Contents of /data/CVE/list

CVE-2010-XXXX (NIS users shadow password leakage)
        - eglibc 2.10.2-4 (medium; bug #560333)
        [lenny] - glibc <unfixed>
        [etch] - glibc <unfixed>
CVE-2010-0115
        RESERVED
CVE-2010-0114
        RESERVED
CVE-2010-0113
        RESERVED
CVE-2010-0112
        RESERVED
CVE-2010-0111
        RESERVED
CVE-2010-0110
        RESERVED
CVE-2010-0109
        RESERVED
CVE-2010-0108
        RESERVED
CVE-2010-0107
        RESERVED
CVE-2010-0106
        RESERVED
CVE-2010-0105
        RESERVED
CVE-2010-0104
        RESERVED
CVE-2010-0103
        RESERVED
CVE-2010-0102
        RESERVED
CVE-2010-0101
        RESERVED
CVE-2010-0100
        RESERVED
CVE-2010-0099
        RESERVED
CVE-2010-0098
        RESERVED
CVE-2010-0097
        RESERVED
CVE-2010-0096
        RESERVED
CVE-2009-4538
        RESERVED
CVE-2009-4537
        RESERVED
CVE-2009-4536
        RESERVED
CVE-2009-4535 (Mongoose 2.8.0 and earlier allows remote attackers to obtain the ...)
        NOT-FOR-US: Mongoose
CVE-2009-4534 (Open redirect vulnerability in the FAQ Ask module 5.x and 6.x before ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4533 (The Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4532 (Cross-site scripting (XSS) vulnerability in the Webform module 5.x ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4531 (httpdx 1.4.4 and earlier allows remote attackers to obtain the source ...)
        NOT-FOR-US: httpdx
CVE-2009-4530 (Mongoose 2.8.0 and earlier allows remote attackers to obtain the ...)
        NOT-FOR-US: Mongoose
CVE-2009-4529 (InterVations NaviCOPA Web Server 3.0.1.2 and earlier allows remote ...)
        NOT-FOR-US: InterVations NaviCOPA Web Server
CVE-2009-4528 (The Organic Groups (OG) Vocabulary module 6.x before 6.x-1.0 for ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4527 (The Shibboleth authentication module 5.x before 5.x-3.4 and 6.x before ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4526 (The Send by e-mail sub-module in the Print (aka Printer, e-mail and ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4525 (Cross-site scripting (XSS) vulnerability in the Print (aka Printer, ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4524 (Cross-site scripting (XSS) vulnerability in the RealName module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4523 (Cross-site scripting (XSS) vulnerability in index.php in Zainu 1.0 ...)
        NOT-FOR-US: Zainu
CVE-2009-4522 (Cross-site scripting (XSS) vulnerability in search.5.html in ...)
        NOT-FOR-US: BloofoxCMS
CVE-2009-4521 (Cross-site scripting (XSS) vulnerability in birt-viewer/run in Eclipse ...)
        NOT-FOR-US: Eclipse Business Intelligence and Reporting Tools
CVE-2009-4520 (The CCK Comment Reference module 5.x before 5.x-1.2 and 6.x before ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4519 (Multiple unspecified vulnerabilities in Ortro before 1.3.4 have ...)
        NOT-FOR-US: Ortro
CVE-2009-4518 (Cross-site scripting (XSS) vulnerability in the Insert Node module 5.x ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4517 (Cross-site request forgery (CSRF) vulnerability in the FAQ Ask module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4516 (Cross-site scripting (XSS) vulnerability in the FAQ Ask module 5.x and ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4515 (The Storm module 6.x before 6.x-1.25 for Drupal does not enforce ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4514 (Cross-site scripting (XSS) vulnerability in the OpenSocial ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4513 (Multiple cross-site scripting (XSS) vulnerabilities in the Workflow ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4512 (Directory traversal vulnerability in index.php in Oscailt 3.3, when ...)
        NOT-FOR-US: Oscailt
CVE-2009-4511
        RESERVED
CVE-2009-4510
        RESERVED
CVE-2009-4509
        RESERVED
CVE-2009-4508
        RESERVED
CVE-2009-4507
        RESERVED
CVE-2009-4506
        RESERVED
CVE-2009-4505
        RESERVED
CVE-2009-4504
        RESERVED
CVE-2009-4503
        RESERVED
CVE-2009-4502 (The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, ...)
        - zabbix 1:1.8-1 (bug #562613)
CVE-2009-4501 (The zbx_get_next_field function in libs/zbxcommon/str.c in Zabbix ...)
        - zabbix 1:1.8-1 (bug #562613)
CVE-2009-4500 (The process_trap function in trapper/trapper.c in Zabbix Server before ...)
        - zabbix 1:1.8-1 (bug #562613)
CVE-2009-4499 (SQL injection vulnerability in the get_history_lastid function in the ...)
        - zabbix 1:1.8-1 (bug #562613)
CVE-2009-4498 (The node_process_command function in Zabbix Server before 1.8 allows ...)
        - zabbix 1:1.8-1 (bug #562613)
CVE-2009-4497 [XSS in LXR]
        RESERVED
        - lxr-cvs <unfixed>
        NOTE: http://sourceforge.net/mailarchive/forum.php?thread_name=E1NS2s4-0001PE-F2@3bkjzd1.ch3.sourceforge.com&forum_name=lxr-developer
CVE-2009-4496
        RESERVED
CVE-2009-4495
        RESERVED
CVE-2009-4494
        RESERVED
CVE-2009-4493
        RESERVED
CVE-2009-4492
        RESERVED
CVE-2009-4491
        RESERVED
CVE-2009-4490
        RESERVED
CVE-2009-4489
        RESERVED
CVE-2009-4488
        RESERVED
CVE-2009-4487
        RESERVED
CVE-2009-4486
        RESERVED
CVE-2009-4485
        RESERVED
CVE-2009-4484 (Buffer overflow in the server in MySQL 5.0.51a on Linux allows remote ...)
        - mysql-dfsg-5.0 <removed>
        TODO: check
CVE-2009-4483 (Unspecified vulnerability in LDAP3A.exe in MailSite 8.0.4 allows ...)
        NOT-FOR-US: MailSite
CVE-2009-4482 (Buffer overflow in MediaServer.exe in TVersity 1.6 allows remote ...)
        NOT-FOR-US: TVersity
CVE-2009-4481 (Unspecified vulnerability in radiusd in FreeRADIUS 1.1.7 allows remote ...)
        - freeradius <unfixed>
        TODO: check
CVE-2009-4480 (Buffer overflow in the web service in AzeoTech DAQFactory 5.77 might ...)
        NOT-FOR-US: AzeoTech DAQFactory
CVE-2009-4479 (LDAP3A.exe in MailSite 8.0.4 allows remote attackers to cause a denial ...)
        NOT-FOR-US: MailSite
CVE-2009-4478 (Multiple cross-site scripting (XSS) vulnerabilities in Xstate Real ...)
        NOT-FOR-US: Xstate Real Estate
CVE-2009-4477 (SQL injection vulnerability in page.html in Xstate Real Estate 1.0 ...)
        NOT-FOR-US: Xstate Real Estate
CVE-2009-4476 (Stack-based buffer overflow in HAURI ViRobot Desktop 5.5 before ...)
        NOT-FOR-US: HAURI ViRobot Desktop
CVE-2009-4475 (SQL injection vulnerability in the Joomlub (com_joomlub) component for ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4474 (SQL injection vulnerability in the Mike de Boer zoom (com_zoom) ...)
        NOT-FOR-US: Mambo component
CVE-2009-4473 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
        NOT-FOR-US: Ektron CMS400.NET
CVE-2009-4472 (Multiple PHP remote file inclusion vulnerabilities in PHPope 1.0.0 and ...)
        NOT-FOR-US: PHPope
CVE-2009-4471 (Multiple PHP remote file inclusion vulnerabilities in FreeSchool 1.1.0 ...)
        NOT-FOR-US: FreeSchool
CVE-2009-4470 (SQL injection vulnerability in boardrule.php in DVBBS 2.0 allows ...)
        NOT-FOR-US: DVBBS
CVE-2009-4469 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
        NOT-FOR-US: phpPowerCards
CVE-2009-4468 (Cross-site scripting (XSS) vulnerability in misc.php in DeluxeBB 1.3 ...)
        NOT-FOR-US: DeluxeBB
CVE-2009-4467 (misc.php in DeluxeBB 1.3 allows remote attackers to register accounts ...)
        NOT-FOR-US: DeluxeBB
CVE-2009-4466 (DeluxeBB 1.3 allows remote attackers to obtain sensitive information ...)
        NOT-FOR-US: DeluxeBB
CVE-2009-4465 (DeluxeBB 1.3 stores sensitive information under the web root with ...)
        NOT-FOR-US: DeluxeBB
CVE-2009-4464 (Cross-site scripting (XSS) vulnerability in searchadvance.asp in ...)
        NOT-FOR-US: Active Business Directory
CVE-2009-4463 (The firmware for Intellicom NetBiter WebSCADA uses hard-coded ...)
        NOT-FOR-US: Intellicom NetBiter WebSCADA
CVE-2009-4462 (Stack-based buffer overflow in NetBiterConfig.exe 1.3.0 in Intellicom ...)
        NOT-FOR-US: Intellicom NetBiter WebSCADA
CVE-2009-4461 (Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.909 ...)
        - flatpress <itp> (bug #466297)
CVE-2009-4460 (Multiple cross-site scripting (XSS) vulnerabilities in Auto-Surf ...)
        NOT-FOR-US: Auto-Surf Traffic Exchange Script
CVE-2009-4459 (Redmine 0.8.7 and earlier uses the title tag before defining the ...)
        - redmine <unfixed> (bug #563940)
CVE-2008-7250 (Cross-site scripting (XSS) vulnerability in Squid Analysis Report ...)
        - sarg <unfixed>
        TODO: check
CVE-2008-7249 (Buffer overflow in Squid Analysis Report Generator (Sarg) 2.2.3.1, and ...)
        - sarg <unfixed>
        TODO: check
CVE-2009-XXXX [sendmail ssl cert spoofing via NUL character]
        - sendmail <unfixed>
        TODO: check
        NOTE: http://www.sendmail.org/releases/8.14.4
CVE-2009-XXXX [pidgin local file disclosure vuln]
        - pidgin <unfixed> (medium; bug #563206)
        - gaim <removed>
        TODO: check stable and oldstable (i.e. gaim)
        NOTE: http://events.ccc.de/congress/2009/Fahrplan/attachments/1483_26c3_ipv4_fuckups.pdf
CVE-2009-4458 (Multiple cross-site scripting (XSS) vulnerabilities in FreePBX 2.5.2 ...)
        - freepbx <itp> (bug #464926)
CVE-2009-4457 (Multiple unspecified vulnerabilities in the Vsftpd Webmin module ...)
        - webmin <itp> (bug #377948)
CVE-2009-4456 (SQL injection vulnerability in news_detail.php in Green Desktiny ...)
        NOT-FOR-US: Green Desktiny
CVE-2009-4455 (The default configuration of Cisco ASA 5500 Series Adaptive Security ...)
        NOT-FOR-US: Cisco
CVE-2009-4454 (vccleaner in VideoCache 1.9.2 allows local users with Squid proxy user ...)
        - videocache <itp> (bug #505329)
CVE-2009-4453 (Insecure method vulnerability in SoftCab Sound Converter ActiveX ...)
        NOT-FOR-US: SoftCab Sound Converter ActiveX
CVE-2009-4452 (Kaspersky Anti-Virus 5.0 (5.0.712); Antivirus Personal 5.0.x; ...)
        NOT-FOR-US: Kaspersky Anti-Viru
CVE-2009-4451 (Unrestricted file upload vulnerability in upper.php in kandalf upper ...)
        NOT-FOR-US: kandalf upper
CVE-2009-4450 (Multiple cross-site scripting (XSS) vulnerabilities in map.php in ...)
        NOT-FOR-US: LiveZilla
CVE-2009-4449 (Directory traversal vulnerability in MyBB (aka MyBulletinBoard) ...)
        NOT-FOR-US: MyBB
CVE-2009-4448 (inc/functions_time.php in MyBB (aka MyBulletinBoard) 1.4.10, and ...)
        NOT-FOR-US: MyBB
CVE-2009-4447 (Jax Guestbook 3.5.0 allows remote attackers to bypass authentication ...)
        NOT-FOR-US: Jax Guestbook
CVE-2009-4446 (Cross-site scripting (XSS) vulnerability in admin.php in ...)
        NOT-FOR-US: phpInstantGallery
CVE-2009-4445 (Microsoft Internet Information Services (IIS), when used in ...)
        NOT-FOR-US: Microsoft
CVE-2009-4444 (Microsoft Internet Information Services (IIS) 5.x and 6.x uses only ...)
        NOT-FOR-US: Microsoft
CVE-2009-4443 (Unspecified vulnerability in the psearch (aka persistent search) ...)
        NOT-FOR-US: Sun Java System Directory Server Enterprise Edition
CVE-2009-4442 (Directory Proxy Server (DPS) in Sun Java System Directory Server ...)
        NOT-FOR-US: Sun Java System Directory Server Enterprise Edition
CVE-2009-4441 (Directory Proxy Server (DPS) in Sun Java System Directory Server ...)
        NOT-FOR-US: Sun Java System Directory Server Enterprise Edition
CVE-2009-4440 (Directory Proxy Server (DPS) in Sun Java System Directory Server ...)
        NOT-FOR-US: Sun Java System Directory Server Enterprise Edition
CVE-2009-4439 (Unspecified vulnerability in the Query Compiler, Rewrite, and ...)
        NOT-FOR-US: DB2
CVE-2009-4438 (The Query Compiler, Rewrite, and Optimizer component in IBM DB2 9.1 ...)
        NOT-FOR-US: DB2
CVE-2009-4437 (Multiple SQL injection vulnerabilities in Active Auction House 3.6 ...)
        NOT-FOR-US: Active Auction House 3.6
CVE-2009-4436 (Multiple SQL injection vulnerabilities in Active Web Softwares ...)
        NOT-FOR-US: Active Web Softwares eWebquiz
CVE-2009-4435 (Multiple directory traversal vulnerabilities in F3Site 2009 allow ...)
        NOT-FOR-US: F3Site 2009
CVE-2009-4434 (Directory traversal vulnerability in index.php in IDevSpot iSupport ...)
        NOT-FOR-US: IDevSpot
CVE-2009-4433 (Multiple cross-site scripting (XSS) vulnerabilities in IDevSpot ...)
        NOT-FOR-US: IDevSpot
CVE-2009-4432 (SQL injection vulnerability in index.php in CodeMight VideoCMS 3.1 ...)
        NOT-FOR-US: CodeMight VideoCMS
CVE-2009-4431 (PHP remote file inclusion vulnerability in cal_popup.php in the ...)
        NOT-FOR-US: Joomla addon
CVE-2009-4430 (SQL injection vulnerability in index.php in VirtueMart 1.0 allows ...)
        NOT-FOR-US: VirtueMart
CVE-2009-4429 (Cross-site scripting (XSS) vulnerability in the Sections module 5.x ...)
        NOT-FOR-US: Drupal addon
CVE-2009-4428 (SQL injection vulnerability in the JoomPortfolio (com_joomportfolio) ...)
        NOT-FOR-US: Joomla addon
CVE-2009-4427 (Directory traversal vulnerability in cmd.php in phpLDAPadmin 1.1.0.5 ...)
        {DSA-1965-1}
        - phpldapadmin 1.1.0.7-1.1 (medium; bug #561975)
        [etch] - phpldapadmin <not-affected> (Vulnerable code not present)
CVE-2009-4426 (Multiple directory traversal vulnerabilities in Ignition 1.2, when ...)
        NOT-FOR-US: Ignition
CVE-2009-4425 (Cross-site scripting (XSS) vulnerability in index.php in iDevCart 1.09 ...)
        NOT-FOR-US: iDevCart
CVE-2009-4424 (SQL injection vulnerability in results.php in the Pyrmont plugin 2 for ...)
        NOT-FOR-US: Wordpress plugin
CVE-2009-XXXX [ampache DoS and CSRF]
        - ampache 3.5.3-1 (low)
        [lenny] - ampache <no-dsa> (minor issue)
        TODO: request CVE and publish more details
CVE-2009-4423 (SQL injection vulnerability in index.php in weenCompany 4.0.0 allows ...)
        NOT-FOR-US: weenCompany
CVE-2009-4422 (Multiple cross-site scripting (XSS) vulnerabilities in the ...)
        - libphp-jpgraph <unfixed> (low; bug #562633)
CVE-2009-4421 (Directory traversal vulnerability in languages_cgi.php in Simple PHP ...)
        NOT-FOR-US: Simple PHP Blog
CVE-2009-4420 (Buffer overflow in the bd daemon in F5 Networks BIG-IP Application ...)
        NOT-FOR-US: F5 Networks BIG-IP Application Security Manager (ASM) and Protocol Security Manager (PSM)
CVE-2009-4419 (Intel Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets in the ...)
        NOT-FOR-US: Intel Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets
CVE-2009-4418 (The unserialize function in PHP 5.3.0 and earlier allows ...)
        - php5 <unfixed> (unimportant)
        NOTE: Only exploitable by malicious script, not treated as a security issue
        NOTE: per Debian PHP security policy
CVE-2009-4417 (The shutdown function in the Zend_Log_Writer_Mail class in Zend ...)
        NOTE: the CVE talks about the Zend Framework, but the culprit
        NOTE: is actually piwik
        TODO: discuss it on oss-sec
CVE-2009-4416 (Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare ...)
        - phpgroupware 1:0.9.16.012+dfsg-9
CVE-2009-4415 (Multiple directory traversal vulnerabilities in phpGroupWare ...)
        - phpgroupware 1:0.9.16.012+dfsg-9
CVE-2009-4414 (SQL injection vulnerability in phpgwapi /inc/class.auth_sql.inc.php in ...)
        - phpgroupware 1:0.9.16.012+dfsg-9
CVE-2009-4412 (Unrestricted file upload vulnerability in Serendipity before 1.5 ...)
        - serendipity <unfixed> (low; bug #562634)
CVE-2009-4411 (The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when ...)
        - acl <unfixed> (low; bug #499076)
        [etch] - acl <not-affected> (Vulnerable code not present)
        NOTE: bug was closed but the fix seems incomplete
        NOTE: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499076#51
CVE-2009-4409 (The (1) CHAP and (2) MS-CHAP-V2 authentication capabilities in the PPP ...)
        NOT-FOR-US: Internet Initiative Japan SEIL/B1 firmware
CVE-2009-4408 (Multiple cross-site scripting (XSS) vulnerabilities in models.parser ...)
        NOT-FOR-US: PyForum
CVE-2009-4407 (Multiple cross-site request forgery (CSRF) vulnerabilities in PyForum ...)
        NOT-FOR-US: PyForum
CVE-2009-4406 (Cross-site scripting (XSS) vulnerability in Forms/login1 in American ...)
        NOT-FOR-US: APC Switched Rack PDU AP7932 B2
CVE-2009-4405 (Multiple unspecified vulnerabilities in Trac before 0.11.6 have ...)
        - trac 0.11.6-1
CVE-2009-4404 (Unspecified vulnerability in t-prot (TOFU Protection) before 2.8 ...)
        - t-prot 2.8-1 (low)
CVE-2009-4403 (Cross-site scripting (XSS) vulnerability in index.php in Rumba XML 1.8 ...)
        NOT-FOR-US: Rumba XML
CVE-2009-4402 (The default configuration of SQL-Ledger 2.8.24 allows remote attackers ...)
        - sql-ledger <unfixed> (bug #562639)
CVE-2009-4410 (The fuse_ioctl_copy_user function in the ioctl handler in ...)
        - linux-2.6 2.6.32-1 (low)
        [etch] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.29)
        [lenny] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.29)
        - linux-2.6.24 <not-affected> (vulnerable code introduced in 2.6.29)
CVE-2009-4401 (SQL injection vulnerability in the Parish Administration Database ...)
        NOT-FOR-US: ste_parish_admin typo3 extension
CVE-2009-4400 (Cross-site scripting (XSS) vulnerability in the Parish Administration ...)
        NOT-FOR-US: ste_parish_admin typo3 extension
CVE-2009-4399 (SQL injection vulnerability in the Parish of the Holy Spirit Religious ...)
        NOT-FOR-US: hs_religiousartgallery typo3 extension
CVE-2009-4398 (Cross-site scripting (XSS) vulnerability in the Parish of the Holy ...)
        NOT-FOR-US: hs_religiousartgallery typo3 extension
CVE-2009-4397 (Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth ...)
        NOT-FOR-US: pd_resources typo3 extension
CVE-2009-4396 (SQL injection vulnerability in the Diocese of Portsmouth Resources ...)
        NOT-FOR-US: pd_resources typo3 extension
CVE-2009-4395 (Cross-site scripting (XSS) vulnerability in the Random Prayer 2 ...)
        NOT-FOR-US: ste_prayer2 typo3 extension
CVE-2009-4394 (SQL injection vulnerability in the Random Prayer 2 (ste_prayer2) ...)
        NOT-FOR-US: ste_prayer2 typo3 extension
CVE-2009-4393 (SQL injection vulnerability in the Document Directorys ...)
        NOT-FOR-US: danp_documentdirs
CVE-2009-4392 (SQL injection vulnerability in the XDS Staff List (xds_staff) ...)
        NOT-FOR-US: xds_staff typo3 extension
CVE-2009-4391 (Cross-site scripting (XSS) vulnerability in the File list (dr_blob) ...)
        NOT-FOR-US: dr_blob typo3 extension
CVE-2009-4390 (SQL injection vulnerability in the Car (car) extension 0.1.1 for TYPO3 ...)
        NOT-FOR-US: car typo3 extension
CVE-2009-4389 (Unspecified vulnerability in the Watchdog (aba_watchdog) extension ...)
        NOT-FOR-US: aba_watchdog typo3 extension
CVE-2009-4388 (Cross-site scripting (XSS) vulnerability in the ListMan (nl_listman) ...)
        NOT-FOR-US: nl_listman typo3 extension
CVE-2009-4387 (The cross-site scripting (XSS) protection mechanism in ...)
        NOT-FOR-US: ManageEngine Password Manager Pro (PMP)
CVE-2009-4386 (SQL injection vulnerability in hotel_tiempolibre_ext.php in Venalsur ...)
        NOT-FOR-US: Venalsur Booking Centre Booking System
CVE-2009-4385 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        NOT-FOR-US: Scriptsez.net Ez Poll Hoster 
CVE-2009-4384 (Multiple cross-site scripting (XSS) vulnerabilities in Scriptsez.net ...)
        NOT-FOR-US: Scriptsez.net Ez Poll Hoster 
CVE-2009-4383 (Directory traversal vulnerability in Pforum.php in Rocomotion P forum ...)
        NOT-FOR-US: Rocomotion P forum
CVE-2009-4382 (Cross-site scripting (XSS) vulnerability in module.php in PHPFABER ...)
        NOT-FOR-US: PHPFABER CMS
CVE-2009-4381 (Cross-site scripting (XSS) vulnerability in index.php in texmedia ...)
        NOT-FOR-US: texmedia Million Pixel Script
CVE-2009-4380 (Multiple SQL injection vulnerabilities in Valarsoft Webmatic before ...)
        NOT-FOR-US: Valarsoft Webmatic
CVE-2009-4379 (Multiple cross-site scripting (XSS) vulnerabilities in Valarsoft ...)
        NOT-FOR-US: Valarsoft Webmatic
CVE-2010-0095
        RESERVED
CVE-2010-0094
        RESERVED
CVE-2010-0093
        RESERVED
CVE-2010-0092
        RESERVED
CVE-2010-0091
        RESERVED
CVE-2010-0090
        RESERVED
CVE-2010-0089
        RESERVED
CVE-2010-0088
        RESERVED
CVE-2010-0087
        RESERVED
CVE-2010-0086
        RESERVED
CVE-2010-0085
        RESERVED
CVE-2010-0084
        RESERVED
CVE-2010-0083
        RESERVED
CVE-2010-0082
        RESERVED
CVE-2010-0081
        RESERVED
CVE-2010-0080
        RESERVED
CVE-2010-0079
        RESERVED
CVE-2010-0078
        RESERVED
CVE-2010-0077
        RESERVED
CVE-2010-0076
        RESERVED
CVE-2010-0075
        RESERVED
CVE-2010-0074
        RESERVED
CVE-2010-0073
        RESERVED
CVE-2010-0072
        RESERVED
CVE-2010-0071
        RESERVED
CVE-2010-0070
        RESERVED
CVE-2010-0069
        RESERVED
CVE-2010-0068
        RESERVED
CVE-2010-0067
        RESERVED
CVE-2010-0066
        RESERVED
CVE-2009-4378 (The IPMI dissector in Wireshark 1.2.0 through 1.2.4, when running on ...)
        - wireshark <not-affected> (Windows-specific)
CVE-2009-4377 (The (1) SMB and (2) SMB2 dissectors in Wireshark 0.9.0 through 1.2.4 ...)
        - wireshark 1.2.5-1
        [lenny] - wireshark <no-dsa> (Minor issue)
        [etch] - wireshark <no-dsa> (Minor issue)
CVE-2009-4376 (Buffer overflow in the daintree_sna_read function in the Daintree SNA ...)
        - wireshark 1.2.5-1
        [lenny] - wireshark <not-affected> (Only affects Wireshark 1.2.x)
        [etch] - wireshark <not-affected> (Only affects Wireshark 1.2.x)
CVE-2009-4375 (SQL injection vulnerability in repository/repository_attachment.php in ...)
        NOT-FOR-US: AlienVault Open Source Security Information Management
CVE-2009-4374 (Directory traversal vulnerability in ...)
        NOT-FOR-US: AlienVault Open Source Security Information Management
CVE-2009-4373 (Unrestricted file upload vulnerability in ...)
        NOT-FOR-US: AlienVault Open Source Security Information Management
CVE-2009-4372 (AlienVault Open Source Security Information Management (OSSIM) 2.1.5, ...)
        NOT-FOR-US: AlienVault Open Source Security Information Management
CVE-2009-4371 (Cross-site scripting (XSS) vulnerability in the Locale module ...)
        - drupal6 <unfixed> (low; bug #562165)
        [lenny] - drupal6 <no-dsa> (Minor issue, requires auth)
CVE-2009-4370 (Cross-site scripting (XSS) vulnerability in the Menu module ...)
        - drupal6 <unfixed> (low; bug #562165)
        [lenny] - drupal6 <no-dsa> (Minor issue, requires auth)
CVE-2009-4369 (Cross-site scripting (XSS) vulnerability in the Contact module ...)
        - drupal6 <unfixed> (low; bug #562165)
        [lenny] - drupal6 <no-dsa> (Minor issue, requires auth)
        - drupal5 <unfixed> (low)
CVE-2009-4368 (Multiple unspecified vulnerabilities in Centreon before 2.1.4 have ...)
        NOT-FOR-US: Centreon
CVE-2009-4367 (The Staging Webservice (&quot;sitecore modules/staging/service/api.asmx&quot;) ...)
        NOT-FOR-US: Sitecore Staging Module
CVE-2009-4366 (Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez ...)
        NOT-FOR-US: ScriptsEz Ez Blog   
CVE-2009-4365 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        NOT-FOR-US: ScriptsEz Ez Blog   
CVE-2009-4364 (Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez ...)
        NOT-FOR-US: ScriptsEz Ez Blog   
CVE-2009-4363 (Text_Filter/lib/Horde/Text/Filter/Xss.php in Horde Application ...)
        - horde3 3.3.6+debian0-1 (low)
CVE-2009-4362 (Multiple buffer overflows in qosmod in IBM AIX 6.1 allow local users ...)
        NOT-FOR-US: IBM AIX
CVE-2009-4361 (Multiple buffer overflows in qoslist in IBM AIX 6.1 allow local users ...)
        NOT-FOR-US: IBM AIX
CVE-2009-4360 (SQL injection vulnerability in modules/content/index.php in the ...)
        NOT-FOR-US: XOOPS
CVE-2009-4359 (Cross-site scripting (XSS) vulnerability in folder.php in the ...)
        NOT-FOR-US: XOOPS
CVE-2009-4358 (freebsd-update in FreeBSD 8.0, 7.2, 7.1, 6.4, and 6.3 uses insecure ...)
        NOT-FOR-US: freebsd-update
CVE-2009-4357 (CQWeb (aka the web interface) in IBM Rational ClearQuest before 7.1.1 ...)
        NOT-FOR-US: IBM Rational ClearQuest
CVE-2009-4356 (Multiple integer overflows in the jpeg.w5s and png.w5s filters in ...)
        NOT-FOR-US: Winamp
CVE-2009-4355
        RESERVED
CVE-2009-4354 (TransWARE Active! mail 2003 build 2003.0139.0871 and earlier does not ...)
        NOT-FOR-US: TransWARE Active
CVE-2009-4353 (The Mobile Edition of TransWARE Active! mail 2003 build 2003.0139.0871 ...)
        NOT-FOR-US: TransWARE Active
CVE-2009-4352 (Multiple cross-site scripting (XSS) vulnerabilities in TransWARE ...)
        NOT-FOR-US: TransWARE Active
CVE-2009-4351 (SQL injection vulnerability in ADMIN/loginaction.php in WSCreator 1.1, ...)
        NOT-FOR-US: WSCreator
CVE-2009-4350 (SQL injection vulnerability in index.php in Arctic Issue Tracker 2.1.1 ...)
        NOT-FOR-US: Arctic Issue Tracker
CVE-2009-4349 (Cross-site request forgery (CSRF) vulnerability in ...)
        NOT-FOR-US: Link Up Gold
CVE-2009-4348 (Cross-site scripting (XSS) vulnerability in index.php in Harold ...)
        NOT-FOR-US: Harold Bakker's NewsScript
CVE-2009-4347 (Cross-site scripting (XSS) vulnerability in daloradius-users/login.php ...)
        NOT-FOR-US: daloRADIUS
CVE-2009-4346 (Cross-site scripting (XSS) vulnerability in the Frontend news ...)
        NOT-FOR-US: fe_rtenews typo3 extension
CVE-2009-4345 (Cross-site scripting (XSS) vulnerability in the vShoutbox (vshoutbox) ...)
        NOT-FOR-US: vShoutbox typo3 extension
CVE-2009-4344 (Cross-site scripting (XSS) vulnerability in the ZID Linkliste ...)
        NOT-FOR-US: zid_linklist typo3 extension
CVE-2009-4343 (Cross-site scripting (XSS) vulnerability in the Training Company ...)
        NOT-FOR-US: trainincdb typo3 extension
CVE-2009-4342 (SQL injection vulnerability in the Job Exchange (jobexchange) ...)
        NOT-FOR-US: jobexchange typo3 extension
CVE-2009-4341 (SQL injection vulnerability in the No indexed Search ...)
        NOT-FOR-US: no_indexed_search typo3 extension
CVE-2009-4340 (Cross-site scripting (XSS) vulnerability in the No indexed Search ...)
        NOT-FOR-US: no_indexed_search typo3 extension
CVE-2009-4339 (SQL injection vulnerability in the Subscription (mf_subscription) ...)
        NOT-FOR-US: mf_subscription typo3 extension
CVE-2009-4338 (SQL injection vulnerability in the Flash SlideShow (slideshow) ...)
        NOT-FOR-US: slideshow typo3 extension
CVE-2009-4337 (SQL injection vulnerability in the Diocese of Portsmouth Calendar ...)
        NOT-FOR-US: pd_calendar typo3 extension
CVE-2009-4336 (Cross-site scripting (XSS) vulnerability in the Diocese of Portsmouth ...)
        NOT-FOR-US: pd_calendar typo3 extension
CVE-2009-4335 (Multiple unspecified vulnerabilities in bundled stored procedures in ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4334 (The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4333 (The Relational Data Services component in IBM DB2 9.5 before FP5 ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4332 (db2pd in the Problem Determination component in IBM DB2 9.1 before FP7 ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4331 (The Install component in IBM DB2 9.5 before FP5 and 9.7 before FP1 ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4330 (Unspecified vulnerability in db2licm in the Engine Utilities component ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4329 (Unspecified vulnerability in the Engine Utilities component in IBM DB2 ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4328 (Unspecified vulnerability in the DRDA Services component in IBM DB2 ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4327 (The Common Code Infrastructure component in IBM DB2 9.5 before FP5 and ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4326 (The RAND scalar function in the Common Code Infrastructure component ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4325 (The Client Interfaces component in IBM DB2 8.2 before FP18, 9.1 before ...)
        NOT-FOR-US: IBM DB2
CVE-2009-XXXX [libapache2-mod-php5: potential disclosure of private php files]
        - php5 5.2.11.dfsg.1-2 (low; bug #562006)
        NOTE: not sure if it should be treated as an issue, probably not
CVE-2009-XXXX [libhaml-ruby XSS issue]
        - libhaml-ruby 2.2.8-1
CVE-2009-XXXX [roundup: unspecified issue]
        - roundup 1.4.11-1
CVE-2009-XXXX [php5 uksort() interruption memory corruption]
        - php5 <unfixed> (low)
        NOTE: CVE requested
CVE-2009-XXXX [php5 usort interruption memory corruption]
        - php5 5.2.11.dfsg.1-1 (low)
        TODO: protection was weak in .11, re-check .12 changes
        NOTE: CVE requested
        NOTE: from "Shocking News in PHP Exploitation" by Stefan Esser
CVE-2009-XXXX [php5 explode() information leak]
        - php5 5.2.11.dfsg.1-1 (low)
        NOTE: CVE requested
        NOTE: from "Shocking News in PHP Exploitation" by Stefan Esser
CVE-2009-XXXX [php5 serialize() information leak]
        - php5 5.2.11.dfsg.1-1 (low)
        NOTE: CVE requested
        NOTE: from "Shocking News in PHP Exploitation" by Stefan Esser
CVE-2010-0065
        RESERVED
CVE-2010-0064
        RESERVED
CVE-2010-0063
        RESERVED
CVE-2010-0062
        RESERVED
CVE-2010-0061
        RESERVED
CVE-2010-0060
        RESERVED
CVE-2010-0059
        RESERVED
CVE-2010-0058
        RESERVED
CVE-2010-0057
        RESERVED
CVE-2010-0056
        RESERVED
CVE-2010-0055
        RESERVED
CVE-2010-0054
        RESERVED
CVE-2010-0053
        RESERVED
CVE-2010-0052
        RESERVED
CVE-2010-0051
        RESERVED
CVE-2010-0050
        RESERVED
CVE-2010-0049
        RESERVED
CVE-2010-0048
        RESERVED
CVE-2010-0047
        RESERVED
CVE-2010-0046
        RESERVED
CVE-2010-0045
        RESERVED
CVE-2010-0044
        RESERVED
CVE-2010-0043
        RESERVED
CVE-2010-0042
        RESERVED
CVE-2010-0041
        RESERVED
CVE-2010-0040
        RESERVED
CVE-2010-0039
        RESERVED
CVE-2010-0038
        RESERVED
CVE-2010-0037
        RESERVED
CVE-2010-0036
        RESERVED
CVE-2010-0035
        RESERVED
CVE-2010-0034
        RESERVED
CVE-2010-0033
        RESERVED
CVE-2010-0032
        RESERVED
CVE-2010-0031
        RESERVED
CVE-2010-0030
        RESERVED
CVE-2010-0029
        RESERVED
CVE-2010-0028
        RESERVED
CVE-2010-0027
        RESERVED
CVE-2010-0026
        RESERVED
CVE-2010-0025
        RESERVED
CVE-2010-0024
        RESERVED
CVE-2010-0023
        RESERVED
CVE-2010-0022
        RESERVED
CVE-2010-0021
        RESERVED
CVE-2010-0020
        RESERVED
CVE-2010-0019
        RESERVED
CVE-2010-0018
        RESERVED
CVE-2010-0017
        RESERVED
CVE-2010-0016
        RESERVED
CVE-2010-0015
        RESERVED
CVE-2010-0014
        RESERVED
CVE-2010-0013
        RESERVED
CVE-2010-0012 [transmission directory traversal when processing .torrent files]
        RESERVED
        - transmission 1.77-1 (low)
        TODO: check affected versions
        NOTE: http://trac.transmissionbt.com/changeset/9829/
        NOTE: https://bugs.launchpad.net/ubuntu/+source/transmission/+bug/500625
CVE-2010-0011 [remote code execution through the "run" function]
        RESERVED
        - uzbl 0.0.0~git.20100105-1 (medium)
        NOTE: http://www.uzbl.org/news.php?id=22
        NOTE: maintainer is aware of it
CVE-2010-0010
        RESERVED
CVE-2010-0009
        RESERVED
CVE-2010-0008
        RESERVED
CVE-2010-0007
        RESERVED
CVE-2010-0006
        RESERVED
CVE-2010-0005
        RESERVED
CVE-2010-0004
        RESERVED
CVE-2010-0003
        RESERVED
CVE-2010-0002
        RESERVED
CVE-2010-0001
        RESERVED
CVE-2009-4324 (Use-after-free vulnerability in the Doc.media.newPlayer method in ...)
        NOT-FOR-US: Adobe Reader and Acrobat 8.0
CVE-2009-4323 (The installation for Zen Cart stores sensitive information and ...)
        NOT-FOR-US: Zen Cart
CVE-2009-4322 (extras/ipn_test_return.php in Zen Cart allows remote attackers to ...)
        NOT-FOR-US: Zen Cart
CVE-2009-4321 (extras/curltest.php in Zen Cart 1.3.8 and 1.3.8a, and possibly other ...)
        NOT-FOR-US: Zen Cart
CVE-2009-4320 (Cross-site scripting (XSS) vulnerability in searchform.php in The Next ...)
        NOT-FOR-US: The Next Generation of Genealogy Sitebuilding
CVE-2009-4319 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: eoCMS
CVE-2009-4318 (Cross-site scripting (XSS) vulnerability in index.php in Real Estate ...)
        NOT-FOR-US: Real Estate Manager
CVE-2009-4317 (Cross-site scripting (XSS) vulnerability in index.php in ScriptsEz Ez ...)
        NOT-FOR-US: ScriptsEz
CVE-2009-4316 (Cross-site scripting (XSS) vulnerability in searchresults_main.php in ...)
        NOT-FOR-US: ZeeLyrics
CVE-2009-4315 (Directory traversal vulnerability in admin/ajaxsave.php in Nuggetz CMS ...)
        NOT-FOR-US: Nuggetz CMS
CVE-2009-4314 (Sun Ray Server Software 4.1 on Solaris 10, when Automatic Multi-Group ...)
        NOT-FOR-US: Sun Ray Server Software
CVE-2009-4313 (ir32_32.dll 3.24.15.3 in the Indeo32 codec in Microsoft Windows 2000 ...)
        NOT-FOR-US: Microsoft
CVE-2009-4312 (Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 ...)
        NOT-FOR-US: Microsoft
CVE-2009-4311 (Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 ...)
        NOT-FOR-US: Microsoft
CVE-2009-4310 (Stack-based buffer overflow in the Intel Indeo41 codec for Windows ...)
        NOT-FOR-US: Microsoft
CVE-2009-4309 (Heap-based buffer overflow in the Intel Indeo41 codec for Windows ...)
        NOT-FOR-US: Microsoft
CVE-2009-4308 (The ext4_decode_error function in fs/ext4/super.c in the ext4 ...)
        - linux-2.6 2.6.32-1 (medium)
        [etch] - linux-2.6 <not-affected> (ext4 introduced in 2.6.19)
        - linux-2.6.24 <removed> (medium)
CVE-2009-4307 (The ext4_fill_flex_info function in fs/ext4/super.c in the Linux ...)
        - linux-2.6 2.6.32-2 (low)
        [etch] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.27)
        [lenny] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.27)
        - linux-2.6.24 <not-affected> (vulnerabile code introduced in 2.6.27)
CVE-2009-4306 (Unspecified vulnerability in the EXT4_IOC_MOVE_EXT (aka move extents) ...)
        - linux-2.6 2.6.32-2 (medium)
        [etch] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.31)
        [lenny] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.31)
        - linux-2.6.24 <not-affected> (vulnerable code introduced in 2.6.31)
CVE-2009-4291
        RESERVED
CVE-2009-4290
        RESERVED
CVE-2009-4289
        RESERVED
CVE-2009-4288
        RESERVED
CVE-2009-4287
        RESERVED
CVE-2009-4286
        RESERVED
CVE-2009-4285
        RESERVED
CVE-2009-4284
        RESERVED
CVE-2009-4283
        RESERVED
CVE-2009-4282
        RESERVED
CVE-2009-4281
        RESERVED
CVE-2009-4280
        RESERVED
CVE-2009-4279
        RESERVED
CVE-2009-4278
        RESERVED
CVE-2009-4277
        RESERVED
CVE-2009-4276
        RESERVED
CVE-2009-4275
        RESERVED
CVE-2009-4274
        RESERVED
CVE-2009-4273
        RESERVED
CVE-2009-4272
        RESERVED
CVE-2009-4271
        RESERVED
CVE-2009-4270 (Stack-based buffer overflow in the errprintf function in base/gsmisc.c ...)
        - ghostscript <unfixed> (medium; bug #562643)
CVE-2009-4269
        RESERVED
CVE-2009-4268
        RESERVED
CVE-2009-4267
        RESERVED
CVE-2009-XXXX [gnome-screensaver inhibitor not removed when connection is closed]
        - gnome-screensaver <unfixed> (low; bug #560895)
        [etch] - gnome-screensaver <no-dsa> (minor issue)
        [lenny] - gnome-screensaver <no-dsa> (minor issue)
        TODO: request CVE id
        NOTE: the code in etch's version is more different but it seems to be affected
        NOTE: http://git.gnome.org/browse/gnome-screensaver/commit/?id=284c9924969a49dbf2d5fae1d680d3310c4df4a3
CVE-2009-XXXX [gif2png multiple buffer overflows parsing CLI arguments]
        - gif2png 2.5.2-1 (low; bug #550978)
        [etch] - gif2png <no-dsa> (minor issue)
        [lenny] - gif2png <no-dsa> (minor issue)
CVE-2009-XXXX [browser-based css info disclosure]
        - xulrunner <unfixed> (unimportant; bug #560108)
        - webkit <unfixed> (unimportant; bug #560870)
        - qt4-x11 <unfixed> (unimportant; bug #561754)
        - kdelibs <unfixed> (unimportant; bug #561752)
        - kde4libs <unfixed> (unimportant; bug #561753)
        - kazehakase <unfixed> (unimportant; bug #560871)
        - epiphany-browser <unfixed> (unimportant; bug #560872)
        - galeon <unfixed> (unimportant; bug #560873)
        - dillo <unfixed> (unimportant; bug #560874)
        NOTE: Minor design issue
CVE-2009-XXXX [xpat2: save game permissions issue]
        - xpat2 <unfixed> (unimportant; bug #560087)
CVE-2009-4144 (NetworkManager (NM) 0.7.2 does not ensure that the configured ...)
        - network-manager-applet <unfixed> (low; bug #560067)
        - network-manager 0.6.5-1 (low)
        [lenny] - network-manager-applet <no-dsa> (minor issue)
        [etch] - network-manager <no-dsa> (minor issue)
        NOTE: network-manager in lenny not affected, because it is in network-manager-applet
CVE-2009-XXXX [unsafe xfs]
        - xfs 1:1.0.8-6 (low; bug #521107)
        [etch] - xfs <no-dsa> (minor issue)
        [lenny] - xfs <no-dsa> (minor issue)
        TODO: next point update: [lenny] - xfs 1:1.0.8-2.2+lenny1
CVE-2009-XXXX [xserver-xorg: inherits user's mask]
        - xserver-xorg-core 2:1.7.2-1 (low; bug #555308)
CVE-2009-4296 (SQL injection vulnerability in the Taxonomy Timer module 5.x-1.8 and ...)
        NOT-FOR-US: Taxonomy Timer module for Drupal
CVE-2009-4295 (Sun Ray Server Software 4.0 and 4.1 does not generate a unique DSA ...)
        NOT-FOR-US: Sun Ray Server Software
CVE-2009-4294 (Unspecified vulnerability in the Authentication Manager (aka utauthd) ...)
        NOT-FOR-US: Sun Ray Server Software
CVE-2009-4293 (Internet Initiative Japan SEIL/X1, SEIL/X2, and SEIL/B1 firmware 2.30 ...)
        NOT-FOR-US: Internet Initiative Japan
CVE-2009-4292 (Buffer overflow in the URL filtering function in Internet Initiative ...)
        NOT-FOR-US: Internet Initiative Japan
CVE-2009-4266 (Cross-site scripting (XSS) vulnerability in search.php in YABSoft ...)
        NOT-FOR-US: YABSoft Advanced Image Hosting (AIH) Script
CVE-2009-4265 (Stack-based buffer overflow in Ideal Administration 2009 9.7.1, and ...)
        NOT-FOR-US: Ideal Administration
CVE-2009-4264 (PHP remote file inclusion vulnerability in components/core/connect.php ...)
        NOT-FOR-US: AROUNDMe
CVE-2009-4263 (SQL injection vulnerability in main_forum.php in PTCPay GeN3 forum 1.3 ...)
        NOT-FOR-US: PTCPay
CVE-2009-4262 (Harold Bakker's NewsScript (HB-NS) 1.3 allows remote attackers to ...)
        NOT-FOR-US: Harold Bakker's Newscript HB-NS
CVE-2009-XXXX [php-net-ping argument injection]
        - php-net-ping 2.4.2-1.1 (medium)
        [etch] - php-net-ping 2.4.2-1+etch1
        [lenny] - php-net-ping 2.4.2-1+lenny1
CVE-2009-4305 (SQL injection vulnerability in the SCORM module in Moodle 1.8 before ...)
