security-commits November 2007

security-commits@lists.fedoraproject.org

1 participants
51 discussions

fedora-security/audit f8, 1.28, 1.29 f9, 1.24, 1.25 fc7, 1.185, 1.186
by fedora-security-commits＠redhat.com 30 Nov '07

30 Nov '07

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv4724/audit Modified Files: f8 f9 fc7 Log Message: add htdig, ruby-gnome2 fedora updates Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.28 retrieving revision 1.29 diff -u -r1.28 -r1.29 --- f8 27 Nov 2007 15:14:08 -0000 1.28 +++ f8 30 Nov 2007 12:18:11 -0000 1.29 @@ -7,11 +7,16 @@ # Up to date CVE as of CVE email 20071030 # Up to date F8 as of 20071029 +CVE-2007-6183 VULNERABLE (ruby-gnome2) #405601 +CVE-2007-6110 backport (htdig) [since FEDORA-2007-3958] CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) [since FEDORA-2007-3639] CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 version (cacti, fixed 0.8.7a) #391991 [since FEDORA-2007-3667] CVE-2007-5977 version (phpMyAdmin, fixed 2.11.2.1) #385901 [since FEDORA-2007-3636] CVE-2007-5976 version (phpMyAdmin, fixed 2.11.2.1) #385901 [since FEDORA-2007-3636] +CVE-2007-5960 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) [since FEDORA-2007-3962] +CVE-2007-5959 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) [since FEDORA-2007-3962] +CVE-2007-5947 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) [since FEDORA-2007-3962] CVE-2007-5938 VULNERABLE (kernel) #385861 iwlwifi CVE-2007-5937 backport (tetex) #379861 [since FEDORA-2007-3308] Multiple dviljk buffer overflows CVE-2007-5936 backport (tetex) #379861 [since FEDORA-2007-3308] dviljk uses insecure temporary file @@ -26,6 +31,7 @@ CVE-2007-5770 backport (ruby) #373391 [since FEDORA-2007-2812] GENERIC-MAP-NOMATCH VULNERABLE (nx) #293031 CVE-2007-5751 backport (liferea, fixed 1.4.6) #360641 [since FEDORA-2007-2853] +CVE-2007-5742 VULNERABLE (wesnoth, fixed 1.2.8) CVE-2007-5712 version (Django, fixed 0.96.1) #362771 [since FEDORA-2007-2788] CVE-2007-5708 version (openldap, fixed 2.3.39) #362991 [since FEDORA-2007-2796] CVE-2007-5707 version (openldap, fixed 2.3.39) #362991 [since FEDORA-2007-2796] @@ -137,7 +143,7 @@ CVE-2006-0987 ignore (bind) example config file only CVE-2006-0496 ignore (firefox) Feature, not a bug moz #324253 CVE-2005-4809 ignore (firefox) Status bar can be modified anyways -CVE-2005-4791 VULNERABLE (liferea) #393301 +CVE-2005-4791 version (liferea, fixed 1.4.8) #393301 [since FEDORA-2007-3701] CVE-2005-4790 backport (blam, fixed 1.8.4) #395761 [since FEDORA-2007-3798] CVE-2005-4790 backport (tomboy) #362951 [since FEDORA-2007-3253] CVE-2005-3675 VULNERABLE (kernel) optack, no upstream fix -- TCP protocol weakness Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.24 retrieving revision 1.25 diff -u -r1.24 -r1.25 --- f9 27 Nov 2007 15:14:08 -0000 1.24 +++ f9 30 Nov 2007 12:18:11 -0000 1.25 @@ -7,11 +7,16 @@ # Up to date CVE as of CVE email 20071030 # Up to date F9 as of 20071029 +CVE-2007-6183 VULNERABLE (ruby-gnome2) #405611 +CVE-2007-6110 version (htdig) [since htdig-3.2.0b6-13.fc9] CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 version (cacti, fixed 0.8.7a) #392001 [since cacti-0.8.7a-1.fc9] CVE-2007-5977 version (phpMyAdmin) #385911 [since phpMyAdmin-2.11.2.2-1.fc9] CVE-2007-5976 version (phpMyAdmin) #385911 [since phpMyAdmin-2.11.2.2-1.fc9] +CVE-2007-5960 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) +CVE-2007-5959 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) +CVE-2007-5947 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) CVE-2007-5937 backport (tetex) #379851 Multiple dviljk buffer overflows [since tetex-3.0-48.fc9] CVE-2007-5936 backport (tetex) #379851 dviljk uses insecure temporary file [since tetex-3.0-48.fc9] CVE-2007-5935 backport (tetex) #379851 dvips -z buffer overflow with long href [since tetex-3.0-48.fc9] @@ -25,6 +30,7 @@ GENERIC-MAP-NOMATCH VULNERABLE (nx) #293031 CVE-2007-5770 backport (ruby) #373401 [since ruby-1.8.6.111-1] CVE-2007-5751 version (liferea, fixed 1.4.6) #360641 [since liferea-1.4.6-3.fc9] +CVE-2007-5742 VULNERABLE (wesnoth, fixed 1.2.8) CVE-2007-5712 version (Django, fixed 0.96.1) #362781 [since Django-0.96.1-1.fc9] CVE-2007-5708 version (openldap, fixed 2.3.39) #360091 [since openldap-2.3.39-1.fc9] CVE-2007-5707 version (openldap, fixed 2.3.39) #360091 [since openldap-2.3.39-1.fc9] @@ -121,8 +127,8 @@ CVE-2006-0987 ignore (bind) example config file only CVE-2006-0496 ignore (firefox) Feature, not a bug moz #324253 CVE-2005-4809 ignore (firefox) Status bar can be modified anyways -CVE-2005-4791 VULNERABLE (liferea) #393311 -CVE-2005-4790 VULNERABLE (blam, fixed 1.8.4) #395771 +CVE-2005-4791 version (liferea, fixed 1.4.8) #393311 [since liferea-1.4.8-1.fc9] +CVE-2005-4790 backport (blam, fixed 1.8.4) #395771 [since blam-1.8.3-11.fc9] CVE-2005-4790 backport (tomboy) #362961 [since tomboy-0.8.1-2.fc9] CVE-2005-3675 VULNERABLE (kernel) optack, no upstream fix -- TCP protocol weakness CVE-2003-1265 ignore (thunderbird) Stuff deleted from userspace is not guarranteed to go away physically moz#198442 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.185 retrieving revision 1.186 diff -u -r1.185 -r1.186 --- fc7 27 Nov 2007 11:37:56 -0000 1.185 +++ fc7 30 Nov 2007 12:18:11 -0000 1.186 @@ -8,11 +8,16 @@ # Up to date CVE as of CVE email 20071030 # Up to date FC7 as of 20071029 +CVE-2007-6183 VULNERABLE (ruby-gnome2) #405591 +CVE-2007-6110 backport (htdig) [since FEDORA-2007-3907] CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) [since FEDORA-2007-3666] CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 version (cacti, fixed 0.8.7a) #391981 [since FEDORA-2007-3683] CVE-2007-5977 version (phpMyAdmin, fixed 2.11.2.1) #385891 [since FEDORA-2007-3627] CVE-2007-5976 version (phpMyAdmin, fixed 2.11.2.1) #385891 [since FEDORA-2007-3627] +CVE-2007-5960 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) [since FEDORA-2007-3952] +CVE-2007-5959 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) [since FEDORA-2007-3952] +CVE-2007-5947 version (mozilla, fixed ff 2.0.0.10, sm 1.1.7) [since FEDORA-2007-3952] CVE-2007-5938 VULNERABLE (kernel) #385861 iwlwifi CVE-2007-5937 backport (tetex) #379831 [since FEDORA-2007-3390] Multiple dviljk buffer overflows CVE-2007-5936 backport (tetex) #379831 [since FEDORA-2007-3390] dviljk uses insecure temporary file @@ -27,6 +32,7 @@ CVE-2007-5795 backport (emacs) #367581 [since FEDORA-2007-3056] CVE-2007-5770 backport (ruby) #373381 [since FEDORA-2007-2685] CVE-2007-5751 backport (liferea, fixed 1.4.6) #360641 [since FEDORA-2007-2725] +CVE-2007-5742 VULNERABLE (wesnoth, fixed 1.2.8) CVE-2007-5728 version (phpPgAdmin) seems to be fixed for some time CVE-2007-5715 backport (denyhosts) fixed long ago CVE-2007-5712 version (Django, fixed 0.96.1) #362761 [since FEDORA-2007-3157] @@ -1387,7 +1393,7 @@ CVE-2006-0019 version (kdelibs, fixed 3.5.1) *CVE-2006-0017 ** (fedora-ds-base) Publish CVE! *CVE-2006-0016 ** (fedora-ds-base) Publish CVE! -CVE-2005-4791 VULNERABLE (liferea) #393291 +CVE-2005-4791 version (liferea, fixed 1.2.8) #393291 [since FEDORA-2007-3733] *CVE-2005-4838 ** (tomcat) CVE-2005-4837 version (net-snmp, fixed 5.2.2) *CVE-2005-4836 ** (tomcat)

