/[secure-testing]/data/DSA/list
ViewVC logotype

Contents of /data/DSA/list

Parent Directory Parent Directory | Revision Log Revision Log

Revision 1926 - (show annotations) (download)
Mon Sep 12 10:36:46 2005 UTC (7 years, 8 months ago) by fw
File size: 84489 byte(s) 
Fix syntax of cross-references.  Add assigned CAN.
Add TODO because the data for DSA-188 appears to be wrong.
1 [09 Sep 2005] DSA-806-1 gcvs - insecure temporary files
2 {CAN-2005-2693}
3 - gcvs 1.0final-7 (low)
4 NOTE: fixed in testing at time of DSA
5 [08 Sep 2005] DSA-805-1 apache2 - several
6 {CAN-2005-1268 CAN-2005-2088 CAN-2005-2700 CAN-2005-2728}
7 - apache2 2.0.54-5 (medium)
8 NOTE: not fixed in testing at time of DSA (too young)
9 [08 Sep 2005] DSA-804-1 kdelibs - insecure permissions
10 {CAN-2005-1920}
11 - kdebase 4:3.4.2-1 (medium)
12 NOTE: not fixed in testing at time of DSA (kde transition)
13 [07 Sep 2005] DSA-803-1 apache - programming error
14 {CAN-2005-2088}
15 - apache 1.3.33-8 (medium)
16 NOTE: not fixed in testing at time of DSA (too young)
17 [07 Sep 2005] DSA-802-1 cvs - insecure temporary files
18 {CAN-2005-2693}
19 - cvs 1:1.11.5-4 (low)
20 NOTE: fixed in testing at time of DSA
21 [05 Sep 2005] DSA-801-1 ntp - programming error
22 {CAN-2005-2496}
23 - ntp 1:4.2.0a+stable-4 (medium)
24 NOTE: not fixed in testing at time of DSA (RC bugs)
25 [02 Sep 2005] DSA-800-1 pcre3 - integer overflow
26 {CAN-2005-2491}
27 - pcre3 6.3-0.1etch1 (high)
28 NOTE: not fixed in testing at time of DSA (glibc transition)
29 NOTE: however, fixed in secure-testing archive
30 [02 Sep 2005] DSA-799-1 webcalendar - input validation
31 {CAN-2005-2717}
32 - webcalendar (unfixed; bug #326223; high)
33 NOTE: not fixed in testing at time of DSA (coordinated disclosure)
34 [02 Sep 2005] DSA-798-1 phpgroupware - several
35 {CAN-2005-2498 CAN-2005-2600 CAN-2005-2761}
36 - phpgroupware 0.9.16.008-1 (high)
37 NOTE: not fixed in testing at time of DSA (too young)
38 [01 Sep 2005] DSA-797-1 zsync - buffer overflow
39 {CAN-2005-1849 CAN-2005-2096}
40 - zsync 0.4.0-2 (medium)
41 NOTE: fixed in testing at time of DSA
42 [01 Sep 2005] DSA-796-1 affix - unsafe use of popen
43 {CAN-2005-2716}
44 - affix 2.1.2-3 (medium)
45 NOTE: not fixed in testing at time of DSA (glibc transition, builds)
46 [01 Sep 2005] DSA-795-2 proftpd - format string error
47 {CAN-2005-2390}
48 - proftpd 1.2.10-20 (medium)
49 NOTE: fixed in testing at time of DSA
50 NOTE: Initial -1 release had a build problem
51 [01 Sep 2005] DSA-794-1 polygen - programming error
52 {CAN-2005-2656}
53 - polygen 1.0.6-9 (low)
54 NOTE: not fixed in testing at time of DSA (too young)
55 [21 Aug 2005] DSA-779-2 mozilla-firefox - several
56 NOTE: Essentially 1.0.6 with rolled-back version number, backported version had regressions
57 {CAN-2005-2260 CAN-2005-2261 CAN-2005-2262 CAN-2005-2263 CAN-2005-2264 CAN-2005-2265 CAN-2005-2266 CAN-2005-2267 CAN-2005-2268 CAN-2005-2269 CAN-2005-2270}
58 - mozilla-firefox 1.0.6-1 (medium)
59 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
60 NOTE: Fixed in DTSA, which will have the same regressions, should be checked/reverted
61 [01 Sep 2005] DSA-793-1 courier - missing input sanitising
62 {CAN-2005-2724}
63 - courier 0.47-8 (medium)
64 NOTE: not fixed in testing at time of DSA (glibc transition, too young)
65 [31 Aug 2005] DSA-792-1 pstotext - missing input sanitising
66 {CAN-2005-2536}
67 - pstotext 1.9-2 (medium)
68 NOTE: not fixed in testing at time of DSA (glibc transition, builds)
69 [30 Aug 2005] DSA-791-1 maildrop - missing privilege release
70 {CAN-2005-2655}
71 - maildrop 1.5.3-1.1etch1 (medium)
72 NOTE: not fixed in testing at time of DSA (glibc transition)
73 NOTE: but fixed in secure-testing repo
74 [30 Aug 2005] DSA-790-1 phpldapadmin - programming error
75 {CAN-2005-2654}
76 - phpldapadmin 0.9.6c-5 (medium)
77 NOTE: fixed in testing at time of DSA
78 [29 Aug 2005] DSA-789-1 php4 - several
79 {CAN-2005-1751 CAN-2005-1921 CAN-2005-2498}
80 - php4 4:4.4.0-2 (high)
81 NOTE: not fixed in testing at time of DSA (not uploaded yet)
82 [29 Aug 2005] DSA-788-1 kismet - several
83 {CAN-2005-2626 CAN-2005-2627}
84 - kismet 2005.08.R1-1 (medium)
85 NOTE: not fixed in testing at time of DSA (glibc transition)
86 NOTE: but fixed in secure-testing repo
87 [26 Aug 2005] DSA-787-1 backup-manager - insecure permissions and tempfile
88 {CAN-2005-1855 CAN-2005-1856}
89 - backup-manager 0.5.8-2 (medium)
90 NOTE: fixed in testing at time of DSA
91 [26 Aug 2005] DSA-786-1 simpleproxy - format string vulnerability
92 {CAN-2005-1857}
93 - simpleproxy 3.2-4 (medium)
94 NOTE: not fixed in testing at time of DSA (embargoed disclosure)
95 [25 Aug 2005] DSA-785-1 libpam-ldap - authentication bypass
96 {CAN-2005-2641}
97 - libpam-ldap 178-1sarge1 (medium)
98 NOTE: not fixed in testing at time of DSA (embargoed disclosure)
99 [25 Aug 2005] DSA-784-1 courier - programming error
100 {CAN-2005-2151}
101 - courier 0.47-6 (low)
102 NOTE: not fixed in testing at time of DSA (glibc transition)
103 [24 Aug 2005] DSA-783-1 mysql-dfsg-4.1 - insecure temporary file
104 {CAN-2005-1636}
105 - mysql-dfsg-4.1 4.1.12 (medium)
106 NOTE: not fixed in testing at time of DSA (glibc transition)
107 - mysql-dfsg-5.0 5.0.11beta-3 (medium)
108 NOTE: not fixed in testing at time of DSA (glibc transition)
109 [23 Aug 2005] DSA-782-1 bluez-utils - missing input sanitising
110 {CAN-2005-2547}
111 - bluez-utils 2.19-1 (high)
112 NOTE: not fixed in testing at time of DSA (missing builds)
113 [23 Aug 2005] DSA-781-1 mozilla-thunderbird - several
114 {CAN-2005-0989 CAN-2005-1159 CAN-2005-1160 CAN-2005-1532 CAN-2005-2261 CAN-2005-2265 CAN-2005-2266 CAN-2005-2269 CAN-2005-2270}
115 - mozilla-thunderbird 1.0.6-1 (medium)
116 NOTE: not fixed in testing at time of DSA (missing builds)
117 [22 Aug 2005] DSA-780-1 kdegraphics - wrong input sanitising
118 {CAN-2005-2097}
119 - kdegraphics 4:3.4.2-1 (bug #322458; low)
120 NOTE: not fixed in testing at time of DSA (nor in unstable; C++ ABI transition)
121 [21 Aug 2005] DSA-779-1 mozilla-firefox - several
122 {CAN-2005-2260 CAN-2005-2261 CAN-2005-2262 CAN-2005-2263 CAN-2005-2264 CAN-2005-2265 CAN-2005-2266 CAN-2005-2267 CAN-2005-2268 CAN-2005-2269 CAN-2005-2270}
123 - mozilla-firefox 1.0.6-1 (medium)
124 NOTE: not fixed in testing at time of DSA (build and deps)
125 [19 Aug 2005] DSA-778-1 mantis - missing input sanitising
126 {CAN-2005-2556 CAN-2005-2557}
127 - mantis 0.19.2-4 (medium)
128 NOTE: not fixed in testing at time of DSA (nor unstable)
129 [17 Aug 2005] DSA-777-1 mozilla - frame injection spoofing
130 {CAN-2004-0718 CAN-2005-1937}
131 - mozilla-browser 1.7.10-1 (medium)
132 NOTE: not fixed in testing at time of DSA (waiting on builds)
133 [16 Aug 2005] DSA-776-1 clamav - integer overflows, infinite loop
134 {CAN-2005-2450}
135 - clamav 0.86.2-1 (medium)
136 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
137 [12 Aug 2005] DSA-775-1 mozilla-firefox - frame injection spoofing
138 {CAN-2004-0718 CAN-2005-1937}
139 - mozilla-firefox 1.0.4-3 (medium)
140 NOTE: IMO the information about the sid fix in the DSA is wrong, pinged security@
141 NOTE: fixed in testing at time of DSA
142 [12 Aug 2005] DSA-774-1 fetchmail - buffer overflow
143 {CAN-2005-2335}
144 - fetchmail 6.2.5-16 (medium)
145 NOTE: fixed in testing at time of DSA
146 [11 Aug 2005] DSA-773-1 New amd64 packages fix several bugs
147 NOTE: amd64 catch-up DSA, no new holes
148 [03 Aug 2005] DSA-772-1 apt-cacher - missing input sanitising
149 {CAN-2005-1854}
150 - apt-cacher 0.9.10 (high)
151 NOTE: not fixed in testing at time of DSA (not uploaded to unstable yet)
152 [01 Aug 2005] DSA-771-1 pdns - several
153 {CAN-2005-2301 CAN-2005-2302}
154 - pdns 2.9.18-1 (medium)
155 NOTE: not fixed in testing at time of DSA (too young)
156 [29 Jul 2005] DSA-770-1 gopher - insecure tmpfile handling
157 {CAN-2005-1853}
158 - gopher 3.0.10
159 NOTE: not fixed in testing at time of DSA (Debian server outage)
160 [29 Jul 2005] DSA-769-1 gaim - memory alignment bug
161 {CAN-2005-2370}
162 - gaim 1:1.4.0-5 (high)
163 NOTE: not fixed in testing at time of DSA (?)
164 [27 Jul 2005] DSA-768-1 phpbb2 - missing input validation
165 {CAN-2005-2161}
166 - phpbb2 2.0.13-6sarge1
167 NOTE: not fixed in testing at time of DSA (Debian server outage)
168 [27 Jul 2005] DSA-767-1 ekg - integer overflows
169 {CAN-2005-1852}
170 - ekg 1.5+20050718+1.6rc3-1 (medium)
171 NOTE: not fixed in testing at time of DSA (Debian server outage)
172 [26 Jul 2005] DSA-766-1 webcalendar - authorisation failure
173 {CAN-2005-2320}
174 - webcalendar (unfixed; bug #315671; medium)
175 NOTE: not fixed in testing at time of DSA (Debian server outage)
176 [22 Jul 2005] DSA-765-1 heimdal - buffer overflow
177 {CAN-2005-0469}
178 - heimdal 0.6.3-10 (medium)
179 NOTE: fixed in testing at time of DSA
180 [21 Jul 2005] DSA-764-1 cacti - several
181 {CAN-2005-1524 CAN-2005-1525 CAN-2005-1526 CAN-2005-2148 CAN-2005-2149}
182 - cacti 0.8.6f-1 (high)
183 NOTE: fixed in testing at time of DSA
184 NOTE: DSA information is incorrect, sid fix is 6f, not 6e
185 [20 Jul 2005] DSA-763-1 zlib - buffer overflow
186 {CAN-2005-1849}
187 - zlib 1.2.3-1 (medium)
188 NOTE: not fixed in testing at time of DSA (only 1/2 days old, not built on s390)
189 [19 Jul 2005] DSA-762-1 affix - several
190 {CAN-2005-2250 CAN-2005-2277}
191 - affix 2.1.2-2 (medium)
192 NOTE: not fixed in testing at time of DSA (only 2/2 days old)
193 [19 Jul 2005] DSA-761-2 heartbeat - insecure temporary files
194 {CAN-2005-2231}
195 - heartbeat 1.2.3-12 (medium)
196 NOTE: not fixed in testing at time of DSA (only 0/2 days old)
197 [18 Jul 2005] DSA-760-1 ekg - several
198 {CAN-2005-1850 CAN-2005-1851 CAN-2005-1916}
199 - ekg 1.5+20050712+1.6rc2-1 (low)
200 NOTE: not fixed in testing at time of DSA (waiting on dependencies, not built on five archs)
201 [18 Jul 2005] DSA-759-1 phppgadmin - missing input sanitising
202 {CAN-2005-2256}
203 - phppgadmin 3.5.4-1 (medium)
204 NOTE: not fixed in testing at time of DSA (only 0/10 days old)
205 [18 Jul 2005] DSA-758-1 heimdal - buffer overflow
206 {CAN-2005-2040}
207 - heimdal 0.6.3-11 (medium)
208 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
209 [17 Jul 2005] DSA-757-1 krb5 - buffer overflow, double-free memory
210 {CAN-2005-1689 CAN-2005-1174 CAN-2005-1175}
211 - krb5 1.3.6-4 (medium)
212 NOTE: not fixed in testing at time of DSA (waiting on dependencies, not built on m68k)