        - moodle <unfixed> (medium; bug #559531)
        NOTE: MSA-09-0031
CVE-2009-4304 (Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 does not use a random ...)
        - moodle <unfixed> (bug #559531)
        NOTE: MSA-09-0029
CVE-2009-4303 (Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 stores (1) password ...)
        - moodle <unfixed> (bug #559531)
        NOTE: MSA-09-0028
CVE-2009-4302 (login/index_form.html in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7 ...)
        - moodle <unfixed> (bug #559531)
        NOTE: MSA-09-0027
CVE-2009-4301 (mnet/lib.php in Moodle 1.8 before 1.8.11 and 1.9 before 1.9.7, when ...)
        - moodle <unfixed> (bug #559531)
        NOTE: MSA-09-0026
CVE-2009-4300 (Multiple unspecified authentication plugins in Moodle 1.8 before ...)
        - moodle <unfixed> (bug #559531)
        NOTE: MSA-09-0025
CVE-2009-4299 (mod/glossary/showentry.php in the Glossary module for Moodle 1.8 ...)
        - moodle <unfixed> (bug #559531)
        NOTE: MSA-09-0024
CVE-2009-4298 (The LAMS module (mod/lams) for Moodle 1.8 before 1.8.11 and 1.9 before ...)
        - moodle <unfixed> (bug #559531)
        NOTE: MSA-09-0023
CVE-2009-4297 (Multiple cross-site request forgery (CSRF) vulnerabilities in Moodle ...)
        - moodle <unfixed> (bug #559531)
        NOTE: MSA-09-0022
CVE-2009-XXXX [docutils insecure usage of temporary files]
        - python-docutils 0.6-2 (low; bug #560755)
        [etch] - python-docutils <not-affected> (vulnerable code introduced in 0.5)
        [lenny] - python-docutils <no-dsa> (Minor issue)
        NOTE: cve requested
CVE-2009-4261 (Multiple directory traversal vulnerabilities in the iallocator ...)
        {DSA-1959-1}
        - ganeti 2.0.5-1 (low)
        NOTE: http://www.ocert.org/advisories/ocert-2009-019.html
CVE-2009-4260
        RESERVED
CVE-2009-4259
        RESERVED
CVE-2009-4258
        RESERVED
CVE-2009-4257
        RESERVED
CVE-2009-4256 (Multiple SQL injection vulnerabilities in cource.php in AlefMentor 2.0 ...)
        NOT-FOR-US: AlefMentor
CVE-2009-4255 (Cross-site scripting (XSS) vulnerability in the You!Hostit! template ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4254 (PowerPhlogger 2.2.5 allows remote attackers to obtain sensitive ...)
        NOT-FOR-US: PowerPhlogger
CVE-2009-4253 (Cross-site scripting (XSS) vulnerability in dspStats.php in ...)
        NOT-FOR-US: PowerPhlogger
CVE-2009-4252 (Cross-site scripting (XSS) vulnerability in images.php in Image ...)
        NOT-FOR-US: Image Hosting Script DPI
CVE-2009-4251 (Stack-based buffer overflow in Jasc Paint Shop Pro 8.10 (aka Corel ...)
        NOT-FOR-US: Jasc Paint Shop Pro
CVE-2009-4250 (Multiple cross-site scripting (XSS) vulnerabilities in CutePHP ...)
        NOT-FOR-US: CuteNews
CVE-2009-4249 (Multiple cross-site scripting (XSS) vulnerabilities in CutePHP ...)
        NOT-FOR-US: CuteNews
CVE-2009-4248
        RESERVED
CVE-2009-4247
        RESERVED
CVE-2009-4246
        RESERVED
CVE-2009-4245
        RESERVED
CVE-2009-4244
        RESERVED
CVE-2009-4243
        RESERVED
CVE-2009-4242
        RESERVED
CVE-2009-4241
        RESERVED
CVE-2009-4240 (Multiple buffer overflows in unspecified setuid executables in the ...)
        NOT-FOR-US: IBM InfoSphere Information Server
CVE-2009-4239 (Cross-site scripting (XSS) vulnerability in the Web console in IBM ...)
        NOT-FOR-US: IBM InfoSphere Information Server
CVE-2009-4238 (Multiple SQL injection vulnerabilities in TestLink before 1.8.5 allow ...)
        NOT-FOR-US: TestLink
CVE-2009-4237 (Multiple cross-site scripting (XSS) vulnerabilities in TestLink before ...)
        NOT-FOR-US: TestLink
CVE-2009-4236 (The process function in ...)
        NOT-FOR-US: EC-CUBE
CVE-2009-4235 (acpid 1.0.4 sets an unrestrictive umask, which might allow local users ...)
        {DSA-1960-1}
        - acpid 1.0.6 (low; bug #560771)
        NOTE: all versions set umask(0), might be worth double-checking what it opens
CVE-2009-4234 (Cross-site scripting (XSS) vulnerability in ...)
        NOT-FOR-US: Micronet Network Access Controller
CVE-2009-4233 (Cross-site scripting (XSS) vulnerability in modules/mod_yj_whois.php ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4232 (The Kide Shoutbox (com_kide) component 0.4.6 for Joomla! does not ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4231 (Directory traversal vulnerability in as/lib/plugins.php in SweetRice ...)
        NOT-FOR-US: SweetRice
CVE-2009-4230 (Multiple stack-based buffer overflows in src/Task.cc in the FastCGI ...)
        NOT-FOR-US: IIPImage Server
CVE-2009-4229 (Multiple SQL injection vulnerabilities in ActiveWebSoftwares Active ...)
        NOT-FOR-US: ActiveWebSoftwares Active Bids
CVE-2009-4226 (Race condition in the IP module in the kernel in Sun OpenSolaris ...)
        NOT-FOR-US: OpenSolaris kernel
CVE-2009-4225 (Stack-based buffer overflow in the PestPatrol ActiveX control ...)
        NOT-FOR-US: PestPatrol
CVE-2009-4228 (Stack consumption vulnerability in u_bound.c in Xfig 3.2.5b and ...)
        - xfig <unfixed> (unimportant)
CVE-2009-4227 (Stack-based buffer overflow in the read_1_3_textobject function in ...)
        - xfig 1:3.2.5.b-1 (low; bug #559274)
        [lenny] - xfig <no-dsa> (Minor issue)
        [etch] - xfig <no-dsa> (Minor issue)
        NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=543905
CVE-2009-4413 (The httpClientDiscardBody function in client.c in Polipo 0.9.8, ...)
        - polipo <unfixed> (low; bug #560779)
        [etch] - polipo <no-dsa> (Minor issue)
        [lenny] - polipo <no-dsa> (Minor issue)
CVE-2009-4224 (Multiple PHP remote file inclusion vulnerabilities in SweetRice 0.5.4, ...)
        NOT-FOR-US: SweetRice
CVE-2009-4223 (PHP remote file inclusion vulnerability in adm/krgourl.php in KR-Web ...)
        NOT-FOR-US: KR-Web
CVE-2009-4222 (phpBazar 2.1.1fix and earlier does not require administrative ...)
        NOT-FOR-US: phpBazar
CVE-2009-4221 (SQL injection vulnerability in classified.php in phpBazar 2.1.1fix and ...)
        NOT-FOR-US: phpBazar
CVE-2009-4220 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: PointComma
CVE-2009-4219 (Stack-based buffer overflow in the MYACTIVEX.MyActiveXCtrl.1 ActiveX ...)
        NOT-FOR-US: Haihaisoft Universal Player
CVE-2009-4218 (Multiple SQL injection vulnerabilities in files/login.asp in JiRo's ...)
        NOT-FOR-US: JiRo's Banner System eXperience (JBSX)
CVE-2009-4217 (SQL injection vulnerability in the Itamar Elharar MusicGallery ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4216 (Directory traversal vulnerability in funzioni/lib/menulast.php in ...)
        NOT-FOR-US: klinza
CVE-2009-4215 (Panda Global Protection 2010, Internet Security 2010, and Antivirus ...)
        NOT-FOR-US: Panda
CVE-2009-4213
        RESERVED
CVE-2009-4212
        RESERVED
CVE-2009-4211 (The U.S. Defense Information Systems Agency (DISA) Security Readiness ...)
        NOT-FOR-US: U.S. Defense Information Systems Agency (DISA) Security Readiness Review (SRR) script
CVE-2009-4210 (The Indeo codec in Microsoft Windows 2000 SP4, XP SP2 and SP3, and ...)
        NOT-FOR-US: Microsoft
CVE-2009-4209 (Multiple cross-site scripting (XSS) vulnerabilities in admin/index.php ...)
        NOT-FOR-US: moziloCMS
CVE-2009-4208 (SQL injection vulnerability in the os_news module in Open-school (OS) ...)
        NOT-FOR-US: Open-school
CVE-2009-4207 (Cross-site scripting (XSS) vulnerability in the Webform module 5.x ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4206 (SQL injection vulnerability in admin.link.modify.php in Million Dollar ...)
        NOT-FOR-US: Million Dollar Text Links
CVE-2009-4205 (Directory traversal vulnerability in admin.php in Flashlight Free ...)
        NOT-FOR-US: Flashlight Free Edition
CVE-2009-4204 (SQL injection vulnerability in read.php in Flashlight Free Edition ...)
        NOT-FOR-US: Flashlight Free Edition
CVE-2009-4203 (Multiple SQL injection vulnerabilities in admin/aclass/admin_func.php ...)
        NOT-FOR-US: Arab Portal
CVE-2009-4202 (Directory traversal vulnerability in the Omilen Photo Gallery ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4201 (Multiple stack-based buffer overflows in Mp3 Tag Assistant ...)
        NOT-FOR-US: Mp3 Tag Assistant Professional
CVE-2009-4200 (SQL injection vulnerability in the Seminar (com_seminar) component ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4199 (Multiple SQL injection vulnerabilities in the Mambo Resident (aka Mos ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4198 (SQL injection vulnerability in my_orders.php in MyMiniBill allows ...)
        NOT-FOR-US: MyMiniBill
CVE-2009-4197 (rpwizPppoe.htm in Huawei MT882 V100R002B020 ARG-T running firmware ...)
        NOT-FOR-US: Huawei MT882 V100R002B020
CVE-2009-4196 (Multiple cross-site scripting (XSS) vulnerabilities in multiple ...)
        NOT-FOR-US: Huawei MT882 V100R002B020
CVE-2009-4195 (Buffer overflow in Adobe Illustrator CS4 13.0.0 and 14.0.0 allows ...)
        NOT-FOR-US: Adobe Illustrator
CVE-2009-4194 (Directory traversal vulnerability in Golden FTP Server 4.30 Free and ...)
        NOT-FOR-US: Golden FTP
CVE-2009-4192 (Directory traversal vulnerability in dialog/file_manager.php in ...)
        NOT-FOR-US: Interspire Knowledge Manager
CVE-2009-4191 (Unspecified vulnerability in the kernel in Sun Solaris 10 and ...)
        NOT-FOR-US: Sun Solaris
CVE-2009-4190 (Unspecified vulnerability in the kernel in Sun OpenSolaris 2009.06 ...)
        NOT-FOR-US: Sun Solaris
CVE-2009-4189 (HP Operations Manager has a default password of OvW*busr1 for the ...)
        NOT-FOR-US: HP Operations Manager
CVE-2009-4188 (HP Operations Dashboard has a default password of j2deployer for the ...)
        NOT-FOR-US: HP Operations Dashboard
CVE-2009-4187 (Multiple cross-site scripting (XSS) vulnerabilities in the Gateway ...)
        NOT-FOR-US: Sun Java System Portal Server
CVE-2009-4186 (Stack consumption vulnerability in Apple Safari 4.0.3 on Windows ...)
        NOT-FOR-US: Apple Safari
CVE-2009-4185
        RESERVED
CVE-2009-4184
        RESERVED
CVE-2009-4183
        RESERVED
CVE-2009-4182
        RESERVED
CVE-2009-4181 (Stack-based buffer overflow in ovwebsnmpsrv.exe in HP OpenView Network ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-4180 (Stack-based buffer overflow in snmpviewer.exe in HP OpenView Network ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-4179 (Stack-based buffer overflow in ovalarm.exe in HP OpenView Network Node ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-4178 (Heap-based buffer overflow in OvWebHelp.exe in HP OpenView Network ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-4177 (Buffer overflow in webappmon.exe in HP OpenView Network Node Manager ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-4176 (Multiple heap-based buffer overflows in ovsessionmgr.exe in HP ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-4175 (CutePHP CuteNews 1.4.6 and UTF-8 CuteNews before 8b allows remote ...)
        NOT-FOR-US: CuteNews
CVE-2009-4174 (The editnews module in CutePHP CuteNews 1.4.6 and UTF-8 CuteNews ...)
        NOT-FOR-US: CuteNews
CVE-2009-4173 (Cross-site request forgery (CSRF) vulnerability in CutePHP CuteNews ...)
        NOT-FOR-US: CuteNews
CVE-2009-4172 (Cross-site scripting (XSS) vulnerability in index.php in CutePHP ...)
        NOT-FOR-US: CuteNews
CVE-2009-4171 (An ActiveX control in YahooBridgeLib.dll for Yahoo! Messenger ...)
        NOT-FOR-US: ActiveX
CVE-2009-4170 (WP-Cumulus Plug-in 1.20 for WordPress, and possibly other versions, ...)
        NOT-FOR-US: WP-Cumulus Plug-in 1.20 for WordPress
CVE-2009-4169 (Cross-site scripting (XSS) vulnerability in wp-cumulus.php in the ...)
        NOT-FOR-US: WP-Cumulus Plug-in 1.20 for WordPress
CVE-2009-4168 (Cross-site scripting (XSS) vulnerability in tagcloud.swf in the ...)
        NOT-FOR-US: WP-Cumulus Plug-in 1.20 for WordPress
CVE-2009-4167 (Unspecified vulnerability in the Automatic Base Tags for RealUrl ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4166 (SQL injection vulnerability in the Trips (mchtrips) extension 2.0.0 ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4165 (SQL injection vulnerability in the simple Glossar (simple_glossar) ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4164 (Cross-site scripting (XSS) vulnerability in the simple Glossar ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4163 (SQL injection vulnerability in the TW Productfinder (tw_productfinder) ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4162 (Unspecified vulnerability in the DB Integration (wfqbe) extension ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4161 (Cross-site scripting (XSS) vulnerability in the [AN] Search it! ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4160 (Unspecified vulnerability in the Simple download-system with counter ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4159 (Cross-site scripting (XSS) vulnerability in the newsletter ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4158 (SQL injection vulnerability in the Calendar Base (cal) extension ...)
        NOT-FOR-US: TYPO3 extension
CVE-2009-4157 (Multiple cross-site scripting (XSS) vulnerabilities in index.php in ...)
        NOT-FOR-US: Joomla
CVE-2009-4156 (PHP remote file inclusion vulnerability in modules/pms/index.php in ...)
        NOT-FOR-US: Ciamos CMS
CVE-2009-4155 (Multiple SQL injection vulnerabilities in Eshopbuilde CMS allow remote ...)
        NOT-FOR-US: Eshopbuilde
CVE-2009-4154 (Directory traversal vulnerability in includes/feedcreator.class.php in ...)
        NOT-FOR-US: Elxis CMS
CVE-2009-4153 (Unspecified vulnerability in the XMLAccess component in IBM WebSphere ...)
        NOT-FOR-US: IBM WebSphere
CVE-2009-4152 (Cross-site scripting (XSS) vulnerability in the Collaboration ...)
        NOT-FOR-US: IBM WebSphere
CVE-2009-4151 (Session fixation vulnerability in html/Elements/SetupSessionCookie in ...)
        {DSA-1944-1}
        - request-tracker3.6 3.6.9-2 (low)
        - request-tracker3.4 <removed> 
CVE-2009-4150 (dasauto in IBM DB2 8 before FP18, 9.1 before FP8, 9.5 before FP4, and ...)
        NOT-FOR-US: IBM DB2
CVE-2009-4149 (Cross-site scripting (XSS) vulnerability in the web interface in CA ...)
        NOT-FOR-US: CA Service Desk
CVE-2009-4148 (DAZ Studio 2.3.3.161, 2.3.3.163, and 3.0.1.135 allows remote attackers ...)
        NOT-FOR-US: DAZ Studio
CVE-2009-4147 (The _rtld function in the Run-Time Link-Editor (rtld) in ...)
        NOT-FOR-US: FreeBSD (the affected file -rtld.c-  is not in the archive, not even kFreeBSD) 
CVE-2009-4146 (The _rtld function in the Run-Time Link-Editor (rtld) in ...)
        NOT-FOR-US: FreeBSD (the affected file -rtld.c-  is not in the archive, not even kFreeBSD) 
CVE-2009-4145 (nm-connection-editor in NetworkManager (NM) 0.7.x exports connection ...)
        - network-manager-applet <unfixed> (low; bug #563371)
        - network-manager 0.6.5-1 (low)
        [lenny] - network-manager-applet <no-dsa> (minor issue)
        [etch] - network-manager <no-dsa> (minor issue)
        NOTE: network-manager in lenny not affected, because it is in network-manager-applet
        NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=546117
CVE-2009-4143 (PHP before 5.2.12 does not properly handle session data, which has ...)
        - php5 <unfixed> (low)
CVE-2009-4142 (The htmlspecialchars function in PHP before 5.2.12 does not properly ...)
        - php5 <unfixed>
        TODO: determine real impact
CVE-2009-4141
        RESERVED
CVE-2009-4140 (Unrestricted file upload vulnerability in ofc_upload_image.php in Open ...)
        - piwik <itp> (bug #506933)
CVE-2009-4139
        RESERVED
CVE-2009-4138 (drivers/firewire/ohci.c in the Linux kernel before 2.6.32-git9, when ...)
        - linux-2.6 2.6.32-3 (medium)
        [etch] - linux-2.6 <not-affected> (ohci introduced in 2.6.22)
        - linux-2.6.24 <removed> (medium)
CVE-2009-4137 (The loadContentFromCookie function in core/Cookie.php in Piwik before ...)
        - piwik <itp> (bug #506933)
CVE-2009-4136 (PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before ...)
        {DSA-1964-1}
        - postgresql-7.4 <removed>
        - postgresql-8.1 <removed>
        - postgresql-8.2 <removed>
        - postgresql-8.3 8.3.9-1 (low)
        - postgresql-8.4 8.4.2-1 (low)
CVE-2009-4135 (The distcheck rule in dist-check.mk in GNU coreutils 5.2.1 through 8.1 ...)
        - coreutils <not-affected> (this issue only affects the coreutils build process; bug #560898)
        NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=545439
CVE-2009-4134
        RESERVED
CVE-2009-4133 (Condor 6.5.4 through 7.2.4, 7.3.x, and 7.4.0, as used in MRG, Grid for ...)
        - condor <itp> (bug #233482)
CVE-2009-4132
        REJECTED
CVE-2009-4131 (The EXT4_IOC_MOVE_EXT (aka move extents) ioctl implementation in the ...)
        - linux-2.6 2.6.32-2 (medium)
        [etch] - linux-2.6 <not-affected> (introduced in 2.6.31)
        [lenny] - linux-2.6 <not-affected> (introduced in 2.6.31)
        - linux-2.6.24 <not-affected> (introduced in 2.6.31)
CVE-2009-XXXX [monkey DoS]
        - monkey 0.9.3-1 (low)
        [lenny] - monkey <no-dsa> (Minor issue, fringe package)
CVE-2009-4130 (Visual truncation vulnerability in the MakeScriptDialogTitle function ...)
        TODO: check
CVE-2009-4129 (Race condition in Mozilla Firefox allows remote attackers to produce a ...)
        TODO: check
CVE-2009-4128 (GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted ...)
        - grub2 1.97+20091115-1 (bug #555195)
        [lenny] - grub2 <not-affected> (Password authentication not yet present)
        - grub <not-affected> (only affects grub2)
CVE-2009-4127 (Unspecified vulnerability in Wikipedia Toolbar extension before ...)
        NOT-FOR-US: Wikipedia Toolbar extension for Firefox
CVE-2009-4126
        RESERVED
CVE-2009-4125
        RESERVED
CVE-2009-4124 (Heap-based buffer overflow in the rb_str_justify function in string.c ...)
        - ruby1.9.1 1.9.1.376-1
        - ruby1.9 <unfixed>
        - ruby1.8 <not-affected>
        TODO: check, 1.9.0.* might be affected as well
        NOTE: http://www.ruby-lang.org/en/news/2009/12/07/heap-overflow-in-string/
CVE-2009-4123
        RESERVED
CVE-2009-4122
        RESERVED
CVE-2009-4121 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        NOT-FOR-US: Quick CMS
CVE-2009-4120 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        NOT-FOR-US: Quick.Cart
CVE-2009-4119 (Cross-site scripting (XSS) vulnerability in Feed Element Mapper module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4118 (The StartServiceCtrlDispatcher function in the cvpnd service ...)
        NOT-FOR-US: Cisco VPN client for Windows
CVE-2009-4117 (Multiple stack-based buffer overflows in pdf_shade4.c in MuPDF before ...)
        NOT-FOR-US: MuPDF
CVE-2009-4116 (Multiple directory traversal vulnerabilities in CutePHP CuteNews ...)
        NOT-FOR-US: CutePHP
CVE-2009-4115 (Multiple static code injection vulnerabilities in the Categories ...)
        NOT-FOR-US: CutePHP CuteNews
CVE-2009-4114 (kl1.sys in Kaspersky Anti-Virus 2010 9.0.0.463, and possibly other ...)
        NOT-FOR-US: Kaspersky Anti-Virus
CVE-2009-4113 (Static code injection vulnerability in the Categories module in ...)
        NOT-FOR-US: CutePHP CuteNews
CVE-2009-4110 (Cross-site scripting (XSS) vulnerability in the search functionality ...)
        NOT-FOR-US: DotNetNuke
CVE-2009-4109 (The install wizard in DotNetNuke 4.0 through 5.1.4 does not prevent ...)
        NOT-FOR-US: DotNetNuke
CVE-2009-4108 (XM Easy Personal FTP Server 5.8.0 allows remote authenticated users to ...)
        NOT-FOR-US: XM Easy Personal FTP Server
CVE-2009-4107 (Buffer overflow in Invisible Browsing 5.0.52 allows user-assisted ...)
        NOT-FOR-US: Invisible Browsing
CVE-2009-4106 (Unrestricted file upload vulnerability in admintools/editpage-2.php in ...)
        NOT-FOR-US: Agoko CMS
CVE-2009-4105 (TYPSoft FTP Server 1.10 allows remote authenticated users to cause a ...)
        NOT-FOR-US: TYPSoft FTP Server
CVE-2009-4104 (SQL injection vulnerability in Lyften Designs LyftenBloggie ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4103 (Buffer overflow in Robo-FTP 3.6.17, and possibly other versions, ...)
        NOT-FOR-US: Robo-FTP
CVE-2009-4102 (Sage 1.4.3 and earlier extension for Firefox performs certain ...)
        {DSA-1951-1}
        - firefox-sage 1.4.3-4 (medium; bug #559267)
CVE-2009-4101 (infoRSS 1.1.4.2 and earlier extension for Firefox performs certain ...)
        NOT-FOR-US: infoRSS extension for Firefox
CVE-2009-4100 (Yoono extension before 6.1.1 for Firefox performs certain operations ...)
        NOT-FOR-US: Yoono extension for Firefox
CVE-2009-4099 (SQL injection vulnerability in the Google Calendar GCalendar ...)
        NOT-FOR-US: Joomla! Component
CVE-2009-4098 (Unrestricted file upload vulnerability in banner-edit.php in OpenX ...)
        NOT-FOR-US: OpenX adserver
CVE-2009-4097 (Stack-based buffer overflow in the MplayInputFile function in Serenity ...)
        NOT-FOR-US: Serenity Audio Player
CVE-2009-4096 (RADIO istek scripti 2.5 stores sensitive information under the web ...)
        NOT-FOR-US: RADIO istek scripti
CVE-2009-4095 (myPhile 1.2.1 allows remote attackers to bypass authentication via an ...)
        NOT-FOR-US: myPhile
CVE-2009-4094 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: Joomla! component
CVE-2009-4093 (Multiple cross-site scripting (XSS) vulnerabilities in comments.php in ...)
        NOT-FOR-US: Simplog
CVE-2009-4092 (Cross-site request forgery (CSRF) vulnerability in user.php in Simplog ...)
        NOT-FOR-US: Simplog
CVE-2009-4091 (comments.php in Simplog 0.9.3.2, and possibly earlier, does not ...)
        NOT-FOR-US: Simplog
CVE-2009-4090 (Unrestricted file upload vulnerability in ajax/addComment.php in ...)
        NOT-FOR-US: telepark.wiki
CVE-2009-4089 (telepark.wiki 2.4.23 and earlier allows remote attackers to bypass ...)
        NOT-FOR-US: telepark.wiki
CVE-2009-4088 (Multiple directory traversal vulnerabilities in telepark.wiki 2.4.23 ...)
        NOT-FOR-US: telepark.wiki
CVE-2009-4087 (Cross-site scripting (XSS) vulnerability in index.php in telepark.wiki ...)
        NOT-FOR-US: telepark.wiki
CVE-2009-4086 (CRLF injection vulnerability in Xerver HTTP Server 4.31 and 4.32 ...)
        NOT-FOR-US: Xerver HTTP Server
CVE-2009-4085 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: PHP Traverser
CVE-2009-4084 (SQL injection vulnerability in the search feature in e107 0.7.16 and ...)
        NOT-FOR-US: e107
CVE-2009-4083 (Multiple cross-site scripting (XSS) vulnerabilities in e107 0.7.16 and ...)
        NOT-FOR-US: e107
CVE-2009-4082 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: Outreach Project Tool
CVE-2009-4081 (Untrusted search path vulnerability in dstat before r3199 allows local ...)
        - dstat <not-affected> (Fixed/tracked as CVE-2009-3894)
        NOTE: This second ID is about the same issue, but for an older version, see
        NOTE: http://bugs.gentoo.org/show_bug.cgi?id=293497
        NOTE: For Debian we'll just use CVE-2009-3894 and mark this one as not-affected
CVE-2009-4080 (Multiple unspecified vulnerabilities in ldap_cachemgr (aka the LDAP ...)
        NOT-FOR-US: ldap_cachemgr in Sun Solaris
CVE-2009-4079 (Cross-site request forgery (CSRF) vulnerability in Redmine 0.8.5 and ...)
        - redmine 0.9.0~svn2902-1
CVE-2009-4078 (Multiple cross-site scripting (XSS) vulnerabilities in Redmine 0.8.5 ...)
        - redmine 0.9.0~svn2902-1
CVE-2009-4077 (Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail ...)
        - roundcube 0.3-1
CVE-2009-4076 (Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail ...)
        - roundcube 0.3-1
CVE-2009-4075 (Unspecified vulnerability in the timeout mechanism in sshd in Sun ...)
        NOT-FOR-US: Sun Solaris
CVE-2009-4074 (The XSS Filter in Microsoft Internet Explorer 8 allows remote ...)
        NOT-FOR-US: Microsoft Internet Explorer 8
CVE-2008-7247 (sql/sql_table.cc in MySQL 5.0.x through 5.0.88, 5.1.x through 5.1.41, ...)
        - mysql-dfsg-5.1 <unfixed>
        - mysql-dfsg-5.0 <removed>
        TODO: check
CVE-2009-4214 (Cross-site scripting (XSS) vulnerability in the strip_tags function in ...)
        - rails <unfixed> (low; bug #558685)
        NOTE: http://groups.google.com/group/rubyonrails-security/browse_thread/thread/4d4f71f2aef4c0ab?pli=1
CVE-2008-7248 (Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify ...)
        - rails <unfixed> (medium; bug #558685)
        [lenny] - rails <not-affected> (Vulnerable code not present)
        NOTE: http://weblog.rubyonrails.org/2008/11/18/potential-circumvention-of-csrf-protection-in-rails-2-1
CVE-2009-4073 (The printing functionality in Microsoft Internet Explorer 8 allows ...)
        NOT-FOR-US: Microsoft Internet Explorer 8
CVE-2009-4072 (Unspecified vulnerability in Opera before 10.10 has unknown impact and ...)
        NOT-FOR-US: Opera
CVE-2009-4071 (Opera before 10.10, when exception stacktraces are enabled, places ...)
        NOT-FOR-US: Opera
CVE-2009-4070 (SQL injection vulnerability in GForge 4.5.14, 4.7.3, and possibly ...)
        {DSA-1818-1}
        - gforge 4.7.3-2
CVE-2009-4069 (Multiple cross-site scripting (XSS) vulnerabilities in GForge 4.5.14, ...)
        {DSA-1818-1}
        - gforge 4.7.3-2
CVE-2009-4068
        RESERVED
CVE-2009-4067
        RESERVED
CVE-2009-4066 (Multiple cross-site request forgery (CSRF) vulnerabilities in the &quot;My ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4065 (Cross-site scripting (XSS) vulnerability in the settings page in the ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4064 (Cross-site scripting (XSS) vulnerability in the Gallery Assist module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4063 (Cross-site scripting (XSS) vulnerability in the Subgroups for Organic ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4062 (Multiple cross-site scripting (XSS) vulnerabilities in the ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4061 (Multiple cross-site scripting (XSS) vulnerabilities in the Agreement ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4060 (SQL injection vulnerability in includes/content/viewProd.inc.php in ...)
        NOT-FOR-US: CubeCart
CVE-2009-4059 (SQL injection vulnerability in the JoomClip (com_joomclip) component ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-4058 (SQL injection vulnerability in allauctions.php in Telebid Auction ...)
        NOT-FOR-US: Telebid Auction Script
CVE-2009-4057 (SQL injection vulnerability in the inertialFATE iF Portfolio Nexus ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-4056 (Directory traversal vulnerability in admin/popup.php in Betsy CMS 3.5 ...)
        NOT-FOR-US: Betsy CMS
CVE-2009-4055 (rtp.c in Asterisk Open Source 1.2.x before 1.2.37, 1.4.x before ...)
        {DSA-1952-1}
        - asterisk 1:1.6.2.0~rc7-1 (bug #559103)
CVE-2009-4054
        REJECTED
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-4053 (Multiple directory traversal vulnerabilities in Home FTP Server ...)
        NOT-FOR-US: Home FTP Server
CVE-2009-4052 (Multiple cross-site scripting (XSS) vulnerabilities in the JSF Widget ...)
        NOT-FOR-US: IBM Rational Application Developer for WebSphere
CVE-2009-4051 (Home FTP Server 1.10.1.139 allows remote attackers to cause a denial ...)
        NOT-FOR-US: Home FTP Server
CVE-2009-4050 (Directory traversal vulnerability in get_file.php in phpMyBackupPro ...)
        NOT-FOR-US: phpMyBackupPro
CVE-2009-4049 (Heap-based buffer overflow in aswRdr.sys (aka the TDI RDR driver) in ...)
        NOT-FOR-US: avast
CVE-2009-4048 (Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote authenticated ...)
        NOT-FOR-US: Dxmsoft XM Easy Personal FTP Server
CVE-2009-4047 (Multiple cross-site scripting (XSS) vulnerabilities in PHD Help Desk ...)
        NOT-FOR-US: PHD Help Desk
CVE-2009-4112 (Cacti 0.8.7e and earlier allows remote authenticated administrators to ...)
        - cacti <unfixed> (low; bug #561339)
        [etch] - cacti <no-dsa> (Minor issue, workaround explained in DSA)
        [lenny] - cacti <no-dsa> (Minor issue, workaround explained in DSA)
        NOTE: 4B0E1566.1070509@moritz-naumann.com in bugtraq
        NOTE: low or maybe even unimportant as one requires admin access
        NOTE: to cacti, upstream will implement a whitelist
CVE-2009-4032 (Multiple cross-site scripting (XSS) vulnerabilities in Cacti 0.8.7e ...)
        {DSA-1954-1}
        - cacti 0.8.7e-1.1 (low; bug #561338)
        NOTE: http://docs.cacti.net/#cross-site_scripting_fixes
        NOTE: http://www.cacti.net/download_patches.php
CVE-2009-4046 (Multiple SQL injection vulnerabilities in FrontAccounting (FA) 2.2.x ...)
        NOT-FOR-US: FrontAccounting
CVE-2009-4045 (Multiple SQL injection vulnerabilities in FrontAccounting (FA) before ...)
        NOT-FOR-US: FrontAccounting
CVE-2009-4044 (The Web Services module 6.x for Drupal does not perform the expected ...)
        NOT-FOR-US: Web Services module for Drupal
CVE-2009-4043 (Cross-site scripting (XSS) vulnerability in the AddToAny module 5.x ...)
        NOT-FOR-US: module for Drupal
CVE-2009-4042 (Cross-site scripting (XSS) vulnerability in the RootCandy theme 6.x ...)
        NOT-FOR-US: theme for Drupal
CVE-2009-4041 (UseBB 1.0.9 before 1.0.10 allows remote attackers to cause a denial of ...)
        NOT-FOR-US: UseBB
CVE-2009-4040 (Cross-site scripting (XSS) vulnerability in phpMyFAQ before 2.0.17 and ...)
        NOT-FOR-US: phpMyFAQ
CVE-2009-4039 (Cross-site scripting (XSS) vulnerability in Piwigo before 2.0.6 allows ...)
        NOT-FOR-US: Piwigo
CVE-2009-4038 (Multiple cross-site scripting (XSS) vulnerabilities in NCH Software ...)
        NOT-FOR-US: NCH Software Axon Virtual PBX
CVE-2009-4037 (Multiple SQL injection vulnerabilities in FrontAccounting (FA) before ...)
        NOT-FOR-US: FrontAccounting
CVE-2009-4036
        RESERVED
CVE-2009-4035 (The FoFiType1::parse function in fofi/FoFiType1.cc in Xpdf 3.0.0, gpdf ...)
        - kdegraphics 4.0
        - xpdf 3.01-1
        - poppler 0.5.1-1
        TODO: check
        NOTE: was silently fixed by upstream xpdf, fix propagated to poppler in 4b4fc5c017b/2005-09-14
        NOTE: but at least version 0.4.5 does *not* contain the ship.
        NOTE: Was fixed somewhere between 0.4.5 and 0.5.1
        NOTE: swftools probably not affected
CVE-2009-4034 (PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before ...)
        {DSA-1964-1}
        - postgresql-7.4 <removed>
        - postgresql-8.1 <removed>
        - postgresql-8.2 <removed>
        - postgresql-8.3 8.3.9-1 (low)
        - postgresql-8.4 8.4.2-1 (low)
CVE-2009-4033 (A certain Red Hat patch for acpid 1.0.4 effectively triggers a call to ...)
        - acpid <not-affected> (problem in redhat-specific patch; debian uses sensible permissions 0664)
        NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=515062
CVE-2009-4031 (The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 ...)
        {DSA-1962-1}
        - linux-2.6 2.6.32-3 (low)
        [etch] - linux-2.6 <not-affected> (kvm introduced in 2.6.25)
        - linux-2.6.24 <not-affected> (kvm introduced in 2.6.25)
        - kvm <removed> (low; bug #562075)
CVE-2009-4030 (MySQL 5.1.x before 5.1.41 allows local users to bypass certain ...)
        - mysql-dfsg-5.1 5.1.41-1
        - mysql-dfsg-5.0 <removed>
        TODO: check
CVE-2009-4029 (The (1) dist or (2) distcheck rules in GNU Automake 1.11.1, 1.10.3, ...)
        - automake 1:1.11-1
        TODO: check
        NOTE: it also affects every Makefile.in generated by automake
        NOTE: but it doesn't really affect Debian
        NOTE: http://lists.gnu.org/archive/html/automake/2009-12/msg00012.html
CVE-2009-4028 (The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x ...)
        - mysql-dfsg-5.1 5.1.41-1
        - mysql-dfsg-5.0 <removed>
        TODO: check
CVE-2009-4027 (Race condition in the mac80211 subsystem in the Linux kernel before ...)
        {DTSA-204-1}
        - linux-2.6 2.6.32-1 (medium)
        [etch] - linux-2.6 <not-affected> (introduced in 2.6.26)
        - linux-2.6.24 <not-affected> (introduced in 2.6.26)
CVE-2009-4026 (The mac80211 subsystem in the Linux kernel before ...)
        {DTSA-204-1}
        - linux-2.6 2.6.32-1 (medium)
        [etch] - linux-2.6 <not-affected> (introduced in 2.6.30)
        [lenny] - linux-2.6 <not-affected> (introduced in 2.6.30)
        - linux-2.6.24 <not-affected> (introduced in 2.6.30)
CVE-2009-4025 (Argument injection vulnerability in the traceroute function in ...)
        NOT-FOR-US: Net_Traceroute PEAR module
CVE-2009-4024 (Argument injection vulnerability in the ping function in Ping.php in ...)
        {DSA-1949-1}
        - php-net-ping 2.4.2-1.1 (medium)
        NOTE: fix applied by upstream is incomplete, reported to oss-sec
CVE-2009-4111 (Argument injection vulnerability in Mail/sendmail.php in the Mail ...)
        {DSA-1938-1}
        - php-mail 1.1.14-2 (medium; bug #557121)
        [lenny] - php-mail  1.1.14-1+lenny1
        [etch] - php-mail 1.1.6-2+etch1
CVE-2009-4023 (Argument injection vulnerability in the sendmail implementation of the ...)
        {DSA-1938-1}
        - php-mail 1.1.14-2 (medium; bug #557121)
        [lenny] - php-mail  1.1.14-1+lenny1
        [etch] - php-mail 1.1.6-2+etch1
CVE-2009-4022 (Unspecified vulnerability in ISC BIND 9.4 before 9.4.3-P4, 9.5 before ...)
        {DSA-1961-1}
        - bind9 1:9.6.1.dfsg.P2-1 (medium)
        NOTE: <https://www.isc.org/node/504>
        NOTE: Only affects installations with trust anchors, but then the
        NOTE: consequences are quite severe.
CVE-2009-4020 (Stack-based buffer overflow in the hfs subsystem in the Linux kernel ...)
        - linux-2.6 2.6.32-3 (medium)
        - linux-2.6.24 <removed> (medium)
CVE-2009-4019 (mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not ...)
        - mysql-dfsg-5.1 5.1.41-1
        - mysql-dfsg-5.0 <removed>
        TODO: check
        NOTE: http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
        NOTE: http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html
        NOTE: http://bugs.mysql.com/47780
        NOTE: http://bugs.mysql.com/48291
CVE-2009-4018 (The proc_open function in ext/standard/proc_open.c in PHP before ...)
        - php5 <unfixed> (unimportant)
        NOTE: safe_mode bypass
CVE-2005-4883 (Race condition in Philippe Jounin Tftpd32 before 2.80 allows remote ...)
        NOT-FOR-US: Tftpd32
CVE-2005-4882 (tftpd in Philippe Jounin Tftpd32 2.74 and earlier, as used in Wyse ...)
        NOT-FOR-US: Tftpd32
CVE-2009-4016
        RESERVED
CVE-2009-4015
        RESERVED
CVE-2009-4014
        RESERVED
CVE-2009-4013
        RESERVED
CVE-2009-4012
        RESERVED
CVE-2009-4011
        RESERVED
CVE-2009-4010
        RESERVED
CVE-2009-4009
        RESERVED
CVE-2009-4008
        RESERVED
CVE-2009-4007 (Unspecified vulnerability in the NormaliseTrainConsist function in ...)
        - openttd 0.7.5-1
        [lenny] - openttd <no-dsa> (Contrib not supported)
        TODO: next point update [lenny] - openttd 0.6.2-1+lenny1
CVE-2009-4006 (Stack-based buffer overflow in the TEA decoding algorithm in RhinoSoft ...)
        NOT-FOR-US: Serv-U FTP server
CVE-2009-4005 (The collect_rx_frame function in drivers/isdn/hisax/hfc_usb.c in the ...)
        - linux-2.6 2.6.32-1 (low)
        - linux-2.6.24 <removed> (low)
CVE-2009-4003
        RESERVED
CVE-2009-4002
        RESERVED
CVE-2009-4001
        RESERVED
CVE-2009-4000
        RESERVED
CVE-2009-3999
        RESERVED
CVE-2009-3998
        RESERVED
CVE-2009-3997 (Integer overflow in IN_MOD.DLL (aka the Module Decoder Plug-in) in ...)
        NOT-FOR-US: winamp
CVE-2009-3996 (Heap-based buffer overflow in IN_MOD.DLL (aka the Module Decoder ...)
        NOT-FOR-US: winamp
CVE-2009-3995 (Multiple heap-based buffer overflows in IN_MOD.DLL (aka the Module ...)
        NOT-FOR-US: winamp
CVE-2009-3994 (Stack-based buffer overflow in the GetUID function in ...)
        - devil 1.7.8-6 (low; bug #560080)
        [lenny] - devil <no-dsa> (Minor issue)
        [etch] - devil <no-dsa> (Minor issue)
CVE-2009-3993
        RESERVED
CVE-2009-3992
        RESERVED
CVE-2009-3991
        RESERVED
CVE-2009-3990
        RESERVED
CVE-2009-3989
        RESERVED
CVE-2009-3988
        RESERVED
CVE-2009-3987 (The GeckoActiveXObject function in Mozilla Firefox before 3.0.16 and ...)
        - xulrunner <not-affected> (Windows-specific vulnerability)
CVE-2009-3986 (Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey ...)
        {DSA-1956-1}
        - xulrunner 1.9.1.6-1
        [etch] - xulrunner <end-of-life> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3985 (Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey ...)
        {DSA-1956-1}
        - xulrunner 1.9.1.6-1
CVE-2009-3984 (Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey ...)
        {DSA-1956-1}
        - xulrunner 1.9.1.6-1
CVE-2009-3983 (Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey ...)
        {DSA-1956-1}
        - xulrunner 1.9.1.6-1
CVE-2009-3982 (Multiple unspecified vulnerabilities in the JavaScript engine in ...)
        - xulrunner 1.9.1.6-1
        [lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
CVE-2009-3981 (Unspecified vulnerability in the browser engine in Mozilla Firefox ...)
        {DSA-1956-1}
        - xulrunner 1.9.1
        NOTE: Only affects Firefox 3
CVE-2009-3980 (Multiple unspecified vulnerabilities in the browser engine in Mozilla ...)
        - xulrunner 1.9.1.6-1
        [lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
CVE-2009-3979 (Multiple unspecified vulnerabilities in the browser engine in Mozilla ...)
        {DSA-1956-1}
        - xulrunner 1.9.1.6-1
CVE-2009-3978 (The nsGIFDecoder2::GifWrite function in decoders/gif/nsGIFDecoder2.cpp ...)
        - xulrunner 1.9.1.5-1 (unimportant)
        NOTE: Browser crashes not treated as security issues
CVE-2009-3977 (Multiple buffer overflows in a certain ActiveX control in ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-3976 (Buffer overflow in Labtam ProFTP 2.9 allows remote FTP servers to ...)
        NOT-FOR-US: Labtam ProFTP 
CVE-2009-3975 (SQL injection vulnerability in index.php in Moa Gallery 1.1.0 and ...)
        NOT-FOR-US: Moa Gallery
CVE-2009-3974 (Multiple SQL injection vulnerabilities in Invision Power Board (IPB or ...)
        NOT-FOR-US: Invision Power Board
CVE-2009-3973 (SQL injection vulnerability in index.php in Turnkey Arcade Script ...)
        NOT-FOR-US: Turnkey Arcade Script
CVE-2009-3972 (SQL injection vulnerability in the Q-Proje Siirler Bileseni ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-3971 (SQL injection vulnerability in the jTips (com_jtips) component 1.0.7 ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-3970 (SQL injection vulnerability in index.php in PHP Dir Submit (aka ...)
        NOT-FOR-US: PHP Dir Submit
CVE-2009-3969 (Stack-based buffer overflow in Faslo Player 7.0 allows remote ...)
        NOT-FOR-US: Faslo Player
CVE-2009-3968 (Multiple SQL injection vulnerabilities in ITechBids 8.0 allow remote ...)
        NOT-FOR-US: ITechBids
CVE-2009-3967 (SQL injection vulnerability in browse.php in Ed Charkow SuperCharged ...)
        NOT-FOR-US: Ed Charkow SuperCharged Linking
CVE-2009-3966 (Arcade Trade Script 1.0 allows remote attackers to bypass ...)
        NOT-FOR-US: Arcade Trade Script
CVE-2009-3965 (SQL injection vulnerability in rating.php in New 5 star Rating 1.0 ...)
        NOT-FOR-US: New 5 star Rating
CVE-2009-3964 (SQL injection vulnerability in the NinjaMonials (com_ninjacentral) ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-3898 (Directory traversal vulnerability in ...)
        - nginx 0.7.63-1 (low; bug #557389)
        [etch] - nginx <no-dsa> (upload rights required)
        [lenny] - nginx <no-dsa> (upload rights required)
CVE-2009-3897 (Dovecot 1.2.x before 1.2.8 sets 0777 permissions during creation of ...)
        - dovecot 1:1.2.8-1 (medium; bug #557601)
        [lenny] - dovecot <not-affected> (Only affects 1.2.x)
        [etch] - dovecot <not-affected> (Only affects 1.2.x)
CVE-2009-4017 (PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number ...)
        {DSA-1940-1}
        - php5 5.2.11.dfsg.1-2 (medium)
        - php4 <removed> (medium)
        NOTE: workarounds include using 5.3.1 or php5-suhosin
        NOTE: 4B068517.802@acunetix.com on bugtraq explains it
CVE-2009-3080 (Array index error in the gdth_read_event function in ...)