1 0

fedora-security/audit f8, 1.27, 1.28 f9, 1.23, 1.24
by fedora-security-commits＠redhat.com 27 Nov '07

27 Nov '07

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv14665/audit Modified Files: f8 f9 Log Message: update Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.27 retrieving revision 1.28 diff -u -r1.27 -r1.28 --- f8 27 Nov 2007 11:37:56 -0000 1.27 +++ f8 27 Nov 2007 15:14:08 -0000 1.28 @@ -32,7 +32,7 @@ CVE-2007-5690 version (zaptel) [since FEDORA-2007-2860] not really an issue CVE-2007-5624 VULNERABLE (nagios, fixed 2.10) #362801 CVE-2007-5623 backport (nagios-plugins, not fixed 1.4.10) #348731 [since FEDORA-2007-2876] nagios-plugins-1.4.8-9.fc8 -CVE-2007-5589 VULNERABLE (phpMyAdmin, fixed 2.11.1.2) #333661 PMASA-2007-6 +CVE-2007-5589 version (phpMyAdmin, fixed 2.11.1.2) #333661 PMASA-2007-6 [since FEDORA-2007-3636] CVE-2007-5461 version (tomcat5) #363001 [since FEDORA-2007-3474] CVE-2007-5398 version (samba) [since FEDORA-2007-3403] CVE-2007-5395 version (link-grammar) #372351 [since FEDORA-2007-3235] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.23 retrieving revision 1.24 diff -u -r1.23 -r1.24 --- f9 26 Nov 2007 18:15:22 -0000 1.23 +++ f9 27 Nov 2007 15:14:08 -0000 1.24 @@ -9,15 +9,15 @@ CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) CVE-2007-6061 VULNERABLE (audacity) #393251 -CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #392001 -CVE-2007-5977 VULNERABLE (phpMyAdmin) #385911 -CVE-2007-5976 VULNERABLE (phpMyAdmin) #385911 -CVE-2007-5937 VULNERABLE (tetex) #379851 Multiple dviljk buffer overflows -CVE-2007-5936 VULNERABLE (tetex) #379851 dviljk uses insecure temporary file -CVE-2007-5935 VULNERABLE (tetex) #379851 dvips -z buffer overflow with long href -CVE-2007-5934 VULNERABLE (php-pear-MDB2) #379111 -CVE-2007-5934 VULNERABLE (php-pear-MDB2-Driver-mysql) #379141 -CVE-2007-5934 VULNERABLE (php-pear-MDB2-Driver-mysqli) #379171 +CVE-2007-6035 version (cacti, fixed 0.8.7a) #392001 [since cacti-0.8.7a-1.fc9] +CVE-2007-5977 version (phpMyAdmin) #385911 [since phpMyAdmin-2.11.2.2-1.fc9] +CVE-2007-5976 version (phpMyAdmin) #385911 [since phpMyAdmin-2.11.2.2-1.fc9] +CVE-2007-5937 backport (tetex) #379851 Multiple dviljk buffer overflows [since tetex-3.0-48.fc9] +CVE-2007-5936 backport (tetex) #379851 dviljk uses insecure temporary file [since tetex-3.0-48.fc9] +CVE-2007-5935 backport (tetex) #379851 dvips -z buffer overflow with long href [since tetex-3.0-48.fc9] +CVE-2007-5934 version (php-pear-MDB2) #379111 [since php-pear-MDB2-2.4.1-2.fc9] +CVE-2007-5934 version (php-pear-MDB2-Driver-mysql) #379141 [since php-pear-MDB2-Driver-mysql-1.4.1-3.fc9] +CVE-2007-5934 version (php-pear-MDB2-Driver-mysqli) #379171 [since php-pear-MDB2-Driver-mysqli-1.4.1-3.fc9] CVE-2007-5925 ignore (mysql) Authenticated user can restart mysql. CVE-2007-5907 VULNERABLE (xen) #390121 CVE-2007-5906 VULNERABLE (xen) #390121 @@ -32,19 +32,19 @@ CVE-2007-5623 backport (nagios-plugins, not fixed 1.4.10) #348731 CVE-2007-5589 version (phpMyAdmin, fixed 2.11.1.2) #333661 PMASA-2007-6 CVE-2007-5461 VULNERABLE (tomcat5, not fixed 5.5.25) #334531 -CVE-2007-5395 VULNERABLE (link-grammar) #372361 -CVE-2007-5393 VULNERABLE (xpdf) #372481 +CVE-2007-5395 version (link-grammar) #372361 [since link-grammar-4.2.5-1.fc9] +CVE-2007-5393 backport (xpdf) #372481 [since xpdf-3.02-4.fc9] CVE-2007-5393 backport (cups) CVE-2007-5393 VULNERABLE (poppler) #372521 CVE-2007-5393 VULNERABLE (kdegraphics) #372581 CVE-2007-5393 VULNERABLE (koffice) #372611 -CVE-2007-5393 VULNERABLE (tetex) #372671 -CVE-2007-5392 VULNERABLE (xpdf) #372481 +CVE-2007-5393 version (tetex) #372671 [since tetex-3.0-48.fc9] +CVE-2007-5392 backport (xpdf) #372481 [since xpdf-3.02-4.fc9] CVE-2007-5392 backport (cups) CVE-2007-5392 VULNERABLE (poppler) #372521 CVE-2007-5392 VULNERABLE (kdegraphics) #372581 CVE-2007-5392 VULNERABLE (koffice) #372611 -CVE-2007-5392 VULNERABLE (tetex) #372671 +CVE-2007-5392 version (tetex) #372671 [since tetex-3.0-48.fc9] CVE-2007-5386 version (phpmyadmin, fixed 2.11.1.1) #333661 PMASA-2007-5 CVE-2007-5201 VULNERABLE (duplicity, no upstream fix) #362841 CVE-2007-5200 version (hugin) #362871 [since hugin-0.6.1-11.fc9] @@ -63,12 +63,12 @@ CVE-2007-4559 VULNERABLE (python, not fixed upstream) #315291 Upstream WONTFIX. See where we use the code. CVE-2007-4476 backport (cpio, not fixed 2.9) #339691 [since cpio-2.9-5.fc9] CVE-2007-4400 VULNERABLE (konversation) #362931 Remove media script? -CVE-2007-4352 VULNERABLE (xpdf) #372481 +CVE-2007-4352 backport (xpdf) #372481 [since xpdf-3.02-4.fc9] CVE-2007-4352 backport (cups) CVE-2007-4352 VULNERABLE (poppler) #372521 CVE-2007-4352 VULNERABLE (kdegraphics) #372581 CVE-2007-4352 VULNERABLE (koffice) #372611 -CVE-2007-4352 VULNERABLE (tetex) #372671 +CVE-2007-4352 version (tetex) #372671 [since tetex-3.0-48.fc9] CVE-2007-4351 version (cups) #361681 CVE-2007-3999 VULNERABLE (nfs-utils-lib) #362101 CVE-2007-3999 VULNERABLE (libtirpc) #362121

