Author: joeyh
Date: 2013-04-26 21:15:03 +0000 (Fri, 26 Apr 2013)
New Revision: 22046
Modified:
data/CVE/list
Log:
automatic update
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2013-04-26 10:38:54 UTC (rev 22045)
+++ data/CVE/list 2013-04-26 21:15:03 UTC (rev 22046)
@@ -56,19 +56,15 @@
CVE-2013-3242
RESERVED
- joomla <itp> (bug #571794)
-CVE-2013-3241 [phpmyadmin PMASA-2013-5]
- RESERVED
+CVE-2013-3241 (export.php (aka the export script) in phpMyAdmin 4.x before
4.0.0-rc3 ...)
- phpmyadmin <not-affected> (Vulnerable code not present)
-CVE-2013-3240 [phpmyadmin PMASA-2013-4]
- RESERVED
+CVE-2013-3240 (Directory traversal vulnerability in the Export feature in
phpMyAdmin ...)
- phpmyadmin <not-affected> (Vulnerable code not present)
-CVE-2013-3239 [phpmyadmin PMASA-2013-3]
- RESERVED
+CVE-2013-3239 (phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3, when a
SaveDir ...)
- phpmyadmin 4:3.4.11.1-2
[squeeze] - phpmyadmin <no-dsa> (Minor issue)
NOTE: Requires non-default option saveDir to be enabled, an
authenticated untrusted user and Apache mod_mime
-CVE-2013-3238 [phpmyadmin PMASA-2013-2]
- RESERVED
+CVE-2013-3238 (phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows
remote ...)
- phpmyadmin <not-affected> (exploitable PHP on Windows only)
NOTE: code patched in 4:3.4.11.1-2 nonetheless
CVE-2013-3237 (The vsock_stream_sendmsg function in net/vmw_vsock/af_vsock.c
in the ...)
@@ -1026,8 +1022,8 @@
RESERVED
CVE-2013-2768
RESERVED
-CVE-2013-2767
- RESERVED
+CVE-2013-2767 (Unspecified vulnerability in Citrix NetScaler Access Gateway
...)
+ TODO: check
CVE-2013-2766 (Cross-site scripting (XSS) vulnerability in Splunk Web in
Splunk 4.3.0 ...)
NOT-FOR-US: Splunk
CVE-2013-2765
@@ -1147,8 +1143,8 @@
RESERVED
CVE-2013-2710
RESERVED
-CVE-2013-2709
- RESERVED
+CVE-2013-2709 (Cross-site request forgery (CSRF) vulnerability in the
FourSquare ...)
+ TODO: check
CVE-2013-2708
RESERVED
CVE-2013-2707
@@ -1173,8 +1169,8 @@
RESERVED
CVE-2013-2697 (Cross-site request forgery (CSRF) vulnerability in the ...)
NOT-FOR-US: Wordpress plugin Downloadmanager
-CVE-2013-2696
- RESERVED
+CVE-2013-2696 (Cross-site request forgery (CSRF) vulnerability in the All in
One ...)
+ TODO: check
CVE-2013-2695
RESERVED
CVE-2013-2694
@@ -2119,10 +2115,10 @@
RESERVED
CVE-2013-2308
RESERVED
-CVE-2013-2307
- RESERVED
-CVE-2013-2306
- RESERVED
+CVE-2013-2307 (The Yahoo! Browser application before 1.4.3 for Android allows
remote ...)
+ TODO: check
+CVE-2013-2306 (The jigbrowser+ application before 1.6.4 for Android does not
properly ...)
+ TODO: check
CVE-2013-2305 (Cross-site request forgery (CSRF) vulnerability in Cybozu
Office ...)
TODO: check
CVE-2013-2304 (The Sleipnir Mobile application 2.8.0 and earlier and Sleipnir
Mobile ...)
@@ -2828,10 +2824,9 @@
CVE-2013-1971
RESERVED
CVE-2013-1970
- RESERVED
+ REJECTED
NOTE: rejected, erroneously assigned for libxml2
-CVE-2013-1969 [use-after-free error in "htmlParseChunk()" and "xmldecl_done()"]
- RESERVED
+CVE-2013-1969 (Multiple use-after-free vulnerabilities in libxml2 2.9.0 and
possibly ...)
- libxml2 <not-affected> (Affecting only 2.9.x, see bug #705722)
NOTE:
https://git.gnome.org/browse/libxml2/commit/?id=de0cc20c29cb3f056062925395e0f68d2250a46f
CVE-2013-1968
@@ -2892,14 +2887,11 @@
NOTE: Regression introduced with
82cc2e6129c872c8be09381055f2fb5641c5e6fe
NOTE: Regression fixed with a9f437119d79a438cb12e510f3cadd4060102c9f
NOTE: http://www.openwall.com/lists/oss-security/2013/04/22/9
-CVE-2013-1949 [Social Media Widget remote file inclusion]
- RESERVED
+CVE-2013-1949 (Social Media Widget (social-media-widget) plugin 4.0 for
WordPress ...)
NOT-FOR-US: Wordpress Social Media Widget
-CVE-2013-1948
- RESERVED
+CVE-2013-1948 (converter.rb in the md2pdf gem 0.0.1 for Ruby allows
context-dependent ...)
NOT-FOR-US: Ruby gem md2pdf
-CVE-2013-1947
- RESERVED
+CVE-2013-1947 (kelredd-pruview gem 0.3.8 for Ruby allows context-dependent
attackers ...)
