Author: mgilbert
Date: 2015-09-27 18:21:44 +0000 (Sun, 27 Sep 2015)
New Revision: 36868
Modified:
data/CVE/list
Log:
nfus
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2015-09-27 17:20:12 UTC (rev 36867)
+++ data/CVE/list 2015-09-27 18:21:44 UTC (rev 36868)
@@ -1873,9 +1873,9 @@
CVE-2015-6549
RESERVED
CVE-2015-6548 (Multiple SQL injection vulnerabilities in a PHP script in the
...)
- TODO: check
+ NOT-FOR-US: Symantec Web Gateway
CVE-2015-6547 (The management console on Symantec Web Gateway (SWG) appliances
with ...)
- TODO: check
+ NOT-FOR-US: Semantec Web Gateway
CVE-2015-6546
RESERVED
CVE-2015-6545 (Cross-site request forgery (CSRF) vulnerability in ajax.php in
Cerb ...)
@@ -2100,9 +2100,9 @@
CVE-2015-6476
RESERVED
CVE-2015-6475 (Multiple cross-site scripting (XSS) vulnerabilities in IBC
Solar ...)
- TODO: check
+ NOT-FOR-US: ServeMaster
CVE-2015-6474 (IBC Solar ServeMaster TLP+ and Danfoss TLX Pro+ allow remote
attackers ...)
- TODO: check
+ NOT-FOR-US: ServeMaster
CVE-2015-6473
RESERVED
CVE-2015-6472
@@ -2110,11 +2110,11 @@
CVE-2015-6471
RESERVED
CVE-2015-6470 (Resource Data Management Data Manager before 2.2 allows remote
...)
- TODO: check
+ NOT-FOR-US: Resource Data Manager
CVE-2015-6469 (The interpreter in IBC Solar ServeMaster TLP+ and Danfoss TLX
Pro+ ...)
- TODO: check
+ NOT-FOR-US: ServerMaster
CVE-2015-6468 (Cross-site request forgery (CSRF) vulnerability in Resource
Data ...)
- TODO: check
+ NOT-FOR-US: Resource Data Manager
CVE-2015-6467
RESERVED
CVE-2015-6466 (Cross-site scripting (XSS) vulnerability in the Diagnosis Ping
feature ...)
@@ -2130,19 +2130,19 @@
CVE-2015-6461
RESERVED
CVE-2015-6460 (Multiple heap-based buffer overflows in 3S-Smart CODESYS
Gateway ...)
- TODO: check
+ NOT-FOR-US: CODESYS Gateway Server
CVE-2015-6459 (Absolute path traversal vulnerability in the download feature
in ...)
- TODO: check
+ NOT-FOR-US: FileDownloadServlet
CVE-2015-6458
RESERVED
CVE-2015-6457
RESERVED
CVE-2015-6456 (GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise
before ...)
- TODO: check
+ NOT-FOR-US: PulseNET
CVE-2015-6455
RESERVED
CVE-2015-6454 (Everest PeakHMI before 8.7.0.2, when the video server is used,
allows ...)
- TODO: check
+ NOT-FOR-US: PeakHMI
CVE-2015-6453
RESERVED
CVE-2015-6452
@@ -2438,31 +2438,31 @@
CVE-2015-6307
RESERVED
CVE-2015-6306 (Cisco AnyConnect Secure Mobility Client 4.1(8) on OS X and
Linux does ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6305 (Untrusted search path vulnerability in the ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6304 (Cross-site request forgery (CSRF) vulnerability in Cisco
TelePresence ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6303 (The Cisco Spark application 2015-07-04 for mobile operating
systems ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6302 (The RADIUS functionality on Cisco Wireless LAN Controller (WLC)
...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6301 (The DHCPv6 server in Cisco IOS on ASR 9000 devices with
software 5.2.0 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6300 (Cisco Secure Access Control Server (ACS) Solution Engine
5.7(0.15) ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6299 (SQL injection vulnerability in the web interface in Cisco Unity
...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6298
RESERVED
CVE-2015-6297 (The DHCPv6 server in Cisco IOS on ASR 9000 devices with
software 5.2.0 ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6296 (Cisco Prime Network Registrar (CPNR) 8.1(3.3), 8.2(3), and
8.3(2) has ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6295 (Cisco NX-OS 6.1(2)I3(4) and 7.0(3)I1(1) on Nexus 9000 (N9K)
devices ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6294 (Cisco IOS 15.2(3)E and earlier and IOS XE 3.6(2)E and earlier
allow ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-6293
RESERVED
CVE-2015-6292
@@ -2549,7 +2549,8 @@
CVE-2015-6253
RESERVED
CVE-2014-9743 (Cross-site scripting (XSS) vulnerability in the httpd_HtmlError
...)