1 0

fedora-security/audit f8, 1.26, 1.27 fc7, 1.184, 1.185
by fedora-security-commits＠redhat.com 27 Nov '07

27 Nov '07

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv7446/audit Modified Files: f8 fc7 Log Message: one fedora update Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.26 retrieving revision 1.27 diff -u -r1.26 -r1.27 --- f8 26 Nov 2007 18:15:22 -0000 1.26 +++ f8 27 Nov 2007 11:37:56 -0000 1.27 @@ -138,7 +138,7 @@ CVE-2006-0496 ignore (firefox) Feature, not a bug moz #324253 CVE-2005-4809 ignore (firefox) Status bar can be modified anyways CVE-2005-4791 VULNERABLE (liferea) #393301 -CVE-2005-4790 VULNERABLE (blam, fixed 1.8.4) #395761 +CVE-2005-4790 backport (blam, fixed 1.8.4) #395761 [since FEDORA-2007-3798] CVE-2005-4790 backport (tomboy) #362951 [since FEDORA-2007-3253] CVE-2005-3675 VULNERABLE (kernel) optack, no upstream fix -- TCP protocol weakness CVE-2003-1265 ignore (thunderbird) Stuff deleted from userspace is not guarranteed to go away physically moz#198442 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.184 retrieving revision 1.185 diff -u -r1.184 -r1.185 --- fc7 26 Nov 2007 18:15:22 -0000 1.184 +++ fc7 27 Nov 2007 11:37:56 -0000 1.185 @@ -1397,7 +1397,7 @@ CVE-2005-4807 ignore (binutils, gas fixed 20050721) this is a bug CVE-2005-4803 version (graphviz, fixed 2.2.1) CVE-2005-4798 version (kernel, not 2.6) -CVE-2005-4790 VULNERABLE (blam, fixed 1.8.4) #395751 +CVE-2005-4790 backport (blam, fixed 1.8.4) #395751 [since FEDORA-2007-3792] CVE-2005-4790 backport (tomboy) #362941 [since FEDORA-2007-3011] CVE-2005-4784 ignore (glibc) struct dirent is big enough CVE-2005-4746 version (freeradius, fixed 1.0.5)

1 0

fedora-security/audit f8, 1.25, 1.26 f9, 1.22, 1.23 fc6, 1.300, 1.301 fc7, 1.183, 1.184
by fedora-security-commits＠redhat.com 26 Nov '07

