Author: keescook-guest
Date: 2007-08-13 21:30:43 +0000 (Mon, 13 Aug 2007)
New Revision: 6298
Modified:
data/CVE/list
data/embedded-code-copies
Log:
NFUs: 31
unfixed: gftp linux-2.6 openssl
fixed: libvorbis sleuthkit vim
not-affected: wpasupplicant
embedded: fpslib in gftp
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2007-08-13 21:14:14 UTC (rev 6297)
+++ data/CVE/list 2007-08-13 21:30:43 UTC (rev 6298)
@@ -9,17 +9,17 @@
CVE-2007-4263 (Unspecified vulnerability in the server side of the Secure Copy
(SCP) ...)
NOT-FOR-US: Cisco
CVE-2007-4262 (Unrestricted file upload vulnerability in EZPhotoSales 1.9.3
and ...)
- TODO: NOT-FOR-US EZPhotoSales
+ NOT-FOR-US: EZPhotoSales
CVE-2007-4261 (EZPhotoSales 1.9.3 and earlier stores sensitive information
under the ...)
- TODO: NOT-FOR-US EZPhotoSales
+ NOT-FOR-US: EZPhotoSales
CVE-2007-4260 (EZPhotoSales 1.9.3 and earlier has a default "admin"
account for ...)
- TODO: NOT-FOR-US EZPhotoSales
+ NOT-FOR-US: EZPhotoSales
CVE-2007-4259 (EZPhotoSales 1.9.3 and earlier allows remote attackers to
download ...)
- TODO: NOT-FOR-US EZPhotoSales
+ NOT-FOR-US: EZPhotoSales
CVE-2007-4258 (SQL injection vulnerability in directory.php in Prozilla Pub
Site ...)
NOT-FOR-US: Prozilla
CVE-2007-4257 (Multiple buffer overflows in Live for Speed (LFS) S1 and S2
allow ...)
- NOT-FOR-US: Live for Speed
+ NOT-FOR-US: Live for Speed
CVE-2007-4256 (Directory traversal vulnerability in showpage.cgi in YNP Portal
System ...)
NOT-FOR-US: YNP Portal System
CVE-2007-4255 (Buffer overflow in the mSQL extension in PHP 5.2.3 allows ...)
@@ -52,9 +52,9 @@
CVE-2007-4244 (PHP remote file inclusion vulnerability in langset.php in the
J! ...)
NOT-FOR-US: com_jreactions for Joomla!
CVE-2007-4243 (Unspecified vulnerability in pfilter-reporter.pl in Astaro
Security ...)
- NOT-FOR-US: Astaro
+ NOT-FOR-US: Astaro Security Gateway
CVE-2007-4242 (The pop3 Proxy in Astaro Security Gateway (ASG) 7 does not
perform ...)
- NOT-FOR-US: Astaro
+ NOT-FOR-US: Astaro Security Gateway
CVE-2007-4241 (Buffer overflow in ldcconn in Hewlett-Packard (HP) Controller
for ...)
NOT-FOR-US: Hewlett-Packard
CVE-2007-4240 (The check_logout function in class/auth.php in Help Center Live
(hcl) ...)
@@ -122,43 +122,43 @@
CVE-2007-4210 (Multiple SQL injection vulnerabilities in module.php in LANAI
(la-nai) ...)
NOT-FOR-US: LANAI CMS
CVE-2007-4209 (SQL injection vulnerability in Recherche.php in Aceboard forum
allows ...)
- NOT-FOR-US: Aceboard
+ NOT-FOR-US: Aceboard forum
CVE-2007-4208 (SQL injection vulnerability in default.asp in Next Gen
Portfolio ...)
- TODO: check
+ NOT-FOR-US: Next Gen Portfolio Manager
CVE-2007-4207 (SQL injection vulnerability in admin_console/index.asp in
Gallery In A ...)
- TODO: check
+ NOT-FOR-US: Gallery In A Box
CVE-2007-4206 (Kaspersky Anti-Spam 3.0 MP1 before Critical Fix 2 (3.0.278.4)
sets ...)
- TODO: check
+ NOT-FOR-US: Kaspersky Anti-Spam
CVE-2007-4205 (XHA (Linux-HA) on the BlueCat Networks Adonis DNS/DHCP
Appliance ...)
- TODO: check
+ NOT-FOR-US: BlueCat Networks Adonis
CVE-2007-4204 (Hitachi Groupmax Collaboration - Schedule, as used in Groupmax
...)
- TODO: check
+ NOT-FOR-US: Hitachi Groupmax Collaboration
CVE-2007-4203 (Session fixation vulnerability in Mambo 4.6.2 CMS allows remote
...)
TODO: check
CVE-2007-4202 (Guidance Software EnCase Enterprise Edition (EEE) 6 does not
properly ...)
- TODO: check
+ NOT-FOR-US: Guidance Software EnCase
CVE-2007-4201 (Guidance Software EnCase 6.2 and 6.5 does not properly handle a
volume ...)
- TODO: check
+ NOT-FOR-US: Guidance Software EnCase
CVE-2007-4200 (ntfs.c in fsstat in Brian Carrier The Sleuth Kit (TSK) before
2.09 ...)