        - linux-2.6 2.6.32-1 (medium)
        - linux-2.6.24 <removed> (medium)
        NOTE: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=690e744869f3262855b83b4fb59199cf142765b0
CVE-2009-4021 (The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in ...)
        - linux-2.6 2.6.32-1 (low)
        - linux-2.6.24 <removed> (low)
        NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=538734
CVE-2009-3963 (Multiple unspecified vulnerabilities in XOOPS before 2.4.0 Final have ...)
        NOT-FOR-US: XOOPS
CVE-2009-3962 (The management interface on the 2wire Gateway 1700HG, 1701HG, 1800HW, ...)
        NOT-FOR-US: 2wire Gateway
CVE-2009-3961 (SQL injection vulnerability in user.php in Super Serious Stats (aka ...)
        NOT-FOR-US: Super Serious Stats
CVE-2009-3960
        RESERVED
CVE-2009-3959
        RESERVED
CVE-2009-3958
        RESERVED
CVE-2009-3957
        RESERVED
CVE-2009-3956
        RESERVED
CVE-2009-3955
        RESERVED
CVE-2009-3954
        RESERVED
CVE-2009-3953
        RESERVED
CVE-2009-3952
        RESERVED
CVE-2009-3951 (Unspecified vulnerability in the Flash Player ActiveX control in Adobe ...)
        NOT-FOR-US: ActiveX
CVE-2009-3950 (Multiple cross-site scripting (XSS) vulnerabilities in Bractus ...)
        NOT-FOR-US: Bractus SunTrack
CVE-2009-3949 (cp/profile.php in VivaPrograms Infinity 2.0.5 and earlier does not ...)
        NOT-FOR-US: VivaPrograms Infinity
CVE-2009-3948 (JetAudio 7.5.3 COWON Media Center allows remote attackers to cause a ...)
        NOT-FOR-US: JetAudio
CVE-2009-3947 (Buffer overflow in the FTP service on the Tandberg MXP F7.0 allows ...)
        NOT-FOR-US: Tandberg MXP F7.0
CVE-2009-3946 (Joomla! before 1.5.15 allows remote attackers to read an extension's ...)
        NOT-FOR-US: Joomla!
CVE-2009-3945 (Unspecified vulnerability in the Front-End Editor in the com_content ...)
        NOT-FOR-US: component in Joomla!
CVE-2009-3944 (Research In Motion (RIM) BlackBerry Browser on the BlackBerry 8800 ...)
        NOT-FOR-US: BlackBerry Browser on the BlackBerry 8800
CVE-2009-3943 (Microsoft Internet Explorer 6 through 6.0.2900.2180 and 7 through ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3942 (Martin Lambers msmtp before 1.4.19, when OpenSSL is used, does not ...)
        - msmtp <not-affected> (uses GnuTLS and not OpenSSL; bug #557324) 
CVE-2009-3941 (Martin Lambers mpop before 1.0.19, when OpenSSL is used, does not ...)
        - mpop <not-affected> (uses GnuTLS and not OpenSSL; bug #557326)
CVE-2009-3940 (Unspecified vulnerability in Guest Additions in Sun xVM VirtualBox ...)
        - virtualbox-guest-additions 3.0.10-1
CVE-2009-3939 (The poll_mode_io file for the megaraid_sas driver in the Linux kernel ...)
        - linux-2.6 <unfixed> (low)
        [etch] - linux-2.6 <not-affected> (Vulnerable code not present)
        - linux-2.6.24 <removed> (low)
CVE-2009-4004 (Buffer overflow in the kvm_vcpu_ioctl_x86_setup_mce function in ...)
        - linux-2.6 2.6.32-1 (medium)
        [etch] - linux-2.6 <not-affected> (kvm introduced in 2.6.25)
        [lenny] - linux-2.6 <not-affected> (vulnerable code not present)
        - linux-2.6.24 <not-affected> (kvm introduced in 2.6.25)
        - kvm 88+dfsg-2 (medium; bug #557736)
        [lenny] - kvm <not-affected> (vulnerable code not present)
        NOTE: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=a9e38c3e01ad242fe2a625354cf065c34b01e3aa
CVE-2009-3937 (Memory leak in Solaris TCP sockets in Sun OpenSolaris snv_106 through ...)
        NOT-FOR-US: Sun OpenSolaris
CVE-2009-3936 (Unspecified vulnerability in Citrix Online Plug-in for Windows 11.0.x ...)
        NOT-FOR-US: Citrix Online Plug-in
CVE-2009-3935 (Multiple unspecified vulnerabilities in the Advanced Management Module ...)
        NOT-FOR-US: IBM BladeCenter
CVE-2009-3934 (The WebFrameLoaderClient::dispatchDidChangeLocationWithinPage function ...)
        - chromium-browser <itp> (low; bug #520324)
CVE-2009-3933 (WebKit before r50173, as used in Google Chrome before 3.0.195.32, ...)
        - webkit <not-affected> (chromium-specific issue in their timer)
        - qt4-x11 <not-affected> (chromium-specific issue in their timer)
        - kdelibs <not-affected> (chromium-specific issue in their timer)
        - kde4libs <not-affected> (chromium-specific issue in their timer)
        - chromium-browser <itp> (low; bug #520324)
CVE-2009-3932 (The Gears plugin in Google Chrome before 3.0.195.32 allows ...)
        - chromium-browser <itp> (low; bug #520324)
        - webkit <unfixed> (low; bug #560905)
        - qt4-x11 <undetermined> (bug #561760)
        [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        [lenny] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        - kdelibs <undetermined> (bug #561765)
        - kde4libs <undetermined> (bug #561762)
CVE-2009-3931 (Incomplete blacklist vulnerability in browser/download/download_exe.cc ...)
        - chromium-browser <itp> (low; bug #520324)
CVE-2009-3930 (Multiple integer overflows in Christos Zoulas file before 5.02 allow ...)
        - file 5.03-1
        [lenny] - file <not-affected>
        [etch] - file <not-affected>
CVE-2009-3929
        RESERVED
CVE-2009-3928
        RESERVED
CVE-2009-3927
        RESERVED
CVE-2009-3926
        RESERVED
CVE-2009-3925
        RESERVED
CVE-2009-XXXX [eglibc: ldd arbitrary code execution]
        - eglibc 2.10.1-7 (unimportant; bug #552518)
        - glibc <removed> (unimportant)
CVE-2009-XXXX [dansguardian: not blocking sites]
        - dansguardian <unfixed> (unimportant; bug #548108)
CVE-2009-3924 (Buffer overflow in pbsv.dll, as used in Soldier of Fortune II and ...)
        NOT-FOR-US: Soldier of Fortune
CVE-2009-3923 (The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop ...)
        NOT-FOR-US: Sun Virtual Desktop Infrastructure
CVE-2009-3922 (Multiple cross-site request forgery (CSRF) vulnerabilities in the User ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3921 (The Smartqueue_og module 5.x before 5.x-1.3 and 6.x before ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3920 (An administration page in the NGP COO/CWP Integration (crmngp) module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3919 (Cross-site scripting (XSS) vulnerability in the NGP COO/CWP ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3918 (Cross-site scripting (XSS) vulnerability in the Zoomify module 5.x ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3917 (Cross-site scripting (XSS) vulnerability in the S5 Presentation Player ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3916 (Cross-site scripting (XSS) vulnerability in the Node Hierarchy module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3915 (Cross-site scripting (XSS) vulnerability in the &quot;Separate title and ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3914 (Cross-site scripting (XSS) vulnerability in the Temporary Invitation ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3913 (SQL injection vulnerability in summary.php in Xerox Fiery Webtools ...)
        NOT-FOR-US: Xerox Fiery Webtools
CVE-2009-3912 (Directory traversal vulnerability in index.php in TFTgallery 0.13 ...)
        NOT-FOR-US: TFTgallery
CVE-2009-3911 (Cross-site scripting (XSS) vulnerability in settings.php in TFTgallery ...)
        NOT-FOR-US: TFTgallery
CVE-2009-3910
        RESERVED
CVE-2009-3909 (Integer overflow in the read_channel_data function in ...)
        - gimp 2.6.7-1.1 (medium; bug #556750)
        NOTE: http://secunia.com/secunia_research/2009-43/
CVE-2009-3908
        REJECTED
CVE-2009-3907
        REJECTED
CVE-2009-3906
        REJECTED
CVE-2009-3905 (Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS ...)
        NOT-FOR-US: e-Courier CMS
CVE-2009-3904 (classes/session/cc_admin_session.php in CubeCart 4.3.4 does not ...)
        NOT-FOR-US: CubeCart
CVE-2009-3903 (Multiple cross-site scripting (XSS) vulnerabilities in jspui/index.jsp ...)
        NOT-FOR-US: ManageEngine Netflow Analyzer 7.5 build 7500
CVE-2009-3902 (Directory traversal vulnerability in Cherokee Web Server 0.5.4 and ...)
        - cherokee <not-affected> (Only windows version is affected)
CVE-2009-3901 (Multiple cross-site scripting (XSS) vulnerabilities in e-Courier CMS ...)
        NOT-FOR-US: e-Courier CMS
CVE-2009-3900 (Unspecified vulnerability in the Cluster Management component in IBM ...)
        NOT-FOR-US: IBM PowerHA
CVE-2009-3899 (Memory leak in the Sockets Direct Protocol (SDP) driver in Sun Solaris ...)
        NOT-FOR-US: Sun Solaris
CVE-2009-3896 (src/http/ngx_http_parse.c in nginx (aka Engine X) 0.1.0 through ...)
        {DSA-1920-1}
        - nginx 0.7.62-1
CVE-2009-3895 (Heap-based buffer overflow in the exif_entry_fix function (aka the tag ...)
        - libexif 0.6.19-1 (medium; bug #557137)
        [lenny] - libexif <not-affected> (Only 0.6.18 is affected)
        [etch] - libexif <not-affected> (Only 0.6.18 is affected)
CVE-2009-3894 (Multiple untrusted search path vulnerabilities in dstat before 0.7.0 ...)
        - dstat 0.7.0-1 (low; bug #557989)
        [lenny] - dstat <no-dsa> (Minor issue)
        [etch] - dstat <no-dsa> (Minor issue)
        NOTE: http://svn.rpmforge.net/svn/trunk/tools/dstat/ChangeLog
CVE-2009-3893
        RESERVED
CVE-2009-3891 (Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in ...)
        - wordpress 2.8.6-1 (low)
        [etch] - wordpress <not-affected> (Vulnerable code not present)
        [lenny] - wordpress <not-affected> (Vulnerable code not present)
CVE-2009-3890 (Unrestricted file upload vulnerability in the wp_check_filetype ...)
        - wordpress 2.8.6-1 (low)
        [etch] - wordpress <not-affected> (Vulnerable code not present)
        [lenny] - wordpress <not-affected> (Vulnerable code not present)
CVE-2009-3889 (The dbg_lvl file for the megaraid_sas driver in the Linux kernel ...)
        - linux-2.6 2.6.27-1 (low)
        [etch] - linux-2.6 <not-affected> (Vulnerable code not present)
        - linux-2.6.24 <removed> (low)
CVE-2009-3888 (The do_mmap_pgoff function in mm/nommu.c in the Linux kernel before ...)
        - linux-2.6 <unfixed> (unimportant)
        - linux-2.6.24 <unfixed> (unimportant)
        NOTE: All Debian kernels have MMU support enabled
CVE-2009-3887
        RESERVED
CVE-2009-3886 (The Java Web Start implementation in Sun Java SE 6 before Update 17 ...)
        - openjdk-6 <unfixed> (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3885 (Sun Java SE 5.0 before Update 22 and 6 before Update 17 on Windows ...)
        - openjdk-6 <not-affected> (a problem in code that is unused on non-windows platforms)
        - sun-java6 <not-affected> (a problem in code that is unused on non-windows platforms)
        NOTE: https://bugzilla.redhat.com/show_bug.cgi?id=530114
CVE-2009-3884 (The TimeZone.getTimeZone method in Sun Java SE 5.0 before Update 22 ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3883 (Multiple unspecified vulnerabilities in the Windows Pluggable Look and ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3882 (Multiple unspecified vulnerabilities in the Swing implementation in ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3881 (Sun Java SE 5.0 before Update 22 and 6 before Update 17, and OpenJDK, ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3880 (The Abstract Window Toolkit (AWT) in Java Runtime Environment (JRE) in ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3879 (Multiple unspecified vulnerabilities in the (1) X11 and (2) ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3878 (Buffer overflow in Sun Java System Web Server 7.0 Update 6 has ...)
        NOT-FOR-US: Sun Java System Web Server
CVE-2009-3877 (Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3876 (Unspecified vulnerability in Sun Java SE in JDK and JRE 5.0 before ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3875 (The MessageDigest.isEqual function in Java Runtime Environment (JRE) ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3874 (Integer overflow in the JPEGImageReader implementation in the ImageI/O ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3873 (The JPEG Image Writer in Sun Java SE in JDK and JRE 5.0 before Update ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3872 (Unspecified vulnerability in the JPEG JFIF Decoder in Sun Java SE in ...)
        - openjdk-6 <unfixed> (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3871 (Heap-based buffer overflow in the setBytePixels function in the ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3869 (Stack-based buffer overflow in the setDiffICM function in the Abstract ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3868 (Sun Java SE in JDK and JRE 5.0 before Update 22, JDK and JRE 6 before ...)
        - openjdk-6 <unfixed> (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3867 (Stack-based buffer overflow in the HsbParser.getSoundBank function in ...)
        - openjdk-6 <unfixed> (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3866 (The Java Web Start Installer in Sun Java SE in JDK and JRE 6 before ...)
        - openjdk-6 <unfixed> (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3865 (The launch method in the Deployment Toolkit plugin in Java Runtime ...)
        - openjdk-6 <unfixed> (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3864 (The Java Update functionality in Java Runtime Environment (JRE) in Sun ...)
        TODO: check
CVE-2009-3863 (Buffer overflow in the gxmim1.dll ActiveX control in Novell Groupwise ...)
        NOT-FOR-US: ActiveX
CVE-2009-3862 (The NDSD process in Novell eDirectory 8.7.3 before 8.7.3.10 ftf2 and ...)
        NOT-FOR-US: Novell eDirectory
CVE-2009-3861 (Stack-based buffer overflow in SafeNet SoftRemote 10.8.5 (Build 2) and ...)
        NOT-FOR-US: SafeNet SoftRemote
CVE-2009-3860 (Multiple insecure method vulnerabilities in Idefense Labs COMRaider ...)
        NOT-FOR-US: Idefense Labs COMRaider
CVE-2009-3859 (Buffer overflow in eEye Retina WiFi Scanner 1.0.8.68, as used in ...)
        NOT-FOR-US: Retina Network Security Scanner
CVE-2009-3858 (Cross-site scripting (XSS) vulnerability in GejoSoft allows remote ...)
        NOT-FOR-US: GejoSoft
CVE-2009-3857 (Buffer overflow in Softonic International SciTE 1.72 allows ...)
        NOT-FOR-US: Softonic International SciTE
CVE-2009-3856 (Cross-site scripting (XSS) vulnerability in the default URI in news/ ...)
        NOT-FOR-US: Twilight CMS
CVE-2009-3855 (Multiple unspecified vulnerabilities in the (1) UNIX and (2) Linux ...)
        NOT-FOR-US: IBM Tivoli Storage Manager
CVE-2009-3854 (Buffer overflow in the traditional client scheduler in the client in ...)
        NOT-FOR-US: IBM Tivoli Storage Manager
CVE-2009-3853 (Stack-based buffer overflow in the client acceptor daemon (CAD) ...)
        NOT-FOR-US: IBM Tivoli Storage Manager
CVE-2009-3852 (Unspecified vulnerability in the XML component in IBM Runtimes for ...)
        NOT-FOR-US: IBM Runtimes for Java Technology 5.0.0 
CVE-2009-3851 (Trusted Extensions in Sun Solaris 10 interferes with the operation of ...)
        NOT-FOR-US: Sun Solaris 10
CVE-2009-3850 (Blender 2.34, 2.35a, 2.40, and 2.49b allows remote attackers to ...)
        - blender <unfixed> (unimportant)
        NOTE: attack vector is social engineering to get the user to open
        NOTE: a malicious .blend file.  by design, blend files support
        NOTE: all python operations, so ultimately any code can be executed
CVE-2009-3849 (Multiple stack-based buffer overflows in HP OpenView Network Node ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-3848 (Stack-based buffer overflow in nnmRptConfig.exe in HP OpenView Network ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-3847 (Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-3846 (Multiple heap-based buffer overflows in ovlogin.exe in HP OpenView ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-3845 (The port-3443 HTTP server in HP OpenView Network Node Manager (OV NNM) ...)
        NOT-FOR-US: HP OpenView Network Node Manager
CVE-2009-3844 (Stack-based buffer overflow in the OmniInet process in HP OpenView ...)
        NOT-FOR-US: HP OpenView Data Protector Application
CVE-2009-3843 (HP Operations Manager 8.10 on Windows contains a &quot;hidden account&quot; in ...)
        NOT-FOR-US: HP Operations Manager
CVE-2009-3842 (Unspecified vulnerability on the HP Color LaserJet M3530 Multifunction ...)
        NOT-FOR-US: HP Color LaserJet
CVE-2009-3841 (Unspecified vulnerability in HP Discovery &amp; Dependency Mapping ...)
        NOT-FOR-US: HP Discovery & Dependency Mapping
CVE-2009-3840 (The embedded database engine service (aka ovdbrun.exe) in HP OpenView ...)
        NOT-FOR-US: HP OpenView
CVE-2009-3839 (Unspecified vulnerability in the Solaris Trusted Extensions Policy ...)
        NOT-FOR-US: Sun Solaris
CVE-2009-3838 (Stack-based buffer overflow in Pegasus Mail (PMail) 4.41 and possibly ...)
        NOT-FOR-US: Pegasus Mail
CVE-2009-3837 (Stack-based buffer overflow in Eureka Email 2.2q allows remote POP3 ...)
        NOT-FOR-US: Eureka Email
CVE-2009-3836 (ArubaOS 3.3.1.x, 3.3.2.x, RN 3.1.x, 3.4.x, and 3.3.2.x-FIPS on the ...)
        NOT-FOR-US: ArubaOS
CVE-2009-3835 (SQL injection vulnerability in the JShop (com_jshop) component for ...)
        NOT-FOR-US: Joomla
CVE-2009-3834 (SQL injection vulnerability in the Photoblog (com_photoblog) component ...)
        NOT-FOR-US: Joomla
CVE-2009-3833 (Cross-site scripting (XSS) vulnerability in index.php in TFTgallery ...)
        NOT-FOR-US: TFTgallery
CVE-2009-3832 (Opera before 10.01 on Windows does not prevent use of Web fonts in ...)
        NOT-FOR-US: Opera
CVE-2009-3831 (Opera before 10.01 allows remote attackers to execute arbitrary code ...)
        NOT-FOR-US: Opera
CVE-2009-3830 (The download functionality in Team Services in Microsoft Office ...)
        NOT-FOR-US: Microsoft
CVE-2009-3829 (Integer overflow in wiretap/erf.c in Wireshark before 1.2.2 allows ...)
        {DSA-1942-1}
        - wireshark 1.2.2-1 (bug #553583)
CVE-2009-3828 (The web interface for Everfocus EDR1600 DVR allows remote attackers to ...)
        NOT-FOR-US: Everfocus EDR1600 DVR
CVE-2009-3827
        RESERVED
CVE-2009-3826 (Multiple buffer overflows in squidGuard 1.4 allow remote attackers to ...)
        - squidguard <unfixed> (low; bug #553319)
CVE-2009-3825 (Multiple directory traversal vulnerabilities in GenCMS 2006 allow ...)
        NOT-FOR-US: GenCMS
CVE-2009-3824 (Directory traversal vulnerability in include/processor.php in ...)
        NOT-FOR-US: Greenwood PHP Content Manager
CVE-2009-3823 (Directory traversal vulnerability in myhtml.php in Mobilelib GOLD 3.0, ...)
        NOT-FOR-US: Mobilelib GOLD 
CVE-2009-3822 (PHP remote file inclusion vulnerability in Fiji Web Design Ajax Chat ...)
        NOT-FOR-US: com_ajaxchat component for Joomla
CVE-2009-3821 (Cross-site scripting (XSS) vulnerability in the Apache Solr Search ...)
        NOT-FOR-US: Apache Solr Search extension for TYPO3
CVE-2009-3820 (SQL injection vulnerability in the Flagbit Filebase (fb_filebase) ...)
        NOT-FOR-US: Flagbit Filebase extension for TYPO3
CVE-2009-3819 (Unspecified vulnerability in the Random Images (maag_randomimage) ...)
        NOT-FOR-US: Random Images extension for TYPO3
CVE-2009-3818 (Unspecified vulnerability in the session handling feature in freeCap ...)
        NOT-FOR-US: freeCap CAPTCHA for TYPO3
CVE-2009-3817 (PHP remote file inclusion vulnerability in doc/releasenote.php in the ...)
        NOT-FOR-US: com_booklibrary component for Joomla!
CVE-2009-3816 (Multiple cross-site scripting (XSS) vulnerabilities in Activities ...)
        NOT-FOR-US: IBM Lotus Connections
CVE-2009-3815 (RunCMS 2M1, when running with certain error_reporting levels, allows ...)
        NOT-FOR-US: RunCMS 2M1
CVE-2009-3814 (Static code injection vulnerability in RunCMS 2M1 allows remote ...)
        NOT-FOR-US: RunCMS 2M1
CVE-2009-3813 (Multiple SQL injection vulnerabilities in RunCMS 2M1 allow remote ...)
        NOT-FOR-US: RunCMS 2M1
CVE-2009-3812 (Heap-based buffer overflow in OtsAV DJ trial version 1.85.64.0, Radio ...)
        NOT-FOR-US: OtsAV products
CVE-2009-3811 (Stack-based buffer overflow in Music Tag Editor 1.61 build 212 allows ...)
        NOT-FOR-US: Music Tag Editor
CVE-2009-3810 (Heap-based buffer overflow in Acoustica MP3 Audio Mixer 2.471 allows ...)
        NOT-FOR-US: Acoustica MP3 Audio Mixer
CVE-2009-3809 (Acoustica MP3 Audio Mixer 1.0 and possibly 2.471 allows remote ...)
        NOT-FOR-US: Acoustica MP3 Audio Mixer
CVE-2009-3808 (MixSense DJ Studio 1.0.0.1 allows remote attackers to cause a denial ...)
        NOT-FOR-US: MixSense DJ Studio
CVE-2009-3807 (Stack-based buffer overflow in MixVibes 7.043 Pro allows remote ...)
        NOT-FOR-US: MixVibes
CVE-2009-3806 (SQL injection vulnerability in feedback_js.php in DedeCMS 5.1 allows ...)
        NOT-FOR-US: DedeCMS
CVE-2009-3805 (gpg2.exe in Gpg4win 2.0.1, as used in KDE Kleopatra 2.0.11, allows ...)
        NOT-FOR-US: Gpg4win
        NOTE: looks like an issue in gpg2 for windows (gpg4win.org), not specific
        NOTE: to kleopatra
CVE-2009-3804 (Multiple SQL injection vulnerabilities in modules/forum/post.php in ...)
        NOT-FOR-US: RunCMS 2M1
CVE-2009-3803 (Multiple cross-site scripting (XSS) vulnerabilities in Amiro.CMS ...)
        NOT-FOR-US: Amiro.CMS
CVE-2009-3802 (Amiro.CMS 5.4.0.0 and earlier allows remote attackers to obtain ...)
        NOT-FOR-US: Amiro.CMS
CVE-2009-3801 (SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows ...)
        NOT-FOR-US: OpenDocMan
CVE-2009-XXXX [multiple missing input sanity checks in KDE]
        - kdelibs <unfixed> (low)
        - kde4libs 4:4.3.4-1 (low)
        [lenny] - kdelibs <no-dsa> (minor and unlikely to be exploited)
        [etch] - kdelibs <no-dsa> (minor and unlikely to be exploited)
        NOTE: http://www.ocert.org/advisories/ocert-2009-015.html
        NOTE: http://www.portcullis-security.com/advisories
        NOTE: advisory mentions kmail and ark (from kdepim and kdeutils, respectively)
        NOTE: but the "fixes" linked from the advisory only change code in kdelibs
        NOTE: more info at oss-sec threads
CVE-2009-3800 (Multiple unspecified vulnerabilities in Adobe Flash Player before ...)
        NOT-FOR-US: Adobe Flash Player
CVE-2009-3799 (Integer overflow in the Verifier::parseExceptionHandlers function in ...)
        NOT-FOR-US: Adobe Flash Player
CVE-2009-3798 (Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might ...)
        NOT-FOR-US: Adobe Flash Player
CVE-2009-3797 (Adobe Flash Player 10.x before 10.0.42.34 and Adobe AIR before 1.5.3 ...)
        NOT-FOR-US: Adobe Flash Player
CVE-2009-3796 (Adobe Flash Player before 10.0.42.34 and Adobe AIR before 1.5.3 might ...)
        NOT-FOR-US: Adobe Flash Player
CVE-2009-3795
        RESERVED
CVE-2009-3794 (Heap-based buffer overflow in Adobe Flash Player before 10.0.42.34 and ...)
        NOT-FOR-US: Adobe Flash Player
CVE-2009-3793
        RESERVED
CVE-2009-3792 (Directory traversal vulnerability in Adobe Flash Media Server (FMS) ...)
        NOT-FOR-US: Adobe Flash Media Server
CVE-2009-3791 (Unspecified vulnerability in Adobe Flash Media Server (FMS) before ...)
        NOT-FOR-US: Adobe Flash Media Server
CVE-2009-3790 (Heap-based buffer overflow in FormMax (formerly AcroForm) evaluation ...)
        NOT-FOR-US: FormMax
CVE-2009-3789 (Multiple cross-site scripting (XSS) vulnerabilities in OpenDocMan ...)
        NOT-FOR-US: OpenDocMan
CVE-2009-3788 (SQL injection vulnerability in index.php in OpenDocMan 1.2.5 allows ...)
        NOT-FOR-US: OpenDocMan
CVE-2009-3787 (files.php in Vivvo CMS 4.1.5.1 allows remote attackers to conduct ...)
        NOT-FOR-US: Vivvo CMS
CVE-2009-3786 (Cross-site scripting (XSS) vulnerability in Organic Groups (OG) ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3785 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3784 (Open redirect vulnerability in Simplenews Statistics 6.x before ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3783 (Cross-site scripting (XSS) vulnerability in Simplenews Statistics 6.x ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3782 (Unspecified vulnerability in Userpoints 6.x before 6.x-1.1, a module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3781 (The filefield_file_download function in FileField 6.x-3.1, a module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3780 (Cross-site scripting (XSS) vulnerability in Abuse 5.x before 5.x-2.1 ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3779 (Cross-site scripting (XSS) vulnerability in vCard 5.x before 5.x-1.4 ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3778 (SQL injection vulnerability in Moodle Course List 6.x before 6.x-1.2, ...)
        NOT-FOR-US: module for Drupal
CVE-2009-XXXX [NULL dereferences, similar to Adobe's CVE-2009-0658]
        - ghostscript <unfixed> (unimportant)
        - gs-gpl <removed> (unimportant)
        - xpdf <unfixed> (unimportant)
CVE-2009-XXXX [multiple vulnerabilities in acidbase; XSS + possible sql injection]
        - acidbase 1.4.4-1 (bug #552235)
CVE-2009-XXXX [multiple vulnerabilities in jetty]
        - jetty <unfixed> (unimportant; bug #553644)
        NOTE: http://www.ush.it/team/ush/hack-jetty6x7x/jetty-adv.txt
        NOTE: The affected apps are not shipped in the package, see #553644
CVE-2009-XXXX [cherokee 0.5.4 DoS]
        - cherokee <not-affected> (not reproducible)
        NOTE: <4089.110.37.64.157.1256562313.squirrel@mail.xc0re.net> in bugtraq
        NOTE: not reproducible in etch's 0.5.5 nor sid's 0.99.22-1.1
CVE-2009-3777
        RESERVED
CVE-2009-3776
        RESERVED
CVE-2009-3775
        RESERVED
CVE-2009-3774
        RESERVED
CVE-2009-3773
        RESERVED
CVE-2009-3772
        RESERVED
CVE-2009-3771
        RESERVED
CVE-2009-3770
        RESERVED
CVE-2009-3769
        RESERVED
CVE-2009-3768
        RESERVED
CVE-2009-3767 (libraries/libldap/tls_o.c in OpenLDAP, when OpenSSL is used, does not ...)
        {DSA-1943-1}
        - openldap 2.4.17-2.1 (low; bug #553432)
        - openldap2.3 <removed>
CVE-2009-3766 (mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when ...)
        - mutt <not-affected> (uses GnuTLS and not OpenSSL)
        NOTE: our mutt is linked against gnutls, bug #553433
CVE-2009-3765 (mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not ...)
        - mutt <not-affected> (uses GnuTLS and not OpenSSL)
        NOTE: our mutt is linked against gnutls
CVE-2009-3764
        RESERVED
CVE-2009-3763
        RESERVED
CVE-2009-3762
        RESERVED
CVE-2009-3761
        RESERVED
CVE-2009-3760 (Static code injection vulnerability in config/writeconfig.php in the ...)
        NOT-FOR-US: Citrix XenCenterWeb
CVE-2009-3759 (Multiple cross-site request forgery (CSRF) vulnerabilities in sample ...)
        NOT-FOR-US: Citrix XenCenterWeb
CVE-2009-3758 (SQL injection vulnerability in login.php in sample code in the ...)
        NOT-FOR-US: Citrix XenCenterWeb
CVE-2009-3757 (Multiple cross-site scripting (XSS) vulnerabilities in sample code in ...)
        NOT-FOR-US: Citrix XenCenterWeb
CVE-2009-3756 (phpBMS 0.96 allows remote attackers to obtain sensitive information ...)
        NOT-FOR-US: phpBMS
CVE-2009-3755 (Multiple cross-site scripting (XSS) vulnerabilities in phpBMS 0.96 ...)
        NOT-FOR-US: phpBMS
CVE-2009-3754 (Multiple SQL injection vulnerabilities in phpBMS 0.96 allow remote ...)
        NOT-FOR-US: phpBMS
CVE-2009-3753 (Unrestricted file upload vulnerability in Opial 1.0 allows remote ...)
        NOT-FOR-US: Opial
CVE-2009-3752 (SQL injection vulnerability in home.php in Opial 1.0 allows remote ...)
        NOT-FOR-US: Opial
CVE-2009-3751 (Cross-site scripting (XSS) vulnerability in home.php in Opial 1.0 ...)
        NOT-FOR-US: Opial
CVE-2009-3750 (SQL injection vulnerability in read.php in ToyLog 0.1 allows remote ...)
        NOT-FOR-US: ToyLog
CVE-2009-3749 (The Web Administrator service (STEMWADM.EXE) in Websense Personal ...)
        NOT-FOR-US: Websense Personal Email Manager
CVE-2009-3748 (Multiple cross-site scripting (XSS) vulnerabilities in the Web ...)
        NOT-FOR-US: Websense Personal Email Manager
CVE-2009-3747 (Cross-site scripting (XSS) vulnerability in index.php in TBmnetCMS 1.0 ...)
        NOT-FOR-US: TBmnetCMS
CVE-2009-3746 (XScreenSaver in Sun Solaris 10, when the accessibility feature is ...)
        NOT-FOR-US: XScreenSaver in Sun Solaris 10
CVE-2009-3745 (Cross-site scripting (XSS) vulnerability in the help pages in IBM ...)
        NOT-FOR-US: IBM Rational AppScan Enterprise Edition
CVE-2009-3744 (rep_serv.exe 6.3.1.3 in the server in EMC RepliStor allows remote ...)
        NOT-FOR-US: EMC RepliStor
CVE-2009-3743
        RESERVED
CVE-2009-3742
        RESERVED
CVE-2009-3741
        RESERVED
CVE-2009-3740
        RESERVED
CVE-2009-3739
        RESERVED
CVE-2009-3738
        RESERVED
CVE-2009-3737
        RESERVED
CVE-2009-3736 (ltdl.c in libltdl in GNU Libtool 1.5.x, and 2.2.6 before 2.2.6b, ...)
        {DSA-1958-1}
        - libtool 2.2.6b-1 (low; bug #559797)
        - arts <unfixed> (low; bug #559798)
        [lenny] - arts <no-dsa> (Minor issue)
        [etch] - arts <no-dsa> (Minor issue)
        - bochs <not-affected> (additional hardening in this package prevents this type of attack; bug #559799)
        - camserv <unfixed> (low; bug #559800)
        [lenny] - camserv <no-dsa> (Minor issue)
        [etch] - camserv <no-dsa> (Minor issue)
        - collectd 4.8.2-1 (low; bug #559801)
        [lenny] - collectd <no-dsa> (Minor issue)
        [etch] - collectd <no-dsa> (Minor issue)
        - cvsnt <unfixed> (low; bug #559803)
        [etch] - cvsnt <no-dsa> (Minor issue)
        [lenny] - cvsnt <no-dsa> (Minor issue)
        - ggobi 2.1.9~20091212-1 (low; bug #559806)
        [etch] - ggobi <no-dsa> (Minor issue)
        [lenny] - ggobi <no-dsa> (Minor issue)
        - gnash <unfixed> (low; bug #559808)
        [lenny] - gnash <no-dsa> (Minor issue)
        - gnu-smalltalk 3.1-2 (low; bug #559809)
        [lenny] - gnu-smalltalk <no-dsa> (Minor issue)
        [etch] - gnu-smalltalk <no-dsa> (Minor issue)
        - graphicsmagick 1.3.5-6 (low; bug #559811)
        [lenny] - graphicsmagick <no-dsa> (Minor issue, can be fixed along with later updates)
        [etch] - graphicsmagick <no-dsa> (Minor issue, can be fixed along with later updates)
        - guile-1.6 1.6.8-7 (low; bug #559813)
        [etch] - guile-1.6 <no-dsa> (Minor issue)
        [lenny] - guile-1.6 <no-dsa> (Minor issue)
        - hamlib <unfixed> (low; bug #559814)
        [lenny] - hamlib <no-dsa> (Minor issue)
        [etch] - hamlib <no-dsa> (Minor issue)
        - hercules <unfixed> (low; bug #559815)
        [lenny] - hercules <no-dsa> (Minor issue)
        [etch] - hercules <no-dsa> (Minor issue)
        - jags 1.0.4-1 (low; bug #559816)
        - kdelibs <not-affected> (dl_open open loads from fixed paths)
        - libannodex <removed> (low; bug #559818)
        [lenny] - libannodex <no-dsa> (Minor issue)
        [etch] - libannodex <no-dsa> (Minor issue)
        - libextractor 0.5.23+dfsg-4 (low; bug #559819)
        [etch] - libextractor <no-dsa> (Minor issue)
        [lenny] - libextractor <no-dsa> (Minor issue)
        - libmcrypt <not-affected> (not included in any of the binary packages; bug #559820)
        - libtunepimp <unfixed> (low; bug #559821)
        - mp4h <unfixed> (low; bug #559822)
        [etch] - mp4h <no-dsa> (Minor issue)
        [lenny] - mp4h <no-dsa> (Minor issue)
        - naim <removed> (low; bug #559823)
        [lenny] - naim <no-dsa> (Minor issue)
        [etch] - naim <no-dsa> (Minor issue)
        - parser-mysql <unfixed> (low; bug #559824)
        - pinball <unfixed> (low; bug #559825)
        [lenny] - pinball <no-dsa> (Minor issue)
        [etch] - pinball <no-dsa> (Minor issue)
        TODO: insufficient solution: only added depends libltdl-dev?
        - redland 1.0.10-1 (low; bug #559826)
        [etch] - redland <not-affected> (Versions prior to 1.0.9 don't use libtool/libltdl)
        [lenny] - redland <not-affected> (Versions prior to 1.0.9 don't use libtool/libltdl)
        - siproxd <unfixed> (low; bug #559827)
        [lenny] - siproxd <no-dsa> (Minor issue)
        [etch] - siproxd <no-dsa> (Minor issue)
        - ski <unfixed> (low; bug #559828)
        - synfig <unfixed> (low; bug #559829)
        [lenny] - synfig <no-dsa> (Minor issue)
        - xmlsec1 1.2.14-1 (unimportant; bug #559831)
        NOTE: Embedded code copy isn't used
        - clamav 0.95+dfsg-1 (low; bug #559832)
        [lenny] - clamav <no-dsa> (Minor issue)
        [etch] - clamav <no-dsa> (Minor issue)
        - imagemagick 6:6.2.3.1-1 (low; bug #559833)
        [lenny] - imagemagick <no-dsa> (Minor issue)
        [etch] - imagemagick <no-dsa> (Minor issue)
        - hypre 2.4.0b-5 (low; bug #559834)
        [etch] - hypre <no-dsa> (Minor issue)
        [lenny] - hypre <no-dsa> (Minor issue)
        - lam <unfixed> (low; bug #559835)
        [lenny] - lam <no-dsa> (Minor issue)
        [etch] - lam <no-dsa> (Minor issue)
        - openmpi 1.3.3-4 (low; bug #559836)
        [lenny] - openmpi <no-dsa> (Minor issue)
        [etch] - openmpi <no-dsa> (Minor issue)
        - parser <unfixed> (unimportant; bug #559837)
        NOTE: users with write access can modify configuration to load new extensions, see #559837
        - pdsh <not-affected> (Only loads from /usr/lib/pdsh, which is controlled by root)
        - sbnc <not-affected> (All released/unstable versions use the system copy of libtool)
        - sdcc <unfixed> (low; bug #559840)
        [lenny] - sdcc <no-dsa> (Minor issue)
        [etch] - sdcc <no-dsa> (Minor issue)
        - wml <unfixed> (low; bug #559841)
        [lenny] - wml <no-dsa> (Minor issue)
        [etch] - wml <no-dsa> (Minor issue)
        - proftpd-dfsg <not-affected> (Only loads from /usr/lib/proftpd)
        - babel 1.4.0.dfsg-5 (low; bug #559843)
        TODO: insufficient solution: only added depends libltdl-dev?
        [lenny] - babel <no-dsa> (Minor issue)
        - libprelude 0.9.14-2 (low; bug #559844)
        [etch] - libprelude <no-dsa> (Minor issue)
        - heartbeat 2.1.4-7 (unimportant; bug #559845)
        NOTE: the dlopened path is always below /usr/lib/heartbeat, which isn't under control of an attacker
        NOTE: From Squeeze onwards the system copy of ltdl is used, use the current version from Squeeze,
        NOTE: might've been fixed earlier
CVE-2009-3735
        RESERVED
CVE-2009-3734
        RESERVED
CVE-2009-XXXX [mandos 0600 file being included in initrd]
        - mandos 1.0.13-1 (bug #551907)
CVE-2009-3733 (Directory traversal vulnerability in VMware Server 1.x before 1.0.10 ...)
        - vmware-package <removed>
CVE-2009-3732
        RESERVED
CVE-2009-3731 (Multiple cross-site scripting (XSS) vulnerabilities in WebWorks Help ...)
        TODO: check
CVE-2009-3730 (Multiple cross-site scripting (XSS) vulnerabilities in the ReqWeb Help ...)
        NOT-FOR-US: ReqWeb
CVE-2009-3729 (Unspecified vulnerability in the TrueType font parsing functionality ...)
        - openjdk-6 <unfixed> (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3728 (Directory traversal vulnerability in the ICC_Profile.getInstance ...)
        - openjdk-6 6b17~pre3-1 (medium; bug #560908)
        - sun-java6 6-17-1
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
CVE-2009-3727 (Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.3, ...)
        {DSA-1952-1}
        - asterisk 1:1.6.2.0~rc6-1
        [lenny] - asterisk <no-dsa> (Minor issue)
        [etch] - asterisk <no-dsa> (Minor issue)
CVE-2009-3726 (The nfs4_proc_lock function in fs/nfs/nfs4proc.c in the NFSv4 client ...)
        - linux-2.6 2.6.31-1 (medium)
        - linux-2.6.24 <removed> (medium)
CVE-2009-3725 (The connector layer in the Linux kernel before 2.6.31.5 does not ...)
        - linux-2.6 2.6.31-1 (medium)
        [etch] - linux-2.6 <not-affected> (Vulnerable code not present)
        - linux-2.6.24 <removed> (medium)
CVE-2009-3724
        RESERVED
        NOT-FOR-US: python-markdown2 (not our markdown, different code base)
CVE-2009-3723 [Unauthorized calls allowed on prohibited networks in asterisk]
        RESERVED
        [etch] - asterisk <not-affected>
        [lenny] - asterisk <not-affected>
        - asterisk 1:1.6.2.0~rc3-2 (medium; bug #552756)
        NOTE: http://downloads.asterisk.org/pub/security/AST-2009-007.html
CVE-2009-3722 (The handle_dr function in arch/x86/kvm/vmx.c in the KVM subsystem in ...)
        {DSA-1962-1}
        [etch] - linux-2.6 <not-affected> (issue introduced in 2.6.30-rc1)
        [lenny] - linux-2.6 <not-affected> (issue introduced in 2.6.30-rc1)
        - linux-2.6 2.6.31-1 (low)
        - kvm 88+dfsg-2 (low; bug #557739)
        NOTE: http://bugzilla.redhat.com/531660
        NOTE: http://git.kernel.org/linus/0a79b009525b160081d75cef5dbf45817956acf2
CVE-2009-3721
        RESERVED
CVE-2009-3720 (The updatePosition function in lib/xmltok_impl.c in libexpat in Expat ...)
        {DSA-1921-1}
        - expat 2.0.1-5 (low; bug #551936)
        - w3c-libwww <removed> (low; bug #551938)
        [etch] - w3c-libwww <no-dsa> (Minor issue, only used by fringe apps)
        - python-xml <removed> (low; bug #560951)
        [etch] - python-xml <no-dsa> (minor issue)
        [lenny] - python-xml <no-dsa> (minor issue)
        - python2.5 <unfixed> (low; bug #560912)
        - python2.4 <unfixed> (low; bug #560913)
        - python-4suite <unfixed> (low; bug #560914)
        [etch] - python-4suite <no-dsa> (Minor issue)
        [lenny] - python-4suite <no-dsa> (Minor issue)
        - wxwindows2.4 <removed> (low; bug #560915)
        [etch] - wxwindows2.4 <no-dsa> (minor issue)
        - wxwidgets2.6 2.6.3.2.2-4 (low; bug #560916)
        [etch] - wxwidgets2.6 <no-dsa> (minor issue)
        [lenny] - wxwidgets2.6 <no-dsa> (minor issue)
        - wxwidgets2.8 2.8.10.1-2 (low; bug #560917)
        [lenny] - wxwidgets2.8 <no-dsa> (minor issue)
        - audacity 1.3.2-1 (unimportant; bug #560919)
        - matanza <unfixed> (unimportant; bug #560920)
        - tdom 0.8.3~20080525-1 (low; bug #560921)
        [etch] - tdom <no-dsa> (minor issue)
        - udunits 2.1.8-4 (unimportant; bug #560922)
        - ayttm 0.6.1-2 (low; bug #560924)
        [etch] - ayttm <no-dsa> (minor issue)
        [lenny] - ayttm <no-dsa> (minor issue)
        - cableswig <unfixed> (unimportant; bug #560925)
        - cadaver <unfixed> (unimportant; bug #560926)
        - cmake 2.6.0-6 (unimportant; bug #560927)
        - coin3 <unfixed> (unimportant; bug #560928)
        - gdcm 2.0.14-2 (low; bug #560929)
        - ghostscript <unfixed> (unimportant; bug #560930)
        - gs-gpl <removed> (unimportant)
        - grmonitor <removed> (unimportant; bug #560931)
        - iceape <unfixed> (unimportant; bug #560932)
        - insighttoolkit 3.16.0-1 (unimportant; bug #560933)
        - paraview <unfixed> (unimportant; bug #560935)
        - poco <unfixed> (unimportant; bug #560936)
        - simgear <unfixed> (unimportant; bug #560937)
        - smart <unfixed> (low; bug #560953)
        [etch] - smart <no-dsa> (minor issue)
        [lenny] - smart <no-dsa> (minor issue)
        - swish-e <unfixed> (low; bug #560939)
        [etch] - swish-e <no-dsa> (minor issue)
        [lenny] - swish-e <no-dsa> (minor issue)
        - tla <unfixed> (low; bug #560940)
        [etch] - tla <no-dsa> (minor issue)
        [lenny] - tla <no-dsa> (minor issue)
        - wbxml2 <unfixed> (low; bug #560941)
        [etch] - wbxml2 <no-dsa> (minor issue)
        [lenny] - wbxml2 <no-dsa> (minor issue)
        - xmlrpc-c <unfixed> (low; bug #560942)
        [etch] - xmlrpc-c <no-dsa> (minor issue)
        [lenny] - xmlrpc-c <no-dsa> (minor issue)
        - iceweasel <not-affected> (uses xulrunner; bug #560943)
        - kompozer 1:0.8~b1-2 (unimportant; bug #560944)
        - vxl 1.13.0-2 (low; bug #560945)
        - xulrunner <unfixed> (unimportant; bug #560946)
        - texlive-bin <not-affected> (Files are not compiled in, see #560948)
        - vnc4 <unfixed> (low; bug #560949)
        [etch] - vnc4 <no-dsa> (minor issue)
        [lenny] - vnc4 <no-dsa> (minor issue)
        - xotcl <unfixed> (low; bug #560950)
        [lenny] - xotcl <no-dsa> (minor issue)
CVE-2009-3719 (Cross-site scripting (XSS) vulnerability in comment.asp in Battle Blog ...)