213 [14 Jul 2005] DSA-746-1 phpgroupware - remote command execution
214 {CAN-2005-1921}
215 - phpgroupware 0.9.16.006-1 (high)
216 NOTE: fixed in testing at time of DSA
217 [13 Jul 2005] DSA-756-1 squirrelmail - several
218 {CAN-2005-1769 CAN-2005-2095}
219 - squirrelmail 2:1.4.4-6 (medium)
220 NOTE: not fixed in testing at time of DSA (only 0/2 days old)
221 [13 Jul 2005] DSA-755-1 tiff - buffer overflow
222 {CAN-2005-1544}
223 - tiff 3.7.2-3 (medium)
224 NOTE: fixed in testing at time of DSA
225 [13 Jul 2005] DSA-754-1 centericq - insecure temporary file
226 {CAN-2005-1914}
227 - centericq 4.20.0-7 (low)
228 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
229 [12 Jul 2005] DSA-753-1 gedit - format string
230 {CAN-2005-1686}
231 - gedit 2.10.3-1 (low)
232 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
233 [11 Jul 2005] DSA-752-1 gzip - several
234 {CAN-2005-0988 CAN-2005-1228}
235 - gzip 1.3.5-10
236 NOTE: fixed in testing at time of DSA
237 [11 Jul 2005] DSA-751-1 squid - IP spoofind
238 {CAN-2005-1519}
239 - squid 2.5.9-9
240 NOTE: fixed in testing at time of DSA
241 [10 Jul 2005] DSA-748-1 ruby1.8 - bad default value
242 {CAN-2005-1992}
243 - ruby1.8 1.8.2-8 (medium)
244 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
245 [11 Jul 2005] DSA-750-1 dhcpcd - out-of-bound memory access
246 {CAN-2005-1848}
247 - dhcpcd 1.3.22pl4-22
248 NOTE: fixed in testing at time of DSA
249 [10 Jul 2005] DSA-749-1 ettercap - format string error
250 {CAN-2005-1796}
251 - ettercap 0.7.3-1 (medium)
252 NOTE: fixed in testing at time of DSA
253 [10 Jul 2005] DSA-747-1 egroupware - input validation error
254 {CAN-2005-1921}
255 - egroupware 1.0.0.007-3.dfsg-1 (high)
256 NOTE: not fixed in testing at time of DSA (only 1/2 days old)
257 [10 Jul 2005] DSA-745-1 drupal - arbitrary command execution
258 {CAN-2005-1921 CAN-2005-2106 CAN-2005-2116}
259 - drupal 4.5.4-1 (high)
260 NOTE: fixed in testing at time of DSA
261 [08 Jul 2005] DSA-744-1 fuse - programming error
262 {CAN-2005-1858}
263 - fuse 2.3.0-1
264 NOTE: fixed in testing at time of DSA
265 [08 Jul 2005] DSA-743-1 ht - buffer overflows, integer overflows
266 {CAN-2005-1545 CAN-2005-1546}
267 - ht 0.8.0-3
268 NOTE: fixed in testing at time of DSA
269 [09 Jul 2005] DSA-742-1 cvs - buffer overflow
270 {CAN-2005-0753}
271 - cvs 1:1.12.9-13 (high)
272 NOTE: fixed in testing at time of DSA
273 [07 Jul 2005] DSA-741-1 bzip2 - infinite loop
274 {CAN-2005-1260}
275 - bzip2 1.0.2-7 (low)
276 NOTE: fixed in testing at time of DSA
277 [06 Jul 2005] DSA-740-1 zlib - buffer overflow
278 {CAN-2005-2096}
279 - zlib 1.2.2-7 (medium)
280 NOTE: anything statically linking zlib needs rebuild
281 NOTE: not fixed in testing at time of DSA (embargoed disclosure)
282 [06 Jul 2005] DSA-739-1 trac - missing input sanitising
283 {CAN-2005-2007}
284 - trac 0.8.4-1 (medium)
285 NOTE: fixed in testing at time of DSA
286 [19 May 2005] DSA-725-2 ppxp - missing privilege release
287 {CAN-2005-0392}
288 - ppxp 0.2001080415-11
289 NOTE: fixed in testing at time of DSA
290 [05 Jul 2005] DSA-738-1 razor - email header parsing error
291 {CAN-2005-2024}
292 - razor 2.720-1 (low)
293 NOTE: not fixed in testing at time of DSA (not built on arm)
294 [05 Jul 2005] DSA-737-1 clamav - various DOS vulnerabilities
295 {CAN-2005-1922 CAN-2005-1923 CAN-2005-2056 CAN-2005-2070}
296 - clamav 0.86.1-1 (medium)
297 NOTE: not fixed in testing at time of DSA (uploaded with low urgency only, one fix missing for sid)
298 [05 Jul 2005] DSA-734-1 gaim - denial of service
299 {CAN-2005-1269 CAN-2005-1934}
300 - gaim 1.3.1-1
301 NOTE: not fixed in testing at time of DSA (not built on sparc)
302 [01 Jul 2005] DSA-736-2 spamassassin - mail header parsing error
303 {CAN-2005-1266}
304 - spamassassin 3.0.4-1 (medium)
305 NOTE: fixed in testing at time of DSA
306 [01 Jul 2005] DSA-736-1 spamassassin - mail header parsing error
307 {CAN-2005-1266}
308 - spamassassin 3.0.4-1 (medium)
309 NOTE: fixed in testing at time of DSA
310 [08 Jul 2005] DSA-735-2 sudo - pathname validation race
311 {CAN-2005-1993}
312 - sudo 1.6.8p9-1 (medium)
313 NOTE: fixed in testing at time of DSA
314 [01 Jul 2005] DSA-735-2 sudo - pathname validation race
315 {CAN-2005-1993}
316 - sudo 1.6.8p9-1 (medium)
317 NOTE: fixed in testing at time of DSA
318 [01 Jul 2005] DSA-735-1 sudo - pathname validation race
319 {CAN-2005-1993}
320 - sudo 1.6.8p9-1 (medium)
321 NOTE: not fixed in testing at time of DSA
322 [30 Jun 2005] DSA-733-1 crip - insecure temporary files
323 {CAN-2005-0393}
324 - crip 3.5-1sarge2 (low)
325 NOTE: not fixed in testing at time of DSA (reserved)
326 [03 Jun 2005] DSA-732-1 mailutils - several
327 {CAN-2005-1520 CAN-2005-1521 CAN-2005-1522 CAN-2005-1523}
328 - mailutils 0.6.1-4
329 NOTE: fixed in testing at time of DSA
330 [02 Jun 2005] DSA-731-1 krb4 - buffer overflows
331 {CAN-2005-0468 CAN-2005-0468}
332 - krb4 1.2.2-11.2
333 NOTE: fixed in testing at time of DSA
334 [27 May 2005] DSA-730-1 bzip2 - race condition
335 {CAN-2005-0953}
336 - bzip2 1.0.2-6
337 NOTE: fixed in testing at time of DSA
338 [26 May 2005] DSA-729-1 php4 - missing input sanitising
339 {CAN-2005-0525}
340 - php4 4.3.10-10
341 NOTE: fixed in testing at time of DSA
342 [25 May 2005] DSA-728-1 qpopper - missing privilege release
343 {CAN-2005-1151 CAN-2005-1152}
344 - qpopper 4.0.5-4sarge1
345 NOTE: fixed in testing at time of DSA by security team
346 [20 May 2005] DSA-727-1 libconvert-uulib-perl - buffer overflow
347 {CAN-2005-1349}
348 - libconvert-uulib-perl 1.0.5.1-1
349 NOTE: fixed in testing at time of DSA
350 [20 May 2005] DSA-726-1 oops - format string vulnerability
351 {CAN-2005-1121}
352 - oops (unfixed; bug #307360)
353 NOTE: not in testing at time of DSA
354 [19 May 2005] DSA-725-1 ppxp - missing privilege release
355 {CAN-2005-0392}
356 - ppxp 0.2001080415-11
357 NOTE: not fixed in testing at time of DSA
358 [18 May 2005] DSA-724-1 phpsysinfo - design flaw
359 {CAN-2005-0870}
360 - phpsysinfo 2.3-3
361 NOTE: fixed in testing at time of DSA
362 [09 May 2005] DSA-723-1 xfree86 - buffer overflow
363 {CAN-2005-0605}
364 - xfree86 4.3.0.dfsg.1-13
365 NOTE: not fixed in testing at time of DSA
366 [09 May 2005] DSA-722-1 smail - buffer overflow
367 {CAN-2005-0892}
368 NOTE: Package not in testing at time of DSA
369 [06 May 2005] DSA-721-1 squid - design flaw
370 {CAN-2005-1345}
371 - squid 2.5.9-7
372 NOTE: not fixed in testing at time of DSA
373 [03 May 2005] DSA-720-1 smartlist - wrong input processing
374 {CAN-2005-0157}
375 - smartlist 3.15-18
376 NOTE: fixed in testing at time of DSA
377 [28 Apr 2005] DSA-719-1 prozilla - format string problems
378 {CAN-2005-0523}
379 - prozilla 1:1.3.7.4-1
380 NOTE: fixed in testing at time of DSA
381 [28 Apr 2005] DSA-718-1 ethereal - buffer overflow
382 {CAN-2005-0739}
383 - ethereal 0.10.10-1
384 NOTE: fixed in testing at time of DSA
385 [27 Apr 2005] DSA-717-1 lsh-utils - buffer overflow, typo
386 {CAN-2003-0826 CAN-2005-0814}
387 - lsh-utils 2.0.1-2
388 NOTE: fixed in testing at time of DSA
389 [27 Apr 2005] DSA-716-1 gaim - denial of service
390 {CAN-2005-0472}
391 - gaim 1.1.3-1
392 NOTE: fixed in testing at time of DSA
393 [27 Apr 2005] DSA-715-1 cvs - several
394 {CAN-2004-1342 CAN-2004-1343}
395 - cvs 1.12.9-12
396 NOTE: not fixed in testing at time of DSA
397 [26 Apr 2005] DSA-714-1 kdelibs - several
398 {CAN-2005-1046}
399 - kdelibs 4:3.3.2-5
400 NOTE: not fixed in testing at time of DSA
401 [21 Apr 2005] DSA-701-2 samba - integer overflows
402 NOTE: only a bug in the backported fix to stable, testing is ok
403 [21 Apr 2005] DSA-713-1 junkbuster - several
404 {CAN-2005-1108 CAN-2005-1109}
405 NOTE: package not in testing/unstable
406 [19 Apr 2005] DSA-712-1 geneweb - insecure file operations
407 {CAN-2005-0391}
408 - geneweb 4.10-7
409 NOTE: fixed in testing at time of DSA
410 [19 Apr 2005] DSA-711-1 info2www - missing input sanitising
411 {CAN-2004-1341}
412 - info2www 1.2.2.9-23
413 NOTE: fixed in testing at time of DSA
414 [18 Apr 2005] DSA-710-1 gtkhtml - null pointer dereference
415 {CAN-2003-0541}
416 - gtkhtml 1.0.4-6.2
417 NOTE: fixed in testing at time of DSA
418 [15 Apr 2005] DSA-709-1 libexif - buffer overflow
419 {CAN-2005-0664}
420 - libexif 0.6.9-5
421 [15 Apr 2005] DSA-708-1 php3 - missing input sanitising
422 {CAN-2005-0525}
423 - php3 3.0.18-31
424 [13 Apr 2005] DSA-707-1 mysql - several
425 {CAN-2004-0957 CAN-2005-0709 CAN-2005-0710 CAN-2005-0711}
426 - mysql-dfsg 4.0.24-5
427 - mysql-dfsg-4.1 4.1.10a-6
428 NOTE: not fixed in testing at time of DSA
429 [13 Apr 2005] DSA-706-1 axel - buffer overflow
430 {CAN-2005-0390}
431 - axel 1.0b-1
432 NOTE: fixed in testing at time of DSA
433 [04 Apr 2005] DSA-705-1 wu-ftpd - missing input sanitising
434 {CAN-2005-0256 CAN-2003-0854}
435 - wu-ftpd 2.6.2-19
436 [04 Apr 2005] DSA-704-1 remstats - tempfile, missing input sanitising
437 {CAN-2005-0387 CAN-2005-0388}
438 - remstats 1.0.13a-5
439 NOTE: not fixed in testing at time of DSA
440 [01 Apr 2005] DSA-703-1 krb5 - buffer overflows
441 {CAN-2005-0468 CAN-2005-0469}
442 - krb5 1.3.6-1
443 [01 Apr 2005] DSA-702-1 imagemagick - several
444 {CAN-2005-0397 CAN-2005-0759 CAN-2005-0760 CAN-2005-0762}
445 - imagemagick 6.0.6.2-2.2
446 [31 Mar 2005] DSA-701-1 samba - integer overflows
447 {CAN-2004-1154}
448 - samba 3.0.10-1
449 [30 Mar 2005] DSA-700-1 mailreader - missing input sanitising
450 {CAN-2005-0386}
451 - mailreader 2.3.29-11
452 NOTE: not fixed in testing at time of DSA
453 [29 Mar 2005] DSA-699-1 netkit-telnet-ssl - buffer overflow
454 {CAN-2005-0469}
455 - netkit-telnet-ssl 0.17.24+0.1-7.1
456 NOTE: not fixed in testing at time of DSA
457 [29 Mar 2005] DSA-698-1 mc - buffer overflow
458 {CAN-2005-0763}
459 NOTE: Not clear which unstable/testing version fixed this,
460 NOTE: but advisory says it's fixed.
461 [29 Mar 2005] DSA-697-1 netkit-telnet - buffer overflow
462 {CAN-2005-0469}
463 - netkit-telnet 0.17-28
464 NOTE: not fixed in testing at time of DSA
465 [22 Mar 2005] DSA-696-1 perl - design flaw
466 {CAN-2005-0448}
467 - perl 5.8.4-8
468 NOTE: fixed in testing at time of DSA
469 [21 Mar 2005] DSA-695-1 xli - buffer overflow, input sanitising, integer overflow
470 {CAN-2001-0775 CAN-2005-0638 CAN-2005-0639}
471 - xli 1.17.0-18
472 NOTE: not fixed in testing at time of DSA
473 [21 Mar 2005] DSA-694-1 xloadimage - missing input sanitising, integer overflow