26 Nov '07

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv17398/audit Modified Files: f8 f9 fc6 fc7 Log Message: process another pile of fedora updates Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.25 retrieving revision 1.26 diff -u -r1.25 -r1.26 --- f8 22 Nov 2007 16:01:07 -0000 1.25 +++ f8 26 Nov 2007 18:15:22 -0000 1.26 @@ -7,45 +7,49 @@ # Up to date CVE as of CVE email 20071030 # Up to date F8 as of 20071029 +CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) [since FEDORA-2007-3639] CVE-2007-6061 VULNERABLE (audacity) #393251 -CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #391991 -CVE-2007-5977 VULNERABLE (phpMyAdmin) #385901 -CVE-2007-5976 VULNERABLE (phpMyAdmin) #385901 +CVE-2007-6035 version (cacti, fixed 0.8.7a) #391991 [since FEDORA-2007-3667] +CVE-2007-5977 version (phpMyAdmin, fixed 2.11.2.1) #385901 [since FEDORA-2007-3636] +CVE-2007-5976 version (phpMyAdmin, fixed 2.11.2.1) #385901 [since FEDORA-2007-3636] CVE-2007-5938 VULNERABLE (kernel) #385861 iwlwifi -CVE-2007-5937 VULNERABLE (tetex) #379861 Multiple dviljk buffer overflows -CVE-2007-5936 VULNERABLE (tetex) #379861 dviljk uses insecure temporary file -CVE-2007-5935 VULNERABLE (tetex) #379861 dvips -z buffer overflow with long href -CVE-2007-5934 VULNERABLE (php-pear-MDB2) #379101 -CVE-2007-5934 VULNERABLE (php-pear-MDB2-Driver-mysql) #379131 -CVE-2007-5934 VULNERABLE (php-pear-MDB2-Driver-mysqli) #379161 +CVE-2007-5937 backport (tetex) #379861 [since FEDORA-2007-3308] Multiple dviljk buffer overflows +CVE-2007-5936 backport (tetex) #379861 [since FEDORA-2007-3308] dviljk uses insecure temporary file +CVE-2007-5935 backport (tetex) #379861 [since FEDORA-2007-3308] dvips -z buffer overflow with long href +CVE-2007-5934 backport (php-pear-MDB2) #379101 [since FEDORA-2007-3376] +CVE-2007-5934 backport (php-pear-MDB2-Driver-mysql) #379131 [since FEDORA-2007-3376] +CVE-2007-5934 backport (php-pear-MDB2-Driver-mysqli) #379161 [since FEDORA-2007-3376] CVE-2007-5925 ignore (mysql) Authenticated user can restart mysql. CVE-2007-5907 VULNERABLE (xen) #390111 CVE-2007-5906 VULNERABLE (xen) #390111 -CVE-2007-5795 VULNERABLE (emacs) #367591 +CVE-2007-5795 backport (emacs) #367591 [since FEDORA-2007-2946] CVE-2007-5770 backport (ruby) #373391 [since FEDORA-2007-2812] GENERIC-MAP-NOMATCH VULNERABLE (nx) #293031 CVE-2007-5751 backport (liferea, fixed 1.4.6) #360641 [since FEDORA-2007-2853] CVE-2007-5712 version (Django, fixed 0.96.1) #362771 [since FEDORA-2007-2788] CVE-2007-5708 version (openldap, fixed 2.3.39) #362991 [since FEDORA-2007-2796] CVE-2007-5707 version (openldap, fixed 2.3.39) #362991 [since FEDORA-2007-2796] +CVE-2007-5690 version (zaptel) [since FEDORA-2007-2860] not really an issue CVE-2007-5624 VULNERABLE (nagios, fixed 2.10) #362801 CVE-2007-5623 backport (nagios-plugins, not fixed 1.4.10) #348731 [since FEDORA-2007-2876] nagios-plugins-1.4.8-9.fc8 CVE-2007-5589 VULNERABLE (phpMyAdmin, fixed 2.11.1.2) #333661 PMASA-2007-6 -CVE-2007-5461 VULNERABLE (tomcat5, not fixed 5.5.25) #363001 +CVE-2007-5461 version (tomcat5) #363001 [since FEDORA-2007-3474] +CVE-2007-5398 version (samba) [since FEDORA-2007-3403] CVE-2007-5395 version (link-grammar) #372351 [since FEDORA-2007-3235] CVE-2007-5393 backport (xpdf) #372471 [since FEDORA-2007-3014] CVE-2007-5393 backport (cups) [since FEDORA-2007-2982] CVE-2007-5393 VULNERABLE (poppler) #372511 CVE-2007-5393 backport (kdegraphics) #372571 [since FEDORA-2007-3001] CVE-2007-5393 backport (koffice) #372601 [since FEDORA-2007-3093] -CVE-2007-5393 VULNERABLE (tetex) #372661 +CVE-2007-5393 backport (tetex) #372661 [since FEDORA-2007-3308] CVE-2007-5392 backport (xpdf) #372471 [since FEDORA-2007-3014] CVE-2007-5392 backport (cups) [since FEDORA-2007-2982] CVE-2007-5392 VULNERABLE (poppler) #372511 CVE-2007-5392 backport (kdegraphics) #372571 [since FEDORA-2007-3001] CVE-2007-5392 backport (koffice) #372601 [since FEDORA-2007-3093] -CVE-2007-5392 VULNERABLE (tetex) #372661 +CVE-2007-5392 backport (tetex) #372661 [since FEDORA-2007-3308] CVE-2007-5386 version (phpmyadmin, fixed 2.11.1.1) #333661 PMASA-2007-5 +CVE-2007-5339 version (thunderbird) [since FEDORA-2007-3414] CVE-2007-5201 VULNERABLE (duplicity, no upstream fix) #362831 CVE-2007-5200 version (hugin) #362861 [since FEDORA-2007-2807] hugin-0.6.1-11.fc8 CVE-2007-5198 VULNERABLE (nagios-plugins, fixed 1.4.10) #362891 @@ -57,9 +61,11 @@ CVE-2007-5007 version (balsa, before 2.3.20) #297601 CVE-2007-4999 version (pidgin, fixed 2.2.2) CVE-2007-4990 version (xorg-x11-xfs, fixed 1.0.5) +CVE-2007-4841 version (thunderbird) [since FEDORA-2007-3414] windows only anyway CVE-2007-4829 VULNERABLE (perl-Archive-Tar, not fixed upstream) #364281 CVE-2007-4752 version (openssh, fixed 4.7) #280461 CVE-2007-4619 version (flac, fixed 1.2) #332581 +CVE-2007-4572 version (samba) [since FEDORA-2007-3403] CVE-2007-4568 version (xorg-x11-xfs, fixed 1.0.5) CVE-2007-4559 VULNERABLE (python, not fixed upstream) #315291 Upstream WONTFIX. See where we use the code. CVE-2007-4476 backport (tar) #280961 [since FEDORA-2007-2800] tar-1.17-4.fc8 @@ -71,9 +77,10 @@ CVE-2007-4352 VULNERABLE (poppler) #372511 CVE-2007-4352 backport (kdegraphics) #372571 [since FEDORA-2007-3001] CVE-2007-4352 backport (koffice) #372601 [since FEDORA-2007-3093] -CVE-2007-4352 VULNERABLE (tetex) #372661 +CVE-2007-4352 backport (tetex) #372661 [since FEDORA-2007-3308] CVE-2007-4351 version (cups) #362971 [since FEDORA-2007-2982] CVE-2007-4045 backport (cups) [since FEDORA-2007-2982] +CVE-2007-4033 backport (tetex) [since FEDORA-2007-3308] CVE-2007-3999 VULNERABLE (nfs-utils-lib) #362091 CVE-2007-3999 VULNERABLE (libtirpc) #362111 CVE-2007-3920 VULNERABLE (compiz, not fixed upstream) #363061 @@ -82,14 +89,19 @@ CVE-2007-3843 version (kernel) #246595 No idea which version fixed this CVE-2007-3544 VULNERABLE (wordpress, NOT fixed 2.2.1) #245211 Incomplete fix for CVE-2007-3543 CVE-2007-3387 version (poppler, fixed 0.5.91) #251512 +CVE-2007-3386 version (tomcat5) [since FEDORA-2007-3474] +CVE-2007-3385 version (tomcat5) [since FEDORA-2007-3474] +CVE-2007-3382 version (tomcat5) [since FEDORA-2007-3474] CVE-2007-3145 ignore (galeon) in 2.0.3 the truncation still occurs, but at reasonable length -CVE-2007-2450 VULNERABLE (tomcat5, not fixed 5.5.24) #363081 -CVE-2007-2449 VULNERABLE (tomcat5, not fixed 5.5.24) #363081 +CVE-2007-2450 version (tomcat5) #363081 [since FEDORA-2007-3474] +CVE-2007-2449 version (tomcat5) #363081 [since FEDORA-2007-3474] CVE-2007-2245 version (phpMyAdmin, fixed 2.10.1) #237882 CVE-2007-2165 version (proftpd, fixed 1.3.1rc3) #237533 CVE-2007-1841 version (ipsec-tools, fixed 0.6.7) #238052 CVE-2007-1804 version (pulseaudio) #235013 NOTABUG, there are other known ways to crash