>  - wordpress 2.8.5-1
> +     [lenny] - wordpress <no-dsa> (Minor issue)
> +     [etch] - wordpress <no-dsa> (Minor issue)
>  NOTE: http://seclists.org/fulldisclosure/2009/Oct/263
Erm, I''m a bit hesitant about making it a no-dsa.
It is fairly easy to trigger it, specially since the php5 cgi and apache2
module both have the mbstring extention built-in.

Cheers,
-- 
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net