474 {CAN-2005-0638 CAN-2005-0639}
475 - xloadimage 4.1-14.2
476 NOTE: not fixed in testing at time of DSA
477 [14 Mar 2005] DSA-693-1 luxman - buffer overflow
478 {CAN-2005-0385}
479 NOTE: not fixed in testing at time of DSA
480 NOTE: not in unstable at time of DSA though DSA claimed it was
481 - luxman 0.41-20
482 [14 Mar 2005] DSA-662-2 squirrelmail - several
483 NOTE: only an update to a prior DSA, did not affct sid/sarge.
484 [08 Mar 2005] DSA-692-1 kppp - design flaw
485 {CAN-2005-0205}
486 - kppp 4:3.1.6
487 NOTE: fixed in testing at time of DSA
488 [07 Mar 2005] DSA-691-1 abuse - several
489 {CAN-2005-0098 CAN-2005-0099}
490 NOTE: not in unstable/testing
491 [25 Feb 2005] DSA-690-1 bsmtpd - missing input sanitising
492 {CAN-2005-0107}
493 - bsmtpd 2.3pl8b-16
494 NOTE: not fixed in testing at time of DSA
495 [23 Feb 2005] DSA-689-1 libapache-mod-python - missing input sanitising
496 {CAN-2005-0088}
497 - libapache-mod-python 2.7.10-4
498 NOTE: fixed in testing at time of DSA
499 - libapache2-mod-python 3.1.3-3
500 NOTE: fixed in testing at time of DSA
501 [23 Feb 2005] DSA-688-1 squid - mising input sanitising
502 {CAN-2005-0446}
503 - squid 2.5.8-3
504 NOTE: fixed in testing at time of DSA
505 [21 Feb 2005] DSA-674-3 mailman - cross-site scripting, directory traversal
506 NOTE: only fixed bug in DSA
507 [18 Feb 2005] DSA-687-1 bidwatcher - format string
508 {CAN-2005-0158}
509 - bidwatcher 1.3.17-1
510 NOTE: not fixed in testing at time of DSA
511 [17 Feb 2005] DSA-686-1 gftp - missing input sanitising
512 {CAN-2005-0372}
513 - gftp 2.0.18-1
514 NOTE: not fixed in testing at time of DSA
515 [17 Feb 2005] DSA-685-1 emacs21 - format string
516 {CAN-2005-0100}
517 - emacs21 21.3+1-9
518 NOTE: not fixed in testing at time of DSA
519 [16 Feb 2005] DSA-684-1 typespeed - format string
520 {CAN-2005-0105}
521 - typespeed 0.4.4-8
522 NOTE: not fixed in testing at time of DSA
523 [15 Feb 2005] DSA-683-1 postgresql - buffer overflows
524 {CAN-2005-0245 CAN-2005-0247}
525 - postgresql 7.4.7-2
526 NOTE: fixed in testing at time of DSA
527 [15 Feb 2005] DSA-682-1 awstats - missing input sanitising
528 {CAN-2005-0363}
529 - awstats 6.2-1.2
530 NOTE: not fixed in testing at time of DSA
531 [14 Feb 2005] DSA-681-1 synaesthesia - privilege escalation
532 {CAN-2005-0070}
533 NOTE: does not apply for sarge, program is not setuid anymore
534 [14 Feb 2005] DSA-680-1 htdig - unsanitised input
535 {CAN-2005-0085}
536 - htdig 3.1.6-11
537 NOTE: fixed in testing at time of DSA
538 [14 Feb 2005] DSA-679-1 toolchain-source - insecure temporary files
539 {CAN-2005-0159}
540 - toolchain-source 3.4-5
541 NOTE: not fixed in testing at time of DSA
542 [11 Feb 2005] DSA-678-1 netkit-rwho - missing input validation
543 {CAN-2004-1180}
544 - netkit-rwho 0.17-8
545 NOTE: not fixed in testing at time of DSA
546 [11 Feb 2005] DSA-677-1 sympa - buffer overflow
547 {CAN-2005-0073}
548 - sympa 4.1.2-2.1
549 NOTE: not fixed in testing at time of DSA
550 [11 Feb 2005] DSA-676-1 xpcd - buffer overflow
551 {CAN-2005-0074}
552 - xpcd 2.08-11.1
553 NOTE: not fixed in testing at time of DSA
554 [11 Feb 2005] DSA-674-2 mailman - cross-site scripting, directory traversal
555 NOTE: only fixed bug in DSA
556 [10 Feb 2005] DSA-675-1 hztty - privilege escalation
557 {CAN-2005-0019}
558 - hztty 2.0-6.1
559 NOTE: not fixed in testing at time of DSA
560 [10 Feb 2005] DSA-674-1 mailman - cross-site scripting, directory traversal
561 {CAN-2004-1177}
562 - mailman 2.1.5-5
563 NOTE: fixed in testing at time of DSA
564 {CAN-2005-0202}
565 - mailman 2.1.5-6
566 NOTE: not fixed in testing at time of DSA
567 [10 Feb 2005] DSA-673-1 evolution - integer overflow
568 {CAN-2005-0102}
569 - evolution 2.0.3-1.2
570 NOTE: fixed in testing at time of DSA
571 [09 Feb 2005] DSA-672-1 xview - buffer overflows
572 {CAN-2005-0076}
573 - xview 3.2p1.4-19
574 NOTE: not fixed in testing at time of DSA
575 [08 Feb 2005] DSA-671-1 xemacs21 - format string
576 {CAN-2005-0100}
577 NOTE: not fixed in testing at time of DSA
578 - xemacs21 21.4.16-2
579 [08 Feb 2005] DSA-670-1 emacs20 - format string
580 {CAN-2005-0100}
581 NOTE: also affects emacs21 in unstable, fixed
582 [04 Feb 2005] DSA-689-1 php3 - several
583 {CAN-2004-0594 CAN-2004-0595}
584 - php3 3.0.18-27
585 NOTE: fixed in testing at time of DSA
586 [04 Feb 2005] DSA-668-1 postgresql - privilege escalation
587 {CAN-2005-0227}
588 - postgresql 7.4.7-1
589 NOTE: not fixed in testing at time of DSA
590 [04 Feb 2005] DSA-667-1 squid - several
591 {CAN-2005-0173 CAN-2005-0175 CAN-2005-0194 CAN-2005-0211}
592 - squid 2.5.7-7
593 NOTE: not fixed in testing at time of DSA
594 [04 Feb 2005] DSA-666-1 python2.2 - design flaw
595 {CAN-2005-0089}
596 - python2.2 2.2.3-14
597 - python2.3 2.3.4-20
598 - python2.4 2.4-5
599 NOTE: not fixed in testing at time of DSA
600 [04 Feb 2005] DSA-665-1 ncpfs - missing privilege release
601 {CAN-2005-0013}
602 - ncpfs 2.2.6-1
603 NOTE: not fixed in testing at time of DSA
604 [02 Feb 2005] DSA-664-1 cpio - broken file permissions
605 {CAN-1999-1572}
606 - cpio 2.5-1.2
607 NOTE: not fixed in testing at time of DSA
608 [02 Feb 2005] DSA-663-1 prozilla - buffer overflows
609 {CAN-2004-1120}
610 - prozilla 1.3.7.3-1
611 NOTE: fixed in testing at time of DSA
612 [01 Feb 2005] DSA-662-1 squirrelmail - several
613 {CAN-2005-0104 CAN-2005-0152}
614 NOTE: CAN-2005-0152 only exists in 1.2.6 version
615 - squirrelmail 1.4.4
616 NOTE: fixed in testing at time of DSA
617 [20 Apr 2005] DSA-661-2 f2c - insecure temporary files
618 {CAN-2005-0017 CAN-2005-0018}
619 - f2c 20020621-3.3
620 NOTE: not fixed in testing at time of DSA
621 [26 Jan 2005] DSA-660-1 kdebase - missing return value check
622 {CAN-2005-0078}
623 - kdebase 4:3.0.5
624 NOTE: fixed in testing at time of DSA
625 [26 Jan 2005] DSA-659-1 libpam-radius-auth - information leak, integer underflow
626 {CAN-2004-1340 CAN-2005-0108}
627 - libpam-radius-auth 1.3.16-3
628 NOTE: 1/2 fixed in testing at time of DSA
629 [25 Jan 2005] DSA-658-1 libdbi-perl - insecure temporary file
630 {CAN-2005-0077}
631 - libdbi-perl 1.46-6
632 NOTE: not fixed in testing at time of DSA
633 [25 Jan 2005] DSA-657-1 xine-lib - buffer overflow
634 {CAN-2004-1379}
635 - xine-lib 1-rc6a-1
636 NOTE: fixed in testing at time of DSA
637 [25 Jan 2005] DSA-656-1 vdr - insecure file access
638 {CAN-2005-0071}
639 - vdr 1.2.6-6
640 NOTE: not fixed in testing at time of DSA
641 [25 Jan 2005] DSA-655-1 zhcon - missing privilege release
642 {CAN-2005-0072}
643 - zhcon 1:0.2.3-8.1
644 NOTE: not fixed in testing at time of DSA
645 [21 Jan 2005] DSA-654-1 enscript - several
646 {CAN-2004-1184 CAN-2004-1185 CAN-2004-1186}
647 - enscript 1.6.4-6
648 NOTE: not fixed in testing at time of DSA
649 [21 Jan 2005] DSA-653-1 ethereal - buffer overflow
650 {CAN-2005-0084}
651 - ethereal 0.10.9-1
652 NOTE: not fixed in testing at time of DSA
653 [21 Jan 2005] DSA-652-1 unarj
654 {CAN-2004-0947 CAN-2004-1027}
655 NOTE: not-for-us (unarj)
656 [20 Jan 2005] DSA-651-1 squid - buffer overflow, integer overflow
657 {CAN-2005-0094 CAN-2005-0095}
658 - squid 2.5.7-4
659 NOTE: not fixed in testing at time of DSA
660 [20 Jan 2005] DSA-650-1 sword - missing input sanitising
661 {CAN-2005-0015}
662 - sword 1.5.7-7
663 NOTE: not fixed in testing at time of DSA
664 [20 Jan 2005] DSA-649-1 xtrlock - buffer overflow
665 {CAN-2005-0079}
666 - xtrlock 2.0-9
667 NOTE: fixed in testing at time of DSA
668 [19 Jan 2005] DSA-648-1 xpdf - buffer overflow
669 {CAN-2005-0064}
670 - xpdf 3.00-12
671 NOTE: not fixed in testing at time of DSA
672 [19 Jan 2005] DSA-647-1 mysql - insecure temporary files
673 {CAN-2005-0004}
674 - mysql-dfsg 4.0.23-3
675 - mysql-dfsg-4.1 4.1.8a-6
676 NOTE: not fixed in testing at time of DSA
677 [19 Jan 2005] DSA-646-1 imagemagick - buffer overflow
678 {CAN-2005-0005}
679 - imagemagick 6.0.6.2-2
680 NOTE: not fixed in testing at time of DSA
681 [19 Jan 2005] DSA-645-1 cupsys - buffer overflow
682 {CAN-2005-0064}
683 NOTE: cupsys not affected in sarge, though other programs are vulnerable
684 NOTE: see CAN/list
685 NOTE: not fixed in testing at time of DSA
686 [18 Jan 2005] DSA-644-1 chbg - buffer overflow
687 {CAN-2004-1264}
688 - chbg 1.5-4
689 NOTE: fixed in testing at time of DSA
690 [18 Jan 2005] DSA-643-1 queue - buffer overflows
691 {CAN-2004-0555}
692 - queue 1.30.1-5
693 NOTE: not fixed in testing at time of DSA
694 [17 Jan 2005] DSA-642-1 gallery - several
695 {CAN-2004-1106}
696 - gallery 1.4.4-pl4-1
697 NOTE: fixed in testing at time of DSA
698 [17 Jan 2005] DSA-641-1 playmidi - buffer overflow
699 {CAN-2005-0020}
700 - playmidi 2.4debian-3
701 NOTE: not fixed in testing at time of DSA
702 [17 Jan 2005] DSA-640-1 gatos - buffer overflow
703 {CAN-2005-0016}
704 - gatos 0.0.5-15
705 NOTE: not fixed in testing at time of DSA
706 [14 Jan 2005] DSA-639-1 mc - several
707 {CAN-2004-1004 CAN-2004-1005 CAN-2004-1009 CAN-2004-1090 CAN-2004-1091 CAN-2004-1092 CAN-2004-1093 CAN-2004-1174 CAN-2004-1175 CAN-2004-1176}