pulse. CVE-2007-1558 version (evolution, fixed 1.8.3-5) +CVE-2007-1358 version (tomcat5) [since FEDORA-2007-3474] +CVE-2007-1355 version (tomcat5) [since FEDORA-2007-3474] CVE-2007-1352 version (libXfont, fixed 1.2.8) #235265 CVE-2007-1351 version (libXfont, fixed 1.2.8) #235265 CVE-2007-1103 ignore (tor) #230927 CANTFIX really Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.22 retrieving revision 1.23 diff -u -r1.22 -r1.23 --- f9 22 Nov 2007 16:01:07 -0000 1.22 +++ f9 26 Nov 2007 18:15:22 -0000 1.23 @@ -7,6 +7,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date F9 as of 20071029 +CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #392001 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385911 Index: fc6 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc6,v retrieving revision 1.300 retrieving revision 1.301 diff -u -r1.300 -r1.301 --- fc6 19 Nov 2007 09:09:24 -0000 1.300 +++ fc6 26 Nov 2007 18:15:22 -0000 1.301 @@ -8,21 +8,26 @@ # Up to date FC6 as of 20071029 CVE-2007-5938 VULNERABLE (kernel) #385861 iwlwifi -CVE-2007-5937 VULNERABLE (tetex) #379841 Multiple dviljk buffer overflows -CVE-2007-5936 VULNERABLE (tetex) #379841 dviljk uses insecure temporary file -CVE-2007-5935 VULNERABLE (tetex) #379841 dvips -z buffer overflow with long href +CVE-2007-5937 backport (tetex) #379841 [since FEDORA-2007-750] Multiple dviljk buffer overflows +CVE-2007-5936 backport (tetex) #379841 [since FEDORA-2007-750] dviljk uses insecure temporary file +CVE-2007-5935 backport (tetex) #379841 [since FEDORA-2007-750] dvips -z buffer overflow with long href CVE-2007-5925 ignore (mysql) Authenticated user can restart mysql. CVE-2007-5907 VULNERABLE (xen) #390091 CVE-2007-5906 VULNERABLE (xen) #390091 CVE-2007-5795 version (emacs, only 21) CVE-2007-5770 backport (ruby) #373371 [since FEDORA-2007-738] +CVE-2007-5708 backport (openldap) [since FEDORA-2007-741] +CVE-2007-5707 backport (openldap) [since FEDORA-2007-741] CVE-2007-5461 VULNERABLE (tomcat5) #334521 -CVE-2007-5393 VULNERABLE (cups) +CVE-2007-5398 backport (samba) [since FEDORA-2007-751] +CVE-2007-5393 backport (cups) [since FEDORA-2007-746] CVE-2007-5393 VULNERABLE (poppler) #372491 CVE-2007-5393 VULNERABLE (kdegraphics) #372551 -CVE-2007-5392 VULNERABLE (cups) +CVE-2007-5393 backport (tetex) [since FEDORA-2007-750] +CVE-2007-5392 backport (cups) [since FEDORA-2007-746] CVE-2007-5392 VULNERABLE (poppler) #372491 CVE-2007-5392 VULNERABLE (kdegraphics) #372551 +CVE-2007-5392 backport (tetex) [since FEDORA-2007-750] CVE-2007-5340 version (mozilla) ff 2.0.0.8, tb 2.0.0.6, sm 1.1.5 CVE-2007-5339 version (mozilla) ff 2.0.0.8, tb 2.0.0.6, sm 1.1.5 CVE-2007-5338 version (mozilla) ff 2.0.0.8, tb 2.0.0.6, sm 1.1.5 @@ -34,7 +39,7 @@ CVE-2007-5267 ignore (libpng) shipped version too old and not affected CVE-2007-5266 ignore (libpng) shipped version too old and not affected CVE-2007-5208 backport (hplip) #329121 [since FEDORA-2007-724] -CVE-2007-5197 VULNERABLE (mono, fixed 1.2.5.1) #367571 +CVE-2007-5197 backport (mono, fixed 1.2.5.1) #367571 [since FEDORA-2007-745] CVE-2007-5191 backport (util-linux) #320141 [since FEDORA-2007-722] CVE-2007-5162 version (ruby) #313801 [since FEDORA-2007-718] CVE-2007-5137 backport (tk, fixed 8.4.16) #332071 [since FEDORA-2007-728] @@ -65,6 +70,7 @@ CVE-2007-4658 backport (php, fixed 5.2.4) #278011 [since FEDORA-2007-709] CVE-2007-4657 ignore (php, fixed 5.2.4) arbitrary read not remotely triggerable CVE-2007-4619 backport (flac, fixed 1.2) #332581 [since FEDORA-2007-730] +CVE-2007-4572 backport (samba) [since FEDORA-2007-751] CVE-2007-4571 version (kernel) [since FEDORA-2007-714] CVE-2007-4569 backport (kdebase) #299741 [since FEDORA-2007-716] CVE-2007-4568 VULNERABLE (xorg-x11-xfs, fixed 1.0.5) #373251 @@ -75,9 +81,10 @@ CVE-2007-4476 backport (tar) [since FEDORA-2007-735] CVE-2007-4465 version (httpd) [since FEDORA-2007-707] CVE-2007-4357 ignore (firefox) status bar can be overwrittten -CVE-2007-4352 VULNERABLE (cups) +CVE-2007-4352 backport (cups) [since FEDORA-2007-746] CVE-2007-4352 VULNERABLE (poppler) #372491 CVE-2007-4352 VULNERABLE (kdegraphics) #372551 +CVE-2007-4352 backport (tetex) [since FEDORA-2007-750] CVE-2007-4351 backport (cups) #361671 [since FEDORA-2007-740] CVE-2007-4255 ignore (php) msql extension not shipped CVE-2007-4251 ignore (openoffice.org) just a crash @@ -88,8 +95,10 @@ CVE-2007-4137 backport (qt) #292951 [since FEDORA-2007-703] CVE-2007-4134 backport (star, fixed 1.5a84) #254129 CVE-2007-4131 backport (tar) #253684 [since FEDORA-2007-683] +CVE-2007-4045 backport (cups) [since FEDORA-2007-746] CVE-2007-4029 backport (libvorbis) #250600 [since FEDORA-2007-677] CVE-2007-4168 backport (libexif) #243892 [since FEDORA-2007-614] +CVE-2007-4033 backport (tetex) [since FEDORA-2007-750] CVE-2007-4000 backport (krb5) [since FEDORA-2007-690] CVE-2007-3999 backport (krb5) [since FEDORA-2007-690] CVE-2007-3999 VULNERABLE (nfs-utils-lib) #294911 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.183 retrieving revision 1.184 diff -u -r1.183 -r1.184 --- fc7 22 Nov 2007 16:01:07 -0000 1.183 +++ fc7 26 Nov 2007 18:15:22 -0000 1.184 @@ -8,28 +8,31 @@ # Up to date CVE as of CVE email 20071030 # Up to date FC7 as of 20071029 +CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) [since FEDORA-2007-3666] CVE-2007-6061 VULNERABLE (audacity) #393251 -CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #391981 -CVE-2007-5977 VULNERABLE (phpMyAdmin) #385891 -CVE-2007-5976 VULNERABLE (phpMyAdmin) #385891 +CVE-2007-6035 version (cacti, fixed 0.8.7a) #391981 [since FEDORA-2007-3683] +CVE-2007-5977 version (phpMyAdmin, fixed 2.11.2.1) #385891 [since FEDORA-2007-3627] +CVE-2007-5976 version (phpMyAdmin, fixed 2.11.2.1) #385891 [since FEDORA-2007-3627] CVE-2007-5938 VULNERABLE (kernel) #385861 iwlwifi -CVE-2007-5937 VULNERABLE (tetex) #379831 Multiple dviljk buffer overflows -CVE-2007-5936 VULNERABLE (tetex) #379831 dviljk uses insecure temporary file -CVE-2007-5935 VULNERABLE (tetex) #379831 dvips -z buffer overflow with long href -CVE-2007-5934 VULNERABLE (php-pear-MDB2) #379091 -CVE-2007-5934 VULNERABLE (php-pear-MDB2-Driver-mysql) #379121 -CVE-2007-5934 VULNERABLE (php-pear-MDB2-Driver-mysqli) #379151 +CVE-2007-5937 backport (tetex) #379831 [since FEDORA-2007-3390] Multiple dviljk buffer overflows +CVE-2007-5936 backport (tetex) #379831 [since FEDORA-2007-3390] dviljk uses insecure temporary file +CVE-2007-5935 backport (tetex) #379831 [since FEDORA-2007-3390] dvips -z buffer overflow with long href +CVE-2007-5934 backport (php-pear-MDB2) #379091 [since FEDORA-2007-3369] +CVE-2007-5934 backport (php-pear-MDB2-Driver-mysql) #379121 [since FEDORA-2007-3369] +CVE-2007-5934 backport (php-pear-MDB2-Driver-mysqli) #379151 [since FEDORA-2007-3369] CVE-2007-5925 