- TODO: check
+ - vlc 2.2.1-4
+ NOTE: might be fixed earlier, but this was the version checked
CVE-2015-6526 (The perf_callchain_user_64 function in
arch/powerpc/perf/callchain.c ...)
- linux 4.1.3-1
[jessie] - linux 3.16.7-ckt11-1
@@ -2569,7 +2570,7 @@
CVE-2015-6239
RESERVED
CVE-2015-6238 (Multiple cross-site scripting (XSS) vulnerabilities in the
Google ...)
- TODO: check
+ NOT-FOR-US: Google Analyticator plugin for WordPress
CVE-2015-6237
RESERVED
CVE-2015-6236
@@ -3059,11 +3060,11 @@
CVE-2015-5994
RESERVED
CVE-2015-5993 (Buffer overflow in form2ping.cgi on Philippine Long Distance
Telephone ...)
- TODO: check
+ NOT-FOR-US: SpeedSurf
CVE-2015-5992 (Cross-site scripting (XSS) vulnerability in form2WlanSetup.cgi
on ...)
- TODO: check
+ NOT-FOR-US: SpeedSurf
CVE-2015-5991 (Cross-site request forgery (CSRF) vulnerability in
form2WlanSetup.cgi ...)
- TODO: check
+ NOT-FOR-US: SpeedSurf
CVE-2015-5990
RESERVED
CVE-2015-5989
@@ -3375,7 +3376,7 @@
CVE-2015-5921 (WebKit in Apple iOS before 9 mishandles
"Content-Disposition: ...)
NOT-FOR-US: Webkit / if anything of this affects Chromium, the Chrome
sec team will know and fix
CVE-2015-5920 (The Software Update component in Apple iTunes before 12.3 does
not ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-5919
RESERVED
CVE-2015-5918
@@ -3393,11 +3394,11 @@
CVE-2015-5912 (The CFNetwork FTPProtocol component in Apple iOS before 9
allows ...)
NOT-FOR-US: Apple
CVE-2015-5911 (Multiple unspecified vulnerabilities in Twisted in Wiki Server
in ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-5910 (IDE Xcode Server in Apple Xcode before 7.0 does not ensure that
server ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-5909 (IDE Xcode Server in Apple Xcode before 7.0 does not properly
restrict ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-5908
RESERVED
CVE-2015-5907 (WebKit in Apple iOS before 9 allows man-in-the-middle attackers
to ...)
@@ -3505,7 +3506,7 @@
CVE-2015-5856 (The Application Store component in Apple iOS before 9 allows
remote ...)
NOT-FOR-US: Apple
CVE-2015-5855 (Apple iOS before 9 allows attackers to discover the e-mail
address of ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-5854
RESERVED
CVE-2015-5853
@@ -3545,7 +3546,7 @@
CVE-2015-5836
RESERVED
CVE-2015-5835 (Apple iOS before 9 allows attackers to obtain sensitive
information ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-5834 (IOAcceleratorFamily in Apple iOS before 9 allows attackers to
obtain ...)
NOT-FOR-US: Apple
CVE-2015-5833
@@ -3643,9 +3644,9 @@
CVE-2015-5787
RESERVED
CVE-2015-5786 (Apple QuickTime before 7.7.8 allows remote attackers to execute
...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-5785 (Apple QuickTime before 7.7.8 allows remote attackers to execute
...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-5784 (runner in Install.framework in the Install Framework Legacy
component ...)
NOT-FOR-US: Apple OS X
CVE-2015-5783 (IOGraphics in Apple OS X before 10.10.5 allows attackers to
execute ...)
@@ -3756,11 +3757,11 @@
NOTE:
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=dcf6f5e15ecee4f593eeacbe0591c1addc004d92
NOTE: iov_* function changed in
http://git.qemu.org/?p=qemu.git;a=commitdiff;h=2278a69e7020d86a8c73a28474e7709d3e7d5081
(v1.2.0-rc0)
CVE-2015-5737 (The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys,
(4) ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2015-5736 (The Fortishield.sys driver in Fortinet FortiClient before 5.2.4
allows ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2015-5735 (The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys,
and ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2015-5729
RESERVED
CVE-2015-5728
@@ -3853,7 +3854,7 @@
NOTE: https://core.trac.wordpress.org/changeset/33535
NOTE: https://core.trac.wordpress.org/changeset/33536
CVE-2015-5717 (The Siemens COMPAS Mobile application before 1.6 for Android
does not ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2015-5716
RESERVED
CVE-2015-5715
@@ -3976,19 +3977,19 @@
CVE-2015-5699
RESERVED
CVE-2015-5698 (Cross-site request forgery (CSRF) vulnerability in the web
server on ...)
- TODO: check
+ NOT-FOR-US: Siemens
CVE-2015-5696 (Dell Netvault Backup before 10.0.5 allows remote attackers to
cause a ...)