- TODO: check
+ - sleuthkit 2.09-1 (low)
CVE-2007-4199 (Brian Carrier The Sleuth Kit (TSK) before 2.09 allows
user-assisted ...)
- TODO: check
+ - sleuthkit 2.09-1 (low)
CVE-2007-4198 (The fs_data_put_str function in ntfs.c in fls in Brian Carrier
The ...)
- TODO: check
+ - sleuthkit 2.09-1 (low)
CVE-2007-4197 (icat in Brian Carrier The Sleuth Kit (TSK) before 2.09 omits
NULL ...)
- TODO: check
+ - sleuthkit 2.09-1 (low)
CVE-2007-4196 (icat in Brian Carrier The Sleuth Kit (TSK) before 2.09
misinterprets a ...)
- TODO: check
+ - sleuthkit 2.09-1 (low)
CVE-2007-4195 (Use-after-free vulnerability in ext2fs.c in Brian Carrier The
Sleuth ...)
- TODO: check
+ - sleuthkit 2.09-1 (low)
CVE-2007-4194 (Guidance Software EnCase 5.0 allows user-assisted remote
attackers to ...)
- TODO: check
+ NOT-FOR-US: Guidance Software EnCase
CVE-2007-4193 (Multiple cross-site request forgery (CSRF) vulnerabilities in
...)
- TODO: check
+ NOT-FOR-US: DVD Rental System
CVE-2007-4192 (Multiple cross-site scripting (XSS) vulnerabilities in IDE
Group DVD ...)
- TODO: check
+ NOT-FOR-US: DVD Rental System
CVE-2007-4191 (Panda Antivirus 2008 stores service executables under the
product's ...)
- TODO: check
+ NOT-FOR-US: Panda Antivirus
CVE-2007-4190 (CRLF injection vulnerability in Joomla! before 1.0.13 (aka
Sunglow) ...)
NOT-FOR-US: Joomla!
CVE-2007-4189 (Multiple cross-site scripting (XSS) vulnerabilities in Joomla!
before ...)
@@ -172,17 +172,17 @@
CVE-2007-4185 (Joomla! 1.0.12 allows remote attackers to obtain sensitive
information ...)
NOT-FOR-US: Joomla!
CVE-2007-4184 (SQL injection vulnerability in
administrator/popups/pollwindow.php in ...)
- TODO: check
+ NOT-FOR-US: Joomla!
CVE-2007-4183 (SQL injection vulnerability in main.php in paBugs 2.0 Beta 3
and ...)
- TODO: check
+ NOT-FOR-US: paBugs
CVE-2007-4182 (Unrestricted file upload vulnerability in index.php in
WikiWebWeaver ...)
- TODO: check
+ NOT-FOR-US: WikiWebWeaver
CVE-2007-4181 (** DISPUTED ** ...)
- TODO: check
+ NOT-FOR-US: Pluck
CVE-2007-4180 (** DISPUTED ** ...)
- TODO: check
+ NOT-FOR-US: Pluck
CVE-2007-4179 (Unspecified vulnerability in the Address and Routing Parameter
Area ...)
- TODO: check
+ NOT-FOR-US: HPUX
CVE-2007-4178 (Cross-site scripting (XSS) vulnerability in index.php in
WebDirector ...)
TODO: check
CVE-2007-4177 (Multiple cross-site scripting (XSS) vulnerabilities in Interact
before ...)
@@ -306,7 +306,7 @@
CVE-2007-4117 (** DISPUTED ** ...)
TODO: check
CVE-2005-4860 (Spectrum Cash Receipting System before 6.504 uses weak
cryptography ...)
- TODO: check
+ NOT-FOR-US: Spectrum Cash Receipting System
CVE-2007-XXXX [teamspeak-server arbitrary file disclosure]
- teamspeak-server 2.0.23.19-1 (bug #435707; medium)
CVE-2007-XXXX [tor insufficient authentication on control port]
@@ -819,7 +819,7 @@
CVE-2007-3871
RESERVED
CVE-2006-7221 (Multiple off-by-one errors in fsplib.c in fsplib before 0.8
allow ...)
- TODO: check
+ - gftp <unfixed> (low; bug #437710)
CVE-2007-XXXX [dokuwiki XSS in spellchecker]
- dokuwiki 0.0.20070626b-1 (unimportant; bug #434134)
NOTE: IE browser bug are not treated as security issues in packages
applications
@@ -1604,7 +1604,7 @@
CVE-2007-3515 (SQL injection vulnerability in view_event.php in TotalCalendar
2.402 ...)
NOT-FOR-US: TotalCalendar
CVE-2006-7220 (Unspecified vulnerability in SAP SAPLPD and SAPSPRINT allows
remote ...)
- TODO: check
+ NOT-FOR-US: SAP SAPLPD
CVE-2006-7219 (eZ publish before 3.8.5 does not properly enforce permissions
for ...)
- ezpublish <not-affected> (Debian's version is too old)
CVE-2006-7218 (eZ publish before 3.8.1 does not properly enforce permissions
for ...)