708 NOTE: unstable not vulnerable according to DSA
709 NOTE: DSA was wrong..
710 - mc 1:4.6.0-4.6.1-pre3-1
711 NOTE: not fixed in testing at time of DSA
712 [13 Jan 2005] DSA-638-1 gopher - several
713 {CAN-2004-0560 CAN-2004-0561}
714 NOTE: not in sarge
715 [13 Jan 2005] DSA-637-1 exim-tls - buffer overflow
716 {CAN-2005-0021}
717 NOTE: not in sarge
718 [12 Jan 2005] DSA-636-1 glibc - insecure temporary files
719 {CAN-2004-0968}
720 - glibc 2.3.2.ds1-20
721 NOTE: fixed in testing at time of DSA
722 [12 Jan 2005] DSA-635-1 exim - buffer overflow
723 {CAN-2005-0021}
724 - exim4 4.34-10
725 NOTE: fixed in testing at time of DSA
726 - exim 3.36-13
727 NOTE: not fixed in testing at time of DSA
728 [11 Jan 2005] DSA-634-1 hylafax - weak hostname and username validation
729 {CAN-2004-1182}
730 - hylafax 4.2.1-1
731 NOTE: fixed in testing at time of DSA
732 [11 Jan 2005] DSA-633-1 bmv - insecure temporary file
733 {CAN-2003-0014}
734 - bmv 1.2-17
735 NOTE: fixed in testing at time of DSA
736 [10 Jan 2005] DSA-632-1 linpopup - buffer overflow
737 {CAN-2004-1282}
738 - linpopup 1.2.0-7
739 NOTE: fixed in testing at time of DSA
740 [10 Jan 2005] DSA-631-1 kdelibs - unsanitised input
741 {CAN-2004-1165}
742 - kdelibs 4:3.3.2-1
743 NOTE: not fixed in testing at time of DSA
744 [10 Jan 2005] DSA-630-1 lintian - insecure temporary directory
745 {CAN-2004-1000}
746 - lintian 1.23.6
747 NOTE: not fixed in testing at time of DSA
748 [07 Jan 2005] DSA-629-1 krb5 - buffer overflow
749 {CAN-2004-1189}
750 - krb5 1.3.6-1
751 NOTE: not fixed in testing at time of DSA
752 [06 Jan 2005] DSA-628-1 imlib2 - integer overflows
753 {CAN-2004-1026}
754 - imlib2 1.1.2-2.1
755 NOTE: not fixed in testing at time of DSA
756 [06 Jan 2005] DSA-627-1 namazu2 - unsanitised input
757 {CAN-2004-1318}
758 - namazu2 2.0.14-1
759 NOTE: not fixed in testing at time of DSA
760 [06 Jan 2005] DSA-626-1 tiff - unsanitised input
761 {CAN-2004-1183}
762 - libtiff4 3.6.1-5
763 NOTE: not fixed in testing at time of DSA
764 [05 Jan 2005] DSA-625-1 pcal - buffer overflows
765 {CAN-2004-1289}
766 - pcal 4.8.0-1
767 NOTE: not fixed in testing at time of DSA
768 [05 Jan 2005] DSA-624-1 zip - buffer overflow
769 {CAN-2004-1010}
770 - zip 2.30-8
771 NOTE: fixed in testing at time of DSA
772 [04 Jan 2005] DSA-623-1 nasm - buffer overflow
773 {CAN-2004-1287}
774 - nasm 0.98.38-1.1
775 [03 Jan 2005] DSA-622-1 htmlheadline - insecure temporary files
776 {CAN-2004-1181}
777 NOTE: not in unstable
778 [31 Dec 2004] DSA-621-1 cupsys - buffer overflow
779 {CAN-2004-1125}
780 - cupsys 1.1.22-2
781 [30 Dec 2004] DSA-620-1 perl - insecure temporary files / directories
782 {CAN-2004-0452 CAN-2004-0976}
783 - perl 5.8.4-5
784 [30 Dec 2004] DSA-619-1 xpdf - buffer overflow
785 {CAN-2004-1125}
786 - xpdf 3.00-11
787 [24 Dec 2004] DSA-618-1 imlib - buffer overflows, integer overflows
788 {CAN-2004-1025 CAN-2004-1026}
789 - imlib 1.9.14-17.1
790 - imlib-png2 1.9.14-16.1
791 [24 Dec 2004] DSA-617-1 libtiff - insufficient input validation
792 {CAN-2004-1308}
793 - libtiff4 3.6.1-4
794 [23 Dec 2004] DSA-616-1 telnetd-ssl - format string
795 {CAN-2004-0998}
796 - telnetd-ssl 0.17.24+0.1-6
797 [22 Dec 2004] DSA-615-1 debmake - insecure temporary file
798 {CAN-2004-1179}
799 - debmake 3.7.7
800 [21 Dec 2004] DSA-614-1 xzgv - integer overflows
801 {CAN-2004-0994}
802 - xzgv 0.8-3
803 [21 Dec 2004] DSA-613-1 ethereal - inifinite loop
804 {CAN-2004-1142}
805 - ethereal 0.10.8-1
806 [21 Dec 2004] DSA-614-1 xzgv - integer overflows
807 {CAN-2004-0994}
808 - xzgv 0.8-3
809 [20 Dec 2004] DSA-612-1 a2ps - unsanitised input
810 {CAN-2004-1170}
811 - a2ps 4.13b-4.2
812 [20 Dec 2004] DSA-611-1 htget - buffer overflow
813 {CAN-2004-0852}
814 NOTE: htget not in sarge or unstable
815 [17 Dec 2004] DSA-610-1 cscope - insecure temporary file
816 {CAN-2004-0996}
817 - cscope 15.5-1
818 [14 Dec 2004] DSA-609-1 atari800 - buffer overflows
819 {CAN-2004-1076}
820 - atari800 1.3.2-1
821 [14 Dec 2004] DSA-608-1 zgv - integer overflows, unsanitised input
822 {CAN-2004-1095 CAN-2004-0999}
823 - zgv 5.7-1.3
824 NOTE: changelog says he only patched 1095, but diff comparison
825 NOTE: shows 0999 was also fixed.
826 [10 Dec 2004] DSA-607-1 xfree86 - several
827 {CAN-2004-0914}
828 - xfree86 4.3.0.dfsg.1-9
829 [08 Dec 2004] DSA-606-1 nfs-utils - wrong signal handler
830 {CAN-2004-1014}
831 - nfs-utils 1:1.0.6-3.1
832 [06 Dec 2004] DSA-605-1 viewcvs - settings not honored
833 {CAN-2004-0915}
834 - viewcvs 0.9.2+cvs.1.0.dev.2004.07.28-1.2
835 [03 Dec 2004] DSA-604-1 hpsockd - missing input sanitising
836 {CAN-2004-0993}
837 - hpsockd 0.14
838 [01 Dec 2004] DSA-603-1 openssl - insecure temporary file
839 {CAN-2004-0975}
840 - openssl 0.9.7e-3
841 [29 Nov 2004] DSA-602-1 libgd2 - integer overlow
842 {CAN-2004-0941 CAN-2004-0990}
843 NOTE: different from fixes from earlier DSA for these CANs; 2004-0941 new
844 - libgd2 2.0.33-1.1
845 [29 Nov 2004] DSA-601-1 libgd1 - integer overflow
846 {CAN-2004-0941 CAN-2004-0990}
847 NOTE: different from fixes from earlier DSA for these CANs; 2004-0941 new
848 - libgd 1.8.4-36.1
849 [25 Nov 2004] DSA-599-1 tetex-bin - integer overflows
850 {CAN-2004-0888}
851 - tetex-bin 2.0.2-23
852 [25 Nov 2004] DSA-598-1 yardradius - buffer overflow
853 {CAN-2004-0987}
854 - yardradius 1.0.20-15
855 [25 Nov 2004] DSA-597-1 cyrus-imapd - buffer overflow
856 {CAN-2004-1012 CAN-2004-1013}
857 - cyrus21-imapd 2.1.17-1
858 [24 Nov 2004] DSA-596-2 sudo - missing input sanitising
859 {CAN-2004-1051}
860 - sudo 1.6.8p3-1
861 [24 Nov 2004] DSA-596-1 sudo - missing input sanitising
862 {CAN-2004-1051}
863 - sudo 1.6.8p3-1
864 [24 Nov 2004] DSA-595-1 bnc - buffer overflow
865 {CAN-2004-1052}
866 NOTE: package not in sarge or sid
867 [17 Nov 2004] DSA-594-1 apache - buffer overflows
868 {CAN-2004-0940}
869 - apache 1.3.33-2
870 [16 Nov 2004] DSA-593-1 imagemagick - buffer overflow
871 {CAN-2004-0981}
872 - imagemagick 6:6.0.6.2-1.5
873 [12 Nov 2004] DSA-592-1 ez-ipupdate - format string
874 {CAN-2004-0980}
875 - ez-ipupdate 3.0.11b8-8
876 [09 Nov 2004] DSA-591-1 libgd2 - integer overflows
877 {CAN-2004-0990}
878 - libgd2 2.0.30-1
879 [09 Nov 2004] DSA-590-1 gnats - format string vulnerability
880 {CAN-2004-0623}
881 NOTE: DSA got version of fix for unstable wrong
882 - gnats 4.0-6.1
883 [09 Nov 2004] DSA-589-1 libgd - integer overflows
884 {CAN-2004-0990}
885 - libgd1 1.8.4-36.1
886 [08 Nov 2004] DSA-588-1 gzip - insecure temporary files
887 {CAN-2004-0970}
888 NOTE: dsa says sid not affected
889 [08 Nov 2004] DSA-587-1 freeamp - buffer overflow
890 {CAN-2004-0964}
891 NOTE: DSA says zinf not vulnerable in sarge
892 [08 Nov 2004] DSA-586-1 ruby - infinite loop
893 {CAN-2004-0983}
894 - ruby1.6 1.6.8-12
895 - ruby1.8 1.8.1+1.8.2pre2-4
896 [05 Nov 2004] DSA-585-1 shadow - programming error
897 {CAN-2004-1001}
898 - shadow 1:4.0.3-30.3
899 [04 Nov 2004] DSA-584-1 dhcp - format string vulnerability
900 {CAN-2004-1006}
901 - dhcp 2.0pl5-19.1
902 [03 Nov 2004] DSA-583-1 lvm10 - insecure temporary directory
903 {CAN-2004-0972}
904 [02 Nov 2004] DSA-582-1 libxml - buffer overflow
905 {CAN-2004-0989}
906 - libxml 1.8.17-9
907 - libxml2 2.6.11-5
908 [01 Nov 2004] DSA-581-1 xpdf - integer overflows
909 {CAN-2004-0888}
910 - xpdf 3.00-9
911 [01 Nov 2004] DSA-580-1 iptables - missing initialisation
912 {CAN-2004-0986}
913 - iptables 1.2.11-4
914 [01 Nov 2004] DSA-579-1 abiword - buffer overflow
915 {CAN-2004-0645}
916 NOTE: according to DSA, sid's abiword is not affected. sarge is same
917 [01 Nov 2004] DSA-578-1 mpg123 - buffer overflow
918 {CAN-2004-0982}
919 - mpg123 0.59r-17
920 [29 Oct 2004] DSA-577-1 postgresql - symlink vulnerability
921 {CAN-2004-0977}
922 - postgresql 7.4.6-1
923 [29 Oct 2004] DSA-576-1 squid - multiple
924 {CVE-1999-0710 CAN-2004-0918}
925 - squid 2.5.7-1
926 [28 Oct 2004] DSA-575-1 catdoc - insecure temporary file
927 {CAN-2003-0193}
928 - catdoc 0.91.5-2
929 [28 Oct 2004] DSA-574-1 cabextract - missing directory sanitising
930 {CAN-2004-0916}
931 - cabextract 1.1-1
932 [21 Oct 2004] DSA-573-1 cupsys - integer overflows
933 {CAN-2004-0888}
934 - cupsys 1.1.20final+rc1-10
935 {CAN-2004-0889}
936 - xpdf 3.00-10
937 NOTE: kpdf and kfax are fixed in sarge, bug #278173 and #280373 for reference
938 - kpdf 4:3.3.1-1
939 - gpdf 2.8.0-1
940 - kfax 4:3.3.1-1
941 [21 Oct 2004] DSA-572-1 ecartis - multiple
942 {CAN-2004-0913}
943 - ecartis 1.0.0+cvs.20030911-8
944 [20 Oct 2004] DSA-571-1 libpng3 - buffer overflows, integer overflow
945 {CAN-2004-0955}
946 - libpng3 1.2.5.0-9
947 [20 Oct 2004] DSA-570-1 libpng - integer overflow
948 {CAN-2004-0955}
949 - libpng 1.0.15-8
950 [18 Oct 2004] DSA-569-1 netkit-telnet-ssl - invalid free(3)
951 {CAN-2004-0911}
952 - netkit-telnet-ssl 0.17.24+0.1-4
953 [16 Oct 2004] DSA-568-1 cyrus-sasl-mit - unsanitised input
954 {CAN-2004-0884}
955 NOTE: removed from testing
956 NOTE: maintainer reports hole not in cyrus-sasl2-mit
957 [15 Oct 2004] DSA-567-1 tiff - heap overflows
958 {CAN-2004-0803 CAN-2004-0804 CAN-2004-0886}
959 - tiff 3.6.1-2
960 - tiff3g 3.6.1-2
961 [14 Oct 2004] DSA-566-1 cupsys - unsanitised input
962 {CAN-2004-0923}
963 - cupsys 1.1.20final+rc1-9
964 [13 Oct 2004] DSA-565-1 sox - buffer overflows
965 {CAN-2004-0557}
966 - sox 12.17.4-9
967 [13 Oct 2004] DSA-564-1 mpg123 - missing user input sanitising
968 {CAN-2004-0805}
969 - mpg123 0.59r-16
970 [12 Oct 2004] DSA-563-1 cyrus-sasl - unsanitised input
971 {CAN-2004-0884}
972 - cyrus-sasl 1.5.28-6.2
973 - cyrus-sasl2 2.1.19-1.3
974 [11 Oct 2004] DSA-562-2 mysql - several vulnerabilities
975 {CAN-2004-0835 CAN-2004-0836 CAN-2004-0837}
976 - mysql 4.0.21-1
977 [11 Oct 2004] DSA-561-1 xfree86 - integer and stack overflows
978 {CAN-2004-0687 CAN-2004-0688}
979 - xfree86 4.3.0.dfsg.1-8
980 [07 Oct 2004] DSA-600-1 samba - arbitrary file access
981 {CAN-2004-0815}
982 NOTE: not affected according to DSA
983 [07 Oct 2004] DSA-560-1 lesstif1-1 - integer and stack overflows
984 {CAN-2004-0687 CAN-2004-0688}
985 - lesstif1-1 0.93.94-10
986 [06 Oct 2004] DSA-559-1 net-acct - insecure temporary file
987 {CAN-2004-0851}
988 - net-acct 0.71-7
989 [06 Oct 2004] DSA-558-1 libapache-mod-dav - null pointer dereference
990 {CAN-2004-0809}
991 - libapache-mod-dav 1.0.3-10
992 - apache2 2.0.51-1
993 [04 Oct 2004] DSA-557-1 pppoe - missing privilegue dropping
994 {CAN-2004-0564}
995 - pppoe 3.5-4
996 [03 Oct 2004] DSA-556-1 netkit-telnet - invalid free(3)
997 {CAN-2004-0911}
998 - netkit-telnet 0.17-26
999 [30 Sep 2004] DSA-555-1 freenet6 - file permissions
1000 {CAN-2004-0563}
1001 - freenet6 1.0-2.2
1002 [27 Sep 2004] DSA-554-1 sendmail - pre-set password
1003 {CAN-2004-0833}
1004 - sendmail 8.13.1-13
1005 [27 Sep 2004] DSA-553-1 getmail - symlink vulnerability
1006 {CAN-2004-0880 CAN-2004-0881}
1007 - getmail 3.2.5-1
1008 [22 Sep 2004] DSA-552-1 imlib2 - unsanitised input
1009 {CAN-2004-0802}
1010 - imlib2 1.1.0-12.4
1011 [21 Sep 2004] DSA-551-1 lukemftpd - incorrect internal variable handling
1012 {CAN-2004-0794}
1013 - lukemftpd 1.1-2.2
1014 [20 Sep 2004] DSA-550-1 wv - buffer overflow
1015 {CAN-2004-0645}
1016 - wv 1.0.2-0.1
1017 [17 Sep 2004] DSA-549-1 gtk+2.0 - multiple holes
1018 {CAN-2004-0782 CAN-2004-0783 CAN-2004-0788}
1019 - gtk+2.0 2.4.9-2
1020 [16 Sep 2004] DSA-548-1 imlib - unsanitised input
1021 {CAN-2004-0817}
1022 - imlib 1.9.14-17
1023 - imlib+png2 1.9.14-16.2
1024 [16 Sep 2004] DSA-547-1 imagemagic - buffer overflows
1025 {CAN-2004-0827}
1026 - imagemagic 6.0.6.2-1
1027 [16 Sep 2004] DSA-546-1 gdk-pixbuf - multiple holes
1028 {CAN-2004-0753 CAN-2004-0782 CAN-2004-0788}
1029 - gdk-pixbuf 0.22.0-7
1030 [15 Sep 2004] DSA-545-1 cupsys - denial of service
1031 {CAN-2004-0558}
1032 - cupsys 1.1.20final+rc1-6
1033 [14 Sep 2004] DSA-544-1 webmin - insecure temporary directory
1034 {CAN-2004-0559}
1035 - webmin 1.160-1
1036 - usermin 1.090-1
1037 [31 Aug 2004] DSA-543-1 krb5 -- several vulnerabilities
1038 {CAN-2004-0642 CAN-2004-0643 CAN-2004-0644 CAN-2004-0772}
1039 - krb5 1.3.4-3
1040 [31 Aug 2004] DSA-458-2 python2.2 - buffer overflow
1041 {CAN-2004-0150}
1042 NOTE: not affected according to DSA
1043 [30 Aug 2004] DSA-542-1 qt - unsanitised input
1044 {CAN-2004-0691 CAN-2004-0692 CAN-2004-0693}
1045 - qt-x11-free 3.3.3-4
1046 [25 Aug 2004] DSA-541 icecast-server - cross site scripting
1047 {CAN-2004-0781}
1048 - icecast-server 1.3.12-8
1049 [18 Aug 2004] DSA-540 mysql-dfsg - insecure file creation
1050 {CAN-2004-0457}
1051 - mysql-dfsg 4.0.20-11
1052 [18 Aug 2004] DSA-539 kdelibs - denial of service
1053 {CAN-2004-0689}
1054 - kdelibs 4:3.2.3-3.sarge.1
1055 [17 Aug 2004] DSA-538 rsync - unauthorised directory traversal and file access
1056 - rsync 2.6.2-3
1057 [16 Aug 2004] DSA-537 ruby - insecure file permissions
1058 {CAN-2004-0755}
1059 - ruby1.8 1.8.1+1.8.2pre1-4
1060 TODO: is ruby1.6 vulnerable?
1061 [04 Aug 2004] DSA-536 libpng - several vulnerabilities
1062 {CAN-2004-0597 CAN-2004-0598 CAN-2004-0599 CAN-2004-0768}
1063 - libpng 1.0.15-6
1064 - libpng3 1.2.5.0-7
1065 [02 Aug 2004] DSA-535 squirrelmail - several vulnerabilities
1066 {CAN-2004-0519 CAN-2004-0520 CAN-2004-0521 CAN-2004-0639}
1067 - squirrelmail 2:1.4.3a-0.1
1068 [22 Jul 2004] DSA-534 mailreader - directory traversal
1069 {CAN-2002-1581}
1070 - mailreader 2.3.29-9
1071 [22 Jul 2004] DSA-533 courier - cross-site scripting
1072 {CAN-2004-0591}
1073 - courier 0.45.4-4
1074 [22 Jul 2004] DSA-532 libapache-mod-ssl - several vulnerabilities
1075 {CAN-2004-0488 CAN-2004-0700}
1076 - libapache-mod-ssl 2.8.19-1
1077 [20 Jul 2004] DSA-531 php4 - several vulnerabilities
1078 {CAN-2004-0594 CAN-2004-0595}
1079 ! php4 4:4.3.8-1
1080 [17 Jul 2004] DSA-530 l2tpd - buffer overflow
1081 {CAN-2004-0649}
1082 - l2tpd 0.70-pre20031121-2
1083 [17 Jul 2004] DSA-529 netkit-telnet-ssl - format string
1084 {CAN-2004-0640}
1085 ! netkit-telnet-ssl 0.17.24+0.1-2
1086 [17 Jul 2004] DSA-528 ethereal - denial of service
1087 {CAN-2004-0635}
1088 - ethereal 0.10.5-1
1089 [03 Jul 2004] DSA-527 pavuk - buffer overflow
1090 {CAN-2004-0456}
1091 NOTE: DSA is incorrect; pavuk is in sarge and unstable.
1092 ! pavuk 0.9pl28-3
1093 [03 Jul 2004] DSA-526 webmin - several vulnerabilities
1094 {CAN-2004-0582 CAN-2004-0583}
1095 - webmin 1.150-1
1096 [24 Jun 2004] DSA-525 apache - buffer overflow
1097 {CAN-2004-0492}
1098 - apache 1.3.31-2
1099 [19 Jun 2004] DSA-524 rlpr - several vulnerabilities
1100 {CAN-2004-0393 CAN-2004-0454}
1101 - rlpr 2.02-7.1
1102 [19 Jun 2004] DSA-523 www-sql - buffer overflow
1103 {CAN-2004-0455}
1104 - www-sql 0.5.7-18
1105 [19 Jun 2004] DSA-522 super - format string vulnerability
1106 {CAN-2004-0579}
1107 - super 3.23.0-1
1108 [18 Jun 2004] DSA-521 sup - format string vulnerability
1109 {CAN-2004-0451}
1110 - sup 1.8-11
1111 [16 Jun 2004] DSA-520 krb5 - buffer overflows
1112 {CAN-2004-0523}
1113 - krb5 1.3.3-2
1114 [15 Jun 2004] DSA-519 cvs - several vulnerabilities
1115 {CAN-2004-0416 CAN-2004-0417 CAN-2004-0418}
1116 - cvs 1:1.12.9-1
1117 [14 Jun 2004] DSA-518 kdelibs - unsanitised input
1118 {CAN-2004-0411}
1119 - kdelibs 3.2.3
1120 [10 Jun 2004] DSA-517 cvs - buffer overflow
1121 {CAN-2004-0414}
1122 - cvs 1.12.9-1
1123 [07 Jun 2004] DSA-516 postgresql - buffer overflow
1124 {CAN-2004-0547}
1125 - postgresql 07.03.0200-3.
1126 [05 Jun 2004] DSA-515 lha - several vulnerabilities
1127 {CAN-2004-0234 CAN-2004-0235}
1128 ! lha 1.14i-8
1129 NOTE: If 1.14i-8 cannot get into testing, the fix for 1.14i-2.0.1
1130 NOTE: from the DSA could to updated via t-p-u.
1131 [04 Jun 2004] DSA-514 kernel-image-sparc-2.2 - failing function and TLB flush
1132 {CAN-2004-0077}
1133 - kernel-image-sparc-2.2 9.1
1134 NOTE: did not check other versions of the kernel
1135 [03 Jun 2004] DSA-513 log2mail - format string
1136 {CAN-2004-0450}
1137 ! log2mail 0.2.8-3
1138 [02 Jun 2004] DSA-512 gallery - unauthenticated access
1139 {CAN-2004-0522}
1140 - gallery 1.4.3-pl2-1
1141 [30 May 2004] DSA-511 ethereal - buffer overflows
1142 {CAN-2004-0176}
1143 - ethereal 0.10.3-1
1144 [29 May 2004] DSA-510 jftpgw - format string
1145 {CAN-2004-0448}
1146 - jftpgw 0.13.4-1
1147 [29 May 2004] DSA-509 gatos - privilege escalation
1148 {CAN-2004-0395}
1149 - gatos 0.0.5-12
1150 [22 May 2004] DSA-508 xpcd - buffer overflow
1151 {CAN-2004-0402}
1152 - xpcd 2.08-10
1153 [19 May 2004] DSA-507 cadaver - buffer overflow
1154 {CAN-2004-0398}
1155 - cadaver 0.22.1-3
1156 [19 May 2004] DSA-506 neon - buffer overflow
1157 {CAN-2004-0398}
1158 - neon 0.24.6.dfsg-1
1159 [19 May 2004] DSA-505 cvs - heap overflow
1160 {CAN-2004-0396}
1161 - cvs 1.12.5-6
1162 [18 May 2004] DSA-504 heimdal - missing input sanitising
1163 {CAN-2004-0434}
1164 - heimdal 0.6.2-1
1165 [13 May 2004] DSA-503 mah-jong - missing argument check
1166 {CAN-2004-0458}
1167 - mah-jong 1.6.2-1
1168 [11 May 2004] DSA-502 exim-tls - buffer overflow
1169 {CAN-2004-0399 CAN-2004-0400}
1170 NOTE: exim-tls not in sarge
1171 [07 May 2004] DSA-501 exim - buffer overflow
1172 {CAN-2004-0399 CAN-2004-0400}
1173 - exim 3.36-11
1174 - exim4 4.33-1
1175 [01 May 2004] DSA-500 flim - insecure temporary file
1176 {CAN-2004-0422}
1177 - flim 1:1.14.6+0.20040415-1
1178 [01 May 2004] DSA-499 rsync - directory traversal
1179 {CAN-2004-0426}
1180 - rsync 2.6.1-1
1181 [30 Apr 2004] DSA-498 libpng - out of bound access
1182 {CAN-2004-0421}
1183 - libpng 1.0.15-5
1184 - libpng3 1.2.5.0-6
1185 [29 Apr 2004] DSA-497 mc - several vulnerabilities
1186 {CAN-2004-0226 CAN-2004-0231 CAN-2004-0232}
1187 - mc 1:4.6.0-4.6.1-pre1-2
1188 [29 Apr 2004] DSA-496 eterm - missing input sanitising
1189 {CAN-2003-0068}
1190 - eterm 0.9.2-6
1191 [26 Apr 2004] DSA-495 linux-kernel-2.4.16-arm - several vulnerabilities
1192 {CAN-2003-0127 CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1193 NOTE: 2.4.16 not present. Did not check newer kernels.