NOT-FOR-US: Dell Netvault Backup
CVE-2015-5693 (The management console on Symantec Web Gateway (SWG) appliances
with ...)
- TODO: check
+ NOT-FOR-US: Symantec Web Gateway
CVE-2015-5692 (admin_messages.php in the management console on Symantec Web
Gateway ...)
- TODO: check
+ NOT-FOR-US: Symantec Web Gateway
CVE-2015-5691 (Multiple cross-site scripting (XSS) vulnerabilities in PHP
scripts in ...)
- TODO: check
+ NOT-FOR-US: Symantec Web Gateway
CVE-2015-5690 (The management console on Symantec Web Gateway (SWG) appliances
with ...)
- TODO: check
+ NOT-FOR-US: Symantec Web Gateway
CVE-2015-5689 (ghostexp.exe in Ghost Explorer Utility in Symantec Ghost
Solutions ...)
- TODO: check
+ NOT-FOR-US: Symantec
CVE-2009-5148
RESERVED
CVE-2015-5695 [Quotas were being bypassed]
@@ -4002,7 +4003,7 @@
- designate 2015.1.0+2015.08.26.git34.9fa07c5798-1 (bug #796108)
[jessie] - designate <not-affected> (Vulnerable code doesn't exist)
CVE-2015-5688 (Directory traversal vulnerability in lib/app/index.js in Geddy
before ...)
- TODO: check
+ NOT-FOR-US: Geddy
CVE-2015-5687
RESERVED
CVE-2015-5686
@@ -4112,25 +4113,25 @@
CVE-2015-5639
RESERVED
CVE-2015-5638 (Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x
before ...)
- TODO: check
+ NOT-FOR-US: H2O
CVE-2015-5637 (The Newphoria Photon application before 1.2 for Android allows
...)
- TODO: check
+ NOT-FOR-US: Newphoria
CVE-2015-5636 (The Newphoria Reversi application before 1.0.3 for Android and
before ...)
- TODO: check
+ NOT-FOR-US: Newphoria
CVE-2015-5635 (The Newphoria Koritore application before 1.1 for Android and
before ...)
- TODO: check
+ NOT-FOR-US: Newphoria
CVE-2015-5634 (The Newphoria MEGAPHONE MUSIC application before 1.1 for
Android and ...)
- TODO: check
+ NOT-FOR-US: Newphoria
CVE-2015-5633 (The Newphoria Auction Camera application for iOS and before 1.2
for ...)
- TODO: check
+ NOT-FOR-US: Newphoria
CVE-2015-5632 (The runtime engine in the Newphoria applican framework before
1.12.3 ...)
- TODO: check
+ NOT-FOR-US: Newphoria
CVE-2015-5631 (Cross-site request forgery (CSRF) vulnerability in the Remote
UI on ...)
- TODO: check
+ NOT-FOR-US: Canon
CVE-2015-5630 (Cross-site scripting (XSS) vulnerability in the NTT Broadband
Platform ...)
- TODO: check
+ NOT-FOR-US: NTT
CVE-2015-5629 (The NTT Broadband Platform Japan Connected-free Wi-Fi
application ...)
- TODO: check
+ NOT-FOR-US: NTT
CVE-2015-5628
RESERVED
CVE-2015-5627
@@ -4138,9 +4139,9 @@
CVE-2015-5626
RESERVED
CVE-2015-5625 (Cross-site scripting (XSS) vulnerability in OpenDocMan before
1.3.4 ...)
- TODO: check
+ NOT-FOR-US: OpenDocMan
CVE-2015-5624 (Buffer overflow in the ExecCall method in c2lv6.ocx in the
FreeBit ...)
- TODO: check
+ NOT-FOR-US: FreeBit
CVE-2015-5697 (The get_bitmap_file function in drivers/md/md.c in the Linux
kernel ...)
{DSA-3329-1 DLA-310-1}
- linux 4.1.3-1
@@ -4171,7 +4172,7 @@
CVE-2015-5613
RESERVED
CVE-2015-5612 (Cross-site scripting (XSS) vulnerability in October CMS build
271 and ...)
- TODO: check
+ NOT-FOR-US: October CMS
CVE-2015-5623 (WordPress before 4.2.3 does not properly verify the edit_posts
...)
{DSA-3328-1}
- wordpress 4.2.3+dfsg-1
@@ -4198,7 +4199,7 @@
CVE-2015-5604
RESERVED
CVE-2015-5603 (The HipChat for JIRA plugin before 6.30.0 for Atlassian JIRA
allows ...)
- TODO: check
+ NOT-FOR-US: HipChat plugin
CVE-2015-5602
RESERVED
CVE-2015-5601
@@ -4337,7 +4338,7 @@
CVE-2015-5539 (Use-after-free vulnerability in Adobe Flash Player before
18.0.0.232 ...)