        NOT-FOR-US: Battle Blog
CVE-2009-3718 (SQL injection vulnerability in admin/authenticate.asp in Battle Blog ...)
        NOT-FOR-US: Battle Blog
CVE-2009-3717 (Heap-based buffer overflow in LucVil PatPlayer 3.9 allows remote ...)
        NOT-FOR-US: LucVil PatPlayer
CVE-2009-3716 (Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 ...)
        NOT-FOR-US: MCshoutbox
CVE-2009-3715 (Multiple SQL injection vulnerabilities in scr_login.php in MCshoutbox ...)
        NOT-FOR-US: MCshoutbox
CVE-2009-3714 (Cross-site scripting (XSS) vulnerability in admin_login.php in ...)
        NOT-FOR-US: MCshoutbox
CVE-2009-3713 (SQL injection vulnerability in fichero.php in MorcegoCMS 1.7.6 and ...)
        NOT-FOR-US: MorcegoCMS
CVE-2009-3712 (Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote ...)
        NOT-FOR-US: Ebay Clone 2009
CVE-2009-3711 (Stack-based buffer overflow in the h_handlepeer function in http.cpp ...)
        NOT-FOR-US: httpdx
CVE-2009-3710 (RioRey RIOS 4.6.6 and 4.7.0 uses an undocumented, hard-coded username ...)
        NOT-FOR-US: RioRey RIOS
CVE-2009-3709 (Stack-based buffer overflow in the Meta Content Optimizer in Konae ...)
        NOT-FOR-US: Konae Technologies Alleycode HTML Editor
CVE-2009-3708 (Stack-based buffer overflow in the Meta Content Optimizer in Konae ...)
        NOT-FOR-US: Konae Technologies Alleycode HTML Editor
CVE-2009-3707 (VMware Authentication Daemon 1.0 in vmware-authd.exe 6.5.3.8888 in the ...)
        NOT-FOR-US: VMware
CVE-2009-3706 (Unspecified vulnerability in the ZFS filesystem in Sun Solaris 10, and ...)
        NOT-FOR-US: ZFS filesystem in Sun Solaris
CVE-2009-3705 (PHP remote file inclusion vulnerability in debugger.php in Achievo ...)
        NOT-FOR-US: Achievo
CVE-2009-3704 (ZoIPer 2.22, and possibly other versions before 2.24 Library 5324, ...)
        NOT-FOR-US: ZoIPer
CVE-2009-3703 (Multiple SQL injection vulnerabilities in the WP-Forum plugin before ...)
        NOT-FOR-US: WordPress plugin
CVE-2009-3702 (Multiple absolute path traversal vulnerabilities in PHP-Calendar 1.1 ...)
        NOT-FOR-US: PHP-Calendar
CVE-2009-3701 (Multiple cross-site scripting (XSS) vulnerabilities in the ...)
        - horde3 3.3.6+debian0-1 (low)
        [lenny] - horde3 <no-dsa> (minor issue)
        [etch] - horde3 <no-dsa> (minor issue)
        NOTE: In order to successfully exploit this vulnerability the targeted user has to be logged as an administrator.
CVE-2009-3700 (Buffer overflow in sgLog.c in squidGuard 1.3 and 1.4 allows remote ...)
        - squidguard <unfixed> (low; bug #553319)
CVE-2009-3699 (Stack-based buffer overflow in libcsa.a (aka the calendar daemon ...)
        NOT-FOR-US: IBM AIX
CVE-2009-3698 (An unspecified function in the Dalvik API in Android 1.5 and earlier ...)
        NOT-FOR-US: Dalvik API in Android
CVE-2009-3697 (SQL injection vulnerability in the PDF schema generator functionality ...)
        {DSA-1918-1}
        - phpmyadmin 4:3.2.2.1-1
        [etch] - phpmyadmin <not-affected> (Vulnerable code not present)
CVE-2009-3696 (Cross-site scripting (XSS) vulnerability in phpMyAdmin 2.11.x before ...)
        {DSA-1918-1}
        - phpmyadmin 4:3.2.2.1-1
CVE-2009-3610
        REJECTED
CVE-2009-3695 (Algorithmic complexity vulnerability in the forms library in Django ...)
        {DSA-1905-1}
        - python-django 1.1.1-1 (medium; bug #550457)
        [etch] - python-django <not-affected> (introduced in 1.0)
        [lenny] - python-django 1.0.2-1+lenny2
CVE-2009-3694 (Directory traversal vulnerability in config/config.php in ezRecipe-Zee ...)
        NOT-FOR-US: ezRecipe-Zee 91
CVE-2009-3693 (Directory traversal vulnerability in the Persits.XUpload.2 ActiveX ...)
        NOT-FOR-US: Persits.XUpload.2 ActiveX
CVE-2009-3691 (Multiple integer overflows in setnet32.exe 3.50.0.13752 in IBM ...)
        NOT-FOR-US: IBM Informix Client SDK
CVE-2009-3690
        RESERVED
CVE-2009-3689
        RESERVED
CVE-2009-3688
        RESERVED
CVE-2009-3687
        RESERVED
CVE-2009-3686
        RESERVED
CVE-2009-3685
        RESERVED
CVE-2009-3684
        RESERVED
CVE-2009-3683
        RESERVED
CVE-2009-3682
        RESERVED
CVE-2009-3681
        RESERVED
CVE-2009-3680
        RESERVED
CVE-2009-3679
        RESERVED
CVE-2009-3678
        RESERVED
CVE-2009-3677 (The Internet Authentication Service (IAS) in Microsoft Windows 2000 ...)
        NOT-FOR-US: Microsoft Internet Authentication Service
CVE-2009-3676 (The kernel in Microsoft Windows Server 2008 R2 and Windows 7 allows ...)
        NOT-FOR-US: Microsoft Windows Server
CVE-2009-3675 (LSASS.exe in the Local Security Authority Subsystem Service (LSASS) in ...)
        NOT-FOR-US: Microsoft Local Security Authority Subsystem Service
CVE-2009-3674 (Microsoft Internet Explorer 8 does not properly handle objects in ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3673 (Microsoft Internet Explorer 7 and 8 does not properly handle objects ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3672 (Microsoft Internet Explorer 6 and 7 does not properly handle objects ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3671 (Microsoft Internet Explorer 8 does not properly handle objects in ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3670 (Stack-based buffer overflow in KSP Sound Player 2009 R2 and R2.1 ...)
        NOT-FOR-US: KSP Sound Player
CVE-2009-3669 (SQL injection vulnerability in the foobla Suggestions ...)
        NOT-FOR-US: Joomla! component
CVE-2009-3668 (Cross-site scripting (XSS) vulnerability in ardguest.php in Ardguest ...)
        NOT-FOR-US: Ardguest 1.8
CVE-2009-3667 (SQL injection vulnerability in admin/index.php in AdsDX 3.05 allows ...)
        NOT-FOR-US: AdsDX
CVE-2009-3666 (Cross-site scripting (XSS) vulnerability in index.php in Nullam Blog ...)
        NOT-FOR-US: Nullam Blog
CVE-2009-3665 (Multiple SQL injection vulnerabilities in index.php in Nullam Blog ...)
        NOT-FOR-US: Nullam Blog
CVE-2009-3664 (Multiple directory traversal vulnerabilities in index.php in Nullam ...)
        NOT-FOR-US: Nullam Blog
CVE-2009-3663 (Format string vulnerability in the h_readrequest function in http.c in ...)
        NOT-FOR-US: httpdx
CVE-2009-3662 (FileCopa FTP Server 5.01 allows remote attackers to cause a denial of ...)
        NOT-FOR-US: FileCopa FTP Server
CVE-2009-3661 (Multiple SQL injection vulnerabilities in the DJ-Catalog ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-3660 (PHP remote file inclusion vulnerability in libraries/database.php in ...)
        NOT-FOR-US: Efront
CVE-2009-3659 (SQL injection vulnerability in file/stats.php in BS Counter 2.5.3 ...)
        NOT-FOR-US: BS Counter
CVE-2009-3658 (Use-after-free vulnerability in the Sb.SuperBuddy.1 ActiveX control ...)
        NOT-FOR-US: Sb.SuperBuddy.1 ActiveX
CVE-2009-3657 (Session fixation vulnerability in Shared Sign-On 5.x and 6.x, a module ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3656 (Cross-site request forgery (CSRF) vulnerability in Shared Sign-On 5.x ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3655 (Rhino Software Serv-U 7.0.0.1 through 8.2.0.3 allows remote attackers ...)
        NOT-FOR-US: Rhino Software Serv-U
CVE-2009-3654 (Unspecified vulnerability in Boost before 6.x-1.03, a module for ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3653 (Cross-site scripting (XSS) vulnerability in the additional links ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3652 (Cross-site scripting (XSS) vulnerability in Organic Groups (OG) ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3651 (Cross-site scripting (XSS) vulnerability in the &quot;Monitor browsers' ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3650 (Cross-site scripting (XSS) vulnerability in Dex 5.x-1.0 and earlier ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3649 (Cross-site scripting (XSS) vulnerability in forums/index.php in Power ...)
        NOT-FOR-US: PBBoard
CVE-2009-3648 (Cross-site scripting (XSS) vulnerability in Service Links 6.x-1.0, a ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3647 (Cross-site scripting (XSS) vulnerability in emaullinks.php in YABSoft ...)
        NOT-FOR-US: YABSoft Mega File Hosting Script (aka MFH or MFHS)
CVE-2009-3646 (InterVations NaviCOPA Web Server 3.01 allows remote attackers to ...)
        NOT-FOR-US: NaviCOPA Web Server
CVE-2009-3645 (SQL injection vulnerability in the JoomlaCache CB Resume Builder ...)
        NOT-FOR-US: JoomlaCache
CVE-2009-3644 (SQL injection vulnerability in the Soundset (com_soundset) component ...)
        NOT-FOR-US: Joomla component
CVE-2009-3643 (Dxmsoft XM Easy Personal FTP Server 5.8.0 allows remote attackers to ...)
        NOT-FOR-US: Dxmsoft XM Easy Personal FTP Server
CVE-2009-3642 (Multiple SQL injection vulnerabilities in the Call Logging feature in ...)
        NOT-FOR-US: FrontRange HEAT
CVE-2009-3641 (Snort before 2.8.5.1, when the -v option is enabled, allows remote ...)
        - snort <unfixed> (low; bug #553584)
        [lenny] - snort <no-dsa> (Minor issue; -v is usually not used as it's slow and is only for debugging purposes)
        [etch] - snort <no-dsa> (Minor issue; -v is usually not used as it's slow and is only for debugging purposes)
CVE-2009-3640 (The update_cr8_intercept function in arch/x86/kvm/x86.c in the KVM ...)
        - linux-2.6 2.6.31-1 (medium)
        [lenny] - linux-2.6 <not-affected> (introduced post 2.6.27)
        [etch] - linux-2.6 <not-affected> (introduced post 2.6.27)
        - linux-2.6.24 <not-affected> (introduced post 2.6.27)
        - kvm 88+dfsg-2 (medium; bug #557737)
        [lenny] - kvm <not-affected> (Vulnerable code not present)
CVE-2009-3639 (The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before ...)
        {DSA-1925-1}
        - proftpd-dfsg 1.3.2a-2 (low)
        NOTE: http://bugs.proftpd.org/show_bug.cgi?id=3275
CVE-2009-3638 (Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in ...)
        {DSA-1962-1 DSA-1927-1}
        - linux-2.6 2.6.31-1 (medium)
        [etch] - linux-2.6 <not-affected> (introduced in 2.6.25)
        NOTE: fixed in upstream 2.6.32-rc4
        - linux-2.6.24 <not-affected> (introduced in 2.6.25)
        - kvm <removed> (medium; bug #562076)
CVE-2009-3637 [alien-arena remote arbitrary code execution]
        RESERVED
        - alien-arena <unfixed> (medium; bug #552038)
        [lenny] - alien-arena <no-dsa> (Contrib not supported)
        TODO: next point-release: [lenny] - alien-arena 7.0-1+lenny1
CVE-2009-3636 (Cross-site scripting (XSS) vulnerability in the Install Tool ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3635 (The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3634 (Cross-site scripting (XSS) vulnerability in the Frontend Login Box ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3633 (Cross-site scripting (XSS) vulnerability in the ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3632 (SQL injection vulnerability in the traditional frontend editing ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3631 (The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3630 (The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3629 (Multiple cross-site scripting (XSS) vulnerabilities in the Backend ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3628 (The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before ...)
        {DSA-1926-1}
        - typo3-src 4.2.10-1 (medium; bug #552020)
CVE-2009-3627 (The decode_entities function in util.c in HTML-Parser before 3.63 ...)
        {DSA-1923-1}
        - libhtml-parser-perl 3.64-1 (bug #552531)
        NOTE: http://secunia.com/advisories/37155/
CVE-2009-3626 (Perl 5.10.1 allows context-dependent attackers to cause a denial of ...)
        - perl 5.10.1-6 (bug #552291)
        [lenny] - perl <not-affected> (Vulnerable code not present)
        [etch] - perl <not-affected> (Vulnerable code not present)
CVE-2009-3625 (Directory traversal vulnerability in www/index.php in Sahana 0.6.2.2 ...)
        - sahana <itp> (bug #497414)
CVE-2009-3624 (The get_instantiation_keyring function in security/keys/keyctl.c in ...)
        - linux-2.6 2.6.31-2 (low)
        [etch] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.29)
        [lenny] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.29)
        - linux-2.6.24 <not-affected> (vulnerable code introduced in 2.6.29)
        NOTE: fixed upstream in 2.6.32-rc5
CVE-2009-3623 (The lookup_cb_cred function in fs/nfsd/nfs4callback.c in the nfsd4 ...)
        - linux-2.6 2.6.31-1 (medium)
        [etch] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.31)
        [lenny] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.31)
        - linux-2.6.24 <not-affected> (vulnerable code introduced in 2.6.31)
CVE-2009-3622 (Algorithmic complexity vulnerability in wp-trackback.php in WordPress ...)
        - wordpress 2.8.5-1
        [lenny] - wordpress <no-dsa> (Minor issue)
        [etch] - wordpress <no-dsa> (Minor issue)
        NOTE: http://seclists.org/fulldisclosure/2009/Oct/263
CVE-2009-3621 (net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows ...)
        {DSA-1929-1 DSA-1928-1 DSA-1927-1}
        - linux-2.6 2.6.31-2 (low)
        - linux-2.6.24 <removed> (low)
CVE-2009-3620 (The ATI Rage 128 (aka r128) driver in the Linux kernel before ...)
        {DSA-1928-1 DSA-1927-1}
        - linux-2.6 2.6.32-1 (medium)
        - linux-2.6.24 <removed> (medium)
CVE-2009-3619 (Unspecified vulnerability in ViewVC 1.0 before 1.0.9 and 1.1 before ...)
        - viewvc <unfixed> (low; bug #560903)
CVE-2009-3618 (Cross-site scripting (XSS) vulnerability in viewvc.py in ViewVC 1.0 ...)
        - viewvc <unfixed> (low; bug #560903)
CVE-2009-3617 (Format string vulnerability in the AbstractCommand::onAbort function ...)
        - aria2 1.6.2-1 (low)
        [lenny] - aria2 <not-affected> (Vulnerable code not present)
        [etch] - aria2 <not-affected> (Vulnerable code not present)
CVE-2009-3616 (Multiple use-after-free vulnerabilities in vnc.c in the VNC server in ...)
        - qemu 0.11.0-1 (medium; bug #553589)
        [lenny] - qemu <not-affected> (Vulnerable code not present)
        [etch] - qemu <not-affected> (Vulnerable code not present)
        - kvm <removed> (medium; bug #553590)
        [lenny] - kvm <not-affected> (Vulnerable code not present)
CVE-2009-3615 (The OSCAR protocol plugin in libpurple in Pidgin before 2.6.3 and ...)
        {DSA-1932-1}
        - pidgin 2.6.3-1
        NOTE: http://pidgin.im/news/security/?id=41
CVE-2009-3614 [oping suid 0 arbitrary file disclosure]
        RESERVED
        - liboping 1.3.3-1 (low; bug #548684)
        [lenny] - liboping <not-affected> (doesn't have -f option yet)
        [etch] - liboping <not-affected> (doesn't have -f option yet)
CVE-2009-3613 (The swiotlb functionality in the r8169 driver in drivers/net/r8169.c ...)
        {DSA-1928-1 DSA-1915-1}
        - linux-2.6 2.6.29-1 (medium)
        - linux-2.6.24 <removed>
        NOTE: http://www.openwall.com/lists/oss-security/2009/10/15/4
CVE-2009-3612 (The tcf_fill_node function in net/sched/cls_api.c in the netlink ...)
        {DSA-1929-1 DSA-1928-1 DSA-1927-1}
        - linux-2.6 2.6.31-2 (low)
        - linux-2.6.24 <removed> (low)
CVE-2009-3611 (common/snapshots.py in Back In Time (aka backintime) 0.9.26 changes ...)
        - backintime 0.9.26-3 (bug #543785)
CVE-2009-3609 (Integer overflow in the ImageStream::ImageStream function in Stream.cc ...)
        {DSA-1941-1}
        - xpdf <unfixed> (medium; bug #551287)
        - poppler 0.12.2-1 (medium; bug #551289)
        - kdegraphics 4:4.0 (medium; bug #551290)
        - swftools <unfixed> (medium; bug #551291)
CVE-2009-3608 (Integer overflow in the ObjectStream::ObjectStream function in XRef.cc ...)
        {DSA-1941-1}
        - xpdf <unfixed> (medium; bug #551287)
        - poppler 0.12.2-1 (medium; bug #551289)
        - kdegraphics 4:4.0 (medium; bug #551290)
        - swftools <unfixed> (medium; bug #551291)
CVE-2009-3607 (Integer overflow in the create_surface_from_thumbnail_data function in ...)
        {DSA-1941-1}
        - poppler 0.12.2-1 (medium; bug #551289)
CVE-2009-3606 (Integer overflow in the PSOutputDev::doImageL1Sep function in Xpdf ...)
        {DSA-1941-1}
        - xpdf <unfixed> (medium; bug #551287)
        - poppler 0.12.2-1 (medium; bug #551289)
        - kdegraphics 4:4.0 (medium; bug #551290)
        - swftools <unfixed> (medium; bug #551291)
CVE-2009-3605 (Multiple integer overflows in Poppler 0.10.5 and earlier allow remote ...)
        {DSA-1941-1}
        - poppler 0.12.2-1 (medium; bug #551289)
CVE-2009-3604 (The Splash::drawImage function in Splash.cc in Xpdf 2.x and 3.x before ...)
        {DSA-1941-1}
        - xpdf <unfixed> (medium; bug #551287)
        - poppler 0.12.2-1 (medium; bug #551289)
        - kdegraphics 4:4.0 (medium; bug #551290)
        - swftools <unfixed> (medium; bug #551291)
CVE-2009-3603 (Integer overflow in the SplashBitmap::SplashBitmap function in Xpdf ...)
        {DSA-1941-1}
        - xpdf <unfixed> (medium; bug #551287)
        - poppler 0.12.2-1 (medium; bug #551289)
        - kdegraphics 4:4.0 (medium; bug #551290)
        - swftools <unfixed> (medium; bug #551291)
CVE-2009-3591 (Dopewars 1.5.12 allows remote attackers to cause a denial of service ...)
        - dopewars 1.5.12-9 (low; bug #550913)
        [etch] - dopewars <no-dsa> (negligible issue)
        [lenny] - dopewars <no-dsa> (neglibigble issue)
CVE-2009-3589 (incron 0.5.5 does not initialize supplementary groups when running a ...)
        - incron 0.5.7-1
CVE-2009-3588 (Unspecified vulnerability in the arclib component in the Anti-Virus ...)
        NOT-FOR-US: eTrust Antivirus
CVE-2009-3587 (Unspecified vulnerability in the arclib component in the Anti-Virus ...)
        NOT-FOR-US: eTrust Antivirus
CVE-2009-3586 (Off-by-one error in src/http.c in CoreHTTP 0.5.3.1 and earlier allows ...)
        NOT-FOR-US: CoreHTTP
CVE-2009-3585 (Session fixation vulnerability in html/Elements/SetupSessionCookie in ...)
        {DSA-1944-1}
        - request-tracker3.4 <removed>
        - request-tracker3.6 3.6.9-2 (low)
CVE-2009-3584 (SQL-Ledger 2.8.24 does not set the secure flag for the session cookie ...)
        - sql-ledger <unfixed> (bug #562639)
CVE-2009-3583 (Directory traversal vulnerability in the Preferences menu item in ...)
        - sql-ledger <unfixed> (bug #562639)
CVE-2009-3582 (Multiple SQL injection vulnerabilities in the delete subroutine in ...)
        - sql-ledger <unfixed> (bug #562639)
CVE-2009-3581 (Multiple cross-site scripting (XSS) vulnerabilities in SQL-Ledger ...)
        - sql-ledger <unfixed> (bug #562639)
CVE-2009-3580 (Cross-site request forgery (CSRF) vulnerability in am.pl in SQL-Ledger ...)
        - sql-ledger <unfixed> (bug #562639)
CVE-2009-3578 (Autodesk Maya 8.0, 8.5, 2008, 2009, and 2010 and Alias Wavefront Maya ...)
        NOT-FOR-US: Autodesk Maya
CVE-2009-3577 (Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 ...)
        NOT-FOR-US: Autodesk
CVE-2009-3576 (Autodesk Softimage 7.x and Softimage XSI 6.x allow remote attackers to ...)
        NOT-FOR-US: Autodesk Softimage
CVE-2009-3575 (Buffer overflow in DHTRoutingTableDeserializer.cc in aria2 0.15.3, ...)
        {DSA-1957-1}
        - aria2 1.2.0-1 (low; bug #551070)
        [etch] - aria2 <not-affected> (Vulnerable code not present)
CVE-2009-3571 (Unspecified vulnerability in OpenOffice.org (OOo) has unknown impact ...)
        TODO: check once details are available: - openoffice.org <unfixed> (medium; bug #551068)
        NOTE: details are unknown
CVE-2009-3570 (Unspecified vulnerability in OpenOffice.org (OOo) has unspecified ...)
        TODO: check once details are available:- openoffice.org <unfixed> (medium; bug #551068)
        NOTE: details are unknown
CVE-2009-3569 (Stack-based buffer overflow in OpenOffice.org (OOo) allows remote ...)
        TODO: check once details are available:- openoffice.org <unfixed> (medium; bug #551068)
        NOTE: details are unknown
CVE-2009-3568 (Comment RSS 5.x before 5.x-2.2 and 6.x before 6.x-2.2, a module for ...)
        NOT-FOR-US: module for Drupal
CVE-2009-3692 (Unspecified vulnerability in the VBoxNetAdpCtl configuration tool in ...)
        - virtualbox-ose 3.0.8-dfsg-1
        [lenny] - virtualbox-ose <not-affected> (vulnerable code not present)
CVE-2009-3602 (Unbound before 1.3.4 does not properly verify signatures for NSEC3 ...)
        {DSA-1963-1}
        - unbound 1.3.4-1 (low)
        NOTE: http://unbound.net/pipermail/unbound-users/2009-October/000852.html
CVE-2009-3601 (Cross-site scripting (XSS) vulnerability in demo_page.php in Scriptsez ...)
        NOT-FOR-US: Scriptsez Ultimate Poll
CVE-2009-3600 (HUBScript 1.0 allows remote attackers to obtain configuration ...)
        NOT-FOR-US: HUBScript
CVE-2009-3599 (Cross-site scripting (XSS) vulnerability in single_winner1.php in ...)
        NOT-FOR-US: HUBScript
CVE-2009-3598 (Cross-site scripting (XSS) vulnerability in survey_result.php in ...)
        NOT-FOR-US: eCardMAX FormXP
CVE-2009-3597 (Digitaldesign CMS 0.1 stores sensitive information under the web root ...)
        NOT-FOR-US: Digitaldesign CMS
CVE-2009-3596 (JoxTechnology Ajox Poll does not properly restrict access to ...)
        NOT-FOR-US: JoxTechnology Ajox Poll
CVE-2009-3595 (SQL injection vulnerability in results.php in VS PANEL 7.5.5 allows ...)
        NOT-FOR-US: VS PANEL
CVE-2009-3594 (Cross-site scripting (XSS) vulnerability in bpost.php in BLOB Blog ...)
        NOT-FOR-US: BLOB Blog System
CVE-2009-3593 (Multiple cross-site scripting (XSS) vulnerabilities in Freelancers 1.0 ...)
        NOT-FOR-US: Freelancers
CVE-2009-3592 (Cross-site scripting (XSS) vulnerability in customer/home.php in ...)
        NOT-FOR-US: Qualiteam X-Cart
CVE-2009-3590 (SQL injection vulnerability in showcat.php in VS PANEL 7.3.6 allows ...)
        NOT-FOR-US: VS PANEL
CVE-2009-3574 (Tuniac 090517c allows remote attackers to cause a denial of service ...)
        NOT-FOR-US: Tuniac
CVE-2009-3573 (Multiple insecure method vulnerabilities in the PDIControl.PDI.1 ...)
        NOT-FOR-US: ActiveX
CVE-2009-3572 (OpenBSD 4.4, 4.5, and 4.6, when running on an i386 kernel, does not ...)
        NOT-FOR-US: OpenBSD
CVE-2009-3567 (Cross-site scripting (XSS) vulnerability in ...)
        NOT-FOR-US: Kayako SupportSuite and eSupport
CVE-2009-3579 (Cross-site scripting (XSS) vulnerability in the CookieDump.java sample ...)
        - jetty <unfixed> (unimportant)
        NOTE: http://www.coresecurity.com/content/jetty-persistent-xss
        NOTE: only an example application
CVE-2009-3566 (McAfee IntruShield Network Security Manager (NSM) before 5.1.11.8.1 ...)
        NOT-FOR-US: McAfee IntruShield Network Security Manager
CVE-2009-3565 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
        NOT-FOR-US: McAfee IntruShield Network Security Manager
CVE-2009-3564 (puppetmasterd in puppet 0.24.6 does not reset supplementary groups ...)
        - puppet 0.25.1-3 (low; bug #551073)
        [etch] - puppet <no-dsa> (minor issue)
        [lenny] - puppet <no-dsa> (minor issue)
CVE-2009-3563 (ntp_request.c in ntpd in NTP before 4.2.4p8, and 4.2.5, allows remote ...)
        {DSA-1948-1}
        - ntp 1:4.2.4p8+dfsg-1 (medium; bug #560074)
CVE-2009-3562 (Cross-site scripting (XSS) vulnerability in Xerver HTTP Server 4.32 ...)
        NOT-FOR-US: Xerver HTTP Server
CVE-2009-3561 (Directory traversal vulnerability in Xerver HTTP Server 4.32 allows ...)
        NOT-FOR-US: Xerver HTTP Server
CVE-2009-3560 (The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, ...)
        {DSA-1953-2 DSA-1953-1}
        - expat 2.0.1-6 (low; bug #560901)
        - w3c-libwww <removed>
        [etch] - w3c-libwww <no-dsa> (Minor issue, only used by fringe apps)
        - python-xml <removed> (low; bug #560951)
        [etch] - python-xml <no-dsa> (minor issue)
        [lenny] - python-xml <no-dsa> (minor issue)
        - python2.5 <unfixed> (low; bug #560912)
        - python2.4 <unfixed> (low; bug #560913)
        - python-4suite <unfixed> (low; bug #560914)
        [etch] - python-4suite <no-dsa> (Minor issue)
        [lenny] - python-4suite <no-dsa> (Minor issue)
        - wxwindows2.4 <removed> (low; bug #560915)
        [etch] - wxwindows2.4 <no-dsa> (minor issue)
        - wxwidgets2.6 2.6.3.2.2-4 (low; bug #560916)
        [etch] - wxwidgets2.6 <no-dsa> (minor issue)
        [lenny] - wxwidgets2.6 <no-dsa> (minor issue)
        - wxwidgets2.8 2.8.10.1-2 (low; bug #560917)
        [lenny] - wxwidgets2.8 <no-dsa> (minor issue)
        - audacity 1.3.2-1 (unimportant; bug #560919)
        - matanza <unfixed> (unimportant; bug #560920)
        - tdom 0.8.3~20080525-1 (low; bug #560921)
        [etch] - tdom <no-dsa> (minor issue)
        - udunits 2.1.8-4 (unimportant; bug #560922)
        - ayttm 0.6.1-2 (low; bug #560924)
        [etch] - ayttm <no-dsa> (minor issue)
        [lenny] - ayttm <no-dsa> (minor issue)
        - cableswig <unfixed> (unimportant; bug #560925)
        - cadaver <unfixed> (unimportant; bug #560926)
        - cmake 2.6.0-6 (unimportant; bug #560927)
        - coin3 <unfixed> (unimportant; bug #560928)
        - gdcm 2.0.14-2 (low; bug #560929)
        - ghostscript <unfixed> (unimportant; bug #560930)
        - gs-gpl <removed> (unimportant)
        - grmonitor <removed> (unimportant; bug #560931)
        - iceape <unfixed> (unimportant; bug #560932)
        - insighttoolkit 3.16.0-1 (unimportant; bug #560933)
        - paraview <unfixed> (unimportant; bug #560935)
        - poco <unfixed> (unimportant; bug #560936)
        - simgear <unfixed> (unimportant; bug #560937)
        - smart <unfixed> (low; bug #560953)
        [etch] - smart <no-dsa> (minor issue)
        [lenny] - smart <no-dsa> (minor issue)
        - swish-e <unfixed> (low; bug #560939)
        [etch] - swish-e <no-dsa> (minor issue)
        [lenny] - swish-e <no-dsa> (minor issue)
        - tla <unfixed> (low; bug #560940)
        [etch] - tla <no-dsa> (minor issue)
        [lenny] - tla <no-dsa> (minor issue)
        - wbxml2 <unfixed> (low; bug #560941)
        [etch] - wbxml2 <no-dsa> (minor issue)
        [lenny] - wbxml2 <no-dsa> (minor issue)
        - xmlrpc-c <unfixed> (low; bug #560942)
        [etch] - xmlrpc-c <no-dsa> (minor issue)
        [lenny] - xmlrpc-c <no-dsa> (minor issue)
        - iceweasel <not-affected> (uses xulrunner; bug #560943)
        - kompozer 1:0.8~b1-2 (low; bug #560944)
        - vxl 1.13.0-2 (low; bug #560945)
        - xulrunner <unfixed> (unimportant; bug #560946)
        - texlive-bin <not-affected> (Files are not compiled in, see #560948)
        - vnc4 <unfixed> (low; bug #560949)
        [etch] - vnc4 <no-dsa> (minor issue)
        [lenny] - vnc4 <no-dsa> (minor issue)
        - xotcl <unfixed> (low; bug #560950)
        [lenny] - xotcl <no-dsa> (minor issue)
CVE-2009-3559 (** DISPUTED ** ...)
        - php5 <unfixed> (unimportant)
        NOTE: safe_mode regression
CVE-2009-3558 (The posix_mkfifo function in ext/posix/posix.c in PHP before 5.2.12 ...)
        - php5 <unfixed> (unimportant)
        NOTE: open_basedir bypass
CVE-2009-3557 (The tempnam function in ext/standard/file.c in PHP before 5.2.12 and ...)
        - php5 <unfixed> (unimportant)
        NOTE: safe_mode bypass
CVE-2009-3556
        RESERVED
CVE-2009-3555 (The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as ...)
        {DSA-1934-1}
        NOTE: See separate CVE-2009-3555 file in SVN
CVE-2009-3554 (Twiddle in Red Hat JBoss Enterprise Application Platform (aka JBoss ...)
        - jbossas4 <unfixed> (bug #562000)
        [lenny] - jbossas4 <no-dsa> (Contrib not supported)
CVE-2009-3553 (Use-after-free vulnerability in the abstract file-descriptor handling ...)
        - cups 1.4.2-4 (low; bug #557740)
        [lenny] - cups <no-dsa> (Minor issue)
        - cupsys <not-affected> (vulnerable code introduced in 1.3.x)
        NOTE: http://www.cups.org/newsgroups.php/s1+gcups.bugs?s1+gcups.bugs+v4+T+Q3200
CVE-2009-3552
        RESERVED
CVE-2009-3551 (Off-by-one error in the dissect_negprot_response function in ...)
        - wireshark 1.2.3-1 (low; bug #553583)
        [lenny] - wireshark <not-affected> (Only affects Wireshark 1.2.x)
        [etch] - wireshark <not-affected> (Only affects Wireshark 1.2.x)
CVE-2009-3550 (The DCERPC/NT dissector in Wireshark 0.10.10 through 1.0.9 and 1.2.0 ...)
        {DSA-1942-1}
        - wireshark 1.2.3-1 (low; bug #553583)
CVE-2009-3549 (packet-paltalk.c in the Paltalk dissector in Wireshark 1.2.0 through ...)
        - wireshark 1.2.3-1 (low; bug #553583)
        [lenny] - wireshark <not-affected> (Only affects Wireshark 1.2.x)
        [etch] - wireshark <not-affected> (Only affects Wireshark 1.2.x)
CVE-2009-3548 (The Windows installer for Apache Tomcat 6.0.0 through 6.0.20, 5.5.0 ...)
        - tomcat6 <not-affected> (Windows only)
CVE-2009-3547 (Multiple race conditions in fs/pipe.c in the Linux kernel before ...)
        {DSA-1929-1 DSA-1928-1 DSA-1927-1}
        - linux-2.6 2.6.31-2 (high)
        - linux-2.6.24 <removed> (high)
CVE-2009-3546 (The _gdGetColors function in gd_gd.c in PHP 5.2.11 and 5.3.x before ...)
        {DSA-1936-1}
        - libgd2 2.0.36~rc1~dfsg-3.1 (medium; bug #552534)
        - php5 <not-affected> (the php packages use the system libgd2)
        NOTE: http://svn.php.net/viewvc?view=revision&revision=289557
        NOTE: <20091015173822.084de220@redhat.com> in OSS-sec
CVE-2009-3545 (DataWizard Technologies FtpXQ FTP Server 3.0 allows remote ...)
        NOT-FOR-US: DataWizard Technologies FtpXQ FTP Server
CVE-2009-3544 (Xerver HTTP Server 4.32 allows remote attackers to obtain the source ...)
        NOT-FOR-US: Xerver HTTP Server
CVE-2009-3527 (Race condition in the Pipe (IPC) close function in FreeBSD 6.3 and 6.4 ...)
        - kfreebsd-6 <removed>
        [lenny] - kfreebsd-6 <no-dsa> (KFreebsd not supported)
CVE-2009-3526
        RESERVED
CVE-2009-XXXX [php5's pear is vulnerable to symlink attacks]
        - php5 <unfixed> (low; bug #546164)
        NOTE: side-effect reported to upstream: http://bugs.php.net/44354
        NOTE: but they apparently only fixed the issue at build time
        NOTE: needs re-testing, as I don't remember the test conditions
CVE-2009-XXXX [kfreebsd: Devfs / VFS NULL pointer race condition]
        - kfreebsd-6 <removed>
        [lenny] - kfreebsd-6 <no-dsa> (KFreebsd not supported)
        - kfreebsd-7 7.2-9 (bug #549871)
        [lenny] - kfreebsd-7 <no-dsa> (KFreebsd not supported)
CVE-2009-3543 (SQL injection vulnerability in _phenotype/admin/login.php in Phenotype ...)
        NOT-FOR-US: Phenotype CMS
CVE-2009-3542 (Directory traversal vulnerability in ls.php in LittleSite (aka LS or ...)
        NOT-FOR-US: LittleSite
CVE-2009-3541 (PHP remote file inclusion vulnerability in CoupleDB.php in ...)
        NOT-FOR-US: PHPGenealogy
CVE-2009-3540 (Cross-site scripting (XSS) vulnerability in listads.php in ...)
        NOT-FOR-US: YourFreeWorld Ultra Classifieds Pro
CVE-2009-3539 (Multiple cross-site scripting (XSS) vulnerabilities in YourFreeWorld ...)
        NOT-FOR-US: YourFreeWorld Ultra Classifieds Pro
CVE-2009-3538 (Directory traversal vulnerability in thumb.php in Clear Content 1.1 ...)
        NOT-FOR-US: Clear Content
CVE-2009-3537 (Multiple stack-based buffer overflows in EpicDJSoftware EpicDJ 1.3.9.1 ...)
        NOT-FOR-US: EpicDJSoftware EpicDJ
CVE-2009-3536 (Multiple stack-based buffer overflows in EpicDJSoftware EpicVJ 1.2.8.0 ...)
        NOT-FOR-US: EpicDJSoftware EpicVJ
CVE-2009-3535 (Directory traversal vulnerability in image.php in Clear Content 1.1 ...)
        NOT-FOR-US: Clear Content
CVE-2009-3534 (Directory traversal vulnerability in index.php in LionWiki 3.0.3, when ...)
        NOT-FOR-US: LionWiki
CVE-2009-3533 (SQL injection vulnerability in report.php in Meeting Room Booking ...)
        NOT-FOR-US: Meeting Room Booking System
CVE-2009-3532 (Multiple SQL injection vulnerabilities in login.asp (aka the login ...)
        NOT-FOR-US: LogRover
CVE-2009-3531 (SQL injection vulnerability in vnews.php in Universe CMS 1.0.6 allows ...)
        NOT-FOR-US: Universe CMS
CVE-2009-3530 (Cross-site scripting (XSS) vulnerability in storefront.php in ...)
        NOT-FOR-US: RadScripts RadBids Gold
CVE-2009-3529 (SQL injection vulnerability in index.php in RadScripts RadBids Gold 4 ...)
        NOT-FOR-US: RadScripts RadBids Gold
CVE-2009-3528 (SQL injection vulnerability in Profile.php in MyMsg 1.0.3 allows ...)
        NOT-FOR-US: MyMsg
CVE-2009-3525 (The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not ...)
        - xen-3 <unfixed> (unimportant)
        - xen-unstable <unfixed> (unimportant)
        NOTE: This is an enhancement, not a security issue.
        NOTE: A user must have access to a guest hard drive image in order to boot it,
        NOTE:  so he can simply mount the drive and remove the password option.
CVE-2009-XXXX [buffer overflow in overkill]
        - overkill <unfixed> (bug #549310; low)
        [lenny] - overkill <no-dsa> (Minor issue)
        [etch] - overkill <no-dsa> (Minor issue)
CVE-2009-3524 (Unspecified vulnerability in ashWsFtr.dll in avast! Home and ...)
        NOT-FOR-US: avast! Home and Professional
CVE-2009-3523 (aavmKer4.sys in avast! Home and Professional for Windows before ...)
        NOT-FOR-US: avast! Home and Professional
CVE-2009-3522 (Stack-based buffer overflow in aswMon2.sys in avast! Home and ...)
        NOT-FOR-US: avast! Home and Professional
CVE-2009-3521 (Multiple cross-site scripting (XSS) vulnerabilities in the ...)
        NOT-FOR-US: WebSphere
CVE-2009-3520 (Cross-site request forgery (CSRF) vulnerability in the Your_account ...)
        NOT-FOR-US: CMSphp
CVE-2009-3519 (Multiple memory leaks in the IP module in the kernel in Sun Solaris 8 ...)
        NOT-FOR-US: Sun Solaris
CVE-2009-3518 (Argument injection vulnerability in the iim: URI handler in IBMIM.exe ...)
        NOT-FOR-US: IBM Installation Manager
CVE-2009-3517 (nfs.ext in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does ...)
        NOT-FOR-US: IBM AIX
CVE-2009-3516 (gssd in IBM AIX 5.3.x through 5.3.9 and 6.1.0 through 6.1.2 does not ...)
        NOT-FOR-US: IBM AIX
CVE-2009-3515 (Directory traversal vulnerability in dnet_admin/index.php in d.net CMS ...)
        NOT-FOR-US: d.net CMS
CVE-2009-3514 (Multiple SQL injection vulnerabilities in d.net CMS allow remote ...)
        NOT-FOR-US: d.net CMS
CVE-2009-3513 (Multiple cross-site scripting (XSS) vulnerabilities in Pilot Group ...)
        NOT-FOR-US: Pilot Group (PG) eTraining
CVE-2009-3512 (Multiple cross-site scripting (XSS) vulnerabilities in MyWeight 1.0 ...)
        NOT-FOR-US: MyWeight
CVE-2009-3511 (Multiple PHP remote file inclusion vulnerabilities in justVisual 1.2 ...)
        NOT-FOR-US: justVisual
CVE-2009-3510 (SQL injection vulnerability in viewListing.php in linkSpheric 0.74 ...)
        NOT-FOR-US: linkSpheric
CVE-2009-3509 (Cross-site scripting (XSS) vulnerability in admin/admin_index.php in ...)
        NOT-FOR-US: CJ Dynamic Poll PRO
CVE-2009-3508 (Multiple directory traversal vulnerabilities in MUJE CMS 1.0.4.34 ...)
        NOT-FOR-US: MUJE CMS
CVE-2009-3507 (Directory traversal vulnerability in modules.php in CMSphp 0.21 allows ...)
        NOT-FOR-US: CMSphp
CVE-2009-3506 (Multiple cross-site scripting (XSS) vulnerabilities in CMSphp 0.21 ...)
        NOT-FOR-US: CMSphp
CVE-2009-3505 (SQL injection vulnerability in view_news.php in Vastal I-Tech MMORPG ...)
        NOT-FOR-US: Vastal I-Tech MMORPG Zone
CVE-2009-3504 (SQL injection vulnerability in offers_buy.php in Alibaba Clone 3.0 ...)
        NOT-FOR-US: Alibaba Clone
CVE-2009-3503 (Multiple SQL injection vulnerabilities in search.aspx in BPowerHouse ...)
        NOT-FOR-US: BPowerHouse BPHolidayLettings
CVE-2009-3502 (SQL injection vulnerability in music.php in BPowerHouse BPMusic 1.0 ...)
        NOT-FOR-US: BPowerHouse BPMusic
CVE-2009-3501 (SQL injection vulnerability in students.php in BPowerHouse BPStudents ...)
        NOT-FOR-US: BPowerHouse BPStudents
CVE-2009-3500 (Multiple SQL injection vulnerabilities in BPowerHouse BPGames 1.0 ...)
        NOT-FOR-US: BPowerHouse BPGames
CVE-2009-3499 (SQL injection vulnerability in employee.aspx in BPowerHouse ...)
        NOT-FOR-US: BPowerHouse BPLawyerCaseDocuments
CVE-2009-3498 (SQL injection vulnerability in php/update_article_hits.php in HBcms ...)
        NOT-FOR-US: HBcms
CVE-2009-3497 (SQL injection vulnerability in view_listing.php in Vastal I-Tech Agent ...)
        NOT-FOR-US: Vastal I-Tech Agent
CVE-2009-3496 (Cross-site scripting (XSS) vulnerability in view_mag.php in Vastal ...)
        NOT-FOR-US: Vastal I-Tech DVD Zone
CVE-2009-3495 (SQL injection vulnerability in view_mag.php in Vastal I-Tech DVD Zone ...)
        NOT-FOR-US: Vastal I-Tech DVD Zone
CVE-2009-3494 (Multiple SQL injection vulnerabilities in index.php in T-HTB Manager ...)
        NOT-FOR-US: T-HTB Manager
CVE-2009-3493 (Multiple cross-site scripting (XSS) vulnerabilities in Zenas ...)
        NOT-FOR-US: Zenas PaoBacheca Guestbook
CVE-2009-3492 (Multiple PHP remote file inclusion vulnerabilities in Loggix Project ...)
        NOT-FOR-US: Loggix Project
CVE-2009-3491 (SQL injection vulnerability in the Kinfusion SportFusion ...)
        NOT-FOR-US: Kinfusion SportFusion
CVE-2009-3490 (GNU Wget before 1.12 does not properly handle a '\0' character in a ...)
        {DSA-1904-1}
        - wget 1.12-1 (medium; bug #549293) 
CVE-2009-3489 (Adobe Photoshop Elements 8.0 installs the Adobe Active File Monitor V8 ...)
        NOT-FOR-US: Adobe Photoshop Elements
CVE-2009-3488 (Cross-site scripting (XSS) vulnerability in the Bibliography (aka ...)
        NOT-FOR-US: Drupal Bibliography Module
CVE-2009-3487 (Multiple cross-site scripting (XSS) vulnerabilities in the J-Web ...)
        NOT-FOR-US: J-Web interface in Juniper JUNOS
CVE-2009-3486 (Multiple cross-site scripting (XSS) vulnerabilities in the J-Web ...)
        NOT-FOR-US: J-Web interface in Juniper JUNOS
CVE-2009-3485 (Cross-site scripting (XSS) vulnerability in the J-Web interface in ...)
        NOT-FOR-US: J-Web interface in Juniper JUNOS
CVE-2009-3484 (Stack-based buffer overflow in Core FTP 2.1 build 1612 allows ...)
        NOT-FOR-US: Core FTP
CVE-2009-3483 (Heap-based buffer overflow in the Create New Site feature in ...)
        NOT-FOR-US: CuteFTP
CVE-2009-3482 (TrustPort Antivirus before 2.8.0.2266 and PC Security before ...)
        NOT-FOR-US: TrustPort Antivirus and PC Security
CVE-2009-3481 (A certain interface in the iCRM Basic (com_icrmbasic) component ...)
        NOT-FOR-US: Joomla component
CVE-2009-3480 (SQL injection vulnerability in the iCRM Basic (com_icrmbasic) ...)