1194 [21 Apr 2004] DSA-494 ident2 - buffer overflow
1195 {CAN-2004-0408}
1196 - ident2 1.04-2
1197 [21 Apr 2004] DSA-493 xchat - buffer overflow
1198 {CAN-2004-0409}
1199 - xchat 2.0.8-1
1200 [18 Apr 2004] DSA-492 iproute - denial of service
1201 {CAN-2003-0856}
1202 - iproute 20010824-13.1
1203 [17 Apr 2004] DSA-491 linux-kernel-2.4.19-mips - several vulnerabilities
1204 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1205 NOTE: 2.4.19 not present. Did not check newer kernels.
1206 [17 Apr 2004] DSA-490 zope - arbitrary code execution
1207 {CVE-2002-0688}
1208 - zope 2.6.0-0.1
1209 [17 Apr 2004] DSA-489 linux-kernel-2.4.17-mips+mipsel - several vulnerabilities
1210 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1211 NOTE: 2.4.17 not present. Did not check newer kernels.
1212 [16 Apr 2004] DSA-488 logcheck - insecure temporary directory
1213 {CAN-2004-0404}
1214 - logcheck 1.1.1-13.2
1215 [16 Apr 2004] DSA-487 neon - format string
1216 {CAN-2004-0179}
1217 - newo 0.24.5-1
1218 [16 Apr 2004] DSA-486 cvs - several vulnerabilities
1219 {CAN-2004-0180 CAN-2004-0405}
1220 - cvs 1:1.12.5-4
1221 [14 Apr 2004] DSA-485 ssmtp - format string
1222 {CAN-2004-0156}
1223 - ssmtp 2.60.7
1224 [14 Apr 2004] DSA-484 xonix - failure to drop privileges
1225 {CAN-2004-0157}
1226 - xonix 1.4-21
1227 [14 Apr 2004] DSA-483 mysql - insecure temporary file creation
1228 {CAN-2004-0381}
1229 - mysql-dfsg 4.0.18-4
1230 {CAN-2004-0388}
1231 - mysql-dfsg 4.0.18-6
1232 [14 Apr 2004] DSA-482 linux-kernel-2.4.17-apus+s390 - several vulnerabilities
1233 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1234 NOTE: 2.4.17 not present. Did not check newer kernels.
1235 [14 Apr 2004] DSA-481 linux-kernel-2.4.17-ia64 - several vulnerabilities
1236 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1237 NOTE: 2.4.17 not present. Did not check newer kernels.
1238 [14 Apr 2004] DSA-480 linux-kernel-2.4.17+2.4.18-hppa - several vulnerabilities
1239 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1240 NOTE: 2.4.17/18 not present. Did not check newer kernels.
1241 [14 Apr 2004] DSA-479 linux-kernel-2.4.18-alpha+i386+powerpc - several vulnerabilities
1242 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1243 NOTE: 2.4.18 not present. Did not check newer kernels.
1244 [06 Apr 2004] DSA-478 tcpdump - denial of service
1245 {CAN-2004-0183 CAN-2004-0184}
1246 - tcpdump 3.7.2-4
1247 [06 Apr 2004] DSA-477 xine-ui - insecure temporary file creation
1248 {CAN-2004-0372}
1249 - xine-ui 0.99.1-1
1250 [06 Apr 2004] DSA-476 heimdal - cross-realm
1251 {CAN-2004-0371}
1252 - heimdal 0.6.1-1
1253 [05 Apr 2004] DSA-475 linux-kernel-2.4.18-hppa - several vulnerabilities
1254 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1255 NOTE: 2.4.18 not present. Did not check newer kernels.
1256 [03 Apr 2004] DSA-474 squid - ACL bypass
1257 {CAN-2004-0189}
1258 - squid 2.5.5-1
1259 [03 Apr 2004] DSA-473 oftpd - denial of service
1260 {CAN-2004-0376}
1261 - oftpd 20040304-1
1262 [03 Apr 2004] DSA-472 fte - several vulnerabilities
1263 {CAN-2003-0648}
1264 - fte 0.50.0-1.1
1265 [02 Apr 2004] DSA-471 interchange - missing input sanitising
1266 {CAN-2004-0374}
1267 - interchange 5.0.1-1
1268 [01 Apr 2004] DSA-470 linux-kernel-2.4.17-hppa - several vulnerabilities
1269 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1270 NOTE: 2.4.17 not present. Did not check newer kernels.
1271 [29 Mar 2004] DSA-469 pam-pgsql - missing input sanitising
1272 {CAN-2004-0366}
1273 - pam-pgsql 0.5.2-7.1
1274 [24 Mar 2004] DSA-468 emil - several vulnerabilities
1275 {CAN-2004-0152 CAN-2004-0153}
1276 - emil 2.1.0-beta9-14
1277 [23 Mar 2004] DSA-467 ecartis - several vulnerabilities
1278 {CAN-2003-0781 CAN-2003-0782}
1279 - ecartis 1.0.0+cvs.20030911
1280 [18 Mar 2004] DSA-466 linux-kernel-2.2.10-powerpc-apus - failing function and TLB flush
1281 {CAN-2004-0077}
1282 NOTE: 2.2.10 not present. Did not check newer kernels.
1283 [17 Mar 2004] DSA-465 openssl - several vulnerabilities
1284 {CAN-2004-0079 CAN-2004-0081}
1285 - openssl 0.9.7d-1
1286 NOTE: CAN-2004-0081 only affects 0.9.6.
1287 NOTE: 0.9.7d also fixes CAN-2004-0112
1288 - openssl 0.9.6l
1289 - openssl096 0.9.6m-1
1290 [16 Mar 2004] DSA-464 gdk-pixbuf - broken image handling
1291 {CAN-2004-0111}
1292 - gdk-pixbuf 0.22.0-3
1293 [12 Mar 2004] DSA-463 samba - privilege escalation
1294 {CAN-2004-0186}
1295 - samba 3.0.2-2
1296 [12 Mar 2004] DSA-462 xitalk - missing privilege release
1297 {CAN-2004-0151}
1298 - xitalk 1.1.11-11
1299 [11 Mar 2004] DSA-461 calife - buffer overflow
1300 {CAN-2004-0188}
1301 - calife 2.8.6-1
1302 [10 Mar 2004] DSA-460 sysstat - insecure temporary file
1303 {CAN-2004-0108}
1304 - sysstat 5.0.2-1
1305 [10 Mar 2004] DSA-459 kdelibs - cookie path traversal
1306 {CAN-2003-0592}
1307 - kdelibs 4:3.1.3-1
1308 [09 Mar 2004] DSA-458 python2.2 - buffer overflow
1309 {CAN-2004-0150}
1310 NOTE: not affected according to DSA
1311 [08 Mar 2004] DSA-457 wu-ftpd - several vulnerabilities
1312 {CAN-2004-0148 CAN-2004-0185}
1313 - wu-ftpd 2.6.2-17.1
1314 [06 Mar 2004] DSA-456 linux-kernel-2.2.19-arm - failing function and TLB flush
1315 {CAN-2004-0077}
1316 NOTE: 2.2.19 not present. Did not check newer kernels.
1317 [03 Mar 2004] DSA-455 libxml - buffer overflows
1318 {CAN-2004-0110}
1319 - libxml 1.8.17-5
1320 - libxml2 2.6.6-1
1321 [02 Mar 2004] DSA-454 linux-kernel-2.2.22-alpha - failing function and TLB flush
1322 {CAN-2004-0077}
1323 NOTE: 2.2.22 not present. Did not check newer kernels.
1324 [02 Mar 2004] DSA-453 linux-kernel-2.2.20-i386+m68k+powerpc - failing function and TLB flush
1325 {CAN-2004-0077}
1326 NOTE: 2.2.20 not present. Did not check newer kernels.
1327 [29 Feb 2004] DSA-452 libapache-mod-python - denial of service
1328 {CAN-2003-0973}
1329 - libapache-mod-python 2:2.7.10-1
1330 [27 Feb 2004] DSA-451 xboing - buffer overflows
1331 {CAN-2004-0149}
1332 - xboing 2.4-26.1
1333 [27 Feb 2004] DSA-450 linux-kernel-2.4.19-mips - several vulnerabilities
1334 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1335 NOTE: 2.4.19 not present. Did not check newer kernels.
1336 [24 Feb 2004] DSA-449 metamail - buffer overflow, format string bugs
1337 {CAN-2004-0104 CAN-2004-0105}
1338 - metamail 2.7-45.2
1339 [22 Feb 2004] DSA-448 pwlib - several vulnerabilities
1340 {CAN-2004-0097}
1341 - pwlib 1.5.2-4
1342 [22 Feb 2004] DSA-447 hsftp - format string
1343 {CAN-2004-0159}
1344 ! hsftp 1.15-1
1345 [21 Feb 2004] DSA-446 synaesthesia - insecure file creation
1346 {CAN-2004-0160}
1347 NOTE: DSA notes not setuid anymore so ok
1348 [21 Feb 2004] DSA-445 lbreakout2 - buffer overflow
1349 {CAN-2004-0158}
1350 - lbreakout2 2.4
1351 [20 Feb 2004] DSA-444 linux-kernel-2.4.17-ia64 - missing function return value check
1352 {CAN-2004-0077}
1353 NOTE: 2.4.17 not present. Did not check newer kernels.
1354 [19 Feb 2004] DSA-443 xfree86 - several vulnerabilities
1355 {CAN-2003-0690}
1356 - xfree86 4.3.0-0pre1v2
1357 {CAN-2004-0083 CAN-2004-0084 CAN-2004-0106}
1358 - xfree86 4.3.0-1
1359 {CAN-2004-0093 CAN-2004-0094}
1360 - xfree86 4.2.1-6
1361 [19 Feb 2004] DSA-442 linux-kernel-2.4.17-s390 - several vulnerabilities
1362 {CAN-2003-0001 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364 CAN-2003-0961 CAN-2003-0985 CAN-2004-0077 CVE-2002-0429}
1363 NOTE: 2.4.17 not present. Did not check newer kernels.
1364 [18 Feb 2004] DSA-441 linux-kernel-2.4.17-mips+mipsel - missing function return value check
1365 {CAN-2004-0077}
1366 NOTE: 2.4.17 not present. Did not check newer kernels.
1367 [18 Feb 2004] DSA-440 linux-kernel-2.4.17-powerpc-apus - several vulnerabilities
1368 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1369 NOTE: 2.4.17 not present. Did not check newer kernels.
1370 [18 Feb 2004] DSA-439 linux-kernel-2.4.16-arm - several vulnerabilities
1371 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1372 NOTE: 2.4.16 not present. Did not check newer kernels.
1373 [18 Feb 2004] DSA-438 linux-kernel-2.4.18-alpha+i386+powerpc - missing function return value check
1374 {CAN-2004-0077}
1375 NOTE: 2.4.17 not present. Did not check newer kernels.
1376 [11 Feb 2004] DSA-437 cgiemail - open mail relay
1377 {CAN-2002-1575}
1378 - cgiemail 1.6-20
1379 [08 Feb 2004] DSA-436 mailman - several vulnerabilities
1380 {CAN-2003-0991}
1381 NOTE: apparently specific to mailman 2.0, not 2.1
1382 {CAN-2003-0965}
1383 - mailman 2.1.4-1
1384 {CAN-2003-0038}
1385 - mailman 2.1.1-1
1386 [06 Feb 2004] DSA-435 mpg123 - heap overflow
1387 {CAN-2003-0865}
1388 - mpg123 0.59r-15
1389 [05 Feb 2004] DSA-434 gaim - several vulnerabilities
1390 {CAN-2004-0005 CAN-2004-0006 CAN-2004-0007 CAN-2004-0008}
1391 - gaim 1:0.75-2
1392 [04 Feb 2004] DSA-433 kernel-patch-2.4.17-mips - integer overflow
1393 {CAN-2003-0961}
1394 NOTE: 2.4.17 not present. Did not check newer kernels.
1395 [03 Feb 2004] DSA-432 crawl - buffer overflow
1396 {CAN-2004-0103}
1397 - crawl 4.0.0beta26-4
1398 [01 Feb 2004] DSA-431 perl - information leak
1399 {CAN-2003-0618}
1400 - perl 5.8.3-3
1401 [28 Jan 2004] DSA-430 trr19 - missing privilege release
1402 {CAN-2004-0047}
1403 - trr19 1.0beta5-17.1
1404 [26 Jan 2004] DSA-429 gnupg - cryptographic weakness
1405 {CAN-2003-0971}
1406 - gnupg 1.2.4-1
1407 [20 Jan 2004] DSA-428 slocate - buffer overflow
1408 {CAN-2003-0848}
1409 - slocate 2.7-3
1410 [19 Jan 2004] DSA-427 linux-kernel-2.4.17-mips+mipsel - missing boundary check
1411 {CAN-2003-0985}
1412 NOTE: 2.4.17 not present. Did not check newer kernels.
1413 [18 Jan 2004] DSA-426 netpbm-free - insecure temporary files
1414 {CAN-2003-0924}
1415 - netpbm-free 2:9.25-9
1416 [16 Jan 2004] DSA-425 tcpdump - multiple vulnerabilities
1417 {CAN-2003-1029 CAN-2003-0989 CAN-2004-0055 CAN-2004-0057}
1418 TODO: No idea if this is fixed, we have a new upstream version
1419 TODO: that came out after these advisories, but neither the debian nor
1420 TODO: the upstream changelog seem to mention them.
1421 NOTE: Mailed maintainer.
1422 [16 Jan 2004] DSA-424 mc - buffer overflow
1423 {CAN-2003-1023}
1424 - mc 1:4.6.0-4.6.1-pre1-1
1425 [15 Jan 2004] DSA-423 linux-kernel-2.4.17-ia64 - several vulnerabilities
1426 {CAN-2003-0001 CAN-2003-0018 CAN-2003-0127 CAN-2003-0461 CAN-2003-0462 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552 CAN-2003-0961 CAN-2003-0985}
1427 NOTE: 2.4.17 not present. Did not check newer kernels.
1428 [13 Jan 2004] DSA-422 cvs - remote vulnerability
1429 - cvs 1.11.11
1430 [12 Jan 2004] DSA-421 mod-auth-shadow - password expiration
1431 {CAN-2004-0041}
1432 - mod-auth-shadow 1.4-1
1433 [12 Jan 2004] DSA-420 jitterbug - improperly sanitised input
1434 {CAN-2004-0028}
1435 - jitterbug 1.6.2-4.5
1436 [09 Jan 2004] DSA-419 phpgroupware - missing filename sanitising, SQL injection
1437 {CAN-2004-0016 CAN-2004-0017}
1438 - phpgroupware 0.9.14.007-4
1439 [07 Jan 2004] DSA-418 vbox3 - privilege leak
1440 {CAN-2004-0015}
1441 - vbox3 0.1.8
1442 [07 Jan 2004] DSA-417 linux-kernel-2.4.18-powerpc+alpha - missing boundary check