@@ -2631,14 +2631,14 @@
CVE-2007-3109 (The CERN Image Map Dispatcher (htimage.exe) in Microsoft
FrontPage ...)
NOT-FOR-US: Microsoft FrontPage
CVE-2007-3108 (The BN_from_montgomery function in crypto/bn/bn_mont.c in
OpenSSL ...)
- TODO: check
+ - openssl <unfixed> (low)
CVE-2007-3107 (The signal handling in the Linux kernel 2.6.2 and later, when
run on ...)
- linux-2.6 <unfixed> (unimportant)
NOTE: Not reproducibly reliably by an attacker, mostly a bug
CVE-2007-3106 (libvorbis 1.1.2, and possibly other versions before 1.2.0,
allows ...)
- TODO: check
+ - libvorbis 1.2.0.dfsg-1 (medium)
CVE-2007-3105 (Stack-based buffer overflow in the random number generator
(RNG) ...)
- TODO: check
+ - linux-2.6 <unfixed>
CVE-2007-3104 (The sysfs_readdir function in the Linux kernel in Red Hat
Enterprise ...)
- linux-2.6 <unfixed>
CVE-2007-3103 (The init.d script for the X.Org X11 xfs font server on Red Hat
...)
@@ -2977,7 +2977,7 @@
CVE-2007-2954
RESERVED
CVE-2007-2953 (Format string vulnerability in the helptags_one function in ...)
- TODO: check
+ - vim 1:7.1-056+1 (low)
CVE-2007-2952
RESERVED
CVE-2007-2951 (The parseIrcUrl function in src/kvirc/kernel/kvi_ircurl.cpp in
KVIrc ...)
@@ -3033,7 +3033,7 @@
CVE-2007-2928
RESERVED
CVE-2007-2927 (Unspecified vulnerability in Atheros 802.11 a/b/g wireless
adapter ...)
- TODO: check
+ NOT-FOR-US: Windows Atheros drivers
CVE-2007-2926 (ISC BIND 9 through 9.5.0a5 uses a weak random number generator
during ...)
{DSA-1341-2}
- bind9 1:9.4.1-P1-1
@@ -3143,7 +3143,7 @@
CVE-2007-2875 (Integer underflow in the cpuset_tasks_read function in the
Linux ...)
- linux-2.6 2.6.21-5 (medium)
CVE-2007-2874 (Buffer overflow in the wpa_printf function in the debugging
code in ...)
- TODO: check
+ - wpasupplicant <not-affected> (Fedora-only issue)
CVE-2007-2873 (SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when
running as ...)
- spamassassin 3.2.1-1 (low)
CVE-2007-2872 (Multiple integer overflows in the chunk_split function in PHP 5
before ...)
@@ -4248,7 +4248,7 @@
CVE-2007-2409 (Cross-domain vulnerability in WebCore on Apple Mac OS X 10.3.9
and ...)
TODO: check
CVE-2007-2408 (WebKit in Apple Safari 3 Beta before Update 3.0.3 does not
properly ...)
- TODO: check
+ NOT-FOR-US: Apple Safari
CVE-2007-2407 (The Samba server on Apple Mac OS X 10.3.9 and 10.4.10, when
Windows ...)
- samba <not-affected> (MacOS/Apple-specific vulnerability)
CVE-2007-2406 (Quartz Composer on Apple Mac OS X 10.4.10 does not initialize a
...)
@@ -6745,7 +6745,7 @@
- tomcat5 <unfixed> (low)
- tomcat5.5 <unfixed> (low)
CVE-2007-1354 (The Access Control functionality (JMXOpsAccessControlFilter) in
JMX ...)
- TODO: check
+ NOT-FOR-US: JBoss Application Server
CVE-2007-1353 (The setsockopt function in the L2CAP and HCI Bluetooth support
in the ...)
- linux-2.6 <unfixed> (low)
CVE-2007-1352 (Integer overflow in the FontFileInitTable function in X.Org
libXfont ...)
@@ -16640,7 +16640,7 @@
CVE-2006-4170
REJECTED
CVE-2006-4169 (Multiple directory traversal vulnerabilities in the G/PGP (GPG)
Plugin ...)
- TODO: check
+ NOT-FOR-US: G/PGP (GPG) plugin for Squirrelmail
CVE-2006-4168 (Integer overflow in the exif_data_load_data_entry function in
...)
{DSA-1310-1}
- libexif 0.6.16-1 (bug #430012)
Modified: data/embedded-code-copies
===================================================================
--- data/embedded-code-copies 2007-08-13 21:14:14 UTC (rev 6297)
+++ data/embedded-code-copies 2007-08-13 21:30:43 UTC (rev 6298)
@@ -259,3 +259,6 @@
libwpd (WordPerfect converter):
openoffice.org
+
+fsplib (http://sourceforge.net/projects/fsp/):
+gftp (lib/fsplib version 0.3)
_______________________________________________
Secure-testing-commits mailing list
[email protected]
http://lists.alioth.debian.org/mailman/listinfo/secure-testing-commits