        NOT-FOR-US: Joomla component
CVE-2009-3479 (Cross-site scripting (XSS) vulnerability in Bibliography (Biblio) 5.x ...)
        NOT-FOR-US: Bibliography
CVE-2009-3478 (Argument injection vulnerability in (1) ...)
        NOT-FOR-US: Bibliography
CVE-2009-3477 (The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before ...)
        NOT-FOR-US: Blackberry Browser in RIM BlackBerry Device Software
CVE-2009-3476 (Buffer overflow in OpenSAML before 1.1.3 as used in Internet2 ...)
        {DSA-1895-2 DSA-1896-1 DSA-1895-1}
        - xmltooling 1.2.2-1
        - opensaml <removed>
        - opensaml2 2.2.1-1
        - shibboleth-sp <removed>
        - shibboleth-sp2 2.2.1+dfsg-1
CVE-2009-3475 (Internet2 Shibboleth Service Provider software 1.3.x before 1.3.3 and ...)
        {DSA-1895-2 DSA-1896-1 DSA-1895-1}
        - xmltooling 1.2.2-1
        - opensaml <removed>
        - opensaml2 2.2.1-1
        - shibboleth-sp <removed>
        - shibboleth-sp2 2.2.1+dfsg-1
CVE-2009-3474 (OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by ...)
        {DSA-1895-2 DSA-1896-1 DSA-1895-1}
        - xmltooling 1.2.2-1
        - opensaml <removed>
        - opensaml2 2.2.1-1
        - shibboleth-sp <removed>
        - shibboleth-sp2 2.2.1+dfsg-1
        [lenny] - opensaml <no-dsa> (Minor issue)
        TODO: next point update: [lenny] - opensaml 2.0-2+lenny1
CVE-2009-3473 (IBM DB2 9.1 before FP8 does not require the SETSESSIONUSER privilege ...)
        NOT-FOR-US: IBM DB2
CVE-2009-3472 (IBM DB2 8 before FP18, 9.1 before FP8, and 9.5 before FP4 allows ...)
        NOT-FOR-US: IBM DB2
CVE-2009-3471 (IBM DB2 8 before FP18, 9.1 before FP8, and 9.5 before FP4 does not ...)
        NOT-FOR-US: IBM DB2
CVE-2009-3470 (IBM Informix Dynamic Server (IDS) 10.00 before 10.00.xC11, 11.10 ...)
        NOT-FOR-US: IBM Informix Dynamic Server (IDS) 
CVE-2009-3469 (Cross-site scripting (XSS) vulnerability in ...)
        NOT-FOR-US: IBM Lotus Connections
CVE-2009-3468 (Multiple unspecified vulnerabilities in Common Desktop Environment ...)
        NOT-FOR-US: Common Desktop Environment (CDE) in Sun Solaris 
CVE-2009-3467
        RESERVED
CVE-2009-3466 (Adobe Shockwave Player before 11.5.2.602 allows remote attackers to ...)
        NOT-FOR-US: Adobe Shockwave Player
CVE-2009-3465 (Adobe Shockwave Player before 11.5.2.602 allows remote attackers to ...)
        NOT-FOR-US: Adobe Shockwave Player
CVE-2009-3464 (Adobe Shockwave Player before 11.5.2.602 allows remote attackers to ...)
        NOT-FOR-US: Adobe Shockwave Player
CVE-2009-3463 (Array index error in Adobe Shockwave Player before 11.5.2.602 allows ...)
        NOT-FOR-US: Adobe Shockwave Player
CVE-2009-3462 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x ...)
        NOT-FOR-US: Adobe
CVE-2009-3461 (Unspecified vulnerability in Adobe Acrobat 9.x before 9.2 allows ...)
        NOT-FOR-US: Adobe
CVE-2009-3460 (Adobe Acrobat 9.x before 9.2, 8.x before 8.1.7, and possibly 7.x ...)
        NOT-FOR-US: Adobe
CVE-2009-3459 (Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before ...)
        NOT-FOR-US: Adobe Acrobat
CVE-2009-3458 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x ...)
        NOT-FOR-US: Adobe
CVE-2009-3457 (Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF) ...)
        NOT-FOR-US: Cisco ACE XML Gateway (AXG) and ACE Web Application Firewall (WAF)
CVE-2009-3456 (Google Chrome, possibly 3.0.195.21 and earlier, does not properly ...)
        - chromium-browser <itp> (bug #520324)
CVE-2009-3455 (Apple Safari, possibly before 4.0.3, on Mac OS X does not properly ...)
        NOT-FOR-US: Apple Safari
CVE-2009-3454
        REJECTED
CVE-2009-3453 (Multiple cross-site scripting (XSS) vulnerabilities in IBM Lotus ...)
        NOT-FOR-US: IBM Lotus Quickr
CVE-2009-3452 (WebCoreModule.ashx in RADactive I-Load before 2008.2.5.0 allows remote ...)
        NOT-FOR-US: RADactive I-Load
CVE-2009-3451 (Directory traversal vulnerability in WebCoreModule.ashx in RADactive ...)
        NOT-FOR-US: RADactive
CVE-2009-3450 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
        NOT-FOR-US: RADactive I-Load
CVE-2009-3449 (MP3 Collector 2.3 allows remote attackers to cause a denial of service ...)
        NOT-FOR-US: MP3 Collector
CVE-2009-3448 (npvmgr.exe in BakBone NetVault Backup 8.22 Build 29 allows remote ...)
        NOT-FOR-US: BakBone NetVault Backup
CVE-2009-3447 (Unrestricted file upload vulnerability in RADactive I-Load before ...)
        NOT-FOR-US: RADactive I-Load
CVE-2009-XXXX [ffmpeg missing input sanitization/crashes]
        - ffmpeg <unfixed> (medium; bug #550442)
        - xmovie <removed> (medium)
        - ffmpeg-debian <removed> (medium)
        NOTE: https://roundup.ffmpeg.org/roundup/ffmpeg/issue1240
        NOTE: https://roundup.ffmpeg.org/roundup/ffmpeg/issue1245
CVE-2009-XXXX [xen-tools: world readable disk image files]
        - xen-tools <removed> (low; bug #548909)
        [lenny] - xen-tools <no-dsa> (Minor issue)
        TODO: request CVE id
        NOTE: Maintainer will look into an update for stable
CVE-2009-3446 (SQL injection vulnerability in the MyRemote Video Gallery (com_mytube) ...)
        NOT-FOR-US: com_mytube component for Joomla!
CVE-2009-3445 (Unspecified vulnerability in Code-Crafters Ability Mail Server before ...)
        NOT-FOR-US: Ability Mail Server
CVE-2009-3444 (Cross-site scripting (XSS) vulnerability in email.php in e107 0.7.16 ...)
        NOT-FOR-US: e107
CVE-2009-3443 (SQL injection vulnerability in the Fastball (com_fastball) component ...)
        NOT-FOR-US: com_fastball component for Joomla!
CVE-2009-3442 (The Meta tags (aka Nodewords) module before 6.x-1.1 for Drupal does ...)
        NOT-FOR-US: Nodewords module for Drupal
CVE-2009-3441 (Open Source Security Information Management (OSSIM) before 2.1.2 ...)
        NOT-FOR-US: Open Source Security Information Management
CVE-2009-3440 (Cross-site scripting (XSS) vulnerability in Open Source Security ...)
        NOT-FOR-US: Open Source Security Information Management
CVE-2009-3439 (Multiple SQL injection vulnerabilities in Open Source Security ...)
        NOT-FOR-US: Open Source Security Information Management
CVE-2009-3438 (SQL injection vulnerability in the JoomlaFacebook (com_facebook) ...)
        NOT-FOR-US: com_facebook component for Joomla!
CVE-2009-3437 (Cross-site scripting (XSS) vulnerability in the live preview feature ...)
        NOT-FOR-US: Markdown Preview module for Drupal
CVE-2009-3436 (Multiple SQL injection vulnerabilities in forum.asp in MaxWebPortal ...)
        NOT-FOR-US: MaxWebPortal
CVE-2009-3435 (Cross-site scripting (XSS) vulnerability in the variable editor in the ...)
        NOT-FOR-US: Devel module for Drupal
CVE-2009-3434 (SQL injection vulnerability in the Tupinambis (com_tupinambis) ...)
        NOT-FOR-US: com_tupinambis for Mambo and Joomla!
CVE-2009-3433 (Unspecified vulnerability in clsetup in the configuration utility in ...)
        NOT-FOR-US: Sun Solaris Cluster
CVE-2009-3432 (Unspecified vulnerability in xscreensaver in Sun Solaris 10, and ...)
        NOT-FOR-US: Sun OpenSolaris xscreensaver
CVE-2009-3431 (Stack consumption vulnerability in Adobe Reader and Acrobat 9.1.3, ...)
        NOT-FOR-US: Adobe Acrobat
CVE-2009-XXXX [fwbuilder insecure temp file usage]
        - fwbuilder 3.0.7-1 (low; bug #547390)
        [lenny] - fwbuilder <not-affected> (Introduced in 3.0.4)
        [etch] - fwbuilder <not-affected> (Introduced in 3.0.4)
CVE-2009-3892 (Cross-site scripting (XSS) vulnerability in Best Practical Solutions ...)
        - request-tracker3.8 3.8.5-1 (bug #546829)
        - request-tracker3.6 3.6.9-1 (bug #546778)
        [etch] - request-tracker3.6 <not-affected> (vulnerable code not present)
        [lenny] - request-tracker3.6 <no-dsa> (Minor issue)
        TODO: next point update: [lenny] - request-tracker3.6 3.6.7-5+lenny2
        NOTE: CVE id requested
CVE-2009-3430 (SQL injection vulnerability in login.php in Allomani Mobile 2.5 allows ...)
        NOT-FOR-US: Allomani Mobile
CVE-2009-3429 (Stack-based buffer overflow in Pirate Radio Destiny Media Player 1.61 ...)
        NOT-FOR-US: Pirate Radio Destiny Media Player
CVE-2009-3428 (Stack-based buffer overflow in Easy Music Player 1.0.0.2 allows remote ...)
        NOT-FOR-US: Easy Music Player
CVE-2009-3427 (Cross-site scripting (XSS) vulnerability in Kayako SupportSuite ...)
        NOT-FOR-US: Kayako SupportSuite
CVE-2009-3426 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: MaxCMS
CVE-2009-3425 (Directory traversal vulnerability in ...)
        NOT-FOR-US: MaxCMS
CVE-2009-3424 (Multiple PHP remote file inclusion vulnerabilities in MaxCMS 3.11.20b, ...)
        NOT-FOR-US: MaxCMS
CVE-2009-3423 (login.php in Zenas PaoLink 1.0, when register_globals is enabled, ...)
        NOT-FOR-US: Zenas PaoLink
CVE-2009-3422 (login.php in Zenas PaoLiber 1.1, when register_globals is enabled, ...)
        NOT-FOR-US: Zenas PaoLiber
CVE-2009-3421 (login.php in Zenas PaoBacheca Guestbook 2.1, when register_globals is ...)
        NOT-FOR-US: Zenas PaoBacheca Guestbook
CVE-2009-3420 (Multiple cross-site scripting (XSS) vulnerabilities in index.php in ...)
        NOT-FOR-US: Miniweb Publisher module
CVE-2009-3419 (SQL injection vulnerability in index.php in the Publisher module 2.0 ...)
        NOT-FOR-US: Miniweb Publisher module
CVE-2009-3418 (Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow (1) ...)
        NOT-FOR-US: Plume CMS
CVE-2009-3417 (SQL injection vulnerability in the IDoBlog (com_idoblog) component 1.1 ...)
        NOT-FOR-US: IDoBlog component Joomla
CVE-2009-3416
        RESERVED
CVE-2009-3415
        RESERVED
CVE-2009-3414
        RESERVED
CVE-2009-3413
        RESERVED
CVE-2009-3412
        RESERVED
CVE-2009-3411
        RESERVED
CVE-2009-3410
        RESERVED
CVE-2009-3409 (Unspecified vulnerability in the PeopleSoft Enterprise HCM (TAM) ...)
        NOT-FOR-US: Oracle PeopleSoft Enterprise
CVE-2009-3408 (Unspecified vulnerability in the Oracle Application Object Library ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2009-3407 (Unspecified vulnerability in the Portal component in Oracle ...)
        NOT-FOR-US: Oracle Application Server
CVE-2009-3406 (Unspecified vulnerability in the JD Edwards Tools component in Oracle ...)
        NOT-FOR-US: Oracle PeopleSoft Enterprise
CVE-2009-3405 (Unspecified vulnerability in the JD Edwards Tools component in Oracle ...)
        NOT-FOR-US: Oracle PeopleSoft Enterprise
CVE-2009-3404 (Unspecified vulnerability in the PeopleSoft PeopleTools &amp; Enterprise ...)
        NOT-FOR-US: Oracle PeopleSoft Enterprise
CVE-2009-3403 (Unspecified vulnerability in the JRockit component in BEA Product ...)
        NOT-FOR-US: BEA Product Suite
CVE-2009-3402 (Unspecified vulnerability in the Oracle Applications Framework ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2009-3401 (Unspecified vulnerability in the Oracle Applications Technology Stack ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2009-3400 (Unspecified vulnerability in the Oracle Advanced Benefits component in ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2009-3399 (Unspecified vulnerability in the WebLogic Server component in BEA ...)
        NOT-FOR-US: BEA Product Suite
CVE-2009-3398
        RESERVED
CVE-2009-3397 (Unspecified vulnerability in the Oracle Application Object Library ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2009-3396 (Unspecified vulnerability in the WebLogic Server component in BEA ...)
        NOT-FOR-US: BEA Product Suite
CVE-2009-3395 (Unspecified vulnerability in the AutoVue component in Oracle ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2009-3394
        RESERVED
CVE-2009-3393 (Unspecified vulnerability in the Oracle Application Object Library ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2009-3392 (Unspecified vulnerability in the Agile Engineering Data Management ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2009-4193 (Merkaartor 0.14 allows local users to append data to arbitrary files ...)
        - merkaartor 0.14+svnfixes~20090912-2 (low; bug #548546)
        [lenny] - merkaartor <not-affected> (vulnerable code not present)
        NOTE: does not run as root so minor issue.
CVE-2009-XXXX [amsn SSL verification vuln]
        TODO: check, file bug   - amsn <unfixed>
        NOTE: http://www.juniper.net/security/auto/vulnerabilities/vuln35507.html
CVE-2009-XXXX [SA-CORE-2009-008]
        - drupal6 6.14-1 (bug #547140)
        [lenny] - drupal6 6.6-3lenny3
CVE-2009-3391
        RESERVED
CVE-2009-3390 (Multiple unspecified vulnerabilities in the (1) iscsiadm and (2) ...)
        NOT-FOR-US: iscsiadm and iscsitadm programs in Sun Solaris 10
CVE-2009-3389 (Integer overflow in libtheora in Xiph.Org Theora before 1.1, as used ...)
        - libtheora 1.1
        - xulrunner 1.9.1.6-1
        [lenny] - xulrunner <not-affected> (Video playback capabilities were added in 3.5)
CVE-2009-3388 (liboggplay in Mozilla Firefox 3.5.x before 3.5.6 and SeaMonkey before ...)
        - liboggplay <unfixed>
        - xulrunner 1.9.1.6-1
        [lenny] - xulrunner <not-affected> (Video playback capabilities were added in 3.5)
CVE-2009-3387
        RESERVED
CVE-2009-3386 (Template.pm in Bugzilla 3.3.2 through 3.4.3 and 3.5 through 3.5.1 ...)
        - bugzilla <not-affected> (Only 3.3 onwards are affected)
        TODO: recheck, once a more recent (3.3.x or 3.4.x) version has been uploaded
CVE-2009-3385
        RESERVED
CVE-2009-3384 (Multiple unspecified vulnerabilities in WebKit in Apple Safari before ...)
        - webkit 1.1.17-2 (medium; bug #559759)
        - qt4-x11 <undetermined> (bug #561760)
        [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        [lenny] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        - kdelibs <undetermined> (bug #561765)
        - kde4libs <undetermined> (bug #561762)
CVE-2009-3383 (Multiple unspecified vulnerabilities in the JavaScript engine in ...)
        - xulrunner 1.9.1.4-1
        [lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
        [etch] - xulrunner <not-affected> (Only affects Firefox 3.5)
CVE-2009-3382 (layout/base/nsCSSFrameConstructor.cpp in the browser engine in Mozilla ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3381 (Multiple unspecified vulnerabilities in the browser engine in Mozilla ...)
        - xulrunner 1.9.1.4-1
        [lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
        [etch] - xulrunner <not-affected> (Only affects Firefox 3.5)
CVE-2009-3380 (Multiple unspecified vulnerabilities in the browser engine in Mozilla ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3379 (Multiple unspecified vulnerabilities in libvorbis, as used in Mozilla ...)
        {DSA-1939-1}
        - libvorbis 1.2.3-1 (medium)
        - xulrunner 1.9.1.4-1
        [lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
        [etch] - xulrunner <not-affected> (Only affects Firefox 3.5)
CVE-2009-3378 (The oggplay_data_handle_theora_frame function in ...)
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <not-affected> (ogg support added in firefox 3.5)
        [lenny] - xulrunner <not-affected> (ogg support added in firefox 3.5)
        - liboggplay 0.2.1~git20091120-1 (medium; bug #552743)
CVE-2009-3377 (Multiple unspecified vulnerabilities in liboggz before ...)
        - xulrunner 1.9.1.4-1
        [lenny] - xulrunner <not-affected> (Only affects Firefox 3.5)
        [etch] - xulrunner <not-affected> (Only affects Firefox 3.5)
        - liboggz 0.9.9-1 (medium)
CVE-2009-3376 (Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3375 (content/html/document/src/nsHTMLDocument.cpp in Mozilla Firefox 3.0.x ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <not-affected> (Only affects Firefox 3.x)
CVE-2009-3374 (The XPCVariant::VariantDataToJS function in the XPCOM implementation ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3373 (Heap-based buffer overflow in the GIF image parser in Mozilla Firefox ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <not-affected> (Only affects Firefox 3.x)
CVE-2009-3372 (Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3371 (Use-after-free vulnerability in Mozilla Firefox 3.5.x before 3.5.4 ...)
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <not-affected> (web workers introduced in firefox 3.5)
        [lenny] - xulrunner <not-affected> (web workers introduced in firefox 3.5)
        - kompozer <unfixed> (unimportant; bug #555326)
        NOTE: kompozer shares the browser engine with Firefox, but JavaScript is not enabled
CVE-2009-3370 (Mozilla Firefox before 3.0.15, and 3.5.x before 3.5.4, allows remote ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3368 (Cross-site scripting (XSS) vulnerability in the Hotel Booking ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-3367 (Multiple cross-site scripting (XSS) vulnerabilities in An image ...)
        NOT-FOR-US: An image gallery 1.0
CVE-2009-3366 (Directory traversal vulnerability in navigation.php in An image ...)
        NOT-FOR-US: An image gallery 1.0
CVE-2009-3365 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: Aurora CMS
CVE-2009-3364 (Stack-based buffer overflow in FTPShell Client 4.1 RC2 allows remote ...)
        NOT-FOR-US: FTPShell Client
CVE-2009-3363 (Cross-site scripting (XSS) vulnerability in the BUEditor module 5.x ...)
        NOT-FOR-US: a module for Drupal
CVE-2009-3362 (PHP remote file inclusion vulnerability in printnews.php3 in SZNews ...)
        NOT-FOR-US: SZNews
CVE-2009-3361 (SQL injection vulnerability in index.php in PHP-IPNMonitor allows ...)
        NOT-FOR-US: PHP-IPNMonitor
CVE-2009-3360 (Multiple cross-site scripting (XSS) vulnerabilities in Datemill 1.0 ...)
        NOT-FOR-US: Datemill
CVE-2009-3359 (Multiple cross-site scripting (XSS) vulnerabilities in Match Agency ...)
        NOT-FOR-US: Match Agency BiZ
CVE-2009-3358 (SQL injection vulnerability in profile.php in Tourism Scripts Adult ...)
        NOT-FOR-US: Tourism Scripts Adult
CVE-2009-3357 (Multiple SQL injection vulnerabilities in the Hotel Booking ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-3356 (SQL injection vulnerability in index.php in Image voting 1.0 allows ...)
        NOT-FOR-US: Image voting
CVE-2009-3355 (Cross-site scripting (XSS) vulnerability in profile.php in Datetopia ...)
        NOT-FOR-US: Datetopia Buy Dating Site
CVE-2009-3354 (Multiple unspecified vulnerabilities in the Rest API module for Drupal ...)
        NOT-FOR-US: Rest API module for Drupal 
CVE-2009-3353 (Multiple unspecified vulnerabilities in the Node2Node module for ...)
        NOT-FOR-US: Node2Node module for Drupal
CVE-2009-3352 (Multiple unspecified vulnerabilities in the quota_by_role (Quota by ...)
        NOT-FOR-US: quota_by_role (Quota by role) module for Drupal 
CVE-2009-3351 (Multiple unspecified vulnerabilities in the Node Browser module for ...)
        NOT-FOR-US: Node Browser module for Drupal 
CVE-2009-3350 (Multiple unspecified vulnerabilities in the Subdomain Manager module ...)
        NOT-FOR-US: Subdomain Manager module for Drupal
CVE-2009-3349 (SQL injection vulnerability in Datavore Gyro 5.0 allows remote ...)
        NOT-FOR-US: Datavore Gyro
CVE-2009-3348 (Cross-site scripting (XSS) vulnerability in Datavore Gyro 5.0 allows ...)
        NOT-FOR-US: Datavore Gyro
CVE-2009-3347 (Buffer overflow on the D-Link DIR-400 wireless router allows remote ...)
        NOT-FOR-US: D-Link DIR-400 wireless router
CVE-2009-3346 (Unspecified vulnerability in SAP Crystal Reports Server 2008 allows ...)
        NOT-FOR-US: SAP Crystal Reports Server
CVE-2009-3345 (Heap-based buffer overflow in SAP Crystal Reports Server 2008 has ...)
        NOT-FOR-US: SAP Crystal Reports Server
CVE-2009-3344 (Unspecified vulnerability in SAP Crystal Reports Server 2008 on ...)
        NOT-FOR-US: SAP Crystal Reports Server
CVE-2009-3343 (SQL injection vulnerability in details.asp in HotWeb Rentals allows ...)
        NOT-FOR-US: HotWeb Rentals
CVE-2009-3342 (SQL injection vulnerability in frontend/assets/ajax/checkusername.php ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-3341 (Buffer overflow on the Linksys WRT54GL wireless router allows remote ...)
        NOT-FOR-US: Linksys WRT54GL wireless router
CVE-2009-3340 (Unspecified vulnerability in FreeSSHD 1.2.4 allows remote attackers to ...)
        NOT-FOR-US: FreeSSHD
CVE-2009-3339 (Unspecified vulnerability in McAfee Email and Web Security Appliance ...)
        NOT-FOR-US: McAfee Email and Web Security Appliance
CVE-2009-3338 (Stack-based buffer overflow in EffectMatrix (E.M.) Magic Morph 1.95b ...)
        NOT-FOR-US: Magic Morph 
CVE-2009-3337 (SQL injection vulnerability in the Freetag (serendipity_event_freetag) ...)
        NOT-FOR-US: plugin for Serendipity
CVE-2009-3336 (SQL injection vulnerability in auction_details.php in PHP Pro Bid ...)
        NOT-FOR-US: PHP Pro Bid
CVE-2009-3335 (SQL injection vulnerability in the TurtuShout component 0.11 for ...)
        NOT-FOR-US: TurtuShout component 0.11 for Joomla!
CVE-2009-3334 (SQL injection vulnerability in the Lhacky! Extensions Cave Joomla! ...)
        NOT-FOR-US: Lhacky! Extensions Cave Joomla!
CVE-2009-3333 (PHP remote file inclusion vulnerability in koesubmit.php in the ...)
        NOT-FOR-US: koeSubmit (com_koesubmit) component 1.0 for Mambo
CVE-2009-3332 (SQL injection vulnerability in the JBudgetsMagic (com_jbudgetsmagic) ...)
        NOT-FOR-US: BudgetsMagic (com_jbudgetsmagic) component for Joomla!
CVE-2009-3331 (Multiple PHP remote file inclusion vulnerabilities in DDL CMS 1.0 ...)
        NOT-FOR-US: DDL CMS
CVE-2009-3330 (SQL injection vulnerability in index.php in cP Creator 2.7.1, when ...)
        NOT-FOR-US: cP Creator
CVE-2009-3329 (Stack-based buffer overflow in Winplot 1.25.0.1 allows user-assisted ...)
        NOT-FOR-US: Winplot
CVE-2009-3328 (Cross-site scripting (XSS) vulnerability in sign.php in WX-Guestbook ...)
        NOT-FOR-US: WX-Guestbook
CVE-2009-3327 (Multiple SQL injection vulnerabilities in WX-Guestbook 1.1.208 allow ...)
        NOT-FOR-US: WX-Guestbook
CVE-2009-3326 (SQL injection vulnerability in index.php in CMScontrol Content ...)
        NOT-FOR-US: CMScontrol
CVE-2009-3325 (SQL injection vulnerability in the Focusplus Developments Survey ...)
        NOT-FOR-US: Survey Manager (com_surveymanager) component 1.5.0 for Joomla!
CVE-2009-3324 (PHP remote file inclusion vulnerability in include/prodler.class.php ...)
        NOT-FOR-US: ProdLer
CVE-2009-3323 (Multiple PHP remote file inclusion vulnerabilities in BAnner ROtation ...)
        NOT-FOR-US: BAnner ROtation System mini (BAROSmini)
CVE-2009-3322 (The Siemens Gigaset SE361 WLAN router allows remote attackers to cause ...)
        NOT-FOR-US: Siemens Gigaset SE361 WLAN router
CVE-2009-3321 (SQL injection vulnerability in SaphpLesson 4.3, when magic_quotes_gpc ...)
        NOT-FOR-US: SaphpLesson
CVE-2009-3320 (Cross-site scripting (XSS) vulnerability in scrivi.php in Zenas ...)
        NOT-FOR-US: Zenas PaoLink (aka Pao-Link)
CVE-2009-3319 (SQL injection vulnerability in poems.php in DCI-Designs Dawaween 1.03 ...)
        NOT-FOR-US: DCI-Designs Dawaween
CVE-2009-3318 (Directory traversal vulnerability in the Roland Breedveld Album ...)
        NOT-FOR-US: Roland Breedveld Album (com_album) component 1.14 for Joomla!
CVE-2009-3317 (PHP remote file inclusion vulnerability in pages/pageHeader.php in ...)
        NOT-FOR-US: OpenSiteAdmin
CVE-2009-3316 (SQL injection vulnerability in the JReservation (com_jreservation) ...)
        NOT-FOR-US: JReservation (com_jreservation) component 1.0 and 1.5 for Joomla!
CVE-2009-3315 (SQL injection vulnerability in admin/index.php in NeLogic Nephp ...)
        NOT-FOR-US: NeLogic Nephp Publisher Enterprise
CVE-2009-3314 (SQL injection vulnerability in ladders.php in Elite Gaming Ladders 3.2 ...)
        NOT-FOR-US: Elite Gaming Ladders
CVE-2009-3313 (Multiple SQL injection vulnerabilities in FMyClone 2.3 allow remote ...)
        NOT-FOR-US: FMyClone
CVE-2009-3312 (PHP remote file inclusion vulnerability in php/init.poll.php in ...)
        NOT-FOR-US: phpPollScript
CVE-2009-3311 (Cross-site scripting (XSS) vulnerability in index.php in ...)
        NOT-FOR-US: RSSMediaScript
CVE-2009-3310 (SQL injection vulnerability in index.php in Zainu 1.0 allows remote ...)
        NOT-FOR-US: Zainu
CVE-2009-3309 (SQL injection vulnerability in index.cfm in CF ShopKart 5.4 beta ...)
        NOT-FOR-US: CF ShopKart
CVE-2009-3308 (SQL injection vulnerability in show-cat.php in FanUpdate 2.2.1 allows ...)
        NOT-FOR-US: FanUpdate
CVE-2009-3307 (Multiple PHP remote file inclusion vulnerabilities in FSphp 0.2.1 ...)
        NOT-FOR-US: FSphp
CVE-2009-3306 (PHP remote file inclusion vulnerability in include/header.php in ...)
        NOT-FOR-US: ClearSite
CVE-2009-3305 (Polipo 1.0.4, and possibly other versions, allows remote attackers to ...)
        - polipo 1.0.4-1.1 (low; bug #547047)
        [etch] - polipo <no-dsa> (Minor issue)
        [lenny] - polipo <no-dsa> (Minor issue)
CVE-2009-3304 (GForge 4.5.14, 4.7 rc2, and 4.8.2 allows local users to overwrite ...)
        {DSA-1945-1}
        - gforge  4.8.2-1
CVE-2009-3303 (Cross-site scripting (XSS) vulnerability in www/help/tracker.php in ...)
        {DSA-1937-1}
        - gforge 4.8.1-3 (low)
CVE-2009-3302
        RESERVED
CVE-2009-3301
        RESERVED
CVE-2009-3300 (Multiple cross-site scripting (XSS) vulnerabilities in the Identity ...)
        {DSA-1947-1}
        - shibboleth-sp2 2.3+dfsg-1 (medium; bug #555608)
        - shibboleth-sp <removed> (medium)
        NOTE: xmltooling/opensaml2 also needs to be updated, changed in sid in 1.3.1-1/2.3-1
CVE-2009-3299 (Cross-site scripting (XSS) vulnerability in the resume blocktype in ...)
        {DSA-1924-1}
        - mahara 1.1.7-1 (low)
        NOTE: http://mahara.org/interaction/forum/topic.php?id=1170
CVE-2009-3298 (Mahara before 1.0.13, and 1.1.x before 1.1.7, allows remote ...)
        {DSA-1924-1}
        - mahara 1.1.7-1 (low)
        NOTE: http://mahara.org/interaction/forum/topic.php?id=1169
CVE-2009-3297
        RESERVED
CVE-2009-3296 (Multiple integer overflows in tiffread.c in CamlImages 2.2 might allow ...)
        {DSA-1912-2 DSA-1912-1}
        - camlimages 1:3.0.1-5 (low)
        - advi 1.6.0-15 (low; bug #551282)
CVE-2009-3295 (The prep_reprocess_req function in kdc/do_tgs_req.c in the cross-realm ...)
        - krb5 1.7+dfsg-4 (medium)
        [lenny] - krb5 <not-affected> (code introduced in 1.7)
        [etch] - krb5 <not-affected> (code introduced in 1.7)
CVE-2009-3294 (The popen API function in TSRM/tsrm_win32.c in PHP before 5.2.11 and ...)
        - php5 <not-affected> (win32-specific)
CVE-2009-3293 (Unspecified vulnerability in the imagecolortransparent function in PHP ...)
        - php5 <not-affected> (the php packages use the system libgd2)
        - php4 <not-affected> (the php packages use the system libgd2)
        NOTE: the transparent colours functionality is only on php5's bundled libgd2
        TODO: watch for possible merge of the transparent colours functionality into libgd2
CVE-2009-3292 (Unspecified vulnerability in PHP before 5.2.11, and 5.3.x before ...)
        {DSA-1940-1}
        - php5 5.2.11.dfsg.1-1 (low)
        NOTE: unknown impact, it is related to missing sanity checks
        NOTE: when determining the length of sections of jpg headers
        NOTE: a missing limit on the nesting level of TIFF files, and
        NOTE: missing EOF checks, possibly leading to NULL dereferences
        NOTE: experimental is likely to be affected (as of 5.3.0)
        TODO: check php4
CVE-2009-3291 (The php_openssl_apply_verification_policy function in PHP before ...)
        {DSA-1940-1}
        - php5 5.2.11.dfsg.1-1 (low)
        [lenny] - php5 <no-dsa> (rather unimportant)
        [etch] - php5 <no-dsa> (rather unimportant)
        NOTE: seems to be related to handling of \0 on CN
        NOTE: not worth a dsa on its own, php doesn't verify certificates by default
        NOTE: experimental is likely to be affected (as of 5.3.0)
        TODO: check php4
CVE-2009-3289 (The g_file_copy function in glib 2.0 sets the permissions of a target ...)
        - glib2.0 2.22.0-1 (low)
        [lenny] - glib2.0 <no-dsa> (Minor issue)
        TODO: next point update: [lenny] - glib2.0 2.16.6-3
        [etch] - glib2.0 <no-dsa> (Minor issue)
CVE-2009-3287 (lib/thin/connection.rb in Thin web server before 1.2.4 relies on the ...)
        - thin 1.2.4-1 (low)
CVE-2009-3285
        RESERVED
CVE-2009-3284 (Directory traversal vulnerability in phpspot PHP BBS, PHP Image ...)
        NOT-FOR-US: phpspot Products
CVE-2009-3283 (Cross-site scripting (XSS) vulnerability in phpspot PHP BBS, PHP Image ...)
        NOT-FOR-US: phpspot Products
CVE-2009-3282 (Integer overflow in the vmx86 kernel extension in VMware Fusion before ...)
        NOT-FOR-US: VMware Fusion
CVE-2009-3281 (The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 ...)
        NOT-FOR-US: VMware Fusion
CVE-2009-3280 (Integer signedness error in the find_ie function in ...)
        - linux-2.6 2.6.31-1 (medium)
        - linux-2.6.24 <not-affected> (vulnerable code not present)
        [etch] - linux-2.6 <not-affected> (vulnerable code not present)
        [lenny] - linux-2.6 <not-affected> (vulnerable code not present)
CVE-2009-3279 (The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 ...)
        NOT-FOR-US: QNAP TS-239 Pro and TS-639
CVE-2009-3278 (The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 ...)
        NOT-FOR-US: QNAP TS-239 Pro and TS-639 
CVE-2009-3277 (DataVault.Tesla/Impl/TypeSystem/AssociationHelper.cs in datavault ...)
        NOT-FOR-US: datavault
CVE-2009-3276 (Zoran/WinFormsAdvansed/RegeularDataToXML/Form1.cs in WinFormsAdvansed ...)
        NOT-FOR-US: NASD CORE.NET Terelik (aka corenet1)
CVE-2009-3275 (Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs ...)
        NOT-FOR-US: Microsoft patterns & practices Enterprise Library
CVE-2009-3274 (Mozilla Firefox 3.6a1, 3.5.3, 3.5.2, and earlier 3.5.x versions, and ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.4-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3273 (iPhone Mail in Apple iPhone OS, and iPhone OS for iPod touch, does not ...)
        NOT-FOR-US: Apple iPhone
CVE-2009-3272 (Stack consumption vulnerability in WebKit.dll in WebKit in Apple ...)
        - webkit <unfixed> (unimportant; bug #559759)
        - qt4-x11 <unfixed> (unimportant)
        [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        [lenny] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        - kdelibs <unfixed> (unimportant)
        - kde4libs <unfixed> (unimportant)
        NOTE: browser crashers are not considered security-relevant
CVE-2009-3271 (Apple Safari on iPhone OS 3.0.1 allows remote attackers to cause a ...)
        NOT-FOR-US: Apple Safari on iPhone OS 3.0.1
CVE-2009-3290 (The kvm_emulate_hypercall function in arch/x86/kvm/x86.c in KVM in the ...)
        {DSA-1915-1 DSA-1907-1 DTSA-203-1}
        - linux-2.6 2.6.31-1 (medium)
        [etch] - linux-2.6 <not-affected> (introduced in 2.6.25)
        - linux-2.6.24 <not-affected> (introduced in 2.6.25)
        - kvm 85+dfsg-4.1 (high; bug #548975)
CVE-2009-3288 (The sg_build_indirect function in drivers/scsi/sg.c in Linux kernel ...)
        - linux-2.6 2.6.31-1 (low)
        [etch] - linux-2.6 <not-affected> (introduced in 2.6.28)
        [lenny] - linux-2.6 <not-affected> (introduced in 2.6.28)
        - linux-2.6.24 <not-affected> (introduced in 2.6.28)
CVE-2009-3286 (NFSv4 in the Linux kernel 2.6.18, and possibly other versions, does ...)
        {DSA-1929-1 DSA-1928-1 DSA-1915-1}
        - linux-2.6 2.6.30-1 (low)
        - linux-2.6.24 <removed>
CVE-2009-3270 (Microsoft Internet Explorer 7 through 7.0.6000.16711 allows remote ...)
        NOT-FOR-US: Microsoft Internet Explorer 7
CVE-2009-3269 (Opera 9.52 and earlier allows remote attackers to cause a denial of ...)
        NOT-FOR-US: Opera
CVE-2009-3268 (Google Chrome 1.0.154.48 and earlier allows remote attackers to cause ...)
        - chromium-browser <itp> (bug #520324)
CVE-2009-3267 (Microsoft Internet Explorer 6 through 6.0.2900.2180, and ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3266 (Opera before 10.01 does not properly restrict HTML in a (1) RSS or (2) ...)
        NOT-FOR-US: Opera
CVE-2009-3265 (Cross-site scripting (XSS) vulnerability in Opera 9 and 10 allows ...)
        NOT-FOR-US: Opera
CVE-2009-3264 (The getSVGDocument method in Google Chrome before 3.0.195.21 omits an ...)
        - chromium-browser <itp> (bug #520324)
CVE-2009-3263 (Cross-site scripting (XSS) vulnerability in Google Chrome 2.x and 3.x ...)
        - chromium-browser <itp> (low; bug #520324)
        NOTE: http://seclists.org/fulldisclosure/2009/Sep/201
        NOTE: other browsers are not affected (only chrome and opera)
CVE-2009-3262 (Cross-site scripting (XSS) vulnerability in the Self Service UI (SSUI) ...)
        NOT-FOR-US: IBM Tivoli Identity Manager
CVE-2009-3261 (update/update_0.1.2_to_0.2.php in LiveStreet 0.2 does not require ...)
        NOT-FOR-US: LiveStreet
CVE-2009-3260 (Cross-site scripting (XSS) vulnerability in LiveStreet 0.2 allows ...)
        NOT-FOR-US: LiveStreet
CVE-2009-3259 (Multiple SQL injection vulnerabilities in RASH Quote Management System ...)
        NOT-FOR-US: RASH Quote Management System (RQMS)
CVE-2009-3258 (vtiger CRM before 5.1.0 allows remote authenticated users, with ...)
        NOT-FOR-US: vtiger CRM 
CVE-2009-3257 (vtiger CRM before 5.1.0 allows remote authenticated users to bypass ...)
        NOT-FOR-US: vtiger CRM
CVE-2009-3256 (Cross-site scripting (XSS) vulnerability in include/ajax/blogInfo.php ...)
        NOT-FOR-US: LiveStreet
CVE-2009-3255 (SQL injection vulnerability in RASH Quote Management System (RQMS) ...)
        NOT-FOR-US: RASH Quote Management System (RQMS)
CVE-2009-3254 (Multiple stack-based buffer overflows in Ultimate Player 1.56 beta ...)
        NOT-FOR-US: Ultimate Player
CVE-2009-3253 (Stack-based buffer overflow in TriceraSoft Swift Ultralite 1.032 ...)
        NOT-FOR-US: TriceraSoft Swift Ultralite
CVE-2009-3252 (Multiple SQL injection vulnerabilities in news.php in Rock Band CMS ...)
        NOT-FOR-US: Rock Band CMS
CVE-2009-3251 (include/utils/ListViewUtils.php in vtiger CRM before 5.1.0 allows ...)
        NOT-FOR-US: vtiger CRM
CVE-2009-3250 (The saveForwardAttachments procedure in the Compose Mail functionality ...)
        NOT-FOR-US: vtiger CRM
CVE-2009-3249 (Multiple directory traversal vulnerabilities in vtiger CRM 5.0.4 allow ...)
        NOT-FOR-US: vtiger CRM
CVE-2009-3248 (Cross-site request forgery (CSRF) vulnerability in the RSS module in ...)
        NOT-FOR-US: vtiger CRM
CVE-2009-3247 (Cross-site scripting (XSS) vulnerability in the Activities module in ...)
        NOT-FOR-US: vtiger CRM
CVE-2009-3246 (SQL injection vulnerability in spnews.php in MyBuxScript PTC-BUX ...)
        NOT-FOR-US: MyBuxScript PTC-BUX
CVE-2008-7246 (Google Chrome 0.2.149.29 and earlier allows remote attackers to cause ...)
        - chromium-browser <itp> (bug #520324)
CVE-2008-7245 (Opera 9.52 and earlier allows remote attackers to cause a denial of ...)
        NOT-FOR-US: Opera
CVE-2008-7244 (Mozilla Firefox 3.0.1 and earlier allows remote attackers to cause a ...)
        TODO: check
CVE-2009-3245
        RESERVED
CVE-2009-3244 (Heap-based buffer overflow in the SwDir.dll ActiveX control in Adobe ...)
        NOT-FOR-US: Adobe ShockWave Player 
CVE-2009-3243 (Unspecified vulnerability in the TLS dissector in Wireshark 1.2.0 and ...)
        - wireshark <not-affected> (Windows-only issue)
CVE-2009-3242 (Unspecified vulnerability in packet.c in the GSM A RR dissector in ...)
        - wireshark 1.2.2-1 (low; bug #547704)
        [etch] - wireshark <not-affected> (Only affects 1.2.x)
        [lenny] - wireshark <not-affected> (Only affects 1.2.x)
CVE-2009-3241 (Unspecified vulnerability in the OpcUa (OPC UA) dissector in Wireshark ...)
        {DSA-1942-1}
        - wireshark 1.2.2-1 (low; bug #547704)
        [etch] - wireshark <not-affected> (Only affects >= 0.99.6)
        [lenny] - wireshark <no-dsa> (Minor issue, targeted for next point release)
        TODO: next point release: [lenny] - wireshark 1.0.2-3+lenny6
CVE-2009-3240 (Cross-site scripting (XSS) vulnerability in the Happy Linux XF-Section ...)
        NOT-FOR-US: module for XOOPS
CVE-2009-3239
        REJECTED
        - openoffice.org <not-affected>
        NOTE: SUSE says that it is not a dup of CVE-2009-2139 and CVE-2009-2140...
CVE-2009-3238 (The get_random_int function in drivers/char/random.c in the Linux ...)
        {DSA-1929-1 DSA-1928-1 DSA-1927-1}
        - linux-2.6 2.6.30-1 (low)
        - linux-2.6.24 <removed> (low)
CVE-2009-3237 (Multiple cross-site scripting (XSS) vulnerabilities in Horde ...)
        - horde3 3.3.5+debian0-1 (low)
        [lenny] - horde3 3.2.2+debian0-2+lenny1
        NOTE: horde3 issue fixed in backport of latest DSA, DSA however did not fix etch
CVE-2009-3235 (Multiple stack-based buffer overflows in the Sieve plugin in Dovecot ...)
        {DSA-1893-1 DSA-1892-1}
        - cyrus-imapd-2.2 2.2.13-17 (medium; bug #547947)
        - kolab-cyrus-imapd 2.2.13-5.1 (medium; bug #547712)
        - dovecot 1:1.2.1-1 (medium; bug #546656)
        NOTE: This is a different vulnerability than CVE-2009-2632, it covers a few additional buffer overflows
CVE-2009-3228 (The tc_fill_tclass function in net/sched/sch_api.c in the tc subsystem ...)
        {DSA-1929-1 DSA-1928-1 DSA-1927-1}
        - linux-2.6 2.6.31-1 (low)
        - linux-2.6.24 <removed> (low)
CVE-2005-4881 (The netlink subsystem in the Linux kernel 2.4.x before 2.4.37.6 and ...)
        - linux-2.6 2.6.13-1 (low)
        - linux-2.6.24 <not-affected> (fixed prior to first upload of 2.6.24)
CVE-2009-3236 (The form library in Horde Application Framework 3.2 before 3.2.5 and ...)
        {DSA-1897-1}
        - horde3 3.3.5+debian0-1 (medium; bug #547318)
CVE-2008-7243 (Cross-site request forgery (CSRF) vulnerability in page 34 in MODx CMS ...)
        NOT-FOR-US: MODx CMS
CVE-2008-7242 (Multiple cross-site scripting (XSS) vulnerabilities in MODx CMS ...)
        NOT-FOR-US: MODx CMS
CVE-2008-7241 (Cross-site request forgery (CSRF) vulnerability in PunBB before 1.2.17 ...)
        NOT-FOR-US: PunBB
CVE-2008-7240 (Directory traversal vulnerability in include/unverified.inc.php in ...)
        NOT-FOR-US: Linux Web Shop (LWS) php User Base
CVE-2009-XXXX [webkit: potential ssl certificate null character stripping vulnerability]
        - webkit <unfixed> (medium; bug #547217)
        TODO: asked maintainer to check; follow-up
CVE-2009-3234 (Buffer overflow in the perf_copy_attr function in ...)
        - linux-2.6 <not-affected> (Introduced in 2.6.31, fixed in Debian package before initial 2.6.31 upload)
        - linux-2.6.24 <not-affected> (Introduced in 2.6.31)
CVE-2009-3227 (Cross-site scripting (XSS) vulnerability in index.php in AlmondSoft ...)
        NOT-FOR-US: AlmondSoft Almond Classifieds Ads Enterprise
CVE-2009-3226 (SQL injection vulnerability in index.php in AlmondSoft Almond ...)
        NOT-FOR-US: AlmondSoft Almond Classifieds Ads Enterprise
CVE-2009-3225 (Multiple cross-site scripting (XSS) vulnerabilities in AlmondSoft ...)