NOT-FOR-US: Adobe Flash Player
CVE-2015-5538 (Multiple unspecified vulnerabilities in Citrix NetScaler
Application ...)
- TODO: check
+ NOT-FOR-US: Citrix
CVE-2015-5537 (The SSL layer of the HTTPS service in Siemens RuggedCom ROS
before ...)
NOT-FOR-US: Siemens
CVE-2015-XXXX [more to CVE-2014-8146]
@@ -4560,6 +4561,7 @@
NOTE:
https://github.com/bestpractical/rt/commit/67d517ba3421ba462e349c73207a627d137ef8ac
(4.2.x)
NOTE:
https://github.com/bestpractical/rt/commit/4ec786bb4743f67a35a634c1bf43b13d3d3b39a9
(4.0.x)
CVE-2015-5474 (BitTorrent and uTorrent allow remote attackers to inject
command line ...)
+ - bittorrent <unfixed>
TODO: check
CVE-2015-5473
RESERVED
@@ -4576,7 +4578,7 @@
CVE-2015-5466
RESERVED
CVE-2015-5465 (Silicon Integrated Systems WindowsXP Display Manager (aka VGA
Driver ...)
- TODO: check
+ NOT-FOR-US: Silicon Integrated Systems
CVE-2015-5464 (The Gemalto SafeNet Luna HSM allows remote authenticated users
to ...)
NOT-FOR-US: Gemalto
CVE-2015-5463
@@ -4790,9 +4792,9 @@
CVE-2015-5369 (Pulse Connect Secure (aka PCS and formerly Juniper PCS)
PSC6000, ...)
NOT-FOR-US: Pulse Connect Secure / Juniper PCS
CVE-2015-5368 (The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before ...)
- TODO: check
+ NOT-FOR-US: HP
CVE-2015-5367 (The HP lt4112 LTE/HSPA+ Gobi 4G module with firmware before ...)
- TODO: check
+ NOT-FOR-US: HP
CVE-2014-9740 (Cross-site scripting (XSS) vulnerability in the Rules Link
module ...)
NOT-FOR-US: Rules Link module for Drupal
CVE-2014-9739 (Cross-site scripting (XSS) vulnerability in the Node Field
module ...)
@@ -6697,7 +6699,7 @@
CVE-2015-4671
RESERVED
CVE-2015-4670 (Directory traversal vulnerability in the AjaxFileUpload control
in ...)
- TODO: check
+ NOT-FOR-US: AjaxControlToolkit
CVE-2015-4669
RESERVED
CVE-2015-4668
@@ -6797,7 +6799,7 @@
CVE-2015-4639
RESERVED
CVE-2015-4638 (The FastL4 virtual server in F5 BIG-IP LTM, AAM, AFM,
Analytics, APM, ...)
- TODO: check
+ NOT-FOR-US: FastL4
CVE-2015-4637 (The REST API in F5 BIG-IQ Cloud, Device, and Security 4.4.0 and
4.5.0 ...)
NOT-FOR-US: BIG-IQ
CVE-2015-4636
@@ -6955,7 +6957,7 @@
CVE-2015-4553
RESERVED
CVE-2015-4552 (Cross-site scripting (XSS) vulnerability in the quick edit
function in ...)
- TODO: check
+ NOT-FOR-US: MyBB
CVE-2015-4551
RESERVED
CVE-2015-4550 (The Cavium cryptographic-module firmware on Cisco Adaptive
Security ...)
@@ -6973,11 +6975,11 @@
CVE-2015-4544 (EMC Documentum Content Server before 7.1P20 and 7.2.x before
7.2P04 ...)
NOT-FOR-US: EMC Documentum Content Server
CVE-2015-4543 (EMC RSA Archer GRC 5.x before 5.5.3 uses cleartext for stored
...)
- TODO: check
+ NOT-FOR-US: EMC RSA Archer GRC
CVE-2015-4542 (EMC RSA Archer GRC 5.x before 5.5.3 allows remote authenticated
users ...)
- TODO: check
+ NOT-FOR-US: EMC RSA Archer GRC
CVE-2015-4541 (Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA
Archer ...)
- TODO: check
+ NOT-FOR-US: EMC RSA Archer GRC
CVE-2015-4540 (Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA
...)
NOT-FOR-US: EMC RSA
CVE-2015-4539 (Multiple cross-site scripting (XSS) vulnerabilities in EMC RSA
...)
@@ -7380,9 +7382,9 @@
CVE-2015-4427 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
NOT-FOR-US: Ektron CMS
CVE-2015-4426 (SQL injection vulnerability in pimcore before build 3473 allows
remote ...)