1443 {CAN-2003-0961 CAN-2003-0985}
1444 NOTE: 2.4.18 not present. Did not check newer kernels.
1445 [06 Jan 2004] DSA-416 fsp - buffer overflow, directory traversal
1446 {CAN-2003-1022 CAN-2004-0011}
1447 - fsp 2.81.b18-1
1448 [06 Jan 2004] DSA-415 zebra - denial of service
1449 {CAN-2003-0795 CAN-2003-0858}
1450 - quagga 0.96.4x-4
1451 [06 Jan 2004] DSA-414 jabber - denial of service
1452 {CAN-2004-0013}
1453 - jabber 1.4.3-1
1454 [06 Jan 2004] DSA-413 linux-kernel-2.4.18 - missing boundary check
1455 {CAN-2003-0985}
1456 NOTE: 2.4.18 not present. Did not check newer kernels.
1457 [05 Jan 2004] DSA-412 nd - buffer overflows
1458 {CAN-2004-0014}
1459 - nd 0.8.2-1
1460 [05 Jan 2004] DSA-411 mpg321 - format string vulnerability
1461 {CAN-2003-0969}
1462 - mpg321 0.2.10.3
1463 [05 Jan 2004] DSA-410 libnids - buffer overflow
1464 {CAN-2003-0850}
1465 - libnids 1.18-1
1466 [05 Jan 2004] DSA-409 bind - denial of service
1467 {CAN-2003-0914}
1468 - bind 1:8.4.3-1
1469 [05 Jan 2004] DSA-408 screen - integer overflow
1470 {CAN-2003-0972}
1471 - screen 4.0.2-0.1
1472 [05 Jan 2004] DSA-407 ethereal - buffer overflows
1473 {CAN-2003-0925 CAN-2003-0926 CAN-2003-0927 CAN-2003-1012 CAN-2003-1013}
1474 - ethereal 0.10.0-1
1475 [05 Jan 2004] DSA-406 lftp - buffer overflow
1476 - lftp 2.6.10-1
1477 [30 Dec 2003] DSA-405 xsok - missing privilege release
1478 {CAN-2003-0949}
1479 - xsok 1.02-11
1480 [04 Dec 2003] DSA-404 rsync - heap overflow
1481 {CAN-2003-0962}
1482 - rsync 2.5.6-1.1
1483 [01 Dec 2003] DSA-403 kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18 - local root exploit
1484 {CAN-2003-0961}
1485 NOTE: 2.4.18 not present in sarge, did not check newer kernels.
1486 [17 Nov 2003] DSA-402 minimalist - unsanitised input
1487 {CAN-2003-0902}
1488 - minimalist 2.4-1
1489 [17 Nov 2003] DSA-401 hylafax - format strings
1490 {CAN-2003-0886}
1491 - hylafax 1:4.1.8-1
1492 [11 Nov 2003] DSA-400 omega-rpg - buffer overflow
1493 {CAN-2003-0932}
1494 - omega-rpg 0.90-pa9-11
1495 [10 Nov 2003] DSA-399 epic4 - buffer overflow
1496 {CAN-2003-0328}
1497 - epic4 1:1.1.11.20030409-2
1498 [10 Nov 2003] DSA-398 conquest - buffer overflow
1499 {CAN-2003-0933}
1500 - conquest 7.2-5
1501 [07 Nov 2003] DSA-397 postgresql - buffer overflow
1502 {CAN-2003-0901}
1503 - postgresql 7.3.4
1504 [29 Oct 2003] DSA-396 thttpd - missing input sanitizing, wrong calculation
1505 {CAN-2002-1562 CAN-2003-0899}
1506 - thttpd 2.23beta1-2.3
1507 [15 Oct 2003] DSA-395 tomcat4 - incorrect input handling
1508 {CAN-2003-0866}
1509 ! tomcat4 4.1.24-2
1510 NOTE: another RC (unreproducible?) bug and missing deps (#263201)
1511 NOTE: are keeping the fix out of testing
1512 [11 Oct 2003] DSA-394 openssl095 - ASN.1 parsing vulnerability
1513 {CAN-2003-0543 CAN-2003-0544 CAN-2003-0545}
1514 - openssl 0.9.7c
1515 - openssl096 0.9.6k
1516 [01 Oct 2003] DSA-393 openssl - denial of service
1517 {CAN-2003-0543 CAN-2003-0544 CAN-2003-0545}
1518 - openssl 0.9.7c
1519 - openssl096 0.9.6k
1520 [29 Sep 2003] DSA-392 webfs - buffer overflows, file and directory exposure
1521 {CAN-2003-0832 CAN-2003-0833}
1522 - webfs 1.20
1523 [28 Sep 2003] DSA-391 freesweep - buffer overflow
1524 {CAN-2003-0828}
1525 - freesweep 0.88-4.1
1526 [26 Sep 2003] DSA-390 marbles - buffer overflow
1527 {CAN-2003-0830}
1528 NOTE: not present in sid, sarge
1529 [20 Sep 2003] DSA-389 ipmasq - insecure packet filtering rules
1530 {CAN-2003-0785}
1531 - ipmasq 3.5.12
1532 [19 Sep 2003] DSA-388 kdebase - several vulnerabilities
1533 {CAN-2003-0690 CAN-2003-0692}
1534 - kdebase 4:3.2
1535 [18 Sep 2003] DSA-387 gopher - buffer overflows
1536 {CAN-2003-0805}
1537 - gopher 3.0.6
1538 [18 Sep 2003] DSA-386 libmailtools-perl - input validation bug
1539 {CAN-2002-1271}
1540 - libmailtools-perl 1.51
1541 [18 Sep 2003] DSA-385 hztty - buffer overflows
1542 {CAN-2003-0783}
1543 - hztty 2.0-6
1544 [17 Sep 2003] DSA-384 sendmail - buffer overflows
1545 {CAN-2003-0681 CAN-2003-0694}
1546 - sendmail 8.12.10-1
1547 [17 Sep 2003] DSA-383 ssh-krb5 - possible remote vulnerability
1548 {CAN-2003-0693}
1549 {CAN-2003-0695}
1550 {CAN-2003-0682}
1551 TODO: Screwy changelog does not make sense. Filed bug.
1552 [16 Sep 2003] DSA-382 ssh - possible remote vulnerability
1553 {CAN-2003-0693}
1554 - openssh 1:3.6.1p2-6.0
1555 {CAN-2003-0695}
1556 - openssh 1:3.7.1
1557 {CAN-2003-0682}
1558 - openssh 1:3.6.1p2-9
1559 [13 Sep 2003] DSA-381 mysql - buffer overflow
1560 {CAN-2003-0780}
1561 - mysql-dfsg 4.0.15-1
1562 [12 Sep 2003] DSA-380 xfree86 - buffer overflows, denial of service
1563 {CAN-2003-0063}
1564 - xfree86 4.2.1-11
1565 {CAN-2003-0071}
1566 - xfree86 4.2.1-11
1567 {CAN-2002-0164}
1568 - xfree86 4.2.1-11
1569 {CAN-2003-0730}
1570 - xfree86 4.2.1-12
1571 [11 Sep 2003] DSA-379 sane-backends - several vulnerabilities
1572 {CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778}
1573 - sane-backends 1.0.11-1
1574 [07 Sep 2003] DSA-378 mah-jong - buffer overflows, denial of service
1575 {CAN-2003-0705 CAN-2003-0706}
1576 - mah-jong 1.5.6-2
1577 [04 Sep 2003] DSA-377 wu-ftpd - insecure program execution
1578 {CVE-1999-0997}
1579 - wu-ftpd 2.6.2-15
1580 [04 Sep 2003] DSA-376 exim - buffer overflow
1581 {CAN-2003-0743}
1582 - exim 3.36-8
1583 [29 Aug 2003] DSA-375 node - buffer overflow, format string
1584 {CAN-2003-0707 CAN-2003-0708}
1585 - node 0.3.2-1
1586 [26 Aug 2003] DSA-374 libpam-smb - buffer overflow
1587 {CAN-2003-0686}
1588 NOTE: not in sid/sarge
1589 [16 Aug 2003] DSA-373 autorespond - buffer overflow
1590 {CAN-2003-0654}
1591 - autorespond 2.0.4-1
1592 [16 Aug 2003] DSA-372 netris - buffer overflow
1593 {CAN-2003-0685}
1594 - netris 0.52-1
1595 [11 Aug 2003] DSA-371 perl - cross-site scripting
1596 {CAN-2003-0615}
1597 - perl 5.8.0-19
1598 [08 Aug 2003] DSA-370 pam-pgsql - format string
1599 {CAN-2003-0672}
1600 - pam-pgsql 0.5.2-7
1601 [08 Aug 2003] DSA-369 zblast - buffer overflow
1602 {CAN-2003-0613}
1603 - zblast 1.2.1-7
1604 [08 Aug 2003] DSA-368 xpcd - buffer overflow
1605 {CAN-2003-0649}
1606 - xpcd 2.08-9
1607 [08 Aug 2003] DSA-367 xtokkaetama - buffer overflow
1608 {CAN-2003-0652}
1609 - xtokkaetama 1.0b-9
1610 [05 Aug 2003] DSA-366 eroaster - insecure temporary file
1611 {CAN-2003-0656}
1612 - eroaster 2.2.0-0.5-1
1613 [05 Aug 2003] DSA-365 phpgroupware - several vulnerabilities
1614 {CAN-2003-0504 CAN-2003-0599 CAN-2003-0657}
1615 - phpgroupware 0.9.14.007-1
1616 [04 Aug 2003] DSA-364 man-db - buffer overflows, arbitrary command execution
1617 {CAN-2003-0620 CAN-2003-0645}
1618 - man-db 2.4.1-13
1619 [03 Aug 2003] DSA-363 postfix - denial of service, bounce-scanning
1620 {CAN-2003-0468 CAN-2003-0540}
1621 - postfix 1.1.12
1622 [02 Aug 2003] DSA-362 mindi - insecure temporary file
1623 {CAN-2003-0617}
1624 - mindi 0.86-1
1625 [01 Aug 2003] DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities
1626 {CAN-2003-0459 CAN-2003-0370}
1627 - kdelibs 4:3.1.3-1
1628 [01 Aug 2003] DSA-360 xfstt - several vulnerabilities
1629 {CAN-2003-0581}
1630 - xfstt 1.5-1
1631 {CAN-2003-0625}
1632 - xfstt 1.5.1-1
1633 [31 Jul 2003] DSA-359 atari800 - buffer overflows
1634 {CAN-2003-0630}
1635 - atari800 1.3.1-2
1636 [31 Jul 2003] DSA-358 linux-kernel-2.4.18 - several vulnerabilities
1637 {CAN-2003-0461 CAN-2003-0462 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552 CAN-2003-0018 CAN-2003-0619 CAN-2003-0643}
1638 NOTE: 2.4.18/2.4.20 not in unstable/testing. Did not check newer ones.
1639 [31 Jul 2003] DSA-357 wu-ftpd - remote root exploit
1640 {CAN-2003-0466}
1641 - wu-ftpd 2.6.2-12
1642 [30 Jul 2003] DSA-356 xtokkaetama - buffer overflows
1643 {CAN-2003-0611}
1644 - xtokkaetama 1.0b-8
1645 [30 Jul 2003] DSA-355 gallery - cross-site scripting
1646 {CAN-2003-0614}
1647 - gallery 1.3.4-3
1648 [29 Jul 2003] DSA-354 xconq - buffer overflows
1649 {CAN-2003-0607}
1650 - xconq 7.4.1-2.1
1651 [29 Jul 2003] DSA-353 sup - insecure temporary file
1652 {CAN-2003-0606}
1653 - sup 1.8-9
1654 [22 Jul 2003] DSA-352 fdclone - insecure temporary directory
1655 {CAN-2003-0596}
1656 - fdclone 2.04-1
1657 [16 Jul 2003] DSA-351 php4 - cross-site scripting
1658 {CAN-2003-0442}
1659 - php4 4:4.3.2+rc3-1
1660 [15 Jul 2003] DSA-350 falconseye - buffer overflow
1661 {CAN-2003-0358}
1662 NOTE: not in testing, fixed in unstable
1663 - falconseye 1.9.3-9
1664 [14 Jul 2003] DSA-349 nfs-utils - buffer overflow
1665 {CAN-2003-0252}
1666 - nfs-utils 1:1.0.3-2
1667 [11 Jul 2003] DSA-348 traceroute-nanog - integer overflow, buffer overflow
1668 {CAN-2003-0453}
1669 - traceroute-nanog 6.1.1-1.3
1670 [08 Jul 2003] DSA-347 teapop - SQL injection
1671 {CAN-2003-0515}
1672 - teapop 0.3.5-2
1673 [08 Jul 2003] DSA-346 phpsysinfo - directory traversal
1674 {CAN-2003-0536}
1675 - phpsysinfo 2.1-1
1676 [08 Jul 2003] DSA-345 xbl - buffer overflow
1677 {CAN-2003-0535}
1678 - xbl 1.0k-6
1679 [08 Jul 2003] DSA-344 unzip - directory traversal
1680 {CAN-2003-0282}
1681 - unzip 5.50-3
1682 [08 Jul 2003] DSA-343 skk, ddskk - insecure temporary file
1683 {CAN-2003-0539}
1684 - skk 10.62a-6
1685 - ddskk 12.1.cvs.20030622-1
1686 [07 Jul 2003] DSA-342 mozart - unsafe mailcap configuration
1687 {CAN-2003-0538}
1688 NOTE: mozart is not in sarge
1689 - mozart 1.2.5.20030212-2
1690 [07 Jul 2003] DSA-341 liece - insecure temporary file
1691 {CAN-2003-0537}
1692 - liece 2.0+0.20030527cvs-1
1693 [06 Jul 2003] DSA-340 x-face-el - insecure temporary file
1694 - x-face-el 1.3.6.23-1
1695 [06 Jul 2003] DSA-339 semi - insecure temporary file
1696 {CAN-2003-0440}
1697 - semi 1.14.5+20030609-1
1698 [29 Jun 2003] DSA-338 proftpd - SQL injection
1699 {CAN-2003-0500}
1700 - proftpd 1.2.8-8
1701 [29 Jun 2003] DSA-337 gtksee - buffer overflow
1702 {CAN-2003-0444}
1703 ! gtksee 0.5.6-1
1704 [29 Jun 2003] DSA-336 linux-kernel-2.2.20 - several vulnerabilities
1705 {CAN-2002-1380 CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0364 CAN-2003-0246 CAN-2003-0244 CAN-2003-0247 CAN-2003-0248}
1706 - kernel-source-2.2.25 2.2.25-3
1707 NOTE: did not check newer kernels
1708 [28 Jun 2003] DSA-335 mantis - incorrect permissions
1709 {CAN-2003-0499}
1710 - mantis 0.17.5-6
1711 [28 Jun 2003] DSA-334 xgalaga - buffer overflows
1712 {CAN-2003-0454}
1713 - xgalaga 2.0.34-22
1714 [27 Jun 2003] DSA-333 acm - integer overflow
1715 {CVE-2002-0391}
1716 - acm 5.0-10
1717 [27 Jun 2003] DSA-332 linux-kernel-2.4.17 - several vulnerabilities
1718 {CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364}
1719 NOTE: note in the archive, and did not check newer kernels
1720 [27 Jun 2003] DSA-331 imagemagick - insecure temporary file
1721 {CAN-2003-0455}
1722 - imagemagick 4:5.5.7-1
1723 [23 Jun 2003] DSA-330 tcptraceroute - failure to drop root privileges
1724 {CAN-2003-0489}
1725 - tcptraceroute 1.4-4
1726 [20 Jun 2003] DSA-329 osh - buffer overflows
1727 {CAN-2003-0452}
1728 - osh 1.7-12
1729 [19 Jun 2003] DSA-328 webfs - buffer overflow
1730 {CAN-2003-0445}
1731 - webfs 1.20
1732 [19 Jun 2003] DSA-327 xbl - buffer overflows
1733 {CAN-2003-0451}
1734 - xbl 1.0k-5
1735 [19 Jun 2003] DSA-326 orville-write - buffer overflows
1736 {CAN-2003-0441}
1737 - orville-write 2.54-1
1738 [19 Jun 2003] DSA-325 eldav - insecure temporary file
1739 {CAN-2003-0438}
1740 - eldav 0.7.2-1
1741 [18 Jun 2003] DSA-324 ethereal - several vulnerabilities
1742 {CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432}
1743 - ethereal 0.9.13-1.