        NOT-FOR-US: AlmondSoft Almond Classifieds Wap and Pro
CVE-2009-3224 (SQL injection vulnerability in index.php in Super Mod System, when ...)
        NOT-FOR-US: Super Mod System
CVE-2009-3223 (SQL injection vulnerability in ppc-add-keywords.php in Inout Adserver ...)
        NOT-FOR-US: Inout Adserver
CVE-2009-3222 (Cross-site scripting (XSS) vulnerability in index.php in ...)
        NOT-FOR-US: FreeWebScriptz Honest Traffic
CVE-2009-3221 (Stack-based buffer overflow in Audio Lib Player (ALP) allows remote ...)
        NOT-FOR-US: Audio Lib Player (ALP)
CVE-2009-3220 (PHP remote file inclusion vulnerability in cp_html2txt.php in All In ...)
        NOT-FOR-US: All In One Control Panel
CVE-2009-3219 (Directory traversal vulnerability in a.php in AR Web Content Manager ...)
        NOT-FOR-US: AR Web Content Manager
CVE-2009-3218 (SQL injection vulnerability in control/login.php in AR Web Content ...)
        NOT-FOR-US: AR Web Content Manager
CVE-2009-3217 (SQL injection vulnerability in the admin module in iWiccle 1.01 allows ...)
        NOT-FOR-US: iWiccle
CVE-2009-3216 (Multiple directory traversal vulnerabilities in iWiccle 1.01, when ...)
        NOT-FOR-US: iWiccle
CVE-2009-3215 (SQL injection vulnerability in IXXO Cart Standalone before 3.9.6.1, ...)
        NOT-FOR-US: IXXO Cart Standalone
CVE-2009-3214 (Multiple stack-based buffer overflows in Photodex ProShow Gold ...)
        NOT-FOR-US: Photodex ProShow Gold
CVE-2009-3213 (Stack-based buffer overflow in broid 1.0 Beta 3a allows remote ...)
        NOT-FOR-US: broid
CVE-2009-3212 (SQL injection vulnerability in VivaPrograms Infinity Script 2.x.x, ...)
        NOT-FOR-US: VivaPrograms Infinity Script
CVE-2009-3211 (Directory traversal vulnerability in VivaPrograms Infinity Script ...)
        NOT-FOR-US: VivaPrograms Infinity Script
CVE-2009-3210 (Multiple cross-site scripting (XSS) vulnerabilities in the Print (aka ...)
        NOT-FOR-US: Print (aka Printer, e-mail and PDF versions) Drupal module (3rd party module)
CVE-2009-3209 (SQL injection vulnerability in remove.php in PHP eMail Manager 3.3.0 ...)
        NOT-FOR-US: PHP eMail Manager
CVE-2009-3208 (Multiple SQL injection vulnerabilities in phpfreeBB 1.0 allow remote ...)
        NOT-FOR-US: phpfreeBB
CVE-2009-3207 (The ImageCache module 5.x before 5.x-2.5 and 6.x before ...)
        NOT-FOR-US: ImageCache module for Drupal (3rd party module)
CVE-2009-3206 (Multiple cross-site scripting (XSS) vulnerabilities in the ImageCache ...)
        NOT-FOR-US: ImageCache module for Drupal (3rd party module)
CVE-2009-3205 (SQL injection vulnerability in main.php in CBAuthority allows remote ...)
        NOT-FOR-US: CBAuthority
CVE-2009-3204 (Multiple cross-site scripting (XSS) vulnerabilities in Stiva Forum 1.0 ...)
        NOT-FOR-US: Stiva Forum
CVE-2009-3203 (SQL injection vulnerability in store.php in AJ Auction Pro OOPD 2.x ...)
        NOT-FOR-US: AJ Auction Pro OOPD
CVE-2009-3202 (Cross-site scripting (XSS) vulnerability in search.php in ULoKI PHP ...)
        NOT-FOR-US: ULoKI PHP Forum
CVE-2009-3201 (Integer overflow in Media Player Classic 6.4.9 allows user-assisted ...)
        NOT-FOR-US: Media Player Classic
CVE-2009-3200 (The QNAP TS-239 Pro and TS-639 Pro with firmware 2.1.7 0613, 3.1.0 ...)
        NOT-FOR-US: QNAP TS-239 Pro and TS-639 Pro
CVE-2009-3199 (Uebimiau Webmail 3.2.0-2.0 stores sensitive information under the web ...)
        NOT-FOR-US: Uebimiau Webmail
CVE-2009-3198 (Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech ...)
        NOT-FOR-US: Affiliate Master
CVE-2009-3197 (Cross-site scripting (XSS) vulnerability in search.php in JCE-Tech PHP ...)
        NOT-FOR-US: JCE-Tech PHP Calendars
CVE-2009-3196 (Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech PHP ...)
        NOT-FOR-US: JCE-Tech PHP Video Script
CVE-2009-3195 (Multiple cross-site scripting (XSS) vulnerabilities in JCE-Tech ...)
        NOT-FOR-US: JCE-Tech Auction RSS Content Script
CVE-2009-3194 (Cross-site scripting (XSS) vulnerability in index.php in JCE-Tech ...)
        NOT-FOR-US: JCE-Tech SearchFeed Script 
CVE-2009-3193 (SQL injection vulnerability in the DigiFolio (com_digifolio) component ...)
        NOT-FOR-US: component for Joomla!
CVE-2009-3192 (Multiple cross-site scripting (XSS) vulnerabilities in index.php in ...)
        NOT-FOR-US: LinkorCMS
CVE-2009-3191 (Multiple cross-site scripting (XSS) vulnerabilities in PAD Site ...)
        NOT-FOR-US: PAD Site Scripts 
CVE-2009-3190 (Multiple SQL injection vulnerabilities in PAD Site Scripts 3.6 allow ...)
        NOT-FOR-US: PAD Site Scripts
CVE-2009-3189 (Cross-site scripting (XSS) vulnerability in search.php in DigiOz ...)
        NOT-FOR-US: DigiOz Guestbook
CVE-2009-3188 (PHP remote file inclusion vulnerability in save.php in phpSANE 0.5.0 ...)
        NOT-FOR-US: phpSANE
CVE-2009-3187 (Cross-site scripting (XSS) vulnerability in gamelist.php in Stand ...)
        NOT-FOR-US: Stand Alone Arcade 
CVE-2009-3186 (Multiple cross-site scripting (XSS) vulnerabilities in VideoGirls BiZ ...)
        NOT-FOR-US: VideoGirls BiZ
CVE-2009-3185 (SQL injection vulnerability in plugin.php in the Crazy Star plugin 2.0 ...)
        NOT-FOR-US: Crazy Star plugin 2.0 for Discuz!
CVE-2009-3184 (Multiple SQL injection vulnerabilities in index.php in Pirates of The ...)
        NOT-FOR-US: Pirates of The Caribbean
CVE-2009-3233 (changetrack 4.3 allows local users to execute arbitrary commands via ...)
        {DSA-1891-1}
        - changetrack 4.5-2 (medium; bug #546791)
CVE-2008-7228 (Multiple format string vulnerabilities in White_Dune before ...)
        - whitedune <not-affected> (bug #546903)
        NOTE: The debian binary versions are not compiled with the --with-aflockdebug option
CVE-2008-7224 (Buffer overflow in entity_cache in ELinks before 0.11.4rc0 allows ...)
        {DSA-1902-1}
        - elinks 0.11.3-1 (low; bug #380347)
CVE-2009-3183 (Heap-based buffer overflow in w in Sun Solaris 8 through 10, and ...)
        NOT-FOR-US: Sun Solaris
CVE-2008-7239 (Multiple unspecified vulnerabilities in Oracle E-Business Suite ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2008-7238 (Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.3 ...)
        NOT-FOR-US: Oracle E-Business Suite
CVE-2008-7237 (Unspecified vulnerability in the Oracle Internet Directory component ...)
        NOT-FOR-US: Oracle Application Server
CVE-2008-7236 (Unspecified vulnerability in the Oracle JDeveloper component in Oracle ...)
        NOT-FOR-US: Oracle Application Server
CVE-2008-7235 (Unspecified vulnerability in the Oracle Forms component in Oracle ...)
        NOT-FOR-US: Oracle Application Server
CVE-2008-7234 (Unspecified vulnerability in the Oracle BPEL Worklist Application ...)
        NOT-FOR-US: Oracle Application Server
CVE-2008-7233 (Unspecified vulnerability in the E-Business Application client, as ...)
        NOT-FOR-US: E-Business Application client
CVE-2008-7232 (Buffer overflow in the report function in xtacacsd 4.1.2 and earlier ...)
        NOT-FOR-US: xtacacsd
CVE-2008-7231 (Cross-site scripting (XSS) vulnerability in Meridio Document and ...)
        NOT-FOR-US: Meridio Document and Records Management
CVE-2008-7230 (Unspecified vulnerability in Small Footprint CIM Broker (SFCB) before ...)
        NOT-FOR-US: Small Footprint CIM Broker
CVE-2008-7229 (GreenSQL Firewall (greensql-fw) before 0.9.2 allows remote attackers ...)
        NOT-FOR-US: GreenSQL Firewall
CVE-2008-7227 (PartialBufferOutputStream2 in GeoServer before 1.6.1 and 1.7.0-beta1 ...)
        NOT-FOR-US: GeoServer
CVE-2008-7226 (SQL injection vulnerability in index.php in the Recipes module 1.3, ...)
        NOT-FOR-US: Recipes module for PHP-Nuke
CVE-2008-7225 (Heap-based buffer overflow in Foxit Remote Access Server (aka WAC ...)
        NOT-FOR-US: Foxit Remote Access Server
CVE-2008-7223 (Multiple cross-site scripting (XSS) vulnerabilities in LinPHA before ...)
        NOT-FOR-US: LinPHA
CVE-2008-7222 (Cross-site scripting (XSS) vulnerability in system/admin.php in RunCMS ...)
        NOT-FOR-US: RunCMS
CVE-2008-7221 (Cross-site request forgery (CSRF) vulnerability in RunCMS 1.6.1 allows ...)
        NOT-FOR-US: RunCMS
CVE-2009-3166 (token.cgi in Bugzilla 3.4rc1 through 3.4.1 places a password in a URL ...)
        - bugzilla <not-affected> (only 3.4.x is affected)
        TODO: check when 3.4.x will be uploaded in unstable
CVE-2009-3165 (SQL injection vulnerability in the Bug.create WebService function in ...)
        {DSA-1913-1}
        - bugzilla 3.2.5.0-1 (low; bug #547132)
        [etch] - bugzilla <not-affected> (Vulnerable code not present)
        NOTE: Introduced in 2.23.4
CVE-2008-7220 (Unspecified vulnerability in Prototype JavaScript framework ...)
        {DSA-1952-1}
        - prototypejs 1.6.0.2-1
        - asterisk 1:1.6.2.0~rc3-1 (low; bug #555220)
        [etch] - asterisk <no-dsa> (Minor issue)
        [lenny] - asterisk <no-dsa> (Minor issue)
        - auth2db 0.2.5-2+dfsg-1 (low; bug #555217)
        - libaws 2.7-1 (low; bug #555221)
        [etch] - libaws <no-dsa> (minor issue)
        [lenny] - libaws <no-dsa> (minor issue)
        - libjson-ruby 1.1.4-1 (low; bug #555223)
        [lenny] - libjson-ruby <no-dsa> (minor issue)
        TODO: next point release [lenny] - libjson-ruby 1.1.2-1+lenny1
        - lucene2 2.9.1+ds1-2 (unimportant; bug #555225)
        [etch] - lucene2 <not-affected> (prototype.js not present)
        NOTE: prototype.js copy unused per #555225
        - glpi 0.72.3-1 (low; bug #555228)
        [etch] - glpi <no-dsa> (minor issue)
        [lenny] - glpi <no-dsa> (minor issue)
        - knowledgeroot <unfixed> (low; bug #555229)
        [etch] - knowledgeroot <no-dsa> (minor issue)
        [lenny] - knowledgeroot <no-dsa> (minor issue)
        - mt-daapd 0.9~r1696.dfsg-6 (low; bug #555231)
        [etch] - mt-daapd <no-dsa> (minor issue)
        TODO:   [etch] - mt-daapd 0.2.4+r1376-1.1+etch3
        - mediatomb <unfixed> (low; bug #555232)
        [lenny] - mediatomb <no-dsa> (minor issue)
        - op-panel 0.30~dfsg-1 (low; bug #555234)
        - ebug-http <removed> (low; bug #555235)
        [lenny] - ebug-http <no-dsa> (Minor issue)
        - poker-network <removed> (low; bug #555237)
        [etch] - poker-network <no-dsa> (minor issue)
        - webhelpers 0.3.4-2 (low; bug #555239)
        - qwik <unfixed> (low; bug #555240)
        [etch] - qwik <no-dsa> (minor issue)
        [lenny] - qwik <no-dsa> (minor issue)
        - wordpress 2.5.0-2 (low; bug #555242)
        [etch] - wordpress <not-affected> (prototype.js not present)
        - exaile 0.2.14+debian-2.2 (low; bug #555244)
        [lenny] - exaile <no-dsa> (minor issue)
        - hobix 0.5~svn20070319-4 (low; bug #555246)
        [lenny] - hobix <no-dsa> (minor issue)
        - pixelpost 1.7.1-6 (low; bug #555248)
        [lenny] - pixelpost <no-dsa> (minor issue)
        - symfony 1.0.21-1.1 (low; bug #555250)
        [lenny] - symfony <no-dsa> (minor issue)
        - jscropperui 1.2.1-1 (low; bug #555255)
        [lenny] - jscropperui <no-dsa> (minor issue)
        - rt-extension-emailcompletion <not-affected> (prototype.js not included in the binary package; bug #555258)
        - scriptaculous 1.8.3-1 (low; bug #555259)
        [lenny] - scriptaculous <no-dsa> (Minor issue)
        - activeldap 1.0.9-1 (unimportant; bug #555263)
        NOTE: Only shipped in an example
        - mantis 1.1.8+dfsg-3 (low; bug #555264)
        [lenny] - mantis <no-dsa> (minor issue)
        - otrs2 2.3.4-6 (low; bug #555266)
        [etch] - otrs2 <not-affected> (prototype.js not present)
        [lenny] - otrs2 <not-affected> (prototype.js not present)
        - webcalendar <unfixed> (low; bug #555268)
        [lenny] - webcalendar <not-affected> (prototype.js not present)
        - libhtml-prototype-perl 1.48-3 (low; bug #558977)
        [etch] - libhtml-prototype-perl <no-dsa> (minor issue)
        [lenny] - libhtml-prototype-perl <no-dsa> (minor issue)
        - plone3 <unfixed> (low; bug #555274)
        - wesnoth <not-affected> (prototype.js not included in any of the binary packages; bug #555266)
        - webcit <not-affected> (fixed since initial inclusion)
        - zabbix <not-affected> (fixed since initial inclusion)
        - chora2 <not-affected> (fixed since initial inclusion)
        - gollem <not-affected> (fixed since initial inclusion)
        - ingo1 <not-affected> (fixed since initial inclusion)
        - kronolith2 <not-affected> (fixed since initial inclusion)
        - jifty <not-affected> (fixed since initial inclusion)
        - jquery <not-affected> (fixed since initial inclusion)
        - passenger <not-affected> (fixed since initial inclusion)
CVE-2008-7219 (Horde Kronolith H3 2.1 before 2.1.7 and 2.2 before 2.2-RC2; Nag H3 2.1 ...)
        - kronolith2 2.1.7-1 (unknown)
        - nag2 2.1.4-1 (unknown)
        - mnemo2 2.1.2-1 (unknown)
CVE-2008-7218 (Unspecified vulnerability in the Horde API in Horde 3.1 before 3.1.6 ...)
        {DSA-1897-1}
        - horde3 3.1.6-1 (unknown)
        - turba2 2.1.7-1 (unknown)
        - kronolith2 2.1.7-1 (unknown)
        - nag2 2.1.4-1 (unknown)
        - mnemo2 2.1.2-1 (unknown)
CVE-2008-7217 (Microsoft Office 2008 for Mac, when running on Macintosh systems that ...)
        NOT-FOR-US: Microsoft Office
CVE-2007-6732 (Multiple buffer overflows in the dtt_load function in ...)
        - xmp 2.6.1-1 (low; bug #546730)
        [etch] - xmp <no-dsa> (Minor issue, fringe app/formats)
        [lenny] - xmp <no-dsa> (Minor issue, fringe app/formats)
CVE-2007-6731 (Extended Module Player (XMP) 2.5.1 and earlier allow remote attackers ...)
        - xmp 2.6.1-1 (low; bug #546730)
        [etch] - xmp <no-dsa> (Minor issue, fringe app/formats)
        [lenny] - xmp <no-dsa> (Minor issue, fringe app/formats)
CVE-2009-3182 (Unrestricted file upload vulnerability in ...)
        NOT-FOR-US: Anantasoft Gazelle CMS
CVE-2009-3181 (Directory traversal vulnerability in Anantasoft Gazelle CMS 1.0 allows ...)
        NOT-FOR-US: Anantasoft Gazelle CMS
CVE-2009-3180 (Anantasoft Gazelle CMS 1.0 allows remote attackers to conduct a ...)
        NOT-FOR-US: Anantasoft Gazelle CMS
CVE-2009-3179 (Multiple unspecified vulnerabilities in Symantec Altiris Deployment ...)
        NOT-FOR-US: Symantec Altiris Deployment Solution
CVE-2009-3178 (Unspecified vulnerability in mm.exe in Symantec Altiris Deployment ...)
        NOT-FOR-US: Symantec Altiris Deployment Solution
CVE-2009-3177 (Unspecified vulnerability in Kaspersky Online Scanner 7.0 has unknown ...)
        NOT-FOR-US: Kaspersky Online Scanner
CVE-2009-3176 (Buffer overflow in the ActiveX control in Novell iPrint Client 4.38 ...)
        NOT-FOR-US: Novell iPrint Client
CVE-2009-3175 (Multiple SQL injection vulnerabilities in Model Agency Manager PRO ...)
        NOT-FOR-US: Model Agency Manager PRO
CVE-2009-3174 (PHP remote file inclusion vulnerability in fonctions_racine.php in ...)
        NOT-FOR-US: OBOphiX
CVE-2009-3173 (Unrestricted file upload vulnerability in admin/add_album.php in The ...)
        NOT-FOR-US: Rat CMS Alpha
CVE-2009-3172 (Unspecified vulnerability in Hitachi Groupmax Groupware Server 07-00 ...)
        NOT-FOR-US: Hitachi Groupmax Groupware Server
CVE-2009-3171 (Multiple cross-site scripting (XSS) vulnerabilities in Anantasoft ...)
        NOT-FOR-US: Anantasoft Gazelle CMS
CVE-2009-3170 (Stack-based buffer overflow in AIMP2 Audio Converter 2.53 (build 330) ...)
        NOT-FOR-US: AIMP2 Audio Converter
CVE-2009-3169 (Multiple unspecified vulnerabilities in Hitachi JP1/File Transmission ...)
        NOT-FOR-US: Hitachi
CVE-2009-3168 (Mevin Productions Basic PHP Events Lister 2.0 does not properly ...)
        NOT-FOR-US: Mevin Productions Basic PHP Events Lister
CVE-2009-3167 (Directory traversal vulnerability in index.php in Anantasoft Gazelle ...)
        NOT-FOR-US: Anantasoft Gazelle CMS
CVE-2008-7216 (Peter's Math Anti-Spam Spinoff plugin for WordPress generates audio ...)
        NOT-FOR-US: Math Anti-Spam Spinoff plugin for WordPress
CVE-2008-7215 (The Image Manager in MOStlyCE before 2.4, as used in Mambo 4.6.3 and ...)
        NOT-FOR-US: MOStlyCE
CVE-2008-7214 (Cross-site request forgery (CSRF) vulnerability in ...)
        NOT-FOR-US: MOStlyCE
CVE-2008-7213 (Cross-site scripting (XSS) vulnerability in ...)
        NOT-FOR-US: MOStlyCE
CVE-2008-7212 (MOStlyCE before 2.4, as used in Mambo 4.6.3 and earlier, allows remote ...)
        NOT-FOR-US: MOStlyCE
CVE-2008-7211 (CreativeLabs es1371mp.sys 5.1.3612.0 WDM audio driver, as used in ...)
        NOT-FOR-US: CreativeLabs WDM audio driver
CVE-2008-7210 (directory.php in AJchat 0.10 allows remote attackers to bypass input ...)
        NOT-FOR-US: AJchat
CVE-2008-7209 (Unrestricted file upload vulnerability in the add2 action in ...)
        NOT-FOR-US: OneCMS
CVE-2008-7208 (Multiple SQL injection vulnerabilities in OneCMS 2.4, and possibly ...)
        NOT-FOR-US: OneCMS
CVE-2008-7207 (RivetTracker before 1.0 stores passwords in cleartext in config.php, ...)
        NOT-FOR-US: RivetTracker
CVE-2008-7206 (Unspecified vulnerability in Electronic Logbook (ELOG) before 2.7.2 ...)
        NOT-FOR-US: Electronic Logbook
CVE-2008-7205 (Unspecified vulnerability in the product view functionality in ...)
        NOT-FOR-US: VirtueMart
CVE-2008-7204 (Cross-site request forgery (CSRF) vulnerability in VirtueMart 1.0.13a ...)
        NOT-FOR-US: VirtueMart
CVE-2008-7203 (Valve Software Half-Life Counter-Strike 1.6 allows remote attackers to ...)
        NOT-FOR-US: Valve Software Half-Life Counter-Strike
CVE-2009-3232 (pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and Debian ...)
        - pam 1.0.1-10 (bug #519927)
        [lenny] - pam <not-affected> (pam-auth-update not yet present)
        [etch] - pam <not-affected> (pam-auth-update not yet present)
CVE-2009-3229 (The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before ...)
        {DSA-1900-1}
        - postgresql-8.4 8.4.1-1
        - postgresql-8.3 8.3.8-1
        - postgresql-8.1 <not-affected>
        - postgresql-7.4 <not-affected>
CVE-2009-3230 (The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before ...)
        {DSA-1900-1}
        - postgresql-8.4 8.4.1-1
        - postgresql-8.3 8.3.8-1
        - postgresql-8.1 <removed>
        - postgresql-7.4 <removed>
CVE-2009-3231 (The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 ...)
        {DSA-1900-1}
        - postgresql-8.4 8.4.1-1
        - postgresql-8.3 8.3.8-1
        - postgresql-8.1 <not-affected>
        - postgresql-7.4 <not-affected>
CVE-2009-3164 (Unspecified vulnerability in the IPv6 networking stack in Sun Solaris ...)
        NOT-FOR-US: Solaris
CVE-2009-3163 (Multiple format string vulnerabilities in lib/silcclient/command.c in ...)
        {DSA-1879-1}
        - silc-toolkit 1.1.10-1 (medium)
        - silc-client 1.1-2 (medium)
        - silc-server 1.1.2-1 (medium)
        NOTE: silc-client/silc-server use libsilc from silc-toolkit since 1.1-2
CVE-2009-3145
        RESERVED
CVE-2009-3144
        RESERVED
CVE-2009-3143
        RESERVED
CVE-2009-3142
        RESERVED
CVE-2009-3141
        RESERVED
CVE-2009-3140
        RESERVED
CVE-2009-3139
        RESERVED
CVE-2009-3138
        RESERVED
CVE-2009-3137
        RESERVED
CVE-2009-3136
        RESERVED
CVE-2009-3135 (Stack-based buffer overflow in Microsoft Office Word 2002 SP3 and 2003 ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3134 (Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3133 (Microsoft Office Excel 2002 SP3, Office 2004 and 2008 for Mac, and ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3132 (Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3131 (Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3130 (Heap-based buffer overflow in Microsoft Office Excel 2002 SP3, Office ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3129 (Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3128 (Microsoft Office Excel 2002 SP3 and 2003 SP3, and Office Excel Viewer ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3127 (Microsoft Office Excel 2002 SP3 and 2003 SP3, Office 2004 and 2008 for ...)
        NOT-FOR-US: Microsoft Office
CVE-2009-3126 (Integer overflow in GDI+ in Microsoft Internet Explorer 6 SP1, Windows ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3162 (Cross-site scripting (XSS) vulnerability in Multi Website 1.5 allows ...)
        NOT-FOR-US: Multi Website
CVE-2009-3161 (The server in IBM WebSphere MQ 7.0.0.1, 7.0.0.2, and 7.0.1.0 allows ...)
        NOT-FOR-US: IBM WebSpHere MQ
CVE-2009-3160 (IBM WebSphere MQ 6.x through 6.0.2.7, 7.0.0.0, 7.0.0.1, 7.0.0.2, and ...)
        NOT-FOR-US: IBM WebSphere MQ
CVE-2009-3159 (Unspecified vulnerability in the rriDecompress function in IBM ...)
        NOT-FOR-US: IBM WebSphere MQ
CVE-2009-3158 (admin/files.php in simplePHPWeb 0.2 does not require authentication, ...)
        NOT-FOR-US: simplePHPWeb
CVE-2009-3157 (Cross-site scripting (XSS) vulnerability in the Calendar module 6.x ...)
        NOT-FOR-US: Calendar module for Drupal
CVE-2009-3156 (Cross-site scripting (XSS) vulnerability in the Date Tools sub-module ...)
        NOT-FOR-US: Date module for Drupal
CVE-2009-3155 (Cross-site scripting (XSS) vulnerability in gmap.php in the Almond ...)
        NOT-FOR-US: Almond Classifieds component for Joomla!
CVE-2009-3154 (SQL injection vulnerability in the Almond Classifieds (com_aclassf) ...)
        NOT-FOR-US: Almond Classifieds component for Joomla!
CVE-2009-3153 (Multiple cross-site scripting (XSS) vulnerabilities in x10 MP3 Search ...)
        NOT-FOR-US: x10 MP3 Search engine
CVE-2009-3152 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
        NOT-FOR-US: NTSOFT BBS E-Market Professional
CVE-2009-3151 (Directory traversal vulnerability in actions/downloadFile.php in ...)
        NOT-FOR-US: Ultrize TimeSheet
CVE-2009-3150 (SQL injection vulnerability in index.php in Multi Website 1.5 allows ...)
        NOT-FOR-US: Multi Website
CVE-2009-3149 (Directory traversal vulnerability in _css/js.php in Elgg 1.5, when ...)
        NOT-FOR-US: Elgg
CVE-2009-3148 (Multiple SQL injection vulnerabilities in PortalXP Teacher Edition 1.2 ...)
        NOT-FOR-US: PortalXP Teacher Edition
CVE-2009-3147 (Cross-site scripting (XSS) vulnerability in showproduct.php in ...)
        NOT-FOR-US: ReviewPost Pro
CVE-2009-3146 (Cross-site scripting (XSS) vulnerability in search_advance.php in ...)
        NOT-FOR-US: ArticleFriend Script
CVE-2009-3125 (SQL injection vulnerability in the Bug.search WebService function in ...)
        - bugzilla <not-affected> (Only 3.3.x and 3.4.x are affected)
        TODO: check when 3.3.x or 3.4.x will be uploaded in unstable
CVE-2009-3124 (Directory traversal vulnerability in get_message.cgi in QuarkMail ...)
        NOT-FOR-US: QuarkMail
CVE-2009-3123 (Directory traversal vulnerability in gallery/gallery.php in Wap-Motor ...)
        NOT-FOR-US: Wap-Motor
CVE-2009-3122 (The Ajax Table module 5.x for Drupal does not perform access control, ...)
        NOT-FOR-US: Ajax Table module module for Drupal
CVE-2009-3121 (Cross-site scripting (XSS) vulnerability in the Ajax Table module 5.x ...)
        NOT-FOR-US: Ajax Table module module for Drupal
CVE-2009-3120 (Cross-site scripting (XSS) vulnerability in public/index.php in BIGACE ...)
        NOT-FOR-US: BIGACE Web CMS
CVE-2009-3119 (SQL injection vulnerability in screen.php in the Download System mSF ...)
        NOT-FOR-US: PHP-Fusion
CVE-2009-3118 (SQL injection vulnerability in mod/poll/comment.php in the vote module ...)
        NOT-FOR-US: Danneo CMS
CVE-2009-3117 (SQL injection vulnerability in category.php in Snow Hall Silurus ...)
        NOT-FOR-US: Snow Hall Silurus System
CVE-2009-3116 (SQL injection vulnerability in index.php in Uiga Church Portal allows ...)
        NOT-FOR-US: Uiga Church Portal
CVE-2009-3115 (SolarWinds TFTP Server 9.2.0.111 and earlier allows remote attackers ...)
        NOT-FOR-US: SolarWinds TFTP Server
CVE-2009-3114 (The RSS reader widget in IBM Lotus Notes 8.0 and 8.5 saves items from ...)
        NOT-FOR-US: IBM Lotus Notes
CVE-2009-3113 (Unspecified vulnerability in OXID eShop Professional, Enterprise, and ...)
        NOT-FOR-US: OXID eShop Professional
CVE-2009-3112 (Unspecified vulnerability in OXID eShop Professional, Enterprise, and ...)
        NOT-FOR-US: OXID eShop Professional
CVE-2009-3111 (The rad_decode function in FreeRADIUS before 1.1.8 allows remote ...)
        - freeradius 2.0.0-1 (low)
CVE-2008-7202 (Multiple cross-site scripting (XSS) vulnerabilities in OpenWebMail ...)
        NOT-FOR-US: OpenWebMail
CVE-2008-7201 (Lantronix MSS485-T allows remote attackers to cause a denial of ...)
        NOT-FOR-US: Lantronix MSS485-T
CVE-2008-7200 (Double free vulnerability in Deliantra server engine before 2.4 has ...)
        NOT-FOR-US: Deliantra server engine
CVE-2008-7199 (Phoenix Contact FL IL 24 BK-PAC allows remote attackers to cause a ...)
        NOT-FOR-US: Phoenix Contact FL IL 24 BK-PAC
CVE-2008-7198 (Multiple unspecified vulnerabilities in phpns before 2.1.1beta1 have ...)
        NOT-FOR-US: phpns
CVE-2008-7197 (Multiple unspecified vulnerabilities in G15Daemon before 1.9.4 have ...)
        NOT-FOR-US: G15Daemon
CVE-2008-7196 (Unspecified vulnerability in metashell before 0.03 has unknown impact ...)
        NOT-FOR-US: metashell
CVE-2008-7195 (Unspecified vulnerability in Fujitsu Interstage HTTP Server, as used ...)
        NOT-FOR-US: Fujitsu Interstage HTTP Server
CVE-2008-7194 (Unspecified vulnerability in Fujitsu Interstage HTTP Server, as used ...)
        NOT-FOR-US: Fujitsu Interstage HTTP Server
CVE-2008-7193 (PHPKIT 1.6.4 PL1 includes the session ID in the URL, which allows ...)
        NOT-FOR-US: PHPKIT
CVE-2008-7192 (Cross-site request forgery (CSRF) vulnerability in index.php in ...)
        NOT-FOR-US: WoltLab Burning Board
CVE-2008-7191 (Unspecified vulnerability in Polipo before 1.0.4 allows remote ...)
        - polipo 1.0.4-1 (low)
CVE-2008-7190 (Unspecified vulnerability in Adium before 1.2 has unknown impact and ...)
        NOT-FOR-US: Adium
CVE-2008-7189 (Multiple unspecified vulnerabilities in Local Media Browser before 0.1 ...)
        NOT-FOR-US: Local Media Browser
CVE-2008-7188 (ClipShare 2.6 does not properly restrict access to certain ...)
        NOT-FOR-US: ClipShare
CVE-2008-7187 (Coppermine Photo Gallery (CPG) 1.4.14 allows remote attackers to ...)
        NOT-FOR-US: Coppermine Photo Gallery
CVE-2008-7186 (Coppermine Photo Gallery (CPG) 1.4.14 does not restrict access to ...)
        NOT-FOR-US: Coppermine Photo Gallery
CVE-2007-6730 (Multiple cross-site request forgery (CSRF) vulnerabilities in the web ...)
        NOT-FOR-US: ZyXEL P-330W
CVE-2007-6729 (Cross-site scripting (XSS) vulnerability in the web management ...)
        NOT-FOR-US: ZyXEL P-330W
CVE-2009-3110 (Race condition in the file transfer functionality in Symantec Altiris ...)
        NOT-FOR-US: Symantec Altiris Deployment Solution
CVE-2009-3109 (Unspecified vulnerability in the AClient agent in Symantec Altiris ...)
        NOT-FOR-US: Symantec Altiris Deployment Solution
CVE-2009-3108 (The Aclient GUI in Symantec Altiris Deployment Solution 6.9.x before ...)
        NOT-FOR-US: Symantec Altiris Deployment Solution
CVE-2009-3107 (Symantec Altiris Deployment Solution 6.9.x before 6.9 SP3 Build 430 ...)
        NOT-FOR-US: Symantec Altiris Deployment Solution
CVE-2009-3106 (The Servlet Engine/Web Container component in IBM WebSphere ...)
        NOT-FOR-US: IBM WebSphere Application Server
CVE-2009-3105 (Cross-site scripting (XSS) vulnerability in IBM Lotus iNotes (aka ...)
        NOT-FOR-US: IBM Lotus iNotes
CVE-2009-3104 (Unspecified vulnerability in Symantec Norton AntiVirus 2005 through ...)
        NOT-FOR-US: Symantec Norton AntiVirus
CVE-2009-3103 (Array index error in the SMBv2 protocol implementation in srv2.sys in ...)
        NOT-FOR-US: Microsoft
CVE-2009-3102 (The doHotCopy subroutine in socket-server.pl in Zmanda Recovery ...)
        NOT-FOR-US: Zmanda Recovery Manager
CVE-2009-3101 (xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 10, and ...)
        - xscreensaver <not-affected> (OpenSolaris-specific, patch 120094-22 causes this)
CVE-2009-3100 (xscreensaver (aka Gnome-XScreenSaver) in Sun Solaris 9 and 10, ...)
        - xscreensaver <not-affected> (OpenSolaris-specific, patch 120094-22 causes this)
CVE-2009-3099 (Unspecified vulnerability in HP OpenView Operations Manager 8.1 on ...)
        NOT-FOR-US: HP OpenView Operations Manager
CVE-2009-3098 (Unspecified vulnerability in the Portal in HP Operations Dashboard 2.1 ...)
        NOT-FOR-US: HP Operations Dashboard
CVE-2009-3097 (Multiple unspecified vulnerabilities in HP Performance Insight 5.3 on ...)
        NOT-FOR-US: HP Performance Insight
CVE-2009-3096 (Multiple unspecified vulnerabilities in HP Performance Insight 5.3 ...)
        NOT-FOR-US: HP Performance Insight
CVE-2009-3095 (The mod_proxy_ftp module in the Apache HTTP Server allows remote ...)
        {DSA-1934-1}
        - apache2 2.2.13-2 (low; bug #545951)
        [etch] - apache2 <no-dsa> (minor issue)
        [lenny] - apache2 <no-dsa> (minor issue)
        TODO: scheduled for 5.0.4: [lenny] - apache2 2.2.9-10+lenny5 (low; bug #545951)
        NOTE: The attacker needs to have valid credentials for the FTP server, which
        NOTE: makes this irrelevant in most cases.
        TODO: check
        TODO: Disclosure has little information, verify that it is really fixed when
        TODO: more info is disclosed.
        NOTE: based on a VulnDisco commercial 0day
CVE-2009-3094 (The ap_proxy_ftp_handler function in modules/proxy/proxy_ftp.c in the ...)
        {DSA-1934-1}
        - apache2 2.2.13-2 (low; bug #545951)
        [etch] - apache2 <no-dsa> (minor issue)
        [lenny] - apache2 <no-dsa> (minor issue)
        TODO: scheduled for 5.0.4: [lenny] - apache2 2.2.9-10+lenny5 (low; bug #545951)
CVE-2009-3093 (Unspecified vulnerability on the ASUS WL-500W wireless router has ...)
        NOT-FOR-US: ASUS WL-500W
CVE-2009-3092 (Buffer overflow on the ASUS WL-500W wireless router has unknown impact ...)
        NOT-FOR-US: ASUS WL-500W
CVE-2009-3091 (Unspecified vulnerability on the ASUS WL-330gE has unknown impact and ...)
        NOT-FOR-US: ASUS WL-330gE
CVE-2009-3090 (Unspecified vulnerability in IBM Tivoli Directory Server (TDS) 6.0 on ...)
        NOT-FOR-US: IBM Tivoli Directory Server
CVE-2009-3089 (IBM Tivoli Directory Server (TDS) 6.0 allows remote attackers to cause ...)
        NOT-FOR-US: IBM Tivoli Directory Server
CVE-2009-3088 (Heap-based buffer overflow in ibmdiradm in IBM Tivoli Directory Server ...)
        NOT-FOR-US: IBM Tivoli Directory Server
CVE-2009-3087 (Unspecified vulnerability in nserver.exe in the server in IBM Lotus ...)
        NOT-FOR-US: IBM Lotus Domino
CVE-2009-3086 (A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x ...)
        - rails 2.2.3-1 (low; bug #545063)
        [etch] - rails <no-dsa> (Minor issue)
        [lenny] - rails <no-dsa> (Minor issue)
CVE-2009-3085 (The XMPP protocol plugin in libpurple in Pidgin before 2.6.2 does not ...)
        - pidgin 2.6.2-1 (low)
        [lenny] - pidgin <no-dsa> (Minor issue)
CVE-2009-3084 (The msn_slp_process_msg function in libpurple/protocols/msn/slpcall.c ...)
        - pidgin 2.6.2-1 (low)
        [lenny] - pidgin <no-dsa> (Minor issue)
CVE-2009-3083 (The msn_slp_sip_recv function in libpurple/protocols/msn/slp.c in the ...)
        - pidgin 2.6.2-1 (low)
        [lenny] - pidgin <no-dsa> (Minor issue)
CVE-2008-7185 (GNOME Rhythmbox 0.11.5 allows remote attackers to cause a denial of ...)
        - rhythmbox <unfixed> (unimportant)
        NOTE: No practical security impact
CVE-2008-7184 (Cross-site scripting (XSS) vulnerability in Diigo Toolbar and Diigolet ...)
        NOT-FOR-US: Diigo Toolbar and Diigolet
CVE-2008-7183 (PHP remote file inclusion vulnerability in eva/index.php in EVA CMS ...)
        NOT-FOR-US: EVA CMS
CVE-2009-XXXX [viewvc: XSS and illegal characters while printing name-value pairs]
        - viewvc 1.0.9-1 (low; bug #545779)
        NOTE: CVE id has been requested, fixed in 1.1.2
CVE-2009-3082 (SQL injection vulnerability in wcategory.php in Snow Hall Silurus ...)
        NOT-FOR-US: Snow Hall Silurus System
CVE-2009-3081 (SQL injection vulnerability in index.php in Uiga Church Portal allows ...)
        NOT-FOR-US: Uiga Church Portal
CVE-2009-3079 (Unspecified vulnerability in Mozilla Firefox before 3.0.14, and 3.5.x ...)
        {DSA-1886-1}
        - iceweasel 3.0.14-1
        [etch] - iceweasel <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3078 (Visual truncation vulnerability in Mozilla Firefox before 3.0.14, and ...)
        {DSA-1885-1}
        - xulrunner 1.9.0.14-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3077 (Mozilla Firefox before 3.0.14, and 3.5.x before 3.5.3, does not ...)
        {DSA-1885-1}
        - xulrunner 1.9.0.14-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3076 (Mozilla Firefox before 3.0.14 does not properly implement certain ...)
        {DSA-1885-1}
        - xulrunner 1.9.0.14-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
        NOTE: Huh?
CVE-2009-3075 (Multiple unspecified vulnerabilities in the JavaScript engine in ...)
        {DSA-1885-1}
        - xulrunner 1.9.0.14-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3074 (Unspecified vulnerability in the JavaScript engine in Mozilla Firefox ...)
        {DSA-1885-1}
        - xulrunner 1.9.0.14-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3073 (Unspecified vulnerability in the JavaScript engine in Mozilla Firefox ...)
        - xulrunner <not-affected> (Only affects Firefox 3.5.x)
        [lenny] - xulrunner <not-affected> (Only affects Firefox 3.5.x)
        [etch] - xulrunner <not-affected> (Only affects Firefox 3.5.x)
CVE-2009-3072 (Multiple unspecified vulnerabilities in the browser engine in Mozilla ...)
        {DSA-1885-1}
        - xulrunner 1.9.0.14-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3071 (Multiple unspecified vulnerabilities in the browser engine in Mozilla ...)
        {DSA-1885-1}
        - xulrunner 1.9.0.14-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3070 (Multiple unspecified vulnerabilities in the browser engine in Mozilla ...)
        {DSA-1885-1}
        - xulrunner 1.9.0.14-1
        [etch] - xulrunner <no-dsa> (Mozilla packages from oldstable no longer covered by security support)
CVE-2009-3069 (Unspecified vulnerability in the browser engine in Mozilla Firefox ...)
        - xulrunner <not-affected> (Only affects Firefox 3.5.x)
        [lenny] - xulrunner <not-affected> (Only affects Firefox 3.5.x)
        [etch] - xulrunner <not-affected> (Only affects Firefox 3.5.x)
CVE-2008-7182 (Buffer overflow in the IMAP service in NetWin Surgemail 3.9e, and ...)
        NOT-FOR-US: Surgemail
CVE-2008-7181 (Butterfly Organizer 2.0.0 allows remote attackers to (1) delete ...)
        NOT-FOR-US: Butterfly Organizer
CVE-2008-7180 (del_query1.php in Telephone Directory 2008 allows remote attackers to ...)
        NOT-FOR-US: Telephone Directory
CVE-2008-7179 (OTManager CMS 2.4 allows remote attackers to bypass authentication and ...)
        NOT-FOR-US: OTManager
CVE-2008-7178 (Directory traversal vulnerability in Uploader module 1.1 for XOOPS ...)
        NOT-FOR-US: XOOPS
CVE-2008-7177 (Buffer overflow in the listing module in Netwide Assembler (NASM) ...)
        - nasm 2.03.01-1 (low)
CVE-2008-7176 (Multiple directory traversal vulnerabilities in Facil CMS 0.1RC allow ...)
        NOT-FOR-US: Facil CMS
CVE-2008-7175 (Cross-site scripting (XSS) vulnerability in wp-admin/admin.php in ...)
        NOT-FOR-US: NextGEN Gallery third party plugin for wordpress
CVE-2008-7174 (Multiple buffer overflows in the Jura Internet Connection Kit for the ...)
        NOT-FOR-US: Jura Impressa
CVE-2008-7173 (The Jura Internet Connection Kit for the Jura Impressa F90 coffee ...)
        NOT-FOR-US: Jura Impressa
CVE-2008-7172 (Lightweight news portal (LNP) 1.0b does not properly restrict access ...)
        NOT-FOR-US: Lightweight news portal
CVE-2008-7171 (Multiple cross-site scripting (XSS) vulnerabilities in Lightweight ...)
        NOT-FOR-US: Lightweight news portal
CVE-2008-7170 (GSC build 2067 and earlier relies on the client to enforce ...)
        NOT-FOR-US: GSC build 
CVE-2008-7169 (SQL injection vulnerability in Jabode horoscope extension (com_jabode) ...)
        NOT-FOR-US: Joomla
CVE-2008-7168 (Insecure method vulnerability in the UUSee UUUpgrade ActiveX control ...)
        NOT-FOR-US: ActiveX
CVE-2008-7167 (Unrestricted file upload vulnerability in upload.php in Page Manager ...)
        NOT-FOR-US: Page Manager
CVE-2009-3068 (Unrestricted file upload vulnerability in the RoboHelpServer Servlet ...)
        NOT-FOR-US: Adobe RoboHelp Server
CVE-2009-3067 (Cross-site scripting (XSS) vulnerability in index.php in Reservation ...)
        NOT-FOR-US: Reservation Manager
CVE-2009-3066 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
        NOT-FOR-US: PropertyWatchScript.com Property Watch
CVE-2009-3065 (PHP remote file inclusion vulnerability in editor/edit_htmlarea.php in ...)
        NOT-FOR-US: Ve-EDIT
CVE-2009-3064 (Directory traversal vulnerability in debugger/debug_php.php in Ve-EDIT ...)
        NOT-FOR-US: Ve-EDIT
CVE-2009-3063 (SQL injection vulnerability in the Game Server (com_gameserver) ...)
        NOT-FOR-US: Joomla!
CVE-2009-3062 (SQL injection vulnerability in message_box.php in OSI Codes PHP Live! ...)
        NOT-FOR-US: OSI Codes PHP Live!
CVE-2009-3061 (SQL injection vulnerability in lesson.php in Alqatari Q R Script 1.0 ...)
        NOT-FOR-US: Alqatari Q R Script
CVE-2009-3060 (Multiple cross-site scripting (XSS) vulnerabilities in Joker Board ...)
        NOT-FOR-US: Joker Board
CVE-2009-3059 (Multiple SQL injection vulnerabilities in Joker Board (aka JBoard) 2.0 ...)
        NOT-FOR-US: Joker Board
CVE-2009-3058 (Stack-based buffer overflow in akPlayer 1.9.0 allows remote attackers ...)
        NOT-FOR-US: akPlayer
CVE-2009-3057 (Multiple cross-site scripting (XSS) vulnerabilities in AOM Software ...)
        NOT-FOR-US: AOM Software Beex
CVE-2009-3056 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: KingCMS
CVE-2009-3055 (PHP remote file inclusion vulnerability in engine/api/api.class.php in ...)