- TODO: check
+ NOT-FOR-US: pimcore
CVE-2015-4425 (Directory traversal vulnerability in pimcore before build 3473
allows ...)
- TODO: check
+ NOT-FOR-US: pimcore
CVE-2015-4424
RESERVED
CVE-2015-4423
@@ -7563,7 +7565,7 @@
CVE-2015-4331 (Cisco Prime Infrastructure (PI) 1.4(0.45) and earlier, when AAA
...)
NOT-FOR-US: Cisco Prime Infrastructure
CVE-2015-4330 (A local file script in Cisco TelePresence Video Communication
Server ...)
- TODO: check
+ NOT-FOR-US: Cisco
CVE-2015-4329 (The administrator web interface in Cisco TelePresence Video ...)
NOT-FOR-US: Cisco TelePresence Video Communication Server
CVE-2015-4328 (Cisco TelePresence Video Communication Server (VCS) Expressway
X8.5.2 ...)
@@ -8268,7 +8270,7 @@
CVE-2015-4078
RESERVED
CVE-2015-4077 (The (1) mdare64_48.sys, (2) mdare32_48.sys, (3) mdare32_52.sys,
and ...)
- TODO: check
+ NOT-FOR-US: Fortinet
CVE-2015-4076
RESERVED
CVE-2015-4075
@@ -8393,7 +8395,7 @@
CVE-2015-4043
RESERVED
CVE-2015-4040 (Directory traversal vulnerability in the configuration utility
in F5 ...)
- TODO: check
+ NOT-FOR-US: F5 BIG-IP
CVE-2015-4039
RESERVED
CVE-2015-4038 (The WP Membership plugin 1.2.3 for WordPress allows remote ...)
@@ -8666,15 +8668,15 @@
CVE-2015-3967
RESERVED
CVE-2015-3966 (The IPsec SA establishment process on Innominate mGuard devices
with ...)
- TODO: check
+ NOT-FOR-US: Innominate mGuard
CVE-2015-3965
RESERVED
CVE-2015-3964 (SMA Solar Sunny WebBox has hardcoded passwords, which makes it
easier ...)
- TODO: check
+ NOT-FOR-US: SMA Solar Sunny WebBox
CVE-2015-3963 (Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before
6.7.1.1, ...)
NOT-FOR-US: Wind River VxWorks as used on Schneider Electric devices
CVE-2015-3962 (Schneider Electric StruxureWare Building Expert MPM before 2.15
does ...)
- TODO: check
+ NOT-FOR-US: Schneider Electric StruxureWare
CVE-2015-3961 (The web-server component in MNS before 4.5.6 on Belden
GarrettCom ...)
NOT-FOR-US: Belden GarrettCom switches
CVE-2015-3960 (The firmware in MNS before 4.5.6 on Belden GarrettCom Magnum 6K
and ...)
@@ -9066,7 +9068,7 @@
CVE-2015-3807 (libxml2 in Apple iOS before 8.4.1 and OS X before 10.10.5
allows ...)
NOT-FOR-US: Apple
CVE-2015-3806 (Apple iOS before 8.4.1 and OS X before 10.10.5 allow local
users to ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-3805 (Apple iOS before 8.4.1 and OS X before 10.10.5 allow local
users to ...)
NOT-FOR-US: Apple OS X
CVE-2015-3804 (FontParser in Apple iOS before 8.4.1 and OS X before 10.10.5
allows ...)
@@ -9144,11 +9146,11 @@
CVE-2015-3768 (Integer overflow in the kernel in Apple iOS before 8.4.1 and OS
X ...)
NOT-FOR-US: Apple OS X
CVE-2015-3767 (udf in Apple OS X before 10.10.5 allows local users to gain
privileges ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-3766 (The kernel in Apple iOS before 8.4.1 and OS X before 10.10.5
does not ...)
NOT-FOR-US: Apple OS X
CVE-2015-3765 (QuickTime 7 in Apple OS X before 10.10.5 allows remote
attackers to ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-3764 (Notification Center in Apple OS X before 10.10.5 does not
properly ...)
NOT-FOR-US: QuickTime
CVE-2015-3763 (Safari in Apple iOS before 8.4.1 does not limit the rate of
JavaScript ...)
@@ -9220,7 +9222,7 @@
CVE-2015-3730 (WebKit, as used in Apple iOS before 8.4.1 and Safari before
6.2.8, 7.x ...)
NOT-FOR-US: Webkit / if anything of this affects Chromium, the Chrome
sec team will know and fix
CVE-2015-3729 (Apple Safari before 6.2.8, 7.x before 7.1.8, and 8.x before
8.0.8, as ...)
- TODO: check
+ NOT-FOR-US: Apple
CVE-2015-3728 (The WiFi Connectivity feature in Apple iOS before 8.4 allows
remote ...)