1744 [16 Jun 2003] DSA-323 noweb - insecure temporary files
1745 {CAN-2003-0381}
1746 - noweb 2.10c-2
1747 [16 Jun 2003] DSA-322 typespeed - buffer overflow
1748 {CAN-2003-0435}
1749 - typespeed 0.4.4
1750 [13 Jun 2003] DSA-321 radiusd-cistron - buffer overflow
1751 {CAN-2003-0450}
1752 - radiusd-cistron 1.6.6-2
1753 [13 Jun 2003] DSA-320 mikmod - buffer overflow
1754 {CAN-2003-0427}
1755 - mikmod 3.1.6-6
1756 [12 Jun 2003] DSA-319 webmin - session ID spoofing
1757 {CAN-2003-0101}
1758 - webmin 1.070-1
1759 [12 Jun 2003] DSA-318 lyskom-server - denial of service
1760 {CAN-2003-0366}
1761 - lyskom-server 2.0.7-2
1762 [11 Jun 2003] DSA-317 cupsys - denial of service
1763 {CAN-2003-0195}
1764 - cupsys 1.1.19final-1
1765 [11 Jun 2003] DSA-316 nethack - buffer overflow, incorrect permissions
1766 {CAN-2003-0358 CAN-2003-0359}
1767 - nethack 3.4.1-1
1768 - slashem 0.0.6E4F8-6
1769 - jnethack 1.1.5-15
1770 NOTE: DSA contains some strange non-nethack version numbers
1771 [11 Jun 2003] DSA-315 gnocatan - buffer overflows, denial of service
1772 {CAN-2003-0433}
1773 TODO: no mention of any security fixes in debian changelog,
1774 TODO: upstream changelog. Mailed maintainer.
1775 [11 Jun 2003] DSA-314 atftp - buffer overflow
1776 {CAN-2003-0380}
1777 - atftp 0.6.2
1778 [11 Jun 2003] DSA-313 ethereal - buffer overflows, integer overflows
1779 {CAN-2003-0356 CAN-2003-0357}
1780 - ethereal 0.9.12-1
1781 [09 Jun 2003] DSA-312 kernel-patch-2.4.18-powerpc - several vulnerabilities
1782 {CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248}
1783 NOTE: not in unstable/testing. Did not check other versions.
1784 [08 Jun 2003] DSA-311 linux-kernel-2.4.18 - several vulnerabilities
1785 {CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364}
1786 NOTE: not in unstable/testing. Did not check other versions.
1787 [08 Jun 2003] DSA-310 xaos - improper setuid-root execution
1788 {CAN-2003-0385}
1789 - xaos 3.1r-4
1790 [06 Jun 2003] DSA-309 eterm - buffer overflow
1791 {CAN-2003-0382}
1792 - eterm 0.9.2-1
1793 [06 Jun 2003] DSA-308 gzip - insecure temporary files
1794 {CVE-1999-1332 CAN-2003-0367}
1795 - gzip 1.3.5-6
1796 [27 May 2003] DSA-307 gps - multiple vulnerabilities
1797 {CAN-2003-0361 CAN-2003-0360 CAN-2003-0362}
1798 - gps 1.1.0-1
1799 [19 May 2003] DSA-306 ircii-pana - buffer overflows, integer overflow
1800 {CAN-2003-0321 CAN-2003-0322 CAN-2003-0328}
1801 - ircii-pana 1:1.0-0c19-8
1802 [15 May 2003] DSA-305 sendmail - insecure temporary files
1803 {CAN-2003-0308}
1804 - sendmail 8.12.9-2
1805 [15 May 2003] DSA-304 lv - privilege escalation
1806 {CAN-2003-0188}
1807 - lv 4.49.5-2
1808 [15 May 2003] DSA-303 mysql - privilege escalation
1809 {CAN-2003-0073}
1810 - mysql-dfsg 4.0.12-2
1811 {CAN-2003-0150}
1812 TODO: not sure if this is fixed
1813 [07 May 2003] DSA-302 fuzz - privilege escalation
1814 {CAN-2003-0261}
1815 - fuzz 0.6-7.1
1816 [07 May 2003] DSA-301 libgtop - buffer overflow
1817 {CAN-2001-0928}
1818 - libgtop 1.0.13-4
1819 [06 May 2003] DSA-300 balsa - buffer overflow
1820 {CAN-2003-0167}
1821 - balse 2.0.10
1822 [06 May 2003] DSA-299 leksbot - improper setuid-root execution
1823 {CAN-2003-0262}
1824 - lexbot 1.2-5
1825 [02 May 2003] DSA-298 epic4 - buffer overflows
1826 {CAN-2003-0323}
1827 - epic4 1:1.1.11.20030409-1
1828 [01 May 2003] DSA-297 snort - integer overflow, buffer overflow
1829 {CAN-2003-0033 CAN-2003-0209}
1830 - snort 2.0.0-1
1831 [30 Apr 2003] DSA-296 kdebase - insecure execution
1832 {CAN-2003-0204}
1833 - kdebase 4:3.1.0-1
1834 [30 Apr 2003] DSA-295 pptpd - buffer overflow
1835 {CAN-2003-0213}
1836 - pptpd 1.1.4-0.b3.2
1837 [23 Apr 2003] DSA-294 gkrellm-newsticker - missing quoting, incomplete parser
1838 {CAN-2003-0205 CAN-2003-0206}
1839 NOTE: not in unstable/testing
1840 [23 Apr 2003] DSA-293 kdelibs - insecure execution
1841 {CAN-2003-0204}
1842 - kdebase 4:3.1.0-1
1843 [22 Apr 2003] DSA-292 mime-support - insecure temporary file creation
1844 {CAN-2003-0214}
1845 - mime-support 3.23-1
1846 [22 Apr 2003] DSA-291 ircii - buffer overflows
1847 {CAN-2003-0323}
1848 - ircii 20030315-1
1849 [17 Apr 2003] DSA-290 sendmail-wide - char-to-int conversion
1850 {CAN-2003-0161}
1851 - sendmail-wide 8.12.9+3.5Wbeta-1
1852 [17 Apr 2003] DSA-289 rinetd - incorrect memory resizing
1853 {CAN-2003-0212}
1854 - rinetd 0.61-2
1855 [17 Apr 2003] DSA-288 openssl - several vulnerabilities
1856 {CAN-2003-0147 CAN-2003-0131}
1857 - openssl 0.9.7b-1
1858 - openssl096 0.9.6j-1
1859 [15 Apr 2003] DSA-287 epic - buffer overflows
1860 {CAN-2003-0324}
1861 - epic4 1:1.1.11.20030409-1
1862 [14 Apr 2003] DSA-286 gs-common - insecure temporary file
1863 {CAN-2003-0207}
1864 - gs-common 0.3.3.1
1865 [14 Apr 2003] DSA-285 lprng - insecure temporary file
1866 {CAN-2003-0136}
1867 - lprng 3.8.20-4.
1868 [12 Apr 2003] DSA-284 kdegraphics - insecure execution
1869 {CAN-2003-0204}
1870 - kdegraphics 4:3.1.0-1
1871 [11 Apr 2003] DSA-283 xfsdump - insecure file creation
1872 {CAN-2003-0173}
1873 - xfsdump 2.2.8-1
1874 [09 Apr 2003] DSA-282 glibc - integer overflow
1875 {CAN-2003-0028}
1876 - glibc 2.3.1-16
1877 [08 Apr 2003] DSA-281 moxftp - buffer overflow
1878 {CAN-2003-0203}
1879 - moxftp 2.2-18.20
1880 [07 Apr 2003] DSA-280 samba - buffer overflow
1881 {CAN-2003-0201 CAN-2003-0196}
1882 - samba 3.0
1883 [07 Apr 2003] DSA-279 metrics - insecure temporary file creation
1884 {CAN-2003-0202}
1885 NOTE: note in unstable/testing
1886 [04 Apr 2003] DSA-278 sendmail - char-to-int conversion
1887 {CAN-2003-0161}
1888 - sendmail 8.12.9-1
1889 [03 Apr 2003] DSA-277 apcupsd - buffer overflows, format string
1890 {CAN-2003-0098 CAN-2003-0099}
1891 - apcupsd 3.8.5-1.2
1892 [03 Apr 2003] DSA-276 linux-kernel-s390 - local privilege escalation
1893 {CAN-2003-0127}
1894 NOTE: this version is not in sarge, did not check others
1895 [02 Apr 2003] DSA-275 lpr-ppd - buffer overflow
1896 {CAN-2003-0144}
1897 - lpr-ppd 1:0.72-3
1898 [28 Mar 2003] DSA-274 mutt - buffer overflow
1899 {CAN-2003-0167}
1900 - mutt 1.4.0
1901 [28 Mar 2003] DSA-273 krb4 - Cryptographic weakness
1902 {CAN-2003-0138 CAN-2003-0139}
1903 - krb4 1.2.2-1
1904 [28 Mar 2003] DSA-272 dietlibc - integer overflow
1905 {CAN-2003-0028}
1906 - dietlibc 0.22-2
1907 [27 Mar 2003] DSA-271 ecartis - unauthorized password change
1908 {CAN-2003-0162}
1909 - ecartis 1.0.0+cvs.20030321-1
1910 [27 Mar 2003] DSA-270 linux-kernel-mips - local privilege escalation
1911 {CAN-2003-0127}
1912 NOTE: not in unstable/testing, did not check other versions
1913 [26 Mar 2003] DSA-269 heimdal - Cryptographic weakness
1914 {CAN-2003-0138}
1915 - heimdal 0.5.2-1
1916 [25 Mar 2003] DSA-268 mutt - buffer overflow
1917 {CAN-2003-0140}
1918 - mutt 1.5.4-1
1919 [24 Mar 2003] DSA-267 lpr - buffer overflow
1920 {CAN-2003-0144}
1921 - lpr 1:2000.05.07-4.20
1922 [24 Mar 2003] DSA-266 krb5 - several vulnerabilities
1923 {CAN-2003-0028}
1924 - krb5 1.3.3-2
1925 NOTE: changelog does not mention this one, verified patch from
1926 NOTE: Tom Yu was applied to this version.
1927 {CAN-2003-0072}
1928 - krb5 1.2.7-3
1929 NOTE: changelog does not mention this one, verified patch from
1930 NOTE: upstream was applied to this version.
1931 {CAN-2003-0082}
1932 - krb5 1.3.3-2
1933 {CAN-2003-0138 VU#623217}
1934 - krb5 1.2.7-3
1935 {CAN-2003-0139 VU#442569}
1936 - krb5 1.2.7-3
1937 [21 Mar 2003] DSA-265 bonsai - several vulnerabilities
1938 {CAN-2003-0152 CAN-2003-0153 CAN-2003-0154 CAN-2003-0155}
1939 - bonsai 1.3+cvs20030317-1
1940 [19 Mar 2003] DSA-264 lxr - missing filename sanitizing
1941 {CAN-2003-0156}
1942 - lxr 0.3-4
1943 [17 Mar 2003] DSA-263 netpbm-free - math overflow errors
1944 {CAN-2003-0146}
1945 - netpbm-free 2:9.20-9
1946 [15 Mar 2003] DSA-262 samba - remote exploit
1947 {CAN-2003-0085 CAN-2003-0086}
1948 - samba 2.2.8
1949 [14 Mar 2003] DSA-261 tcpdump - infinite loop
1950 {CAN-2003-0093 CAN-2003-0145}
1951 NOTE: DSA reports sid was not affected, sarge has sid version
1952 [13 Mar 2003] DSA-260 file - buffer overflow
1953 {CAN-2003-0102}
1954 - file 3.40-1.1
1955 [12 Mar 2003] DSA-259 qpopper - mail user privilege escalation
1956 {CAN-2003-0143}
1957 - qpopper 4.0.4-9
1958 [10 Mar 2003] DSA-258 ethereal - format string vulnerability
1959 {CAN-2003-0081}
1960 - ethereal 0.9.9-2
1961 [04 Mar 2003] DSA-257 sendmail - remote exploit
1962 {CAN-2002-1337}
1963 - sendmail 8.12.8
1964 [28 Feb 2003] DSA-256 mhc - insecure temporary file
1965 {CAN-2003-0120}
1966 - mhc 0.25+20030224-1
1967 [27 Feb 2003] DSA-255 tcpdump - infinite loop
1968 {CAN-2003-0108 CAN-2002-0380}
1969 - tcpdump 3.7.1-1.2
1970 [27 Feb 2003] DSA-254 traceroute-nanog - buffer overflow
1971 {CAN-2002-1051 CAN-2002-1364 CAN-2002-1386 CAN-2002-1387}
1972 - traceroute-nanog 6.3.0-1
1973 [24 Feb 2003] DSA-253 openssl - information leak
1974 {CAN-2003-0078}
1975 - openssl 0.9.7a-1
1976 [21 Feb 2003] DSA-252 slocate - buffer overflow
1977 {CAN-2003-0056}
1978 - slocate 2.7-1
1979 [14 Feb 2003] DSA-251 w3m - missing HTML quoting
1980 {CAN-2002-1335 CAN-2002-1348}
1981 - w3m 0.3.2.2-1
1982 [12 Feb 2003] DSA-250 w3mmee-ssl - missing HTML quoting
1983 {CAN-2002-1335 CAN-2002-1348}
1984 NOTE: not in sid/sarge
1985 [11 Feb 2003] DSA-249 w3mmee - missing HTML quoting
1986 {CAN-2002-1335 CAN-2002-1348}
1987 - w3mmee 0.3.p24.17-3
1988 [31 Jan 2003] DSA-248 hypermail - buffer overflows
1989 {CAN-2003-0057}
1990 - hypermail 2.1.6-1
1991 [30 Jan 2003] DSA-247 courier-ssl - missing input sanitizing
1992 {CAN-2003-0040}
1993 - courier 0.40.2-3
1994 [29 Jan 2003] DSA-246 tomcat - information exposure, cross site scripting
1995 {CAN-2003-0042 CAN-2003-0043 CAN-2003-0044}
1996 NOTE: tomcat not in sid/sarge
1997 NOTE: tomcat4 not affected
1998 [28 Jan 2003] DSA-245 dhcp3 - ignored counter boundary
1999 {CAN-2003-0039}
2000 - dhcp3 1.1.2-1
2001 [27 Jan 2003] DSA-244 noffle - buffer overflows
2002 {CAN-2003-0037}
2003 - noffle 1.1.2-1
2004 [24 Jan 2003] DSA-243 kdemultimedia - several vulnerabilities
2005 {CAN-2002-1393}
2006 - kdemultimedia 4:3.1
2007 [24 Jan 2003] DSA-242 kdebase - several vulnerabilities
2008 {CAN-2002-1393}
2009 - kdebase 4:3.1
2010 [24 Jan 2003] DSA-241 kdeutils - several vulnerabilities
2011 {CAN-2002-1393}
2012 - kdeutils 4:3.1
2013 [23 Jan 2003] DSA-240 kdegames - several vulnerabilities
2014 {CAN-2002-1393}
2015 - kdegames 4:3.1
2016 [23 Jan 2003] DSA-239 kdesdk - several vulnerabilities
2017 {CAN-2002-1393}
2018 - kdesdk 4:3.1
2019 [23 Jan 2003] DSA-238 kdepim - several vulnerabilities
2020 {CAN-2002-1393}
2021 - kdepim 4:3.1
2022 [22 Jan 2003] DSA-237 kdenetwork - several vulnerabilities
2023 {CAN-2002-1393}
2024 - kdenetwork 4:3.1
2025 [22 Jan 2003] DSA-236 kdelibs - several vulnerabilities
2026 {CAN-2002-1393}
2027 - kdelibs 4:3.1
2028 [22 Jan 2003] DSA-235 kdegraphics - several vulnerabilities
2029 {CAN-2002-1393}
2030 - kdegraphics 4:3.1
2031 [22 Jan 2003] DSA-234 kdeadmin - several vulnerabilities
2032 {CAN-2002-1393}
2033 - kdeadmin 4:3.1
2034 [21 Jan 2003] DSA-233 cvs - doubly freed memory
2035 {CAN-2003-0015}
2036 - cvs 1.11.2-5.1
2037 [20 Jan 2003] DSA-232 cupsys - several vulnerabilities
2038 {CAN-2002-1366 CAN-2002-1367 CAN-2002-1368 CAN-2002-1369 CAN-2002-1371 CAN-2002-1372 CAN-2002-1383 CAN-2002-1384}
2039 - cupsys 1.1.18-1
2040 [17 Jan 2003] DSA-231 dhcp3 - stack overflows
2041 {CAN-2003-0026}
2042 - dhcp3 3.0+3.0.1rc11-1
2043 [16 Jan 2003] DSA-230 bugzilla - insecure permissions, spurious backup files