ignore (mysql) Authenticated user can restart mysql. CVE-2007-5907 VULNERABLE (xen) #390101 CVE-2007-5906 VULNERABLE (xen) #390101 -CVE-2007-5795 VULNERABLE (emacs) #367581 +CVE-2007-5846 backport (net-snmp) [since FEDORA-2007-3019] +CVE-2007-5795 backport (emacs) #367581 [since FEDORA-2007-3056] CVE-2007-5770 backport (ruby) #373381 [since FEDORA-2007-2685] CVE-2007-5751 backport (liferea, fixed 1.4.6) #360641 [since FEDORA-2007-2725] CVE-2007-5728 version (phpPgAdmin) seems to be fixed for some time CVE-2007-5715 backport (denyhosts) fixed long ago CVE-2007-5712 version (Django, fixed 0.96.1) #362761 [since FEDORA-2007-3157] -CVE-2007-5708 VULNERABLE (openldap, fixed 2.3.39) #360081 -CVE-2007-5707 VULNERABLE (openldap, fixed 2.3.39) #360081 +CVE-2007-5708 backport (openldap, fixed 2.3.39) #360081 [since FEDORA-2007-3124] +CVE-2007-5707 backport (openldap, fixed 2.3.39) #360081 [since FEDORA-2007-3124] +CVE-2007-5690 version (zaptel) [since FEDORA-2007-3094] not really an issue CVE-2007-5626 ignore (bacula) known, documented limitation CVE-2007-5624 VULNERABLE (nagios, fixed 2.10) #362791 CVE-2007-5623 backport (nagios-plugins) #348731 [since FEDORA-2007-2713] @@ -41,24 +44,26 @@ CVE-2007-5589 version (phpmyadmin, fixed 2.11.1.2) #333661 PMASA-2007-6 [since FEDORA-2007-2738] CVE-2007-5585 backport (rss-glx) #336331 [since FEDORA-2007-2652] CVE-2007-5585 backport (tempest) #336331 [since FEDORA-2007-2652] -CVE-2007-5461 VULNERABLE (tomcat5) #334511 +CVE-2007-5461 version (tomcat5) #334511 [since FEDORA-2007-3456] CVE-2007-5416 ignore (drupal) Vulnerability in PHP<5.1.3, we're safe -CVE-2007-5395 VULNERABLE (link-grammar) #372341 +CVE-2007-5398 version (samba) [since FEDORA-2007-3402] +CVE-2007-5395 version (link-grammar) #372341 [since FEDORA-2007-3339] CVE-2007-5393 backport (xpdf) #372461 [since FEDORA-2007-3031] CVE-2007-5393 backport (cups) [since FEDORA-2007-3100] CVE-2007-5393 VULNERABLE (poppler) #372501 CVE-2007-5393 backport (kdegraphics) #372561 [since FEDORA-2007-2985] CVE-2007-5393 backport (koffice) #372591 [since FEDORA-2007-3059] -CVE-2007-5393 VULNERABLE (tetex) #372651 +CVE-2007-5393 backport (tetex) #372651 [since FEDORA-2007-3390] CVE-2007-5392 backport (xpdf) #372461 [since FEDORA-2007-3031] CVE-2007-5392 backport (cups) [since FEDORA-2007-3100] CVE-2007-5392 VULNERABLE (poppler) #372501 CVE-2007-5392 backport (kdegraphics) #372561 [since FEDORA-2007-2985] CVE-2007-5392 backport (koffice) #372591 [since FEDORA-2007-3059] -CVE-2007-5392 VULNERABLE (tetex) #372651 +CVE-2007-5392 backport (tetex) #372651 [since FEDORA-2007-3390] CVE-2007-5386 version (phpmyadmin, fixed 2.11.1.1) #333661 PMASA-2007-5 [since FEDORA-2007-2738] CVE-2007-5340 version (mozilla) ff 2.0.0.8, tb 2.0.0.6, sm 1.1.5 [since FEDORA-2007-2664] CVE-2007-5339 version (mozilla) ff 2.0.0.8, tb 2.0.0.6, sm 1.1.5 [since FEDORA-2007-2664] +CVE-2007-5339 version (thunderbird) [since FEDORA-2007-3431] CVE-2007-5338 version (mozilla) ff 2.0.0.8, tb 2.0.0.6, sm 1.1.5 [since FEDORA-2007-2664] CVE-2007-5337 version (mozilla) ff 2.0.0.8, tb 2.0.0.6, sm 1.1.5 [since FEDORA-2007-2664] CVE-2007-5335 version (mozilla) ff 2.0.0.8, does not affect ff1.5 [since FEDORA-2007-2664] @@ -101,6 +106,7 @@ CVE-2007-4893 version (wordpress, fixed 2.2.3) [since FEDORA-2007-2143] CVE-2007-4851 ignore (tk) duplicate of CVE-2007-5137 CVE-2007-4841 ignore (mozilla) Windows only +CVE-2007-4841 version (thunderbird) [since FEDORA-2007-3431] windows only anyway CVE-2007-4840 ignore (php) CVE-2007-4829 VULNERABLE (perl-Archive-Tar) #315321 CVE-2007-4828 version (mediawiki, fixed 1.11.0, 1.10.2, 1.9.4) #287881 [since FEDORA-2007-2189] @@ -125,6 +131,7 @@ CVE-2007-4631 version (qgit) #268381 [since FEDORA-2007-2108] CVE-2007-4619 version (flac, fixed 1.2) #332571 [since FEDORA-2007-2596] CVE-2007-4573 version (kernel) [since FEDORA-2007-2298] +CVE-2007-4572 version (samba) [since FEDORA-2007-3402] CVE-2007-4571 version (kernel) [since FEDORA-2007-2349] CVE-2007-4569 backport (kdebase) #299731 [since FEDORA-2007-2361] CVE-2007-4568 VULNERABLE (xorg-x11-xfs, fixed 1.0.5) #373261 @@ -152,7 +159,7 @@ CVE-2007-4352 VULNERABLE (poppler) #372501 CVE-2007-4352 backport (kdegraphics) #372561 [since FEDORA-2007-2985] CVE-2007-4352 backport (koffice) #372591 [since FEDORA-2007-3059] -CVE-2007-4352 VULNERABLE (tetex) #372651 +CVE-2007-4352 backport (tetex) #372651 [since FEDORA-2007-3390] CVE-2007-4351 backport (cups) #361661 [since FEDORA-2007-2715] CVE-2007-4323 backport (denyhosts) #252291 [since FEDORA-2007-0589] CVE-2007-4321 backport (fail2ban) #252290 [since FEDORA-2007-0621] version since FEDORA-2007-1643 @@ -178,6 +185,7 @@ CVE-2007-4065 backport (libvorbis) #245991 [since FEDORA-2007-1765] CVE-2007-4045 backport (cups) [since FEDORA-2007-3100] CVE-2007-4033 backport (t1lib) #303021 [since FEDORA-2007-2343] +CVE-2007-4033 backport (tetex) [since FEDORA-2007-3390] CVE-2007-4029 backport (libvorbis) #245991 [since FEDORA-2007-1765] CVE-2007-4000 backport (krb5) [since FEDORA-2007-2017] CVE-2007-3999 backport (krb5) [since FEDORA-2007-2017] @@ -248,7 +256,10 @@ CVE-2007-3387 backport (koffice) #251522 [since FEDORA-2007-1614] CVE-2007-3387 backport (cups) #251518 [since FEDORA-2007-1541] CVE-2007-3387 ignore (libextractor) http://bugs.gentoo.org/show_bug.cgi?id=188169 +CVE-2007-3386 version (tomcat5) [since FEDORA-2007-3456] +CVE-2007-3385 version (tomcat5) [since FEDORA-2007-3456] CVE-2007-3384 ignore (tomcat) only affects 3.3.x and just affects an example +CVE-2007-3382 version (tomcat5) [since FEDORA-2007-3456] CVE-2007-3381 version (gdm, fixed 2.18.4) #250277 [since FEDORA-2007-1362] CVE-2007-3378 ignore (php) safe mode escape CVE-2007-3377 version (perl-Net-DNS, fixed 0.60) #245612 [since FEDORA-2007-0668] @@ -326,8 +337,8 @@ CVE-2007-2453 version (kernel, fixed 2.6.21.4) [ since FEDORA-2007-0409 ] CVE-2007-2451 version (kernel, fixed 2.6.21.4) [ since FEDORA-2007-0409 ] *CVE-2007-2452 ** (locate) -CVE-2007-2450 VULNERABLE (tomcat5) #244810 -CVE-2007-2449 VULNERABLE (tomcat5) #244810 +CVE-2007-2450 version (tomcat5) #244810 [since FEDORA-2007-3456] +CVE-2007-2449 version (tomcat5) #244810 [since FEDORA-2007-3456] CVE-2007-2448 version (subversion, fixed 1.4.4) #243856 [since FEDORA-2007-2635] *CVE-2007-2447 ** (samba) *CVE-2007-2446 ** (samba) @@ -441,7 +452,8 @@ *CVE-2007-1366 ** (qemu) #238723 CVE-2007-1362 version (seamonkey, fixed 1.0.9) #241840 *CVE-2007-1359 backport (mod_security, fixed 2.1.0-3) #231728 -CVE-2007-1358 ** (tomcat5) #244810 +CVE-2007-1358 version (tomcat5) #244810 [since FEDORA-2007-3456] +CVE-2007-1355 version (tomcat5) [since FEDORA-2007-3456] *CVE-2007-1354 ** (jboss) CVE-2007-1352 version (libXfont) #235265 CVE-2007-1351 version (libXfont) #235265