NOT-FOR-US: Apple iOS
CVE-2015-3727 (WebKit in Apple Safari before 6.2.7, 7.x before 7.1.7, and 8.x
before ...)
@@ -9597,7 +9599,7 @@
CVE-2015-3624 (Cross-site request forgery (CSRF) vulnerability in ...)
NOT-FOR-US: Ektron Content Management System
CVE-2015-3623 (XML external entity (XXE) vulnerability in QlikTech Qlikview
before ...)
- TODO: check
+ NOT-FOR-US: QlikTech
CVE-2015-3621 (Untrusted search path vulnerability in SAP Enterprise Central
...)
NOT-FOR-US: SAP ECC
CVE-2015-3620 (Cross-site scripting (XSS) vulnerability in the advanced
dataset ...)
@@ -10608,7 +10610,7 @@
CVE-2015-3270
RESERVED
CVE-2015-3269 (Apache Flex BlazeDS, as used in flex-messaging-core.jar in
Adobe ...)
- TODO: check
+ NOT-FOR-US: Adobe
CVE-2015-3268
RESERVED
CVE-2015-3267 (Cross-site scripting (XSS) vulnerability in the 404 error page
in Red ...)
@@ -11554,25 +11556,25 @@
RESERVED
- libstruts1.2-java <not-affected> (Affects 2.0.0 - 2.3.16.3)
CVE-2015-2991 (Buffer overflow in NScripter before 3.00 allows remote
attackers to ...)
- TODO: check
+ NOT-FOR-US: NScripter
CVE-2015-2990 (Directory traversal vulnerability in zhtml.cgi in NEOJAPAN
desknet NEO ...)
- TODO: check
+ NOT-FOR-US: desknet NEO
CVE-2015-2989 (Cross-site scripting (XSS) vulnerability in index.php in
LEMON-S PHP ...)
- TODO: check
+ NOT-FOR-US: LEMON-S
CVE-2015-2988
RESERVED
CVE-2015-2987 (Type74 ED before 4.0 misuses 128-bit ECB encryption for small
files, ...)
- TODO: check
+ NOT-FOR-US: Type74 ED
CVE-2015-2986 (Cross-site scripting (XSS) vulnerability in rakuto.net hitSuji
...)
- TODO: check
+ NOT-FOR-US: hitSuji
CVE-2015-2985 (Cross-site scripting (XSS) vulnerability in guide-park.com BBS
X102 ...)
- TODO: check
+ NOT-FOR-US: guide-park.com BBS
CVE-2015-2984 (I-O DATA DEVICE WN-G54/R2 routers with firmware before 1.03 and
...)
- TODO: check
+ NOT-FOR-US: I-O DATA
CVE-2015-2983 (Cross-site request forgery (CSRF) vulnerability in admin.php in
PHP ...)
- TODO: check
+ NOT-FOR-US: Kobo Photo Gallery CMS
CVE-2015-2982 (Cross-site scripting (XSS) vulnerability in
jquery.lightbox-0.5.min.js ...)
- TODO: check
+ NOT-FOR-US: Kobo Photo Gallery CMS
CVE-2015-2981
RESERVED
CVE-2015-2980 (The Yodobashi application 1.2.1.0 and earlier for Android
allows ...)
@@ -11733,13 +11735,13 @@
CVE-2015-2918
RESERVED
CVE-2015-2917 (Securifi Almond devices with firmware before
AL1-R201EXP10-L304-W34 ...)
- TODO: check
+ NOT-FOR-US: Securifi Almond
CVE-2015-2916 (Cross-site request forgery (CSRF) vulnerability on Securifi
Almond ...)
- TODO: check
+ NOT-FOR-US: Securifi Almond
CVE-2015-2915 (Securifi Almond devices with firmware before
AL1-R201EXP10-L304-W34 ...)
- TODO: check
+ NOT-FOR-US: Securifi Almond
CVE-2015-2914 (Securifi Almond devices with firmware before
AL1-R201EXP10-L304-W34 ...)
- TODO: check
+ NOT-FOR-US: Securifi Almond
CVE-2015-2913
RESERVED
CVE-2015-2912
@@ -11757,9 +11759,9 @@
CVE-2015-2906 (** DISPUTED ** Mobile Devices (aka MDI) C4 OBD-II dongles with
...)
TODO: check
CVE-2015-2905 (Cross-site request forgery (CSRF) vulnerability on Actiontec
GT784WN ...)
- TODO: check
+ NOT-FOR-US: Actiontec
CVE-2015-2904 (Actiontec GT784WN modems with firmware before NCS01-1.0.13 have
...)
- TODO: check
+ NOT-FOR-US: Actiontec
CVE-2015-2903
RESERVED
CVE-2015-2902
@@ -11827,9 +11829,9 @@
CVE-2015-2874
RESERVED
CVE-2015-2873 (Trend Micro Deep Discovery Inspector (DDI) on Deep Discovery
Threat ...)