2044 NOTE: not in testing due to 3 newer security holes
2045 {CAN-2003-0012}
2046 - bugzilla 2.16.2
2047 {CAN-2003-0013}
2048 - bugzilla 2.16.2
2049 [15 Jan 2003] DSA-229 imp - SQL injection
2050 {CAN-2003-0025}
2051 NOTE: I think imp3 is ok.
2052 [14 Jan 2003] DSA-228 libmcrypt - buffer overflows and memory leak
2053 {CAN-2003-0031 CAN-2003-0032}
2054 - libmcrypt 2.5.5-1
2055 [13 Jan 2003] DSA-227 openldap2 - buffer overflows and other bugs
2056 {CAN-2002-1378 CAN-2002-1379 CAN-2002-1508}
2057 - openldap2 2.0.27-3
2058 [10 Jan 2003] DSA-226 xpdf-i - integer overflow
2059 {CAN-2002-1384}
2060 - xpdf 2.01-2
2061 [09 Jan 2003] DSA-225 tomcat4 - source disclosure
2062 {CAN-2002-1394}
2063 ! tomcat4 4.1.16-1
2064 NOTE: another RC (unreproducible?) bug and missing deps (#263201)
2065 NOTE: are keeping the fix out of testing
2066 NOTE: this is the second unfixed security hole in tomcat4 in testing..
2067 [08 Jan 2003] DSA-224 canna - buffer overflow and more
2068 {CAN-2002-1158 CAN-2002-1159}
2069 - canna 3.6p1-1
2070 [07 Jan 2003] DSA-223 geneweb - information exposure
2071 {CAN-2002-1390}
2072 - geneweb 4.09-1
2073 [06 Jan 2003] DSA-222 xpdf - integer overflow
2074 {CAN-2002-1384}
2075 - xpdf 2.01-2
2076 [03 Jan 2003] DSA-221 mhonarc - cross site scripting
2077 {CAN-2002-1388}
2078 - mhonarc 2.5.14-1
2079 [02 Jan 2003] DSA-220 squirrelmail - cross site scripting
2080 {CAN-2002-1341}
2081 - squirrelmail 1:1.3.2-2
2082
2083 ------- These processed by Djoumé SALVETTI <salvetti@crans.org> -----
2084
2085 [31 Dec 2002] DSA-219 dhcpcd - remote command execution
2086 {CAN-2002-1403}
2087 - dhcpcd 1.3.22pl2-2
2088 [30 Dec 2002] DSA-218 bugzilla - cross site scripting
2089 NOTE: not in testing, fixed in unstable (bugzilla 2.16.2-1).
2090 [27 Dec 2002] DSA-217 typespeed - buffer overflow
2091 {CAN-2002-1389}
2092 - typespeed 0.4.2-2
2093 [24 Dec 2002] DSA-216 fetchmail - buffer overflow
2094 {CAN-2002-1365}
2095 - fetchmail 6.2.0-1
2096 [23 Dec 2002] DSA-215 cyrus-imapd - buffer overflow
2097 {CAN-2002-1580}
2098 - cyrus-imapd 1.5.19-9.10
2099 [20 Dec 2002] DSA-214 kdnetwork - buffer overflows
2100 {CAN-2002-1306}
2101 - kdenetwork 2.2.2-14.20
2102 NOTE: there is a typo in the DSA, the name of the package is kdenetwork.
2103 [19 Dec 2002] DSA-213 libpng - buffer overflow
2104 {CAN-2002-1363}
2105 - libpng 1.0.12-7
2106 - libpng3 1.2.5-8
2107 [17 Dec 2002] DSA-212 mysql - multiple problems
2108 {CAN-2002-1373 CAN-2002-1374 CAN-2002-1375 CAN-2002-1376}
2109 - mysql-dfsg 4.0.7.gamma-1
2110 [13 Dec 2002] DSA-211 micq - denial of service
2111 {CAN-2002-1362}
2112 NOTE: not in testing nor unstable (was fixed in 0.4.9.4-1)
2113 [13 Dec 2002] DSA-210 lynx - CRLF injection
2114 {CAN-2002-1405}
2115 - lynx 2.8.4.1b-4
2116 NOTE: lynx-ssl not in testing nor unstable.
2117 [12 Dec 2002] DSA-209 wget - directory traversal
2118 {CAN-2002-1344}
2119 - wget 1.8.2-8
2120 [12 Dec 2002] DSA-208 perl - broken safe compartment
2121 {CAN-2002-1323}
2122 - perl 5.8.0-14
2123 [11 Dec 2002] DSA-207 tetex-bin - arbitrary command execution
2124 {CAN-2002-0836}
2125 - tetex-bin 1.0.7+20021025-4
2126 [10 Dec 2002] DSA-206 tcpdump - denial of service
2127 {CAN-2002-1350}
2128 - tcpdump 3.7.2-1
2129 [10 Dec 2002] DSA-205 gtetrinet - buffer overflow
2130 - gtetrinet 0.4.4-1
2131 NOTE: no CAN not CVE for this one
2132 [05 Dec 2002] DSA-204 kdelibs - arbitrary program execution
2133 {CAN-2002-1281 CAN-2002-1282}
2134 - kdelibs 4:3.1.0-1
2135 [04 Dec 2002] DSA-203 smb2www - arbitrary command execution
2136 {CAN-2002-1342}
2137 - smb2www 980804-17
2138 [03 Dec 2002] DSA-202 im - insecure temporary files
2139 {CAN-2002-1395}
2140 - im 141-20
2141 [02 Dec 2002] DSA-201 freeswan - denial of service
2142 {CAN-2002-0666 VU#459371}
2143 - freeswan 1.99-1
2144 [22 Nov 2002] DSA-200 samba - remote exploit
2145 {CAN-2002-1318}
2146 - samba 2.99.cvs.20020713-1
2147 [19 Nov 2002] DSA-199 mhonarc - cross site scripting
2148 {CAN-2002-1307}
2149 - mhonarc 2.5.13-1
2150 [18 Nov 2002] DSA-198 nullmailer - denial of service
2151 {CAN-2002-1313}
2152 - nullmailer 1.00RC5-17
2153 [15 Nov 2002] DSA-197 courier - buffer overflow
2154 {CAN-2002-1311}
2155 - courier 0.40.0-1
2156 [14 Nov 2002] DSA-196 bind - several vulnerabilities
2157 {CAN-2002-0029 CAN-2002-1219 CAN-2002-1220 CAN-2002-1221}
2158 - bind 8.3.3-3
2159 [13 Nov 2002] DSA-195 apache-perl - several vulnerabilities
2160 {CAN-2002-0839 CAN-2002-0840 CAN-2002-0843 CAN-2001-0131 CAN-2002-1233}
2161 - apache-perl 1.3.26-1.1-1.27-3-1
2162 [12 Nov 2002] DSA-194 masqmail - buffer overflows
2163 {CAN-2002-1279}
2164 - masqmail 0.2.15-1
2165 [11 Nov 2002] DSA-193 kdenetwork - buffer overflow
2166 {CAN-2002-1247}
2167 - kdenetwok 2.2.2-14.3
2168 [08 Nov 2002] DSA-192 html2ps - arbitrary code execution
2169 {CAN-2002-1275}
2170 - html2ps 1.0b3-2
2171 [07 Nov 2002] DSA-191 squirrelmail - cross site scripting
2172 {CAN-2002-1131 CAN-2002-1132 CAN-2002-1276}
2173 - squirrelmail 1.2.8-1.1
2174 [07 Nov 2002] DSA-190 wmaker - buffer overflow
2175 {CAN-2002-1277}
2176 - wmaker 0.80.1-4
2177 [06 Nov 2002] DSA-189 luxman - local root exploit
2178 {CAN-2002-1245}
2179 - luxman 0.41-19
2180 [05 Nov 2002] DSA-188 apache-ssl - several vulnerabilities
2181 TODO: The DSA is for apache-ssl, but the bug entries are for apache.
2182 {CAN-2002-0839 CAN-2002-0840 CAN-2002-0843}
2183 - apache 1.3.27-0.1
2184 {CAN-2001-0131 CAN-2002-1233}
2185 - apache 1.3.27-1
2186 TODO: note sure about this
2187 NOTE: I have mailed maintainers
2188 {CAN-2002-0843}
2189 TODO: I don't know about this
2190 NOTE: I have mailed maintainers
2191 [04 Nov 2002] DSA-187 apache - several vulnerabilities
2192 {CAN-2002-0839 CAN-2002-0840 CAN-2002-0843}
2193 - apache 1.3.27-0.1
2194 {CAN-2001-0131 CAN-2002-1233}
2195 - apache 1.3.27-1
2196 TODO: note sure about this
2197 NOTE: I have mailed maintainers
2198 {CAN-2002-0843}
2199 TODO: I don't know about this
2200 NOTE: I have mailed maintainers
2201 [01 Nov 2002] DSA-186 log2mail - buffer overflow
2202 {CAN-2002-1251}
2203 - log2mail 0.2.6-1
2204 [31 Oct 2002] DSA-185 heimdal - buffer overflow
2205 {CAN-2002-1235}
2206 - heimdal 0.4e-22
2207 [30 Oct 2002] DSA-184 krb4 - buffer overflow
2208 {CAN-2002-1235}
2209 - krb4 1.1-11-8
2210 [29 Oct 2002] DSA-183 krb5 - buffer overflow
2211 {CAN-2002-1235}
2212 - krb5 1.2.6-2
2213 [28 Oct 2002] DSA-182 kdegraphics - buffer overflow
2214 {CAN-2002-0838}
2215 - kdegraphics 2.2.2-6.9
2216 [22 Oct 2002] DSA-181 libapache-mod-ssl - cross site scripting
2217 {CAN-2002-1157}
2218 - libapache-mod-ssl 2.8.9-2.3
2219 [21 Oct 2002] DSA-180 nis - information leak
2220 {CAN-2002-1232}
2221 - nis 3.9-6.2
2222 [18 Oct 2002] DSA-179 gnome-gv - buffer overflow
2223 {CAN-2002-0838}
2224 - gnome-gv 1.99.7-9
2225 [17 Oct 2002] DSA-178 heimdal - remote command execution
2226 {CAN-2002-1225 CAN-2002-1226}
2227 - heimdal 0.4e-21
2228 [17 Oct 2002] DSA-177 pam - serious security violation
2229 {CAN-2002-1227}
2230 - pam 0.76-6
2231 [16 Oct 2002] DSA-176 gv - buffer overflow
2232 {CAN-2002-0838}
2233 - gv 3.5.8-27
2234 [15 Oct 2002] DSA-175 syslog-ng - buffer overflow
2235 {CAN-2002-1200}
2236 - syslog-ng 1.5.21-1
2237 [14 Oct 2002] DSA-174 heartbeat - buffer overflow
2238 {CAN-2002-1215}
2239 - heartbeat 0.4.9.2-1
2240 [09 Oct 2002] DSA-173 bugzilla - privilege escalation
2241 {CAN-2002-1196}
2242 NOTE: not in testing, fixed in unstable (bugzilla 2.16.0-2.1)
2243 [08 Oct 2002] DSA-172 tkmail - insecure temporary files
2244 {CAN-2002-1193}
2245 NOTE: not in testing nor unstable (was fixed in 4.0beta9-9)
2246 [07 Oct 2002] DSA-171 fetchmail - buffer overflows
2247 {CAN-2002-1175 CAN-2002-1174}
2248 - fetchmail 6.1.0-1
2249 NOTE: fetchmail-ssl not in testing, fixed in unstable (fetchmail-ssl 6.1.0-1)
2250 [04 Oct 2002] DSA-170 tomcat4 - source code disclosure
2251 {CAN-2002-1148}
2252 ! tomcat4 4.1.12-1
2253 NOTE: only 4.0.4-4 in testing (which seems to be vulnerable)
2254 [25 Sep 2002] DSA-169 htcheck - cross site scripting
2255 {CAN-2002-1195}
2256 - htcheck 1.1-1.2
2257 [18 Sep 2002] DSA-168 php - bypassing safe_mode, CRLF injection
2258 {CAN-2002-0985 CAN-2002-0986}
2259 - php3 3.0.18-23.2
2260 - php4 4.2.3-3
2261 NOTE: php3 is not in testing, it seems to be wait for tiff and gcc transition
2262 NOTE: and is out of date on alpha and arm
2263 [16 Sep 2002] DSA-167 kdelibs - cross site scripting
2264 {CAN-2002-1151}
2265 - kdelibs 2.2.2-14
2266 NOTE: there is a typo in the DSA that mentionned Konquerer instead of kdelibs
2267 [13 Sep 2002] DSA-166 purity - buffer overflows
2268 {CAN-2002-1124}
2269 - purity 1-16
2270 [12 Sep 2002] DSA-165 postgresql - buffer overflows
2271 {CAN-2002-0972 CAN-2002-1398 CAN-2002-1400 CAN-2002-1401 CVE-2002-1402}
2272 - postgresql 7.2.2-2
2273 [10 Sep 2002] DSA-164 cacti - arbitrary code execution
2274 {CAN-2002-1477 CAN-2002-1478}
2275 - cacti 0.6.8a-2
2276 [09 Sep 2002] DSA-163 mhonarc - cross site scripting
2277 {CVE-2002-0738}
2278 - mhonarc 2.5.11-1
2279 [06 Sep 2002] DSA-162 ethereal - buffer overflow
2280 {CAN-2002-0834}
2281 - ethereal 0.9.6-1
2282 [04 Sep 2002] DSA-161 mantis - privilege escalation
2283 {CAN-2002-1115 CAN-2002-1116}
2284 - mantis 0.17.5-2
2285 [03 Sep 2002] DSA-160 scrollkeeper - insecure temporary file creation
2286 {CAN-2002-0662}
2287 - scrollkeeper 0.3.11-2
2288 [28 Aug 2002] DSA-159 python - insecure temporary files
2289 {CAN-2002-1119}
2290 - python2.1 2.1.3-6a
2291 - python2.2 2.2.1-8
2292 NOTE: python1.5 not in testing nor unstable (was fixed in 1.5.2-24)
2293 NOTE: python2.3 is not vulnerable
2294 [27 Aug 2002] DSA-158 gaim - arbitrary program execution
2295 {CVE-2002-0989}
2296 - gaim 0.59.1-2
2297 [23 Aug 2002] DSA-157 irssi-text - denial of service
2298 {CAN-2002-0983}
2299 - irssi-text 0.8.5-2
2300 [22 Aug 2002] DSA-156 epic4-script-light - arbitrary script execution
2301 {CVE-2002-0984}
2302 - epic4-script-light 2.7.30p5-2
2303 [17 Aug 2002] DSA-155 kdelibs - privacy escalation with Konqueror
2304 {CAN-2002-0970}
2305 - kdelibs 4:2.2.2-14
2306 [15 Aug 2002] DSA-154 fam - privilege escalation
2307 {CVE-2002-0875}
2308 - fam 2.6.8-1
2309 [14 Aug 2002] DSA-153 mantis - cross site code execution and privilege escalation
2310 {CAN-2002-1114 CAN-2002-1113 CAN-2002-1112 CAN-2002-1111 CAN-2002-1110}
2311 - mantis 0.17.4a-2
2312 [13 Aug 2002] DSA-152 l2tpd - missing random seed
2313 {CVE-2002-0872 CVE-2002-0873}
2314 NOTE: not in testing (was fixed in unstable 0.68-1)
2315 [13 Aug 2002] DSA-151 xinetd - pipe exposure
2316 {CVE-2002-0871}
2317 - xinetd 2.3.7-1
2318 [13 Aug 2002] DSA-150 interchange - illegal file exposition
2319 {CAN-2002-0874}
2320 - interchange 4.8.6-1
2321 [13 Aug 2002] DSA-149 glibc - integer overflow
2322 {CVE-2002-0391}
2323 - glibc 2.2.5-13
2324 [12 Aug 2002] DSA-148 hylafax - buffer overflows and format string vulnerabilities
2325 {CVE-2002-1049 CVE-2002-1050 CAN-2001-1034}
2326 - hylafax 4.1.2-2.1
2327 [08 Aug 2002] DSA-147 mailman - cross-site scripting
2328 {CAN-2002-0388 CAN-2002-0855}
2329 - mailman 2.0.12-1
2330 [08 Aug 2002] DSA-146 dietlibc - integer overflow
2331 {CVE-2002-0391}
2332 - dietlibc 0.20-0cvs20020808
2333 [07 Aug 2002] DSA-145 tinyproxy - doubly freed memory
2334 {CVE-2002-0847}
2335 - tinyproxy 1.4.3-3
2336 [06 Aug 2002] DSA-144 wwwoffle - improper input handling
2337 {CVE-2002-0818}
2338 - wwwoffle 2.7d-1
2339 [05 Aug 2002] DSA-143 krb5 - integer overflow
2340 {CVE-2002-0391}
2341 - krb5 1.2.5-2
2342 [05 Aug 2002] DSA-142 openafs - integer overflow
2343 {CVE-2002-0391}
2344 - openafs 1.2.6-1
2345 [01 Aug 2002] DSA-141 mpack - buffer overflow
2346 {CAN-2002-1425}
2347 - mpack 1.5-9
2348 [05 Aug 2002] DSA-140 libpng - buffer overflow
2349 {CAN-2002-0660 CAN-2002-0728}
2350 - libpng 1.0.12-4
2351 - libpng3 1.2.1-2
2352 [01 Aug 2002] DSA-139 super - format string vulnerability
2353 {CVE-2002-0817}
2354 - super 3.18.0-3
2355 [01 Aug 2002] DSA-138 gallery - remote exploit
2356 {CAN-2002-1412}
2357 - gallery 1.3-3
2358 [30 Jul 2002] DSA-137 mm - insecure temporary files
2359 {CVE-2002-0658}
2360 - mm 1.1.3-7
2361 [30 Jul 2002] DSA-136 openssl - multiple remote exploits
2362 {CAN-2002-0655 CAN-2002-0656 CAN-2002-0657 CAN-2002-0659}
2363 - openssl 0.9.6e-1
  ViewVC Help
Powered by ViewVC 1.1.5