        NOT-FOR-US: DataLife Engine
CVE-2009-3054 (SQL injection vulnerability in the Artetics.com Art Portal ...)
        NOT-FOR-US: Joomla!
CVE-2009-3053 (Directory traversal vulnerability in the Agora (com_agora) component ...)
        NOT-FOR-US: Joomla!
CVE-2009-3052 (SQL injection vulnerability in root/includes/prime_quick_style.php in ...)
        NOT-FOR-US: Prime Quick Style addon
CVE-2008-7166 (Buffer overflow in the web interface in BitTorrent 6.0.1 (build 7859) ...)
        NOT-FOR-US: web interface in BitTorrent 6.0.1 (build 7859)
CVE-2008-7165 (Cross-site request forgery in cp06_wifi_m_nocifr.cgi in the ...)
        NOT-FOR-US: TELECOM ITALIA Alice Gate2 Plus Wi-Fi
CVE-2008-7164 (Multiple unspecified vulnerabilities in Shareaza before 2.3.1.0 have ...)
        NOT-FOR-US: Shareaza
CVE-2008-7163 (Directory traversal vulnerability in mods/Integrated/index.php in ...)
        NOT-FOR-US: SineCMS
CVE-2008-7162 (Buffer overflow in Hero Super Player 3000 allows remote attackers to ...)
        NOT-FOR-US: Hero Super Player
CVE-2008-7161 (Fortinet FortiGuard Fortinet FortiGate-1000 3.00 build 040075,070111 ...)
        NOT-FOR-US: Fortinet FortiGuard Fortinet
CVE-2008-7159 (The silc_asn1_encoder function in lib/silcasn1/silcasn1_encode.c in ...)
        {DSA-1879-1}
        [lenny] - silc-toolkit 1.1.7-2+lenny1
        - silc-toolkit 1.1.10-1 (low)
        - silc-client 1.1-2 (low)
        - silc-server <not-affected> (Vulnerable code not present)
        NOTE: silc-client uses libsilc from silc-toolkit since 1.1-2
CVE-2009-3051 (Multiple format string vulnerabilities in ...)
        {DSA-1879-1}
        - silc-toolkit 1.1.10-1 (medium)
        - silc-client 1.1-2 (medium)
        - silc-server 1.1.2-1 (medium)
        NOTE: silc-client/silc-server use libsilc from silc-toolkit since 1.1-2
CVE-2008-7160 (The silc_http_server_parse function in lib/silchttp/silchttpserver.c ...)
        {DSA-1879-1}
        - silc-toolkit 1.1.10-1 (low)
        - silc-client <not-affected> (Vulnerable code not present)
        - silc-server 1.1.2-1 (low)
        NOTE: silc-client/silc-server use libsilc from silc-toolkit since 1.1-2
CVE-2009-3050 (Buffer overflow in the set_page_size function in util.cxx in HTMLDOC ...)
        - htmldoc 1.8.27-4.1 (low; bug #537637)
        [etch] - htmldoc <no-dsa> (Minor issue)
        [lenny] - htmldoc <no-dsa> (Minor issue)
CVE-2009-3049 (Opera before 10.00 does not properly display all characters in ...)
        NOT-FOR-US: Opera
CVE-2009-3048 (Opera before 10.00 on Linux, Solaris, and FreeBSD does not properly ...)
        NOT-FOR-US: Opera
CVE-2009-3047 (Opera before 10.00, when a collapsed address bar is used, does not ...)
        NOT-FOR-US: Opera
CVE-2009-3046 (Opera before 10.00 does not check all intermediate X.509 certificates ...)
        NOT-FOR-US: Opera
CVE-2009-3045 (Opera before 10.00 trusts root X.509 certificates signed with the MD2 ...)
        NOT-FOR-US: Opera
CVE-2009-3044 (Opera before 10.00 does not properly handle a (1) '\0' character or ...)
        NOT-FOR-US: Opera
CVE-2009-3043 (The tty_ldisc_hangup function in drivers/char/tty_ldisc.c in the Linux ...)
        - linux-2.6 2.6.31-1 (medium)
        [etch] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.31)
        [lenny] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.31)
        - linux-2.6.24 <not-affected> (vulnerable code introduced in 2.6.31)
CVE-2008-7158 (Numara FootPrints 7.5a through 7.5a1 and 8.0 through 8.0a allows ...)
        NOT-FOR-US: Numara FootPrints
CVE-2008-7157 (Unrestricted file upload vulnerability in EkinBoard 1.1.0 and earlier ...)
        NOT-FOR-US: EkinBoard
CVE-2008-7156 (EkinBoard 1.1.0 and earlier, when register_globals is enabled, allows ...)
        NOT-FOR-US: EkinBoard
CVE-2008-7155 (NetRisk 1.9.7 does not properly restrict access to ...)
        NOT-FOR-US: NetRisk
CVE-2008-7154 (Docebo 3.5.0.3 and earlier allows remote attackers to obtain sensitive ...)
        NOT-FOR-US: Docebo
CVE-2008-7153 (SQL injection vulnerability in the autoDetectRegion function in ...)
        NOT-FOR-US: Docebo
CVE-2009-3039
        RESERVED
CVE-2009-3038 (A certain ActiveX control in lnresobject.dll 7.1.1.119 in the Research ...)
        NOT-FOR-US: ActiveX
CVE-2009-3037 (Buffer overflow in xlssr.dll in the Autonomy KeyView XLS viewer (aka ...)
        NOT-FOR-US: Autonomy KeyView XLS viewer
CVE-2008-7152 (Multiple PHP remote file inclusion vulnerabilities in Specimen Image ...)
        NOT-FOR-US: Specimen Image Database
CVE-2008-7151 (Cross-site request forgery (CSRF) vulnerability in Live 5.x before ...)
        NOT-FOR-US: Live third-party Drupal module
CVE-2008-7150 (Cross-site scripting (XSS) vulnerability in Refine by Taxonomy 5.x ...)
        NOT-FOR-US: Refine by Taxonomy
CVE-2008-7149 (Unspecified vulnerability in AgileWiki before 0.10.1 has unknown ...)
        NOT-FOR-US: AgileWiki
CVE-2008-7148 (Unspecified vulnerability in Synfig Animation Studio before 0.61.08 ...)
        NOT-FOR-US: Synfig Animation Studio
CVE-2008-7147 (Multiple cross-site scripting (XSS) vulnerabilities in IntraLearn ...)
        NOT-FOR-US: IntraLearn Software IntraLearn
CVE-2008-7146 (IntraLearn Software IntraLearn 2.1, and possibly other versions before ...)
        NOT-FOR-US: IntraLearn Software IntraLearn
CVE-2008-7145 (Multiple SQL injection vulnerabilities in index.php in CoronaMatrix ...)
        NOT-FOR-US: CoronaMatrix phpAddressBook
CVE-2008-7144 (Multiple unspecified vulnerabilities in RARLAB WinRAR before 3.71 have ...)
        NOT-FOR-US: RARLAB WinRAR
CVE-2008-7143 (phpBB 2.0.23 includes the session ID in a request to modcp.php when ...)
        - phpbb2 <removed>
CVE-2008-7142 (Absolute path traversal vulnerability in the Disk Usage module ...)
        NOT-FOR-US: cPanel
CVE-2008-7141 (Cross-site scripting (XSS) vulnerability in setup.php in @lex Poll 2.1 ...)
        NOT-FOR-US: @lex Poll
CVE-2008-7140 (Multiple cross-site scripting (XSS) vulnerabilities in @lex Guestbook ...)
        NOT-FOR-US: @lex Guestbook
CVE-2008-7139 (Multiple cross-site request forgery (CSRF) vulnerabilities in WS-Proxy ...)
        NOT-FOR-US: Eye-Fi
CVE-2008-7138 (The Manager in Eye-Fi 1.1.2 generates predictable snonce values based ...)
        NOT-FOR-US: Eye-Fi
CVE-2008-7137 (WS-Proxy in Eye-Fi 1.1.2 allows remote attackers to cause a denial of ...)
        NOT-FOR-US: Eye-Fi
CVE-2008-7136 (toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers ...)
        NOT-FOR-US: ICQ Toolbar
CVE-2008-7135 (toolbaru.dll in ICQ Toolbar (ICQToolbar) 2.3 allows remote attackers ...)
        NOT-FOR-US: ICQ Toolbar
CVE-2008-7134 (Multiple cross-site scripting (XSS) vulnerabilities in the default URI ...)
        NOT-FOR-US: Chris LaPointe RedGalaxy Download Center
CVE-2008-7133 (Multiple cross-site scripting (XSS) vulnerabilities in onlinetools.org ...)
        NOT-FOR-US: onlinetools.org EasyImageCatalogue
CVE-2008-7132 (Cross-site scripting (XSS) vulnerability in index.php in Nuked-Klan ...)
        NOT-FOR-US: Nuked-Klan
CVE-2009-3036
        RESERVED
CVE-2009-3035
        RESERVED
CVE-2009-3034
        RESERVED
CVE-2009-3033 (Buffer overflow in the RunCmd method in the Altiris eXpress NS Console ...)
        NOT-FOR-US: ActiveX
CVE-2009-3032
        RESERVED
CVE-2009-3031 (Stack-based buffer overflow in the BrowseAndSaveFile method in the ...)
        NOT-FOR-US: Symantec Altiris Notification Server
CVE-2009-3030 (Cross-site scripting (XSS) vulnerability in Symantec ...)
        NOT-FOR-US: Symantec SecurityExpressions Audit and Compliance Server
CVE-2009-3029 (Cross-site scripting (XSS) vulnerability in the console in Symantec ...)
        NOT-FOR-US: Symantec SecurityExpressions Audit and Compliance Server
CVE-2009-3028
        RESERVED
CVE-2009-3027 (VRTSweb.exe in VRTSweb in Symantec Backup Exec Continuous Protection ...)
        NOT-FOR-US: Symantec Backup Exec Continuous Protection Server
CVE-2009-3025 (Unspecified vulnerability in Pidgin 2.6.0 allows remote attackers to ...)
        - pidgin 2.6.1-1 (low)
        [lenny] - pidgin <not-affected> (Vulnerable code introduced in 2.6.0)
        [etch] - pidgin <not-affected> (Vulnerable code introduced in 2.6.0)
CVE-2009-3024 (The verify_hostname_of_cert function in the certificate checking ...)
        - libio-socket-ssl-perl 1.30-1
        [lenny] - libio-socket-ssl-perl 1.16-1+lenny1
        [etch] - libio-socket-ssl-perl <not-affected> (Affected functionality introduced in 1.14)
CVE-2009-3023 (Buffer overflow in the FTP Service in Microsoft Internet Information ...)
        NOT-FOR-US: Microsoft IIS
CVE-2009-3022 (Cross-site request forgery (CSRF) vulnerability in bingo!CMS 1.2 and ...)
        NOT-FOR-US: bingo!CMS
CVE-2009-3021 (Cross-site scripting (XSS) vulnerability in Site Calendar 'mycaljp' ...)
        NOT-FOR-US: Site Calendar 'mycaljp' plugin
CVE-2009-3020 (win32k.sys in Microsoft Windows Server 2003 SP2 allows remote ...)
        NOT-FOR-US: Microsoft Windows Server
CVE-2009-3019 (Microsoft Internet Explorer 6 on Windows XP SP2 and SP3, and Internet ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3018 (Maxthon Browser 3.0.0.145 Alpha with Ultramode does not properly block ...)
        NOT-FOR-US: Maxthon Browser
CVE-2009-3017 (Orca Browser 1.2 build 5 does not properly block data: URIs in Refresh ...)
        NOT-FOR-US: Orca Browser
CVE-2009-3016 (Apple Safari 4.0.3 does not properly block javascript: and data: URIs ...)
        NOT-FOR-US: Apple Safari
CVE-2009-3015 (QtWeb 3.0 Builds 001 and 003 does not properly block javascript: and ...)
        NOTE: This is a web site issue (open redirector), not a browser problem.
CVE-2009-3014 (Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; ...)
        NOTE: This is a web site issue (open redirector), not a browser problem.
        - iceweasel <unfixed> (unimportant)
CVE-2009-3013 (Opera 9.52 and earlier, and 10.00 Beta 3 Build 1699, does not properly ...)
        NOT-FOR-US: Opera
CVE-2009-3012 (Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre ...)
        NOTE: This is a web site issue (open redirector), not a browser problem.
CVE-2009-3011 (Google Chrome 1.0.154.48 and earlier, 2.0.172.28, 2.0.172.37, and ...)
        - chromium-browser <itp> (bug #520324; unimportant)
        NOTE: This is a web site issue (open redirector), not a browser problem.
CVE-2009-3010 (Mozilla Firefox 3.0.13 and earlier, 3.5, 3.6 a1 pre, and 3.7 a1 pre; ...)
        NOTE: This is a web site issue (open redirector), not a browser problem.
        - iceweasel <unfixed> (unimportant)
CVE-2009-3009 (Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before ...)
        {DSA-1887-1}
        - rails 2.2.3-1 (low; bug #545063)
        [etch] - rails <no-dsa> (Unsupported)
CVE-2009-3008 (K-Meleon 1.5.3 allows context-dependent attackers to spoof the address ...)
        NOT-FOR-US: K-Meleon    
CVE-2009-3007 (Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1, allow ...)
        {DSA-1922-1}
        - xulrunner 1.9.1.3-3 (low)
        - iceape 2.0-1 (low)
        [lenny] - iceape <not-affected> (Iceape from Lenny only provides NSS libs)
        - webkit <not-affected> (proof-of-concept did not work)
CVE-2009-3006 (Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to spoof the ...)
        NOT-FOR-US: Maxthon Browser
CVE-2009-3005 (Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof the address ...)
        NOT-FOR-US: Lunascape
CVE-2009-3004 (Avant Browser 11.7 Builds 35 and 36 allows remote attackers to spoof ...)
        NOT-FOR-US: Avant Browser
CVE-2009-3003 (Microsoft Internet Explorer 6 through 8 allows remote attackers to ...)
        NOT-FOR-US: Microsoft Internet Explorer
CVE-2009-3002 (The Linux kernel before 2.6.31-rc7 does not initialize certain data ...)
        {DSA-1929-1 DSA-1928-1 DSA-1915-1}
        - linux-2.6 2.6.30-7 (low)
        - linux-2.6.24 <removed>
        NOTE: minor info leaks
CVE-2009-3001 (The llc_ui_getname function in net/llc/af_llc.c in the Linux kernel ...)
        {DSA-1929-1 DSA-1928-1 DSA-1915-1}
        - linux-2.6 2.6.30-7 (low)
        - linux-2.6.24 <removed>
        NOTE: minor info leak
CVE-2009-3000 (The sockfs module in the kernel in Sun Solaris 10 and OpenSolaris ...)
        NOT-FOR-US: Sun Solaris
CVE-2008-7131 (Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier ...)
        NOT-FOR-US: DB2 Monitoring Console
CVE-2008-7130 (Unspecified vulnerability in DB2 Monitoring Console 2.2.4 and earlier ...)
        NOT-FOR-US: DB2 Monitoring Console
CVE-2008-7129 (XySSL before 0.9 allows remote attackers to cause a denial of service ...)
        - xyssl 0.9-1
        - polarssl <not-affected> (fixed in xyssl before polarssl was forked from it)
        - pdkim <itp> (bug #543150)
        NOTE: check pdkim if/when it enters unstable (contains polarssl code copy)
CVE-2008-7128 (The ssl_parse_client_key_exchange function in XySSL before 0.9 does ...)
        - xyssl 0.9-1
        - polarssl <not-affected> (fixed in xyssl before polarssl was forked from it)
        - pdkim <itp> (bug #543150)
        NOTE: check pdkim if/when it enters unstable (contains polarssl code copy)
CVE-2008-7127 (osagent.exe in Borland VisiBroker Smart Agent 08.00.00.C1.03 and ...)
        NOT-FOR-US: Borland VisiBroker Smart Agent
CVE-2008-7126 (Integer overflow in osagent.exe in Borland VisiBroker Smart Agent ...)
        NOT-FOR-US: Borland VisiBroker Smart Agent
CVE-2008-7125 (pphoto in Ariadne before 2.6 allows remote authenticated users with ...)
        NOT-FOR-US: Ariadne
CVE-2008-7124 (zKup CMS 2.0 through 2.3 does not require administrative ...)
        NOT-FOR-US: zKup CMS
CVE-2008-7123 (Static code injection vulnerability in ...)
        NOT-FOR-US: zKup CMS
CVE-2008-7122 (Multiple insecure method vulnerabilities in an ActiveX control in ...)
        NOT-FOR-US: ActiveX
CVE-2008-7121 (Cross-site scripting (XSS) vulnerability in Mr. CGI Guy Hot Links ...)
        NOT-FOR-US: Mr. CGI Guy Hot Links SQL-PHP
CVE-2008-7120 (SQL injection vulnerability in Mr. CGI Guy Hot Links SQL-PHP 3 and ...)
        NOT-FOR-US: Mr. CGI Guy Hot Links SQL-PHP
CVE-2008-7119 (SQL injection vulnerability in item.php in WeBid auction script 0.5.4 ...)
        NOT-FOR-US: WeBid auction script
CVE-2008-7118 (WeBid auction script 0.5.4 stores sensitive information under the web ...)
        NOT-FOR-US: WeBid auction script
CVE-2008-7117 (eledicss.php in WeBid auction script 0.5.4 allows remote attackers to ...)
        NOT-FOR-US: WeBid auction script
CVE-2008-7116 (SQL injection vulnerability in the admin panel (admin/) in WeBid ...)
        NOT-FOR-US: WeBid auction script
CVE-2008-7115 (The web interface to the Belkin Wireless G router and ADSL2 modem ...)
        NOT-FOR-US: Belkin Wireless G
CVE-2008-7114 (SQL injection vulnerability in members_search.php in iFusion Services ...)
        NOT-FOR-US: iFusion Services
CVE-2008-7113 (The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 ...)
        NOT-FOR-US: Kyocera Mita
CVE-2008-7112 (The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 ...)
        NOT-FOR-US: Kyocera Mita
CVE-2008-7111 (The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 ...)
        NOT-FOR-US: Kyocera Mita
CVE-2008-7110 (Directory traversal vulnerability in the Scanner File Utility (aka ...)
        NOT-FOR-US: Kyocera Mita
CVE-2008-7109 (The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 ...)
        NOT-FOR-US: Kyocera Mita
CVE-2008-7108 (Multiple cross-site scripting (XSS) vulnerabilities in Carmosa phpCart ...)
        NOT-FOR-US: Carmosa phpCart
CVE-2008-7107 (easdrv.sys in ESET Smart Security 3.0.667.0 allows local users to ...)
        NOT-FOR-US: ESET Smart Security
CVE-2009-2999 (The com.android.phone process in Android 1.5 CRBxx allows remote ...)
        NOT-FOR-US: Android
CVE-2009-XXXX [serveez: buffer overflow in header parser]
        - serveez <removed> (low)
        [lenny] - serveez <no-dsa> (Fringe package, mostly unused)
        TODO: next point release [lenny] - serveez 0.1.5-2.1+lenny1
        [etch] - serveez <no-dsa> (Fringe package, mostly unused)
        TODO: next point release [etch] - serveez 0.1.5-2+etch1
CVE-2009-2998 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2997 (Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before ...)
        NOT-FOR-US: Adobe
CVE-2009-2996 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2995 (Integer overflow in Adobe Acrobat 7.x before 7.1.4, 8.x before 8.1.7, ...)
        NOT-FOR-US: Adobe
CVE-2009-2994 (Buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2993 (The JavaScript for Acrobat API in Adobe Reader and Acrobat 7.x before ...)
        NOT-FOR-US: Adobe
CVE-2009-2992 (An unspecified ActiveX control in Adobe Reader and Acrobat 9.x before ...)
        NOT-FOR-US: Adobe
CVE-2009-2991 (Unspecified vulnerability in the Mozilla plug-in in Adobe Reader and ...)
        NOT-FOR-US: Adobe
CVE-2009-2990 (Array index error in Adobe Reader and Acrobat 9.x before 9.2, 8.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2989 (Integer overflow in Adobe Acrobat 9.x before 9.2, 8.x before 8.1.7, ...)
        NOT-FOR-US: Adobe
CVE-2009-2988 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2987 (Unspecified vulnerability in an ActiveX control in Adobe Reader and ...)
        NOT-FOR-US: Adobe
CVE-2009-2986 (Multiple heap-based buffer overflows in Adobe Reader and Acrobat 7.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2985 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2984 (Unspecified vulnerability in the image decoder in Adobe Acrobat 9.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2983 (Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and ...)
        NOT-FOR-US: Adobe
CVE-2009-2982 (An unspecified certificate in Adobe Reader and Acrobat 9.x before 9.2, ...)
        NOT-FOR-US: Adobe
CVE-2009-2981 (Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2980 (Integer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x ...)
        NOT-FOR-US: Adobe
CVE-2009-2979 (Adobe Reader and Acrobat 9.x before 9.2, 8.x before 8.1.7, and ...)
        NOT-FOR-US: Adobe
CVE-2009-2978 (SQL injection vulnerability in SugarCRM 4.5.1o and earlier, 5.0.0k and ...)
        NOT-FOR-US: SugarCRM
CVE-2009-2977 (The Cisco Security Monitoring, Analysis and Response System (CS-MARS) ...)
        NOT-FOR-US: Cisco
CVE-2009-2976 (Cisco Aironet Lightweight Access Point (AP) devices send the contents ...)
        NOT-FOR-US: Cisco
CVE-2009-2975 (Mozilla Firefox 3.5.2 on Windows XP, in some situations possibly ...)
        - xulrunner <not-affected> (unimportant)
        NOTE: browser crashes not treated as security issues
        NOTE: not reproducible, probably only Firefox in Windows XP is affected
CVE-2009-2974 (Google Chrome 1.0.154.65, 1.0.154.48, and earlier allows remote ...)
        - chromium-browser <itp> (bug #520324)
CVE-2009-2973 (Google Chrome before 2.0.172.43 does not prevent SSL connections to a ...)
        - chromium-browser <itp> (bug #520324)
CVE-2009-2972 (in.lpd in the print service in Sun Solaris 8 and 9 allows remote ...)
        NOT-FOR-US: Sun Solaris
CVE-2008-7106 (The installation of Sophos PureMessage for Microsoft Exchange 3.0 ...)
        NOT-FOR-US: Microsoft Exchange
CVE-2008-7105 (Sophos PureMessage for Microsoft Exchange 3.0 before 3.0.2 allows ...)
        NOT-FOR-US: Sophos PureMessage for Microsoft Exchange
CVE-2008-7104 (Sophos PureMessage Scanner service (PMScanner.exe) in PureMessage for ...)
        NOT-FOR-US: Sophos PureMessage Scanner service
CVE-2008-7103 (Stack-based buffer overflow in an ActiveX control in ...)
        NOT-FOR-US: Toolbar 2.0.4.1
CVE-2008-7102 (DotNetNuke 2.0 through 4.8.4 allows remote attackers to load .ascx ...)
        NOT-FOR-US: DotNetNuke
CVE-2008-7101 (Unspecified vulnerability in DotNetNuke 4.0 through 4.8.4 and 5.0 ...)
        NOT-FOR-US: DotNetNuke
CVE-2008-7100 (Unspecified vulnerability in DotNetNuke 4.4.1 through 4.8.4 allows ...)
        NOT-FOR-US: DotNetNuke
CVE-2008-7099 (Unspecified vulnerability in the Manage Templates feature in Qsoft ...)
        NOT-FOR-US: Qsoft K-Rate Premium
CVE-2008-7098 (Multiple cross-site scripting (XSS) vulnerabilities in Qsoft K-Rate ...)
        NOT-FOR-US: Qsoft K-Rate Premium
CVE-2008-7097 (Multiple SQL injection vulnerabilities in Qsoft K-Rate Premium allow ...)
        NOT-FOR-US: Qsoft K-Rate Premium
CVE-2008-7096 (Intel Desktop and Intel Mobile Boards with BIOS firmware DQ35JO, ...)
        NOT-FOR-US: Intel Desktop and Intel Mobile Boards
CVE-2008-7095 (The SNMP daemon in ArubaOS 3.3.2.6 in Aruba Mobility Controller does ...)
        NOT-FOR-US: ArubaOS
CVE-2009-2971
        RESERVED
CVE-2009-2970 (Stack-based buffer overflow in the GetUiDllVersion function in an ...)
        NOT-FOR-US: UiTV UiPlayer
CVE-2009-2969
        RESERVED
CVE-2009-2968 (Directory traversal vulnerability in a support component in the web ...)
        NOT-FOR-US: VMware Studio
CVE-2009-2967 (Multiple cross-site scripting (XSS) vulnerabilities in Buildbot 0.7.6 ...)
        - buildbot 0.7.11p3-1
        [lenny] - buildbot <no-dsa> (Minor issue)
        [etch] - buildbot <not-affected> (According to the vendor 0.7.5 and earlier are not affected)
CVE-2008-7094 (Campaign/CampaignListener in the listener server in Unica Affinium ...)
        NOT-FOR-US: Affinium Campaign
CVE-2008-7093 (Multiple directory traversal vulnerabilities in Unica Affinium ...)
        NOT-FOR-US: Affinium Campaign
CVE-2008-7092 (Multiple cross-site scripting (XSS) vulnerabilities in Unica Affinium ...)
        NOT-FOR-US: Affinium Campaign
CVE-2008-7091 (Multiple SQL injection vulnerabilities in Pligg 9.9 and earlier allow ...)
        NOT-FOR-US: Pligg
CVE-2008-7090 (Multiple directory traversal vulnerabilities in Pligg 9.9 and earlier ...)
        NOT-FOR-US: Pligg
CVE-2008-7089 (Cross-site scripting (XSS) vulnerability in Pligg 9.9 and earlier ...)
        NOT-FOR-US: Pligg
CVE-2008-7088 (Unrestricted file upload vulnerability in upload.php in PhotoPost ...)
        NOT-FOR-US: PhotoPost vBGallery
CVE-2008-7087 (PHP remote file inclusion vulnerability in search_wA.php in OpenPro ...)
        NOT-FOR-US: OpenPro
CVE-2008-7086 (Maian Greetings 2.1 allows remote attackers to bypass authentication ...)
        NOT-FOR-US: Maian Greetings
CVE-2008-7085 (Multiple SQL injection vulnerabilities in TheHockeyStop HockeySTATS ...)
        NOT-FOR-US: TheHockeyStop HockeySTATS Online
CVE-2008-7084 (Directory traversal vulnerability in the web server 1.0 in Velocity ...)
        NOT-FOR-US: Velocity Security Management System
CVE-2009-2966 (avp.exe in Kaspersky Internet Security 9.0.0.459 and Anti-Virus ...)
        NOT-FOR-US: Kaspersky Internet Security
CVE-2009-2965 (Cross-site scripting (XSS) vulnerability in entry/index.jsp in ...)
        NOT-FOR-US: Radvision Scopia
CVE-2009-2964 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        - squirrelmail 2:1.4.20~rc2-1 (low; bug #543818)
CVE-2009-2963 (Unspecified vulnerability in the update feature in Toolbar Uninstaller ...)
        NOT-FOR-US: Toolbar Uninstaller
CVE-2009-2961 (Stack-based buffer overflow in Thaddy de Konng KOL Player 1.0 allows ...)
        NOT-FOR-US: Thaddy de Konng KOL Player
CVE-2009-2960 (CuteFlow 2.10.3 and 2.11.0_c does not properly restrict access to ...)
        NOT-FOR-US: CuteFlow
CVE-2009-2959 (Cross-site scripting (XSS) vulnerability in the waterfall web status ...)
        - buildbot 0.7.11p3-1 (low; bug #543822)
        [lenny] - buildbot <no-dsa> (Minor issue)
        [etch] - buildbot <not-affected> (According to the vendor 0.7.5 and earlier are not affected)
CVE-2009-2958 (The tftp_request function in tftp.c in dnsmasq before 2.50, when ...)
        {DSA-1876-1}
        - dnsmasq 2.50-1
        [etch] - dnsmasq <not-affected>
CVE-2009-2957 (Heap-based buffer overflow in the tftp_request function in tftp.c in ...)
        {DSA-1876-1}
        - dnsmasq 2.50-1
        [etch] - dnsmasq <not-affected>
CVE-2009-2956 (The (1) Net.Commerce and (2) Net.Data components in IBM WebSphere ...)
        NOT-FOR-US: IBM WebSphere
CVE-2009-2955 (Google Chrome 1.0.154.48 and earlier allows remote attackers to cause ...)
        - chromium-browser <itp> (bug #520324)
CVE-2009-2954 (Microsoft Internet Explorer 6.0.2900.2180 and earlier allows remote ...)
        NOT-FOR-US: Microsoft
CVE-2009-2953 (Mozilla Firefox 3.0.6 through 3.0.13, and 3.5.x, allows remote ...)
        - xulrunner <unfixed> (unimportant; bug #557753)
        - webkit <unfixed> (unimportant; bug #557752)
        - qt4-x11 <undetermined> (unimportant; bug #561760)
        [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        [lenny] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        - kdelibs <undetermined> (unimportant; bug #561765)
        - kde4libs <undetermined> (unimportant; bug #561762)
        NOTE: browser denial-of-services are considered unimportant
CVE-2009-2952 (Unspecified vulnerability in the pollwakeup function in Sun Solaris ...)
        NOT-FOR-US: Sun Solaris
CVE-2009-2951 (Phenotype CMS before 2.9 does not use a random salt value for password ...)
        NOT-FOR-US: Phenotype CMS
CVE-2008-7083 (Multiple SQL injection vulnerabilities in ReVou Micro Blogging Twitter ...)
        NOT-FOR-US: ReVou Micro Blogging Twitter clone
CVE-2008-7082 (MyBB (aka MyBulletinBoard) 1.4.3 includes the sensitive my_post_key ...)
        NOT-FOR-US: MyBB (aka MyBulletinBoard)
CVE-2008-7081 (userHandler.cgi in RaidSonic ICY BOX NAS firmware 2.3.2.IB.2.RS.1 ...)
        NOT-FOR-US: RaidSonic ICY BOX NAS firmware
CVE-2008-7080 (Team PHP PHP Classifieds Script stores sensitive information under the ...)
        NOT-FOR-US: Team PHP PHP Classifieds Script
CVE-2008-7079 (Buffer overflow in Nero ShowTime 5.0.15.0 allows remote attackers to ...)
        NOT-FOR-US: Nero ShowTime
CVE-2008-7078 (Multiple buffer overflows in Rumpus before 6.0.1 allow remote ...)
        NOT-FOR-US: Rumpus
CVE-2008-7077 (Multiple SQL injection vulnerabilities in SailPlanner 0.3a allow ...)
        NOT-FOR-US: SailPlanner
CVE-2008-7076 (Unrestricted file upload vulnerability in user.modify.profile.php in ...)
        NOT-FOR-US: Kalptaru Infotech Ltd. Star Articles
CVE-2008-7075 (Multiple SQL injection vulnerabilities in Kalptaru Infotech Ltd. Star ...)
        NOT-FOR-US: Kalptaru Infotech Ltd. Star Articles
CVE-2008-7074 (Format string vulnerability in MemeCode Software i.Scribe 1.88 through ...)
        NOT-FOR-US: MemeCode Software i.Scribe
CVE-2008-7073 (PHP remote file inclusion vulnerability in lib/action/rss.php in RSS ...)
        NOT-FOR-US: RSS module 0.1 for Pie Web M{a,e}sher
CVE-2008-7072 (Cross-site scripting (XSS) vulnerability in index.php in Chipmunk ...)
        NOT-FOR-US: Chipmunk Topsites
CVE-2008-7071 (SQL injection vulnerability in authenticate.php in Chipmunk Topsites ...)
        NOT-FOR-US: Chipmunk Topsites
CVE-2008-7070 (Argument injection vulnerability in the URI handler in KVIrc 3.4.2 ...)
        - kvirc <unfixed>
        TODO: check
CVE-2008-7069 (All Club CMS (ACCMS) 0.0.2 and earlier stores sensitive information ...)
        NOT-FOR-US: All Club CMS (ACCMS)
CVE-2008-7067 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: PageTree CMS 
CVE-2008-7066 (OpenForum 0.66 Beta allows remote attackers to bypass authentication ...)
        NOT-FOR-US: OpenForum
CVE-2008-7065 (Siemens C450 IP and C475 IP VoIP devices allow remote attackers to ...)
        NOT-FOR-US: Siemens C450 IP and C475 IP VoIP devices
CVE-2008-7064 (Directory traversal vulnerability in the get_lang function in ...)
        NOT-FOR-US: Quicksilver Forums
CVE-2008-7063 (Ocean12 FAQ Manager Pro stores sensitive data under the web root with ...)
        NOT-FOR-US: Ocean12 FAQ Manager Pro
CVE-2008-7062 (Unrestricted file upload vulnerability in admin/index.php in Download ...)
        NOT-FOR-US: Download Manager module 1.0 for LoveCMS
CVE-2008-7061 (The tooltip manager (chrome/views/tooltip_manager.cc) in Google Chrome ...)
        - chromium-browser <itp> (bug #520324)
CVE-2008-7060 (Multiple cross-site scripting (XSS) vulnerabilities in One-News Beta 2 ...)
        NOT-FOR-US: One-News
CVE-2008-7059 (SQL injection vulnerability in index.php in One-News Beta 2 allows ...)
        NOT-FOR-US: One-News
CVE-2008-7058 (Cross-site request forgery (CSRF) vulnerability in BandSite CMS 1.1.4 ...)
        NOT-FOR-US: BandSite CMS
CVE-2008-7057 (Cross-site scripting (XSS) vulnerability in merchandise.php in ...)
        NOT-FOR-US: BandSite CMS
CVE-2008-7056 (BandSite CMS 1.1.4 does not perform access control for ...)
        NOT-FOR-US: BandSite CMS
CVE-2008-7055 (module.php in ezContents 2.0.3 allows remote attackers to bypass the ...)
        NOT-FOR-US: ezContents
CVE-2008-7054 (Multiple directory traversal vulnerabilities in ezContents 2.0.3 allow ...)
        NOT-FOR-US: ezContents
CVE-2008-7053 (LogMeIn Remote Access Utility ActiveX control (RACtrl.dll) allows ...)
        NOT-FOR-US: LogMeIn
CVE-2009-2950
        RESERVED
CVE-2009-2949
        RESERVED
CVE-2009-2948 (mount.cifs in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before ...)
        {DSA-1908-1}
        - samba 2:3.4.2-1 (medium; bug #550423)
CVE-2009-2947 (Cross-site scripting (XSS) vulnerability in Xapian Omega before 1.0.16 ...)
        {DSA-1882-1}
        - xapian-omega 1.0.15-2
CVE-2009-2946 (Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in ...)
        {DSA-1878-2 DSA-1878-1}
        - devscripts 2.10.54
CVE-2009-2945 (weblogin/login.fcgi (aka the WebLogin login script) in Stanford ...)
        - webauth 3.6.2-1 (low)
        [lenny] - webauth <no-dsa> (Minor issue, maintainer prepares update for spu)
        [etch] - webauth <not-affected> (Vulnerable code not present)
CVE-2009-2944 (Incomplete blacklist vulnerability in the teximg plugin in ikiwiki ...)
        {DSA-1875-1}
        - ikiwiki 3.1415926
CVE-2009-2943 (The postgresql-ocaml bindings 1.5.4, 1.7.0, and 1.12.1 for PostgreSQL ...)
        {DSA-1909-1}
        - postgresql-ocaml 1.12.1-1 (low)
CVE-2009-2942 (The mysql-ocaml bindings 1.0.4 for MySQL do not properly support the ...)
        {DSA-1910-1}
        - mysql-ocaml 1.0.4-7 (low)
CVE-2009-2941 [pgtcl: missing escape function]
        RESERVED
        - pgtcl <unfixed> (low)
CVE-2009-2940 (The pygresql module 3.8.1 and 4.0 for Python does not properly support ...)
        {DSA-1911-1}
        - pygresql 1:4.0-1 (low)
CVE-2009-2939 (The postfix.postinst script in the Debian GNU/Linux and Ubuntu postfix ...)
        - postfix 2.6.5-3 (low)
        [lenny] - postfix <no-dsa> (Minor issue)
        [etch] - postfix <no-dsa> (Minor issue)
CVE-2009-2938
        RESERVED
CVE-2009-2937 (Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet ...)
        - planet <removed> (low; bug #546178)
        [lenny] - planet <no-dsa> (Minor issue)
        [etch] - planet <no-dsa> (Minor issue)
        - planet-venus 0~bzr116-1 (low; bug #546179)
        [lenny] - planet-venus <no-dsa> (Minor issue)
        TODO: next point update [lenny] - planet-venus 0~bzr95-2+lenny1
        [etch] - planet-venus <no-dsa> (Minor issue)
CVE-2009-2936
        RESERVED
CVE-2009-2935 (Google V8, as used in Google Chrome before 2.0.172.43, allows remote ...)
        - chromium-browser <itp> (bug #520324)
CVE-2009-2934 (Multiple stack-based buffer overflows in xaudio.dll in Programmed ...)
        NOT-FOR-US: Programmed Integration PIPL
CVE-2009-2933 (SQL injection vulnerability in comments.php in Piwigo before 2.0.3 ...)
        NOT-FOR-US: Piwigo
CVE-2009-2932 (Cross-site scripting (XSS) vulnerability in uddiclient/process in the ...)
        NOT-FOR-US: SAP NetWeaver
CVE-2009-2931 (Directory traversal vulnerability in p.php in SlideShowPro Director ...)
        NOT-FOR-US: SlideShowPro Director
CVE-2009-2930 (Cross-site scripting (XSS) vulnerability in the Search feature in elka ...)
        NOT-FOR-US: elka CMS (aka Elkapax) 
CVE-2009-2929 (Multiple SQL injection vulnerabilities in TGS Content Management 0.x ...)
        NOT-FOR-US: TGS Content Management
CVE-2009-2928 (Cross-site scripting (XSS) vulnerability in login.php in TGS Content ...)
        NOT-FOR-US: TGS Content Management
CVE-2009-2927 (SQL injection vulnerability in DetailFile.php in DigitalSpinners DS ...)
        NOT-FOR-US: DigitalSpinners DS CMS
CVE-2009-2926 (Multiple SQL injection vulnerabilities in PHP Competition System BETA ...)
        NOT-FOR-US: PHP Competition System BETA
CVE-2008-7052 (Unrestricted file upload vulnerability in profile.php in Pre Projects ...)
        NOT-FOR-US: Pre Projects Pre Real Estate Listings
CVE-2008-7051 (AJ Square AJ Article allows remote attackers to bypass authentication ...)
        NOT-FOR-US: AJ Square AJ Article
CVE-2008-7050 (The password_check function in auth/auth_phpbb3.php in WoW Raid ...)
        NOT-FOR-US: WoW Raid Manager
CVE-2008-7049 (Multiple SQL injection vulnerabilities in login.asp in NatterChat 1.1 ...)
        NOT-FOR-US: NatterChat
CVE-2008-7048 (Multiple cross-site scripting (XSS) vulnerabilities in NatterChat 1.12 ...)
        NOT-FOR-US: NatterChat
CVE-2008-7047 (NatterChat 1.1 allows remote attackers to bypass authentication and ...)
        NOT-FOR-US: NatterChat
CVE-2008-7046 (AJ Square Free Polling Script (AJPoll) allows remote attackers to ...)
        NOT-FOR-US: AJ Square Free Polling Script 
CVE-2008-7045 (AJ Square Free Polling Script (AJPoll) Database version allows remote ...)
        NOT-FOR-US: AJ Square Free Polling Script 
CVE-2008-7044 (SQL injection vulnerability in admin/include/newpoll.php in AJ Square ...)
        NOT-FOR-US: AJ Square Free Polling Script 
CVE-2008-7043 (Cross-site scripting (XSS) vulnerability in register.php in ...)
        NOT-FOR-US: FreshScripts Fresh Email Script
CVE-2008-7042 (PHP remote file inclusion vulnerability in url.php in FreshScripts ...)
        NOT-FOR-US: FreshScripts Fresh Email Script
CVE-2008-7041 (AJ Classifieds allows remote attackers to bypass authentication and ...)
        NOT-FOR-US: AJ Classifieds
CVE-2008-7040 (SQL injection vulnerability in ahah/sf-profile.php in the Yellow ...)
        NOT-FOR-US: Yellow Swordfish Simple Forum module for Wordpress
CVE-2008-7039 (Cross-site scripting (XSS) vulnerability in admin/comments.php in ...)
        NOT-FOR-US: Gelato CMS
CVE-2008-7038 (SQL injection vulnerability in the My_eGallery module for PHP-Nuke ...)
        NOT-FOR-US: My_eGallery module for PHP-Nuke
CVE-2008-7037 (The Sidebar gadget in ITN News Gadget (aka ITN Hub Gadget) 1.06 for ...)
        NOT-FOR-US: ITN News Gadget
CVE-2008-7036 (Multiple cross-site scripting (XSS) vulnerabilities in index.php in ...)
        NOT-FOR-US: DevTracker module 3.0 for bcoos
CVE-2008-7035 (Cross-site scripting (XSS) vulnerability in an unspecified component ...)
        NOT-FOR-US: Simple Machines phpRaider
CVE-2008-7034 (PHP remote file inclusion vulnerability in ...)
        NOT-FOR-US: PHPEcho CMS
CVE-2008-7033 (SQL injection vulnerability in the Simple Shop Galore (com_simpleshop) ...)
        NOT-FOR-US: component for Joomla!
CVE-2008-7032 (Web Management Console Cross-site request forgery (CSRF) vulnerability ...)
        NOT-FOR-US: web management console in F5 BIG-IP 
CVE-2008-7031 (Heap-based buffer overflow in Foxit Remote Access Server (aka WAC ...)
        NOT-FOR-US: Foxit Remote Access Server (aka WAC Server) 
CVE-2008-7030 (Multiple SQL injection vulnerabilities in Site2Nite Real Estate Web ...)
        NOT-FOR-US: Site2Nite Real Estate Web
CVE-2008-7029 (Unrestricted file upload vulnerability in usercp.php in AlilG ...)
        NOT-FOR-US: AlilG Application AliBoard
CVE-2008-7028 (RPG.Board 0.8 Beta2 and earlier allows remote attackers to bypass ...)
        NOT-FOR-US: RPG.Board
CVE-2008-7027 (Libra File Manager 1.18 and earlier allows remote attackers to bypass ...)
        NOT-FOR-US: Libra File Manager
CVE-2008-7026 (Unrestricted file upload vulnerability in filesystem3.class.php in ...)
        NOT-FOR-US: eFront
CVE-2008-7025 (TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe ...)
        NOT-FOR-US: Check Point ZoneAlarm
CVE-2008-7024 (admin.php in Arz Development The Gemini Portal 4.7 and earlier allows ...)
        NOT-FOR-US: Arz Development The Gemini Portal
CVE-2008-7023 (Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other ...)
        NOT-FOR-US: ArubaOS
CVE-2008-7022 (Insecure method vulnerability in ChilkatMail_v7_9.dll in the Chilkat ...)
        NOT-FOR-US: Chilkat Software IMAP ActiveX control
CVE-2008-7021 (Unrestricted file upload vulnerability in editlogo.php in AvailScript ...)
        NOT-FOR-US: AvailScript Jobs Portal Script
CVE-2008-7020 (McAfee SafeBoot Device Encryption 4 build 4750 and earlier stores ...)
        NOT-FOR-US: McAfee SafeBoot Device Encryption
CVE-2008-7019 (Esqlanelapse 2.6.1 and 2.6.2 allows remote attackers to bypass ...)
        NOT-FOR-US: Esqlanelapse
CVE-2008-7018 (Cross-site scripting (XSS) vulnerability in NashTech Easy PHP Calendar ...)
        NOT-FOR-US: NashTech Easy PHP Calendar 
CVE-2008-7017 (Cross-site scripting (XSS) vulnerability in analyse.php in CAcert ...)
        NOT-FOR-US: CAcert
CVE-2008-7016 (tnftpd before 20080929 splits large command strings into multiple ...)
        NOT-FOR-US: tnftpd
CVE-2003-1574 (TikiWiki 1.6.1 allows remote attackers to bypass authentication by ...)
        NOT-FOR-US: TikiWiki
CVE-2009-3026 (protocols/jabber/auth.c in libpurple in Pidgin 2.6.0, and possibly ...)
        - pidgin 2.6.1-1 (low; bug #542891)
        [lenny] - pidgin 2.4.3-4lenny4
        NOTE: gaim nof affected, it never claimed to support TLS/SSL
        NOTE: http://developer.pidgin.im/ticket/8131
        NOTE: http://developer.pidgin.im/viewmtn/revision/diff/312e056d702d29379ea61aea9d27765f127bc888/with/55897c4ce0787edc1e7721b7f4a9b5cbc8357279
CVE-2009-2962
        REJECTED
CVE-2009-2925 (Directory traversal vulnerability in DJcalendar.cgi in DJCalendar ...)
        NOT-FOR-US: DJCalendar
CVE-2009-2924 (Multiple SQL injection vulnerabilities in Videos Broadcast Yourself 2 ...)
        NOT-FOR-US: Videos Broadcast Yourself 2
CVE-2009-2923 (Multiple directory traversal vulnerabilities in BitmixSoft PHP-Lance ...)
        NOT-FOR-US: BitmixSoft PHP-Lance
CVE-2009-2922 (Absolute path traversal vulnerability in pixaria.image.php in Pixaria ...)
        NOT-FOR-US: Pixaria Gallery
CVE-2009-2921 (Multiple SQL injection vulnerabilities in login.php in MOC Designs PHP ...)