1 0

fedora-security/audit f8, 1.24, 1.25 f9, 1.21, 1.22 fc7, 1.182, 1.183
by fedora-security-commits＠redhat.com 22 Nov '07

22 Nov '07

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv20523/audit Modified Files: f8 f9 fc7 Log Message: blam insecure LD_LIBRARY_PATH Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.24 retrieving revision 1.25 diff -u -r1.24 -r1.25 --- f8 21 Nov 2007 08:51:15 -0000 1.24 +++ f8 22 Nov 2007 16:01:07 -0000 1.25 @@ -126,6 +126,7 @@ CVE-2006-0496 ignore (firefox) Feature, not a bug moz #324253 CVE-2005-4809 ignore (firefox) Status bar can be modified anyways CVE-2005-4791 VULNERABLE (liferea) #393301 +CVE-2005-4790 VULNERABLE (blam, fixed 1.8.4) #395761 CVE-2005-4790 backport (tomboy) #362951 [since FEDORA-2007-3253] CVE-2005-3675 VULNERABLE (kernel) optack, no upstream fix -- TCP protocol weakness CVE-2003-1265 ignore (thunderbird) Stuff deleted from userspace is not guarranteed to go away physically moz#198442 Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.21 retrieving revision 1.22 diff -u -r1.21 -r1.22 --- f9 21 Nov 2007 08:51:15 -0000 1.21 +++ f9 22 Nov 2007 16:01:07 -0000 1.22 @@ -121,6 +121,7 @@ CVE-2006-0496 ignore (firefox) Feature, not a bug moz #324253 CVE-2005-4809 ignore (firefox) Status bar can be modified anyways CVE-2005-4791 VULNERABLE (liferea) #393311 +CVE-2005-4790 VULNERABLE (blam, fixed 1.8.4) #395771 CVE-2005-4790 backport (tomboy) #362961 [since tomboy-0.8.1-2.fc9] CVE-2005-3675 VULNERABLE (kernel) optack, no upstream fix -- TCP protocol weakness CVE-2003-1265 ignore (thunderbird) Stuff deleted from userspace is not guarranteed to go away physically moz#198442 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.182 retrieving revision 1.183 diff -u -r1.182 -r1.183 --- fc7 21 Nov 2007 08:51:15 -0000 1.182 +++ fc7 22 Nov 2007 16:01:07 -0000 1.183 @@ -1385,6 +1385,7 @@ CVE-2005-4807 ignore (binutils, gas fixed 20050721) this is a bug CVE-2005-4803 version (graphviz, fixed 2.2.1) CVE-2005-4798 version (kernel, not 2.6) +CVE-2005-4790 VULNERABLE (blam, fixed 1.8.4) #395751 CVE-2005-4790 backport (tomboy) #362941 [since FEDORA-2007-3011] CVE-2005-4784 ignore (glibc) struct dirent is big enough CVE-2005-4746 version (freeradius, fixed 1.0.5)

1 0

fedora-security/audit f8, 1.23, 1.24 f9, 1.20, 1.21 fc7, 1.181, 1.182
by fedora-security-commits＠redhat.com 21 Nov '07

21 Nov '07

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv18043/audit Modified Files: f8 f9 fc7 Log Message: audacity cve id Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.23 retrieving revision 1.24 diff -u -r1.23 -r1.24 --- f8 20 Nov 2007 22:17:49 -0000 1.23 +++ f8 21 Nov 2007 08:51:15 -0000 1.24 @@ -7,7 +7,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date F8 as of 20071029 -GENERIC-MAP-NOMATCH VULNERABLE (audacity) #393251 +CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #391991 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385901 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385901 Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.20 retrieving revision 1.21 diff -u -r1.20 -r1.21 --- f9 20 Nov 2007 22:17:49 -0000 1.20 +++ f9 21 Nov 2007 08:51:15 -0000 1.21 @@ -7,7 +7,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date F9 as of 20071029 -GENERIC-MAP-NOMATCH VULNERABLE (audacity) #393251 +CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #392001 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385911 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385911 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.181 retrieving revision 1.182 diff -u -r1.181 -r1.182 --- fc7 20 Nov 2007 22:17:49 -0000 1.181 +++ fc7 21 Nov 2007 08:51:15 -0000 1.182 @@ -8,7 +8,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date FC7 as of 20071029 -GENERIC-MAP-NOMATCH VULNERABLE (audacity) #393251 +CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #391981 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385891 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385891

1 0

fedora-security/audit f8, 1.22, 1.23 f9, 1.19, 1.20 fc7, 1.180, 1.181
by fedora-security-commits＠redhat.com 20 Nov '07

20 Nov '07

Author: lkundrak Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv29273 Modified Files: f8 f9 fc7 Log Message: audacity /tmp liferead LD_LIBRARY_PATH Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.22 retrieving revision 1.23 diff -u -r1.22 -r1.23 --- f8 20 Nov 2007 12:10:08 -0000 1.22 +++ f8 20 Nov 2007 22:17:49 -0000 1.23 @@ -7,6 +7,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date F8 as of 20071029 +GENERIC-MAP-NOMATCH VULNERABLE (audacity) #393251 CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #391991 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385901 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385901 @@ -124,6 +125,7 @@ CVE-2006-0987 ignore (bind) example config file only CVE-2006-0496 ignore (firefox) Feature, not a bug moz #324253 CVE-2005-4809 ignore (firefox) Status bar can be modified anyways +CVE-2005-4791 VULNERABLE (liferea) #393301 CVE-2005-4790 backport (tomboy) #362951 [since FEDORA-2007-3253] CVE-2005-3675 VULNERABLE (kernel) optack, no upstream fix -- TCP protocol weakness CVE-2003-1265 ignore (thunderbird) Stuff deleted from userspace is not guarranteed to go away physically moz#198442 Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.19 retrieving revision 1.20 diff -u -r1.19 -r1.20 --- f9 20 Nov 2007 12:10:08 -0000 1.19 +++ f9 20 Nov 2007 22:17:49 -0000 1.20 @@ -7,6 +7,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date F9 as of 20071029 +GENERIC-MAP-NOMATCH VULNERABLE (audacity) #393251 CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #392001 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385911 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385911 @@ -119,6 +120,7 @@ CVE-2006-0987 ignore (bind) example config file only CVE-2006-0496 ignore (firefox) Feature, not a bug moz #324253 CVE-2005-4809 ignore (firefox) Status bar can be modified anyways +CVE-2005-4791 VULNERABLE (liferea) #393311 CVE-2005-4790 backport (tomboy) #362961 [since tomboy-0.8.1-2.fc9] CVE-2005-3675 VULNERABLE (kernel) optack, no upstream fix -- TCP protocol weakness CVE-2003-1265 ignore (thunderbird) Stuff deleted from userspace is not guarranteed to go away physically moz#198442 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.180 retrieving revision 1.181 diff -u -r1.180 -r1.181 --- fc7 20 Nov 2007 12:10:08 -0000 1.180 +++ fc7 20 Nov 2007 22:17:49 -0000 1.181 @@ -8,6 +8,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date FC7 as of 20071029 +GENERIC-MAP-NOMATCH VULNERABLE (audacity) #393251 CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #391981 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385891 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385891 @@ -1374,6 +1375,7 @@ CVE-2006-0019 version (kdelibs, fixed 3.5.1) *CVE-2006-0017 ** (fedora-ds-base) Publish CVE! *CVE-2006-0016 ** (fedora-ds-base) Publish CVE! +CVE-2005-4791 VULNERABLE (liferea) #393291 *CVE-2005-4838 ** (tomcat) CVE-2005-4837 version (net-snmp, fixed 5.2.2) *CVE-2005-4836 ** (tomcat)