- TODO: check
+ NOT-FOR-US: Trend Micro
CVE-2015-2872 (Multiple cross-site scripting (XSS) vulnerabilities in Trend
Micro ...)
- TODO: check
+ NOT-FOR-US: Trend Micro
CVE-2015-2871 (Chiyu BF-660C fingerprint access-control devices allow remote
...)
NOT-FOR-US: Chiyu BF-660C fingerprint access-control devices
CVE-2015-2870 (Cross-site scripting (XSS) vulnerability on Chiyu BF-630,
BF-630W, and ...)
@@ -11845,7 +11847,7 @@
CVE-2015-2865
REJECTED
CVE-2015-2864 (Retrospect and Retrospect Client before 10.0.2.119 on Windows,
before ...)
- TODO: check
+ NOT-FOR-US: Retrospect Client
CVE-2015-2863 (Open redirect vulnerability in Kaseya Virtual System
Administrator ...)
NOT-FOR-US: Kaseya VSA
CVE-2015-2862 (Directory traversal vulnerability in Kaseya Virtual System ...)
@@ -14599,7 +14601,7 @@
CVE-2015-2014 (Open redirect vulnerability in the web server in IBM Domino 8.5
before ...)
NOT-FOR-US: IBM Domino
CVE-2015-2013 (IBM WebSphere MQ 7.0.1 before 7.0.1.13 allows remote attackers
to ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2015-2012
RESERVED
CVE-2015-2011
@@ -14739,7 +14741,7 @@
CVE-2015-1944 (Cross-site scripting (XSS) vulnerability in IBM WebSphere
Portal 8.0.0 ...)
NOT-FOR-US: IBM WebSphere
CVE-2015-1943 (IBM WebSphere Portal 6.1.0.x through 6.1.0.6 CF27, 6.1.5.x
through ...)
- TODO: check
+ NOT-FOR-US: IBM
CVE-2015-1942 (The server in IBM Tivoli Storage Manager FastBack 6.1 before
6.1.12 ...)
NOT-FOR-US: IBM
CVE-2015-1941 (The server in IBM Tivoli Storage Manager FastBack 6.1 before
6.1.12 ...)
@@ -15967,7 +15969,7 @@
[squeeze] - piwigo <end-of-life> (Unsupported in squeeze-lts)
NOTE: Request to mark the package as unsupported in #779104
CVE-2015-1516 (Cross-site scripting (XSS) vulnerability in Polycom
RealPresence ...)
- TODO: check
+ NOT-FOR-US: Polycom
CVE-2015-1515 (The dwall.sys driver in SoftSphere DefenseWall Personal
Firewall 3.24 ...)
NOT-FOR-US: SoftSphere
CVE-2015-1514 (Multiple SQL injection vulnerabilities in FancyFon FAMOC before
3.17.4 ...)
@@ -16814,7 +16816,7 @@
CVE-2015-1320
RESERVED
CVE-2015-1319 (The Unity Settings Daemon before
14.04.0+14.04.20150825-0ubuntu2 and ...)
- TODO: check
+ - unity <itp> (bug #609278)
CVE-2015-1318 (The crash reporting feature in Apport 2.13 through 2.17.x
before ...)
[experimental] - apport <unfixed>
NOTE: apport only in experimental, so we cannot track this in
security-tracker
@@ -17432,11 +17434,11 @@
CVE-2015-1174
RESERVED
CVE-2015-1173 (Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 does
not ...)
- TODO: check
+ NOT-FOR-US: Unit4 Polska TETA Web
CVE-2015-1172 (Unrestricted file upload vulnerability in admin/upload-file.php
in the ...)
NOT-FOR-US: WordPress theme holding_pattern
CVE-2015-1171 (Stack-based buffer overflow in GSM SIM Utility (aka SIM Card
Editor) ...)
- TODO: check
+ NOT-FOR-US: SIM Card Editor
CVE-2015-1170 (The NVIDIA Display Driver R304 before 309.08, R340 before
341.44, R343 ...)
NOT-FOR-US: NVIDIA Windows driver
CVE-2015-1169 (Apereo Central Authentication Service (CAS) Server before 3.5.3
allows ...)
@@ -17875,7 +17877,7 @@
CVE-2014-9606
RESERVED
CVE-2014-9605 (WebUpgrade in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and
4.1.x ...)
- TODO: check
+ NOT-FOR-US: Netsweeper
CVE-2014-9604 (libavcodec/utvideodec.c in FFmpeg before 2.5.2 does not check
for a ...)
{DSA-3189-1}
- ffmpeg 7:2.5.1-1
@@ -21153,11 +21155,11 @@
CVE-2014-9230 (Cross-site scripting (XSS) vulnerability in the administration
console ...)