        NOT-FOR-US: MOC Designs PHP News
CVE-2009-2920 (Multiple cross-site scripting (XSS) vulnerabilities in Elvin 1.2.2 ...)
        NOT-FOR-US: Elvin
CVE-2009-2919 (Cross-site scripting (XSS) vulnerability in Boonex Orca 2.0 and 2.0.2 ...)
        NOT-FOR-US: Boonex Orca
CVE-2009-2918 (The tgbvpn.sys driver in TheGreenBow IPSec VPN Client 4.61.003 allows ...)
        NOT-FOR-US: TheGreenBow IPSec VPN Client
CVE-2009-2917 (Stack-based buffer overflow in ImTOO MPEG Encoder 3.1.53 allows remote ...)
        NOT-FOR-US: ImTOO MPEG Encoder
CVE-2009-2916 (Format string vulnerability in the CNS_AddTxt function in logs.dll in ...)
        NOT-FOR-US: 2K Games Vietcong
CVE-2009-2915 (SQL injection vulnerability in 2fly_gift.php in 2FLY Gift Delivery ...)
        NOT-FOR-US: 2FLY Gift Delivery System
CVE-2009-2914 (Cross-site scripting (XSS) vulnerability in index.php in XZero ...)
        NOT-FOR-US: XZero Community Classified
CVE-2009-2913 (Cross-site scripting (XSS) vulnerability in index.php in XZero ...)
        NOT-FOR-US: XZero Community Classified
CVE-2009-2912 (The (1) sendfile and (2) sendfilev functions in Sun Solaris 8 through ...)
        NOT-FOR-US: Sun Solaris
CVE-2009-2911 (SystemTap 1.0, when the --unprivileged option is used, does not ...)
        - systemtap 1.0-2 (bug #551918)
        [lenny] - systemtap <not-affected> (Affected functionality only added in 1.0)
CVE-2009-2910 (arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.31.4 on the ...)
        {DSA-1928-1 DSA-1915-1}
        - linux-2.6 2.6.31-1 (medium)
        - linux-2.6.24 <unfixed> (medium)
CVE-2009-2909 (Integer signedness error in the ax25_setsockopt function in ...)
        {DSA-1929-1 DSA-1928-1 DSA-1915-1}
        - linux-2.6 2.6.31-1 (medium)
        - linux-2.6.24 <removed> (medium)
CVE-2009-2908 (The d_delete function in fs/ecryptfs/inode.c in eCryptfs in the Linux ...)
        {DSA-1928-1 DSA-1915-1}
        - linux-2.6 2.6.31-1 (medium)
        [etch] - linux-2.6 <not-affected> (vulnerable code introduced in 2.6.19)
        - linux-2.6.24 <removed> (medium)
CVE-2009-2907
        RESERVED
CVE-2009-2906 (smbd in Samba 3.0 before 3.0.37, 3.2 before 3.2.15, 3.3 before 3.3.8, ...)
        {DSA-1908-1}
        - samba 2:3.4.2-1 (low; bug #550423)
CVE-2009-2905 (Heap-based buffer overflow in textbox.c in newt 0.51.5, 0.51.6, and ...)
        {DSA-1894-1}
        - newt 0.52.10-4.1 (medium; bug #548198)
CVE-2009-2904 (A certain Red Hat modification to the ChrootDirectory feature in ...)
        - openssh <not-affected> (issue with homechroot patch specific to Red Hat)
CVE-2009-2903 (Memory leak in the appletalk subsystem in the Linux kernel 2.4.x ...)
        {DSA-1928-1 DSA-1915-1}
        - linux-2.6 2.6.31-1 (low)
        - linux-2.6.24 <removed> (low)
CVE-2009-2902
        RESERVED
CVE-2009-2901
        RESERVED
CVE-2009-2900
        RESERVED
CVE-2009-2899
        RESERVED
CVE-2009-2898 (Cross-site scripting (XSS) vulnerability in the Alerts list feature in ...)
        NOT-FOR-US: SpringSource Hyperic HQ
CVE-2009-2897 (Multiple cross-site scripting (XSS) vulnerabilities in ...)
        NOT-FOR-US: SpringSource Hyperic HQ
CVE-2009-2896 (Buffer overflow in KMplayer 2.9.4.1433 and earlier allows remote ...)
        NOT-FOR-US: KMPlayer: http://www.kmplayer.com
CVE-2009-2895 (SQL injection vulnerability in rss.php in Ultimate Regnow Affiliate ...)
        NOT-FOR-US: Ultimate Regnow Affiliate
CVE-2009-2894 (Multiple SQL injection vulnerabilities in Ebay Clone 2009 allow remote ...)
        NOT-FOR-US: Ebay Clone 2009
CVE-2009-2893 (Multiple cross-site scripting (XSS) vulnerabilities in index.php in ...)
        NOT-FOR-US: XZero Community Classifieds
CVE-2009-2892 (Multiple SQL injection vulnerabilities in header.php in Scripteen Free ...)
        NOT-FOR-US: Scripteen Free Image Hosting Script
CVE-2009-2891 (SQL injection vulnerability in list.php in PHP Scripts Now Riddles ...)
        NOT-FOR-US: PHP Scripts Now Riddles 
CVE-2009-2890 (Cross-site scripting (XSS) vulnerability in results.php in PHP Scripts ...)
        NOT-FOR-US: PHP Scripts Now Riddles 
CVE-2009-2889 (Cross-site scripting (XSS) vulnerability in index.php in PHP Scripts ...)
        NOT-FOR-US: PHP Scripts Now Riddles 
CVE-2009-2888 (SQL injection vulnerability in index.php in PHP Scripts Now Hangman ...)
        NOT-FOR-US: PHP Scripts Now Hangman
CVE-2009-2887 (Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts ...)
        NOT-FOR-US: PHP Scripts Now President Bios 
CVE-2009-2886 (SQL injection vulnerability in bios.php in PHP Scripts Now President ...)
        NOT-FOR-US: PHP Scripts Now President
CVE-2009-2885 (SQL injection vulnerability in bios.php in PHP Scripts Now World's ...)
        NOT-FOR-US: PHP Scripts Now World's
CVE-2009-2884 (Cross-site scripting (XSS) vulnerability in bios.php in PHP Scripts ...)
        NOT-FOR-US: PHP Scripts Now World's Tallest Buildings
CVE-2009-2883 (SQL injection vulnerability in admin/login.php in SaphpLesson 4.0, ...)
        NOT-FOR-US: SaphpLesson
CVE-2009-2882 (Multiple cross-site scripting (XSS) vulnerabilities in PG MatchMaking ...)
        NOT-FOR-US: PG MatchMaking
CVE-2009-2881 (Multiple SQL injection vulnerabilities in Basilic 1.5.13 allow remote ...)
        NOT-FOR-US: Basilic
CVE-2009-3369 (CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in ...)
        - backuppc 3.1.0-8 (low; bug #542218)
        [etch] - backuppc <not-affected> (No configuration GUI)
        [lenny] - backuppc <no-dsa> (Requires access)
        TODO: next point release:  [lenny] - backuppc 3.1.0-4lenny2
CVE-2009-XXXX [burn: Insecure escaping of file names]
        - burn 0.4.5-1 (low; bug #542329)
        [lenny] - burn 0.4.3-2.1+lenny1
        [etch] - burn <no-dsa> (Minor issue)
CVE-2009-2880 (Buffer overflow in atrpui.dll in the Cisco WebEx WRF Player 26.x ...)
        NOT-FOR-US: Cisco WebEx WRF Player
CVE-2009-2879 (Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player ...)
        NOT-FOR-US: Cisco WebEx WRF Player
CVE-2009-2878 (Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player ...)
        NOT-FOR-US: Cisco WebEx WRF Player
CVE-2009-2877 (Stack-based buffer overflow in ataudio.dll in the Cisco WebEx WRF ...)
        NOT-FOR-US: Cisco WebEx WRF Player
CVE-2009-2876 (Heap-based buffer overflow in atas32.dll in the Cisco WebEx WRF Player ...)
        NOT-FOR-US: Cisco WebEx WRF Player
CVE-2009-2875 (Buffer overflow in atas32.dll in the Cisco WebEx WRF Player 26.x ...)
        NOT-FOR-US: Cisco WebEx WRF Player
CVE-2009-2874 (The TimesTenD process in Cisco Unified Presence 1.x, 6.x before ...)
        NOT-FOR-US: Cisco Unified Presence
CVE-2009-2873 (Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2872 (Cisco IOS 12.0 through 12.4, when IP-based tunnels and the Cisco ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2871 (Unspecified vulnerability in Cisco IOS 12.2 and 12.4, when SSLVPN ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2870 (Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when the ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2869 (Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2868 (Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2867 (Unspecified vulnerability in Cisco IOS 12.2XNA, 12.2XNB, 12.2XNC, ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2866 (Unspecified vulnerability in Cisco IOS 12.2 through 12.4 allows remote ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2865 (Buffer overflow in the login implementation in the Extension Mobility ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2864 (Cisco Unified Communications Manager (aka CUCM, formerly CallManager) ...)
        NOT-FOR-US: Cisco
CVE-2009-2863 (Race condition in the Firewall Authentication Proxy feature in Cisco ...)
        NOT-FOR-US: Cisco IOS
CVE-2009-2862 (The Object Groups for Access Control Lists (ACLs) feature in Cisco IOS ...)
        NOT-FOR-US: Cisco
CVE-2009-2861 (The Over-the-Air Provisioning (OTAP) functionality on Cisco Aironet ...)
        NOT-FOR-US: Cisco
CVE-2009-2860 (Unspecified vulnerability in db2jds in IBM DB2 8.1 before FP18 allows ...)
        NOT-FOR-US: db2jds in IBM DB2
CVE-2009-2859 (IBM DB2 8.1 before FP18 allows attackers to obtain unspecified access ...)
        NOT-FOR-US: IBM DB2
CVE-2009-2858 (Memory leak in the Security component in IBM DB2 8.1 before FP18 on ...)
        NOT-FOR-US: IBM DB2
CVE-2009-2857 (The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before ...)
        NOT-FOR-US: kernel in Sun Solaris
CVE-2009-2856 (Sun Virtual Desktop Infrastructure (VDI) 3.0, when anonymous binding ...)
        NOT-FOR-US: Sun Virtual Desktop Infrastructure
CVE-2009-2855 (The strListGetItem function in src/HttpHeaderTools.c in Squid 2.7 ...)
        - squid 2.7.STABLE7-1 (low; bug #534982)
        - squid3 3.0.STABLE19-1
CVE-2009-2854 (Wordpress before 2.8.3 does not check capabilities for certain ...)
        {DSA-1871-2 DSA-1871-1}
        - wordpress 2.8.3-1
CVE-2009-2853 (Wordpress before 2.8.3 allows remote attackers to gain privileges via ...)
        {DSA-1871-2 DSA-1871-1}
        - wordpress 2.8.3-1
CVE-2009-2852 (WP-Syntax plugin 0.9.1 and earlier for Wordpress, with ...)
        NOT-FOR-US: WP-Syntax plugin
CVE-2009-2851 (Cross-site scripting (XSS) vulnerability in the administrator ...)
        {DSA-1871-2 DSA-1871-1}
        - wordpress 2.8.3-1 (low)
CVE-2009-2850 (Multiple buffer overflows in NASA Common Data Format (CDF) allow ...)
        NOT-FOR-US: NASA Common Data Format
CVE-2009-2845
        REJECTED
CVE-2008-7015 (Unreal engine 3, as used in Unreal Tournament 3 1.3, Frontlines: Fuel ...)
        NOT-FOR-US: Unreal Tournament
CVE-2008-7014 (fhttpd 0.4.2 allows remote attackers to cause a denial of service ...)
        NOT-FOR-US: fhttpd
CVE-2008-7013 (NetService.dll in Baidu Hi IM allows remote servers to cause a denial ...)
        NOT-FOR-US: Baidu Hi IM
CVE-2008-7012 (courier/1000@/api_error_email.html (aka &quot;error reporting page&quot;) in ...)
        NOT-FOR-US: Accellion File Transfer Appliance
CVE-2008-7011 (The Unreal engine, as used in Unreal Tournament 3 1.3, Unreal ...)
        NOT-FOR-US: Unreal Tournament
CVE-2008-7010 (Skalfa Software SkaLinks Exchange Script 1.5 allows remote attackers ...)
        NOT-FOR-US: Skalfa Software SkaLinks Exchange Script
CVE-2008-7009 (Buffer overflow in multiscan.exe in Check Point ZoneAlarm Security ...)
        NOT-FOR-US: Check Point ZoneAlarm Security Suite
CVE-2008-7008 (HyperStop Web Host Directory 1.2 allows remote attackers to bypass ...)
        NOT-FOR-US: HyperStop Web Host Directory 
CVE-2008-7007 (Free PHP VX Guestbook 1.06 allows remote attackers to bypass ...)
        NOT-FOR-US: Free PHP VX Guestbook
CVE-2008-7006 (Free PHP VX Guestbook 1.06 allows remote attackers to bypass ...)
        NOT-FOR-US: Free PHP VX Guestbook
CVE-2008-7005 (include/modules/top/1-random_quote.php in Minb Is Not a Blog (minb) ...)
        NOT-FOR-US: Minb Is Not a Blog
CVE-2008-7004 (Buffer overflow in Electronic Logbook (ELOG) before 2.7.1 has unknown ...)
        NOT-FOR-US: Electronic Logbook
CVE-2009-2849 (The md driver (drivers/md/md.c) in the Linux kernel before 2.6.30.2 ...)
        {DSA-1928-1 DSA-1872-1}
        - linux-2.6 2.6.30-4 (medium)
        - linux-2.6.24 <removed>
        [lenny] - linux-2.6 2.6.26-19 (medium)
CVE-2009-2848 (The execve function in the Linux kernel, possibly 2.6.30-rc6 and ...)
        {DSA-1928-1 DSA-1872-1}
        - linux-2.6 2.6.30-7 (low)
        - linux-2.6.24 <removed>
        [lenny] - linux-2.6 2.6.26-19 (low)
CVE-2009-2847 (The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 ...)
        {DSA-1928-1 DSA-1872-1}
        - linux-2.6 2.6.30-6 (low)
        - linux-2.6.24 <removed>
        [lenny] - linux-2.6 2.6.26-19 (low)
CVE-2009-2846 (The eisa_eeprom_read function in the parisc isa-eeprom component ...)
        {DSA-1928-1 DSA-1872-1}
        - linux-2.6 2.6.30-6 (low)
        - linux-2.6.24 <removed>
        [lenny] - linux-2.6 2.6.26-19 (low)
CVE-2009-2844 (cfg80211 in net/wireless/scan.c in the Linux kernel 2.6.30-rc1 and ...)
        - linux-2.6 2.6.30-7 (medium)
        [etch] - linux-2.6 <not-affected> (vulnerability introduced in 2.6.30)
        [lenny] - linux-2.6 <not-affected> (vulnerability introduced in 2.6.30)
        - linux-2.6.24 <not-affected> (vulnerability introduced in 2.6.30)
CVE-2009-2843 (Java for Mac OS X 10.5 before Update 6 and 10.6 before Update 1 ...)
        NOT-FOR-US: Mac OS X
CVE-2009-2842 (Apple Safari before 4.0.4 does not properly implement certain (1) Open ...)
        NOT-FOR-US: Apple Safari
CVE-2009-2841 (WebKit in Apple Safari before 4.0.4 on Mac OS X does not perform the ...)
        - webkit <undetermined> (medium; bug #559759)
        - qt4-x11 <undetermined> (bug #561760)
        [etch] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        [lenny] - qt4-x11 <not-affected> (webkit support introduced in version 4.4)
        - kdelibs <undetermined> (bug #561765)
        - kde4libs <undetermined> (bug #561762)
CVE-2009-2840 (Spotlight in Apple Mac OS X 10.5.8 does not properly handle temporary ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2839 (Screen Sharing in Apple Mac OS X 10.5.8 allows remote VNC servers to ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2838 (Integer overflow in QuickLook in Apple Mac OS X 10.5.8 allows remote ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2837 (Heap-based buffer overflow in QuickDraw Manager in Apple Mac OS X ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2836 (Race condition in Login Window in Apple Mac OS X 10.6.x before 10.6.2, ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2835 (The kernel in Apple Mac OS X before 10.6.2 does not properly handle ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2834 (IOKit in Apple Mac OS X before 10.6.2 allows local users to modify the ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2833 (Buffer overflow in the UCCompareTextDefault API in International ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2832 (Buffer overflow in FTP Server in Apple Mac OS X before 10.6.2 allows ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2831 (Dictionary in Apple Mac OS X 10.5.8 allows remote attackers to create ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2830 (Multiple buffer overflows in Christos Zoulas file before 5.03 in Apple ...)
        - file 5.03-1
        [lenny] - file <not-affected>
        [etch] - file <not-affected>
CVE-2009-2829 (Event Monitor in Apple Mac OS X 10.5.8 does not properly handle ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2828 (The server in DirectoryService in Apple Mac OS X 10.5.8 allows remote ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2827 (Heap-based buffer overflow in Disk Images in Apple Mac OS X 10.5.8 ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2826 (Multiple integer overflows in CoreGraphics in Apple Mac OS X 10.5.8 ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2825 (Certificate Assistant in Apple Mac OS X before 10.6.2 does not ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2824 (Multiple buffer overflows in Apple Type Services (ATS) in Apple Mac OS ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2823 (The Apache HTTP Server in Apple Mac OS X before 10.6.2 enables the ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2822
        RESERVED
CVE-2009-2821
        RESERVED
CVE-2009-2820 (The web interface in CUPS before 1.4.2, as used on Apple Mac OS X ...)
        {DSA-1933-1}
        - cups 1.4.2-1 (low; bug #555666)
        - cupsys <removed>
CVE-2009-2819 (AFP Client in Apple Mac OS X 10.5.8 allows remote AFP servers to ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2818 (Adaptive Firewall in Apple Mac OS X before 10.6.2 does not properly ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2817 (Buffer overflow in Apple iTunes before 9.0.1 allows remote attackers ...)
        NOT-FOR-US: Apple iTunes
CVE-2009-2816 (The implementation of Cross-Origin Resource Sharing (CORS) in WebKit, ...)
        - webkit <unfixed> (medium; bug #559759)
        [lenny] - webkit <not-affected> (vulnerable code not present)
CVE-2009-2815 (The Telephony component in Apple iPhone OS before 3.1 does not ...)
        NOT-FOR-US: Apple iPhone OS
CVE-2009-2814 (Cross-site scripting (XSS) vulnerability in the Wiki Server in Apple ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2813 (Samba 3.4 before 3.4.2, 3.3 before 3.3.8, 3.2 before 3.2.15, and ...)
        {DSA-1908-1}
        - samba 2:3.4.2-1 (unimportant; bug #550422)
        NOTE: requires an administrator to manually configure a user account without
        NOTE: a home dir, otherwise, this is ineffective
CVE-2009-2812 (Launch Services in Apple Mac OS X 10.5.8 does not properly recognize ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2811 (Incomplete blacklist vulnerability in Launch Services in Apple Mac OS ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2810 (Launch Services in Apple Mac OS X 10.6.x before 10.6.2 recursively ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2809 (ImageIO in Apple Mac OS X 10.4.11 and 10.5.8 allows remote attackers ...)
        NOT-FOR-US: ImageIO in Apple Mac OS X
CVE-2009-2808 (Help Viewer in Apple Mac OS X before 10.6.2 does not use an HTTPS ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2807 (Heap-based buffer overflow in the USB backend in CUPS in Apple Mac OS ...)
        - cupsys <not-affected> (issue in darwin-specific code; bug #550150)
        - cups <not-affected> (issue in darwin-specific code; bug #550150)
CVE-2009-2806
        RESERVED
CVE-2009-2805 (Integer overflow in CoreGraphics in Apple Mac OS X 10.4.11 and 10.5.8 ...)
        NOT-FOR-US: CoreGraphics in Apple Mac OS X
CVE-2009-2804 (Integer overflow in ColorSync in Apple Mac OS X 10.4.11 and 10.5.8, ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2803 (CarbonCore in Apple Mac OS X 10.4.11 and 10.5.8 allows attackers to ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2802
        RESERVED
CVE-2009-2801
        RESERVED
CVE-2009-2800 (Buffer overflow in Alias Manager in Apple Mac OS X 10.4.11 and 10.5.8 ...)
        NOT-FOR-US: Apple Mac OS X
CVE-2009-2799 (Heap-based buffer overflow in Apple QuickTime before 7.6.4 allows ...)
        NOT-FOR-US: Apple QuickTime
CVE-2009-2798 (Heap-based buffer overflow in Apple QuickTime before 7.6.4 allows ...)
        NOT-FOR-US: Apple QuickTime
CVE-2009-2797 (The WebKit component in Safari in Apple iPhone OS before 3.1, and ...)
        - webkit <unfixed> (medium; bug #559759)
        TODO: someone needs to gain membership to the webkit security list so we can actually check these issues
CVE-2009-2796 (The UIKit component in Apple iPhone OS 3.0, and iPhone OS 3.0.1 for ...)
        NOT-FOR-US: Apple iPhone OS
CVE-2009-2795 (Heap-based buffer overflow in the Recovery Mode component in Apple ...)
        NOT-FOR-US: Apple iPhone OS 
CVE-2009-2794 (The Exchange Support component in Apple iPhone OS before 3.1, and ...)
        NOT-FOR-US: Apple iPhone OS 
CVE-2009-2793 (The kernel in NetBSD, probably 5.0.1 and earlier, on x86 platforms ...)
        NOT-FOR-US: NetBSD kernel
CVE-2009-2792 (Directory traversal vulnerability in plugings/pagecontent.php in ...)
        NOT-FOR-US: Really Simple CMS
CVE-2009-2791 (PHP remote file inclusion vulnerability in pda_projects.php in ...)
        NOT-FOR-US: WebDynamite ProjectButler
CVE-2009-2790 (SQL injection vulnerability in cat_products.php in SoftBiz Dating ...)
        NOT-FOR-US: SoftBiz Dating
CVE-2009-2789 (SQL injection vulnerability in the Permis (com_groups) component 1.0 ...)
        NOT-FOR-US: com_groups component for Joomla!
CVE-2009-2788 (Multiple SQL injection vulnerabilities in Mobilelib GOLD 3 allow ...)
        NOT-FOR-US: Mobilelib GOLD
CVE-2009-2787 (Directory traversal vulnerability in ...)
        NOT-FOR-US: Reputation plugin for PunBB
CVE-2009-2786 (SQL injection vulnerability in reputation.php in the Reputation plugin ...)
        NOT-FOR-US: Reputation plugin for PunBB
CVE-2009-2785 (Multiple cross-site scripting (XSS) vulnerabilities in PHP Open ...)
        NOT-FOR-US: PHP Open Classifieds Script
CVE-2009-2784 (Multiple directory traversal vulnerabilities in dit.cms 1.3, when ...)
        NOT-FOR-US: dit.cms
CVE-2009-2783 (Multiple cross-site scripting (XSS) vulnerabilities in XOOPS 2.3.3 ...)
        NOT-FOR-US: XOOPS
CVE-2009-2782 (SQL injection vulnerability in the JFusion (com_jfusion) component for ...)
        NOT-FOR-US: com_jfusion component for Joomla!
CVE-2009-2781 (SQL injection vulnerability in forum.php in Arab Portal 2.x, when ...)
        NOT-FOR-US: Arab Portal
CVE-2009-2780 (Multiple cross-site scripting (XSS) vulnerabilities in 68 Classifieds ...)
        NOT-FOR-US: 68 Classifieds
CVE-2009-2779 (SQL injection vulnerability in index.php in AJ Matrix DNA allows ...)
        NOT-FOR-US: AJ Matrix DNA
CVE-2008-7003 (Multiple SQL injection vulnerabilities in login.php in The Rat CMS ...)
        NOT-FOR-US: The Rat CMS 
CVE-2008-7002 (PHP 5.2.5 does not enforce (a) open_basedir and (b) safe_mode_exec_dir ...)
        - php5 (unimportant)
        NOTE: safe-mode and basedir violations not treated as security issues
CVE-2008-7001 (Unrestricted file upload vulnerability in the file manager in Creative ...)
        NOT-FOR-US: Creative Mind Creator CMS
CVE-2008-7000 (PHP remote file inclusion vulnerability in index.php in PHPAuction 3.2 ...)
        NOT-FOR-US: phpAuction
CVE-2008-6999 (phpAuction 3.2, and possibly 3.3.0 GPL Basic edition, allows remote ...)
        NOT-FOR-US: phpAuction
CVE-2008-6998 (Stack-based buffer overflow in chrome/common/gfx/url_elider.cc in ...)
        - chromium-browser <itp> (bug #520324)
CVE-2008-6997 (Google Chrome 0.2.149.27 allows user-assisted remote attackers to ...)
        - chromium-browser <itp> (bug #520324)
CVE-2008-6996 (Google Chrome BETA (0.2.149.27) does not prompt the user before saving ...)
        - chromium-browser <itp> (bug #520324)
CVE-2008-6995 (Integer underflow in net/base/escape.cc in chrome.dll in Google Chrome ...)
        - chromium-browser <itp> (bug #520324)
CVE-2008-6994 (Stack-based buffer overflow in the SaveAs feature ...)
        - chromium-browser <itp> (bug #520324)
CVE-2008-6993 (Siemens Gigaset WLAN Camera 1.27 has an insecure default password, ...)
        NOT-FOR-US: Siemens Gigaset WLAN Camera
CVE-2008-6992 (GreenSQL Firewall (greensql-fw), possibly before 0.9.2 or 0.9.4, ...)
        NOT-FOR-US: GreenSQL Firewall
CVE-2008-6991 (SQL injection vulnerability in public/page.php in Websens CMSbright ...)
        NOT-FOR-US: CMSbright
CVE-2008-6990 (SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka ...)
        NOT-FOR-US: Easy Photo Gallery
CVE-2008-6989 (SQL injection vulnerability in gallery.php in Easy Photo Gallery (aka ...)
        NOT-FOR-US: Easy Photo Gallery
CVE-2008-6988 (Multiple cross-site scripting (XSS) vulnerabilities in Easy Photo ...)
        NOT-FOR-US: Easy Photo Gallery
CVE-2008-6987 (Unrestricted file upload vulnerability in eZoneScripts Dating Website ...)
        NOT-FOR-US: eZoneScripts Dating Website script
CVE-2008-6986 (SQL injection vulnerability in the actionMultipleAddProduct function ...)
        NOT-FOR-US: Zen Cart
CVE-2008-6985 (Multiple SQL injection vulnerabilities in ...)
        NOT-FOR-US: Zen Cart
CVE-2008-6984 (Plesk 8.6.0, when short mail login names (SHORTNAMES) are enabled, ...)
        NOT-FOR-US: Plesk
CVE-2008-6983 (modules/tool/hitcounter.php in devalcms 1.4a allows remote attackers ...)
        NOT-FOR-US: devalcms
CVE-2008-6982 (Cross-site scripting (XSS) vulnerability in index.php in devalcms 1.4a ...)
        NOT-FOR-US: devalcms
CVE-2008-6981 (index.php in phpAdultSite CMS, possibly 2.3.2, allows remote attackers ...)
        NOT-FOR-US: phpAdultSite CMS
CVE-2008-6980 (SQL injection vulnerability in as_archives.php in phpAdultSite CMS, ...)
        NOT-FOR-US: phpAdultSite CMS
CVE-2008-6979 (Cross-site scripting (XSS) vulnerability in as_archives.php in ...)
        NOT-FOR-US: phpAdultSite CMS
CVE-2008-6978 (Unrestricted file upload vulnerability in Full Revolution aspWebAlbum ...)
        NOT-FOR-US: aspWebAlbum
CVE-2008-6977 (Cross-site scripting (XSS) vulnerability in album.asp in Full ...)
        NOT-FOR-US: aspWebAlbum
CVE-2008-6976 (MicroTik RouterOS 3.x through 3.13 and 2.x through 2.9.51 allows ...)
        NOT-FOR-US: MicroTik RouterOS
CVE-2009-2778 (Cross-site scripting (XSS) vulnerability in visitor/view.php in ...)
        NOT-FOR-US: GarageSales script
CVE-2009-2777 (SQL injection vulnerability in visitor/view.php in GarageSales Script ...)
        NOT-FOR-US: GarageSales Script
CVE-2009-2776 (SQL injection vulnerability in showresult.asp in Smart ASP Survey ...)
        NOT-FOR-US: Smart ASP Survey
CVE-2009-2775 (SQL injection vulnerability in linkout.php in PHPArcadeScript (PHP ...)
        NOT-FOR-US: PHPArcadeScript
CVE-2009-2774 (SQL injection vulnerability in paidbanner.php in PHP Paid 4 Mail ...)
        NOT-FOR-US: PHP Paid 4 Mail
CVE-2009-2773 (PHP remote file inclusion vulnerability in home.php in PHP Paid 4 Mail ...)
        NOT-FOR-US: PHP Paid 4 Mail
CVE-2009-2772 (Multiple cross-site scripting (XSS) vulnerabilities in PG Roommate ...)
        NOT-FOR-US: PG Roommate Finder Solution
CVE-2009-2771 (Cross-site scripting (XSS) vulnerability in Free Arcade Script 1.3 ...)
        NOT-FOR-US: Free Arcade Script
CVE-2009-2770 (PowerUpload 2.4 allows remote attackers to bypass authentication and ...)
        NOT-FOR-US: PowerUpload
CVE-2009-2769 (PHP remote file inclusion vulnerability in include/timesheet.php in ...)
        NOT-FOR-US: Ultrize TimeSheet
CVE-2009-2768 (The load_flat_shared_library function in fs/binfmt_flat.c in the flat ...)
        - linux-2.6 2.6.30-6 (medium)
        [etch] - linux-2.6 <not-affected> (kernel/cred.c introduced in 2.6.29)
        [lenny] - linux-2.6 <not-affected> (kernel/cred.c introduced in 2.6.29)
        - linux-2.6.24 <not-affected> (kernel/cred.c introduced in 2.6.29)
CVE-2009-2767 (The init_posix_timers function in kernel/posix-timers.c in the Linux ...)
        - linux-2.6 2.6.30-6 (medium)
        [etch] - linux-2.6 <not-affected> (introduced in 2.6.28)
        [lenny] - linux-2.6 <not-affected> (introduced in 2.6.28)
        - linux-2.6.24 <not-affected> (introduced in 2.6.28)
CVE-2009-2766 (httpd.c in httpd in the management GUI in DD-WRT 24 sp1 does not ...)
        NOT-FOR-US: DD-WRT
CVE-2009-2765 (httpd.c in httpd in the management GUI in DD-WRT 24 sp1, and other ...)
        NOT-FOR-US: DD-WRT
CVE-2009-2764 (Microsoft Internet Explorer 8.0.7100.0 on Windows 7 RC on the x64 ...)
        NOT-FOR-US: Microsoft
CVE-2008-6975 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        NOT-FOR-US: DD-WRT
CVE-2008-6974 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        NOT-FOR-US: DD-WRT
CVE-2009-3040 (Multiple SQL injection vulnerabilities in Open Computer and Software ...)
        - ocsinventory-server 1.02.1-2 (low; bug #541995)
        [lenny] - ocsinventory-server <no-dsa> (Minor issue)
        NOTE: Authentication is needed
CVE-2009-3042 (SQL injection vulnerability in machine.php in Open Computer and ...)
        - ocsinventory-server 1.02.1-2 (low; bug #541995)
        [lenny] - ocsinventory-server <no-dsa> (Minor issue)
        NOTE: Authentication is needed
CVE-2009-2763
        RESERVED
CVE-2009-XXXX [logrotate race condition could lead to file disclosure]
        - logrotate 3.7.8-4 (low)
CVE-2008-6973 (Multiple unspecified vulnerabilities in IBM WebSphere Commerce 6.0 ...)
        NOT-FOR-US: IBM WebSphere 
CVE-2008-6961 (mailnews in Mozilla Thunderbird before 2.0.0.18 and SeaMonkey before ...)
        - icedove 2.0.0.19-1
        - iceape 1.1.14-1
CVE-2009-XXXX [XSS in drupal printing module]
        - drupal6 <unfixed> (unimportant)
        NOTE: you need admin privs in orde to exploit this
        NOTE: http://lampsecurity.org/drupal-print-module-vulnerabilities
CVE-2009-2761 (Unquoted Windows search path vulnerability in the scheduler ...)
        NOT-FOR-US: Avira AntiVir
CVE-2008-6972 (Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content ...)
        NOT-FOR-US: Drupal Content Construction Kit (third-party module)
CVE-2008-6971 (The password reset functionality in Simple Machines Forum (SMF) 1.0.x ...)
        NOT-FOR-US: Simple Machines Forum
CVE-2008-6970 (SQL injection vulnerability in dosearch.inc.php in UBB.threads 7.3.1 ...)
        NOT-FOR-US: UBB.threads
CVE-2008-6969 (Multiple cross-site scripting (XSS) vulnerabilities in checkout.php in ...)
        NOT-FOR-US: Avactis Shopping Cart
CVE-2008-6968 (Multiple SQL injection vulnerabilities in submit.php in Pligg CMS ...)
        NOT-FOR-US: Pligg CMS
CVE-2008-6967 (Multiple unspecified vulnerabilities in WorldClient in Alt-N MDaemon ...)
        NOT-FOR-US: Alt-N MDaemon
CVE-2008-6966 (AJ Square AJ Auction Pro Platinum Skin #1 sends a redirect but does ...)
        NOT-FOR-US: AJ Square AJ Auction Pro Platinum Skin #1
CVE-2008-6965 (AJ Square AJ Auction OOPD, Pro Platinum Skin #1, Pro Platinum Skin #2, ...)
        NOT-FOR-US: AJ Square AJ Auction OOPD
CVE-2008-6964 (SQL injection vulnerability in the login page in X7 Chat 2.0.5 allows ...)
        NOT-FOR-US: X7 Chat
CVE-2008-6963 (admin.php in TurnkeyForms Text Link Sales allows remote attackers to ...)
        NOT-FOR-US: TurnkeyForms Text Link Sales
CVE-2008-6962 (Avira AntiVir Premium, Premium Security Suite, AntiVir Professional, ...)
        NOT-FOR-US: Avira AntiVir Premium
CVE-2009-2760
        RESERVED
CVE-2009-2759
        RESERVED
CVE-2009-2758
        RESERVED
CVE-2009-2757
        RESERVED
CVE-2009-2756
        RESERVED
CVE-2009-2755
        RESERVED
CVE-2009-2754
        RESERVED
CVE-2009-2753
        RESERVED
CVE-2009-2752
        RESERVED
CVE-2009-2751
        RESERVED
CVE-2009-2750
        RESERVED
CVE-2009-2749 (Feature Pack for Communications Enabled Applications (CEA) before ...)
        NOT-FOR-US: IBM WebSphere Application Server
CVE-2009-2748
        RESERVED
CVE-2009-2747
        RESERVED
CVE-2009-2746 (Cross-site request forgery (CSRF) vulnerability in the administrative ...)
        NOT-FOR-US: IBM WebSphere Application Server
CVE-2009-2745
        RESERVED
CVE-2009-2744 (Unspecified vulnerability in IBM WebSphere Application Server (WAS) ...)
        NOT-FOR-US: IBM WebSphere Application Server
CVE-2009-2743 (IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.27, and 7.0 ...)
        NOT-FOR-US: IBM WebSphere Application Server
CVE-2009-2742 (Cross-site scripting (XSS) vulnerability in Eclipse Help in IBM ...)
        NOT-FOR-US: IBM WebSphere Application Server
CVE-2009-2741 (Unspecified vulnerability in the wberuntimeear application in the test ...)
        NOT-FOR-US: IBM WebSphere Business Events 
CVE-2009-2740 (kmxIds.sys before 7.3.1.18 in CA Host-Based Intrusion Prevention ...)
        NOT-FOR-US: CA Host-Based Intrusion Prevention System (HIPS)
CVE-2009-2739 (Cross-site scripting (XSS) vulnerability in FreeNAS before 0.69.2 ...)
        NOT-FOR-US: FreeNAS
CVE-2009-2738 (Cross-site request forgery (CSRF) vulnerability in the WebGUI in ...)
        NOT-FOR-US: FreeNAS
CVE-2008-6960 (download.php in X10media x10 Automatic Mp3 Search Engine Script 1.5.5 ...)
        NOT-FOR-US: X10media
CVE-2008-6959 (Insecure method vulnerability in the Chilkat Socket ActiveX control ...)
        NOT-FOR-US: ActiveX
CVE-2008-6958 (wap/index.php in Crossday Discuz! Board 6.x and 7.x allows remote ...)
        NOT-FOR-US: Crossday Discuz! Board
CVE-2008-6957 (member.php in Crossday Discuz! Board allows remote attackers to reset ...)
        NOT-FOR-US: Crossday Discuz! Board
CVE-2008-6956 (Static code injection vulnerability in admin/admin.php in mxCamArchive ...)
        NOT-FOR-US: mxCamArchive
CVE-2008-6955 (mxCamArchive 2.2 stores sensitive information under the web root with ...)
        NOT-FOR-US: mxCamArchive
CVE-2008-6954 (The web interface (CobblerWeb) in Cobbler before 1.2.9 allows remote ...)
        NOT-FOR-US: Cobbler
CVE-2008-6953 (Buffer overflow in oovoo.exe in ooVoo 1.7.1.35, and possibly other ...)
        NOT-FOR-US: ooVoo
CVE-2008-6952 (SQL injection vulnerability in Rss.php in MauryCMS 0.53.2 and earlier ...)
        NOT-FOR-US: MauryCMS
CVE-2008-6951 (MauryCMS 0.53.2 and earlier does not require administrative ...)
        NOT-FOR-US: MauryCMS
CVE-2008-6950 (Multiple SQL injection vulnerabilities in login.asp in Bankoi ...)
        NOT-FOR-US: Bankoi WebHosting Control Panel
CVE-2008-6949 (Multiple cross-site request forgery (CSRF) vulnerabilities in ...)
        NOT-FOR-US: Collabtive
CVE-2008-6948 (Unrestricted file upload vulnerability in Collabtive 0.4.8 allows ...)
        NOT-FOR-US: Collabtive
CVE-2008-6947 (Collabtive 0.4.8 allows remote attackers to bypass authentication and ...)
        NOT-FOR-US: Collabtive
CVE-2008-6946 (Cross-site scripting (XSS) vulnerability in manageproject.php in ...)
        NOT-FOR-US: Collabtive
CVE-2008-6945 (Multiple cross-site scripting (XSS) vulnerabilities in Interchange 5.7 ...)
        - interchange 5.6.1-1 (low)
CVE-2008-6944 (Unrestricted file upload vulnerability in ScriptsFeed Auto Classifieds ...)
        NOT-FOR-US: ScriptsFeed Auto Classifieds
CVE-2008-6943 (Unrestricted file upload vulnerability in ScriptsFeed Recipes Listing ...)
        NOT-FOR-US: ScriptsFeed Recipes Listing Portal
CVE-2008-6942 (Unrestricted file upload vulnerability in ScriptsFeed Realtor ...)
        NOT-FOR-US: ScriptsFeed Realtor Classifieds System
CVE-2008-6941 (SQL injection vulnerability in the login functionality in TurnkeyForms ...)
        NOT-FOR-US: TurnkeyForms Web Hosting Directory
CVE-2008-6940 (TurnkeyForms Web Hosting Directory stores sensitive information under ...)
        NOT-FOR-US: TurnkeyForms Web Hosting Directory
CVE-2008-6939 (TurnkeyForms Web Hosting Directory allows remote attackers to bypass ...)
        NOT-FOR-US: TurnkeyForms Web Hosting Directory
CVE-2008-6938 (Pi3Web 2.0.3 before PL2, when installed on Windows as a desktop ...)
        NOT-FOR-US: Pi3Web
CVE-2008-6937 (Argument injection vulnerability in Exodus 0.10 allows remote ...)
        NOT-FOR-US: Exodus
CVE-2008-6936 (Argument injection vulnerability in Exodus 0.10 allows remote ...)
        NOT-FOR-US: Exodus
CVE-2008-6935 (Argument injection vulnerability in Exodus 0.10 allows remote ...)
        NOT-FOR-US: Exodus
CVE-2008-6934 (Static code injection vulnerability in Sanus|artificium (aka Sanusart) ...)
        NOT-FOR-US: Sanus|artificium (aka Sanusart)
CVE-2008-6933 (Directory traversal vulnerability in index.php in MiniGal b13 (aka ...)
        NOT-FOR-US: MiniGal
CVE-2008-6932 (Unrestricted file upload vulnerability in submit_file.php in ...)
        NOT-FOR-US: AlstraSoft SendIt Pro
CVE-2008-6931 (Unrestricted file upload vulnerability in PHPStore Job Search (aka ...)
        NOT-FOR-US: PHPStore Job Search (aka PHPCareers)
CVE-2008-6930 (Unrestricted file upload vulnerability in PHPStore Real Estate allows ...)
        NOT-FOR-US: PHPStore Real Estate
CVE-2008-6929 (Unrestricted file upload vulnerability in PHPStore Auto Classifieds ...)
        NOT-FOR-US: PHPStore Auto Classifieds
CVE-2008-6928 (Unrestricted file upload vulnerability in PHPStore Complete ...)
        NOT-FOR-US: PHPStore Complete Classifieds
CVE-2009-2737 (The EditCSVAction function in cgi/actions.py in Roundup 1.2 before ...)
        {DSA-1754-1}
        - roundup 1.4.4-4+lenny1 (bug #518768)
CVE-2009-2736 (Static code injection vulnerability in admin.php in sun-jester ...)
        NOT-FOR-US: OpenNews
CVE-2009-2735 (SQL injection vulnerability in admin.php in sun-jester OpenNews 1.0, ...)
        NOT-FOR-US: OpenNews
CVE-2009-2734 (SQL injection vulnerability in the get_employee function in ...)
        NOT-FOR-US: Achievo
CVE-2009-2733 (Multiple cross-site scripting (XSS) vulnerabilities in Achievo before ...)
        NOT-FOR-US: Achievo
CVE-2009-2732 (The checkHTTPpassword function in http.c in ntop 3.3.10 and earlier ...)
        - ntop 3:3.3-12 (low; bug #543312)
        [lenny] - ntop <no-dsa> (Minor issue)
        [etch] - ntop <no-dsa> (Minor issue)
CVE-2009-2731
        RESERVED
CVE-2009-2730 (libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' ...)
        {DSA-1935-1}
        - gnutls26 2.8.3-1 (low; bug #541439)
        - gnutls13 <removed>
CVE-2009-2729
        RESERVED
CVE-2009-2728
        RESERVED
CVE-2009-2727 (Stack-based buffer overflow in the _tt_internal_realpath function in ...)
        NOT-FOR-US: IBM AIX
CVE-2009-2726 (The SIP channel driver in Asterisk Open Source 1.2.x before 1.2.34, ...)
        - asterisk 1:1.6.2.0~dfsg~rc1-1 (bug #541441)
        [squeeze] - asterisk <not-affected> (Doesn't permit SIP packets to exceed 1500 bytes total)
        [lenny] - asterisk <not-affected> (Doesn't permit SIP packets to exceed 1500 bytes total)
        [etch] - asterisk <not-affected> (Doesn't permit SIP packets to exceed 1500 bytes total)
CVE-2009-2725
        RESERVED
CVE-2009-2724 (Race condition in the java.lang package in Sun Java SE 5.0 before ...)
        - sun-java5 1.5.0-20-1 (unknown)
        [etch] - sun-java5 <no-dsa> (Non-free not supported)
        [lenny] - sun-java5 <no-dsa> (Non-free not supported)
        NOTE: unknown impact and attack vectors
CVE-2009-2723 (Unspecified vulnerability in deserialization in the Provider class in ...)
        - sun-java5 1.5.0-20-1 (unknown)
        [etch] - sun-java5 <no-dsa> (Non-free not supported)
        [lenny] - sun-java5 <no-dsa> (Non-free not supported)
        NOTE: unknown impact and attack vectors
CVE-2009-2722 (Multiple unspecified vulnerabilities in the Provider class in Sun Java ...)
        - sun-java5 1.5.0-20-1 (unknown)
        [etch] - sun-java5 <no-dsa> (Non-free not supported)
        [lenny] - sun-java5 <no-dsa> (Non-free not supported)
        NOTE: unknown impact and attack vectors
CVE-2009-2721 (Multiple unspecified vulnerabilities in the Provider class in Sun Java ...)
        - sun-java5 1.5.0-20-1 (unknown)
        [etch] - sun-java5 <no-dsa> (Non-free not supported)
        [lenny] - sun-java5 <no-dsa> (Non-free not supported)
        NOTE: unknown impact and attack vectors
CVE-2009-2720 (Unspecified vulnerability in the ...)
        - sun-java6 6-15-1
        [etch] - sun-java6 <no-dsa> (Non-free not supported)
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
        - openjdk-6 6b16-1 (medium; bug #560908)
CVE-2009-2719 (The Java Web Start implementation in Sun Java SE 6 before Update 15 ...)
        - sun-java6 6-15-1
        [etch] - sun-java6 <no-dsa> (Non-free not supported)
        [lenny] - sun-java6 <no-dsa> (Non-free not supported)
        - openjdk-6 6b16-1 (medium; bug #560908)
CVE-2009-2718 (The Abstract Window Toolkit (AWT) implementation in Sun Java SE 6 ...)
        - sun-java6 6-15-1
        [etch] - sun-java6 <no-dsa> (Non-free not supported)