diff options
| author | Raphael Geissert <geissert@debian.org> | 2011-03-19 23:55:41 +0000 |
|---|---|---|
| committer | Raphael Geissert <geissert@debian.org> | 2011-03-19 23:55:41 +0000 |
| commit | 66985c05ddc862db88283a6049658349b4a26838 (patch) | |
| tree | fdfa9e07e880dc35f06c6d6f29e89e81867de8a0 | |
| parent | e51a9dd55f1869e0bcd37cecffc62b4ee0469d79 (diff) | |
3 php issues, some fixed, some unimportant.
maradns and php5 DSA
git-svn-id: svn+ssh://svn.debian.org/svn/secure-testing@16401 e39458fd-73e7-0310-bf30-c45bca0a0e42
| -rw-r--r-- | data/CVE/list | 17 | ||||
| -rw-r--r-- | data/DSA/list | 7 |
2 files changed, 18 insertions, 6 deletions
diff --git a/data/CVE/list b/data/CVE/list index 333c965529..f7710c10b0 100644 --- a/data/CVE/list +++ b/data/CVE/list @@ -637,7 +637,7 @@ CVE-2011-1155 CVE-2011-1154 RESERVED CVE-2011-1153 (Multiple format string vulnerabilities in phar_object.c in the phar ...) - TODO: check + - php5 <unfixed> CVE-2011-1152 RESERVED CVE-2011-1151 @@ -646,8 +646,10 @@ CVE-2011-1150 RESERVED CVE-2011-1149 RESERVED -CVE-2011-1148 +CVE-2011-1148 [substr_replace use after free] RESERVED + - php5 <unfixed> (unimportant) + NOTE: only exploitable by malicious scripts CVE-2011-1147 (Multiple stack-based and heap-based buffer overflows in the (1) ...) - asterisk <undetermined> (bug #614580) TODO: check vuln versions @@ -2628,8 +2630,10 @@ CVE-2011-0443 (SQL injection vulnerability in inc/tinybb-settings.php in tinyBB NOT-FOR-US: tinyBB CVE-2011-0442 (The service utility in EMC Avamar 5.x before 5.0.4 uses cleartext to ...) TODO: check -CVE-2011-0441 +CVE-2011-0441 [arbitrary files removal via cronjob] RESERVED + - php5 5.3.6-1 (bug #618489) + NOTE: Debian-specific CVE-2011-0440 RESERVED CVE-2011-0439 @@ -3038,8 +3042,9 @@ CVE-2011-XXXX NOTE: CVE ID requested CVE-2010-4645 (strtod.c, as used in the zend_strtod function in PHP 5.2 before 5.2.17 ...) - php5 5.3.3-7 (high) - [lenny] - php5 <unfixed> (high) - NOTE: lenny9 doesn't appear to be affected, for a reason still unknown + [lenny] - php5 <not-affected> + NOTE: lenny10 includes a test for the bug. With lenny's toolchain + NOTE: and settings, the bug can't be reproduced. CVE-2011-XXXX [Crash with long HOME environment variable] - toppler <unfixed> (unimportant; bug #608979) NOTE: Negligable privilege escalation @@ -20228,7 +20233,7 @@ CVE-2009-3527 (Race condition in the Pipe (IPC) close function in FreeBSD 6.3 an CVE-2009-3526 RESERVED CVE-2011-1072 (The installer in PEAR before 1.9.2 allows local users to overwrite ...) - - php5 <unfixed> (low; bug #546164) + - php5 5.3.6-1 (low; bug #546164) [squeeze] - php5 <no-dsa> (Minor issue) NOTE: side-effect also reported at: http://bugs.php.net/44354 CVE-2009-XXXX [kfreebsd: Devfs / VFS NULL pointer race condition] diff --git a/data/DSA/list b/data/DSA/list index 00a3e9db8c..0ea346182e 100644 --- a/data/DSA/list +++ b/data/DSA/list @@ -1,3 +1,10 @@ +[19 Mar 2011] DSA-2196-1 maradns - buffer overflow + {CVE-2011-0520} + [lenny] - maradns 1.3.07.09-2.1 +[19 Mar 2011] DSA-2195-1 php5 - several + {CVE-2011-0441 CVE-2010-3709 CVE-2010-3710 CVE-2010-3870 CVE-2010-4150} + [lenny] - php5 5.2.6.dfsg.1-1+lenny10 + [squeeze] - php5 5.3.3-7+squeeze1 [18 Mar 2011] DSA-2194-1 libvirt - privilege escalation {CVE-2011-1146} [squeeze] - libvirt 0.8.3-5+squeeze1 |