NOT-FOR-US: Enforce Server in Symantec Data Loss Prevention
CVE-2014-9229 (Multiple SQL injection vulnerabilities in interface PHP scripts
in the ...)
- TODO: check
+ NOT-FOR-US: Symantec
CVE-2014-9228 (sysplant.sys in the Manager component in Symantec Endpoint
Protection ...)
- TODO: check
+ NOT-FOR-US: Symantec
CVE-2014-9227 (Multiple untrusted search path vulnerabilities in the Manager
...)
- TODO: check
+ NOT-FOR-US: Symantec
CVE-2014-9226 (The management server in Symantec Critical System Protection
(SCSP) ...)
NOT-FOR-US: Symantec Data Center Security
CVE-2014-9225 (The ajaxswing webui in the management server in Symantec
Critical ...)
@@ -21193,7 +21195,7 @@
CVE-2014-9209 (Untrusted search path vulnerability in the Clean Utility
application ...)
NOT-FOR-US: Rockwell Automation FactoryTalk Services Platform
CVE-2014-9208 (Multiple stack-based buffer overflows in unspecified DLL files
in ...)
- TODO: check
+ NOT-FOR-US: Advantech
CVE-2014-9207 (Untrusted search path vulnerability in CmnView.exe in CIMON
CmnView ...)
NOT-FOR-US: CIMON CmnView
CVE-2014-9206 (Stack-based buffer overflow in Device Type Manager (DTM) 3.1.6
and ...)
@@ -23281,7 +23283,7 @@
CVE-2014-8779 (Pexip Infinity before 8 uses the same SSH host keys across
different ...)
NOT-FOR-US: Pexip Infinity
CVE-2014-8778 (Checkmarx CxSAST (formerly CxSuite) before 7.1.8 allows remote
...)
- TODO: check
+ NOT-FOR-US: Checkmarx
CVE-2014-8777
RESERVED
CVE-2014-8776
@@ -25800,8 +25802,12 @@
CVE-2014-7914
RESERVED
CVE-2014-7913 (The print_option function in dhcp-common.c in dhcpcd through
6.9.1, as ...)
+ - dhcpcd5 <unfixed>
+ NOTE: android's dhcpd is a fork of dhcpcd5, and code very similar to
the vulnerable section exists in dhcpcd5, but i didn't have time to check
whether it too is vulnerable to the problem
TODO: check
CVE-2014-7912 (The get_option function in dhcp.c in dhcpcd before 6.2.0, as
used in ...)
+ - dhcpcd5 <unfixed>
+ NOTE: android's dhcpd is a fork of dhcpcd5, and code very similar to
the vulnerable section exists in dhcpcd5, but i didn't have time to check
whether it too is vulnerable to the problem
TODO: check
CVE-2014-7911 (luni/src/main/java/java/io/ObjectInputStream.java in the ...)
NOT-FOR-US: Android
@@ -27389,7 +27395,7 @@
[wheezy] - phpmyadmin <not-affected> (Vulnerable code not present)
[squeeze] - phpmyadmin <not-affected> (Vulnerable code not present)
CVE-2014-7216 (Multiple stack-based buffer overflows in Yahoo! Messenger
11.5.0.228 ...)
- TODO: check
+ NOT-FOR-US: Yahoo
CVE-2014-7215
RESERVED
CVE-2014-7214
@@ -37731,7 +37737,7 @@
CVE-2014-3149 (Cross-site scripting (XSS) vulnerability in Invision Power
IP.Board ...)
NOT-FOR-US: Invision Power IP.Board
CVE-2014-3148 (Cross-site scripting (XSS) vulnerability in libahttp/err.c in
OkCupid ...)
- TODO: check
+ NOT-FOR-US: OkCupid
CVE-2014-3147 (Cross-site scripting (XSS) vulnerability in the auto-complete
feature ...)
NOT-FOR-US: Splunk
CVE-2014-3146 (Incomplete blacklist vulnerability in the lxml.html.clean
module in ...)
@@ -40818,7 +40824,7 @@
CVE-2014-1973 (Directory traversal vulnerability in the NextApp File Explorer
...)
NOT-FOR-US: NextApp File Explorer application for Android
CVE-2014-1972 (Apache Tapestry before 5.3.6 relies on client-side object
storage ...)
- TODO: check
+ NOT-FOR-US: Apache Tapestry
CVE-2014-1971 (Cross-site scripting (XSS) vulnerability in Silex before 2.0.0
allows ...)
NOT-FOR-US: Silex
CVE-2014-1970 (Directory traversal vulnerability in the ES File Explorer File
Manager ...)
_______________________________________________
Secure-testing-commits mailing list
[email protected]
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