NOT-FOR-US: Ruby Gem kelredd-pruview
CVE-2013-1946
RESERVED
@@ -2949,8 +2941,7 @@
- mantis <unfixed>
NOTE: http://www.openwall.com/lists/oss-security/2013/04/04/8
NOTE: http://www.mantisbt.org/bugs/view.php?id=15416
-CVE-2013-1933 [Remote Command Injection]
- RESERVED
+CVE-2013-1933 (The extract_from_ocr function in lib/docsplit/text_extractor.rb
in the ...)
NOT-FOR-US: Karteek Docsplit Ruby Gem
CVE-2013-1932 [mantis: XSS vulnerability on Configuration Report page]
RESERVED
@@ -3013,8 +3004,7 @@
CVE-2013-1916
RESERVED
NOT-FOR-US: WordPress plugin
-CVE-2013-1915 [Vulnerable to XXE attacks]
- RESERVED
+CVE-2013-1915 (ModSecurity before 2.7.3 allows remote attackers to read
arbitrary ...)
{DSA-2659-1}
- modsecurity-apache 2.6.6-6 (bug #704625)
- libapache-mod-security <removed>
@@ -4850,8 +4840,8 @@
NOT-FOR-US: Cisco IOS
CVE-2013-1216
RESERVED
-CVE-2013-1215
- RESERVED
+CVE-2013-1215 (The vpnclient program in the Easy VPN component on Cisco
Adaptive ...)
+ TODO: check
CVE-2013-1214 (The scripts editor in Cisco Unified Contact Center Express (aka
...)
NOT-FOR-US: Cisco Unified Contact Center Express
CVE-2013-1213
@@ -5104,7 +5094,7 @@
RESERVED
CVE-2013-1089
RESERVED
-CVE-2013-1088 (Cross-site request forgery (CSRF) vulnerability in Apache
Tomcat, as ...)
+CVE-2013-1088 (Cross-site request forgery (CSRF) vulnerability in Novell
iManager 2.7 ...)
TODO: check
CVE-2013-1087
RESERVED
@@ -5962,8 +5952,8 @@
RESERVED
CVE-2013-0728 (Multiple stack-based buffer overflows in NCSAddOn.dll in the
ERDAS ...)
TODO: check
-CVE-2013-0727
- RESERVED
+CVE-2013-0727 (Multiple untrusted search path vulnerabilities in Global Mapper
14.1.0 ...)
+ TODO: check
CVE-2013-0726
RESERVED
CVE-2013-0725
@@ -7170,8 +7160,7 @@
RESERVED
{DSA-2652-1}
- libxml2 2.8.0+dfsg1-7+nmu1 (bug #702260)
-CVE-2013-0338 [CPU consumption DoS when performing string substitutions during
entities expansion]
- RESERVED
+CVE-2013-0338 (libxml2 2.9.0 and earlier allows context-dependent attackers to
cause ...)
{DSA-2652-1}
- libxml2 2.8.0+dfsg1-7+nmu1 (bug #702260)
CVE-2013-0337 [Directory /var/log/nginx is world readable]
@@ -7503,8 +7492,7 @@
CVE-2013-0234
RESERVED
- elgg <itp> (bug #526197)
-CVE-2013-0233
- RESERVED
+CVE-2013-0233 (Devise gem 2.2.x before 2.2.3, 2.1.x before 2.1.3, 2.0.x before
2.0.5, ...)
- ruby-devise <itp> (bug #691525)
CVE-2013-0232 (includes/functions.php in ZoneMinder Video Server 1.24.0,
1.25.0, and ...)
{DSA-2640-1}
@@ -7692,8 +7680,7 @@
[squeeze] - libssh <no-dsa> (Minor issue)
NOTE: http://www.libssh.org/2013/01/22/libssh-0-5-4-security-release/
NOTE:
http://git.libssh.org/projects/libssh.git/commit/?h=v0-5&id=55b09f426417406bb25c0b9c474fbab1398b0dc8
-CVE-2013-0175
- RESERVED
+CVE-2013-0175 (multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and
...)
- ruby-multi-xml <itp> (bug #691189)
NOTE: fixed in https://rubygems.org/gems/multi_xml/versions/0.5.2
CVE-2013-0174
@@ -10947,8 +10934,8 @@
RESERVED
CVE-2012-5221
RESERVED
-CVE-2012-5220
- RESERVED
+CVE-2012-5220 (Unspecified vulnerability in HP Storage Data Protector 6.20,
6.21, ...)
+ TODO: check
CVE-2012-5219
RESERVED
CVE-2012-5218 (HP ElitePad 900 PCs with BIOS F.0x before F.01 Update 1.0.0.8
do not ...)
@@ -13103,14 +13090,12 @@
CVE-2012-4467 (The (1) do_siocgstamp and (2) do_siocgstampns functions in ...)
- linux-2.6 <not-affected> (Vulnerable code introduced in 3.3)
- linux <not-affected> (Vulnerable code introduced in 3.3)
-CVE-2012-4466
- RESERVED
+CVE-2012-4466 (Ruby 1.8.7 before patchlevel 371, 1.9.3 before patchlevel 286,
and 2.0 ...)
- ruby1.9.1 1.9.3.194-2 (low; bug #689075)
[squeeze] - ruby1.9.1 <no-dsa> (Minor issue)
CVE-2012-4465 (Heap-based buffer overflow in the substr function in parsing.c
in cgit ...)
- cgit <itp> (bug #515793)
-CVE-2012-4464
- RESERVED
+CVE-2012-4464 (Ruby 1.9.3 before patchlevel 286 and 2.0 before revision r37068
allows ...)
- ruby1.9.1 1.9.3.194-2 (low; bug #689075)
[squeeze] - ruby1.9.1 <not-affected> (Introduced in 1.9.3)
CVE-2012-4463 (Midnight Commander (mc) 4.8.5 does not properly handle the (1)
...)
_______________________________________________
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