1 0

fedora-security/audit f8, 1.21, 1.22 f9, 1.18, 1.19 fc7, 1.179, 1.180
by fedora-security-commits＠redhat.com 20 Nov '07

20 Nov '07

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv9564/audit Modified Files: f8 f9 fc7 Log Message: cacti sql injection Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.21 retrieving revision 1.22 diff -u -r1.21 -r1.22 --- f8 19 Nov 2007 09:09:24 -0000 1.21 +++ f8 20 Nov 2007 12:10:08 -0000 1.22 @@ -7,6 +7,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date F8 as of 20071029 +CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #391991 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385901 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385901 CVE-2007-5938 VULNERABLE (kernel) #385861 iwlwifi Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.18 retrieving revision 1.19 diff -u -r1.18 -r1.19 --- f9 19 Nov 2007 09:09:24 -0000 1.18 +++ f9 20 Nov 2007 12:10:08 -0000 1.19 @@ -7,6 +7,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date F9 as of 20071029 +CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #392001 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385911 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385911 CVE-2007-5937 VULNERABLE (tetex) #379851 Multiple dviljk buffer overflows Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.179 retrieving revision 1.180 diff -u -r1.179 -r1.180 --- fc7 19 Nov 2007 09:09:24 -0000 1.179 +++ fc7 20 Nov 2007 12:10:08 -0000 1.180 @@ -8,6 +8,7 @@ # Up to date CVE as of CVE email 20071030 # Up to date FC7 as of 20071029 +CVE-2007-6035 VULNERABLE (cacti, fixed 0.8.7a) #391981 CVE-2007-5977 VULNERABLE (phpMyAdmin) #385891 CVE-2007-5976 VULNERABLE (phpMyAdmin) #385891 CVE-2007-5938 VULNERABLE (kernel) #385861 iwlwifi

1 0

fedora-security/tools/Libexig Util.pm, 1.1.2.1, 1.1.2.2
by fedora-security-commits＠redhat.com 19 Nov '07

19 Nov '07

Author: lkundrak Update of /cvs/fedora/fedora-security/tools/Libexig In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv19685/Libexig Modified Files: Tag: lkundrak-tools-ng Util.pm Log Message: Fix tempfile handling, add comments to parent bugs. Index: Util.pm =================================================================== RCS file: /cvs/fedora/fedora-security/tools/Libexig/Attic/Util.pm,v retrieving revision 1.1.2.1 retrieving revision 1.1.2.2 diff -u -r1.1.2.1 -r1.1.2.2 --- Util.pm 7 Nov 2007 16:58:50 -0000 1.1.2.1 +++ Util.pm 19 Nov 2007 09:10:38 -0000 1.1.2.2 @@ -6,6 +6,8 @@ package Libexig::Util; +use File::Temp ('tempfile'); + # Launch an editor for editing the bugzilla comment or whatever sub edit_string { @@ -34,3 +36,5 @@ print STDERR "\n"; $string; } + +1;

1 0

fedora-security/tools add-cve-bug, 1.1.2.2, 1.1.2.3 add-tracking-bugs, 1.2.2.1, 1.2.2.2
by fedora-security-commits＠redhat.com 19 Nov '07

19 Nov '07

Author: lkundrak Update of /cvs/fedora/fedora-security/tools In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv19685 Modified Files: Tag: lkundrak-tools-ng add-cve-bug add-tracking-bugs Log Message: Fix tempfile handling, add comments to parent bugs. Index: add-cve-bug =================================================================== RCS file: /cvs/fedora/fedora-security/tools/Attic/add-cve-bug,v retrieving revision 1.1.2.2 retrieving revision 1.1.2.3 diff -u -r1.1.2.2 -r1.1.2.3 --- add-cve-bug 7 Nov 2007 16:58:50 -0000 1.1.2.2 +++ add-cve-bug 19 Nov 2007 09:10:37 -0000 1.1.2.3 @@ -26,7 +26,6 @@ '; use XMLRPC::Lite; -use File::Temp ('tempfile'); use Getopt::Long; use Data::Dumper; Index: add-tracking-bugs =================================================================== RCS file: /cvs/fedora/fedora-security/tools/add-tracking-bugs,v retrieving revision 1.2.2.1 retrieving revision 1.2.2.2 diff -u -r1.2.2.1 -r1.2.2.2 --- add-tracking-bugs 7 Nov 2007 16:58:50 -0000 1.2.2.1 +++ add-tracking-bugs 19 Nov 2007 09:10:37 -0000 1.2.2.2 @@ -103,7 +103,7 @@ 'bug_id' => $bugs, 'bug_status' => [], 'column_list' => $columns, - }, $username, $password); + }, ($dryrun ? () : ($username, $password))); my $result = $call->result or die $call->faultstring; @@ -115,15 +115,15 @@ # Add blockers (unless dryrun) to a bug sub add_blockers { + return 0 if $dryrun; + my $bug = shift or die 'No blocker!'; my $parents = shift or die 'No bug to block!'; - return 0 if $dryrun; - my $call = $bugzilla_rpc->call('bugzilla.updateDepends', $bug, { 'blocked' => $parents, 'action' => 'add', - }, $username, $password); + }, $username, $password, 1); my $result = $call->result or die $call->faultstring; @@ -132,6 +132,23 @@ return undef; } +# Add private comment (unless dryrun) to a bug +sub add_private_comment +{ + return 0 if $dryrun; + + my $bug = shift or die 'No bug!'; + my $comment = shift or die 'No comment!'; + + my $call = $bugzilla_rpc->call('bugzilla.addComment', $bug, $comment, $username, $password, 1); + + my $result = $call->result + or die $call->faultstring; + + print STDERR 'Bugzilla answered to updateComment: '.Dumper($result) if $debug; + return undef; +} + # Parse command line options: my %options; @@ -154,7 +171,7 @@ $options{'bugs'} or die 'bugs argument is mandatory'; @bugs = split (/,/, $options{'bugs'}); -$options{'versions'} or die 'bugs argument is mandatory'; +$options{'versions'} or die 'versions argument is mandatory'; @versions = split (/,/, $options{'versions'}); $versions{$_} or die "Invalid version: $_" foreach (@versions); @@ -211,6 +228,8 @@ # File for each version +my $comment = "Created Fedora tracking bugs for $component:\n\n"; + foreach my $version (@versions) { my %bug = %bug_tmpl; $bug{'short_desc'} .= " [$versions{$version}]"; @@ -218,6 +237,14 @@ print Dumper (\%bug) if $debug; my $bug_id = file_bug (\%bug); - print $bug{'version'}.": $bug_id\n"; add_blockers ($bug_id, \@bugs); + $comment .= $bug{'version'}.": bug #$bug_id\n"; } + +# Add comment to original bugs + +foreach my $bug (@bugs) { + add_private_comment ($bug, $comment); +} + +print STDERR $comment;

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

security-commits November 2007