/[secure-testing]/data/DSA/list
ViewVC logotype

Contents of /data/DSA/list

Parent Directory Parent Directory | Revision Log Revision Log

Revision 1961 - (show annotations) (download)
Tue Sep 13 18:59:57 2005 UTC (7 years, 9 months ago) by joeyh
File size: 84922 byte(s) 
munge version numbers for php4 dtsa
1 [13 Sep 2005] DSA-810-1 mozilla - several
2 {CAN-2004-0718 CAN-2005-1937 CAN-2005-2260 CAN-2005-2261 CAN-2005-2263 CAN-2005-2265 CAN-2005-2266 CAN-2005-2268 CAN-2005-2269 CAN-2005-2270}
3 - mozilla 2:1.7.8-1sarge2 (medium)
4 NOTE: not fixed in testing at time of DSA (buggy and TBS)
5 [13 Sep 2005] DSA-809-1 squid - several
6 {CAN-2005-2794 CAN-2005-2796}
7 - squid 2.5.10-5 (medium)
8 NOTE: not fixed in testing at time of DSA (too young)
9 [12 Sep 2005] DSA-808-1 tdiary - design error
10 {CAN-2005-2411}
11 - tdairy 2.0.2-1 (medium)
12 NOTE: fixed in testing at time of DSA
13 [12 Sep 2005] DSA-807-1 libapache-mod-ssl - acl restriction bypass
14 {CAN-2005-2700}
15 - libapache-mod-ssl 2.8.24-1 (medium)
16 NOTE: not fixed in testing at time of DSA (too young)
17 [09 Sep 2005] DSA-806-1 gcvs - insecure temporary files
18 {CAN-2005-2693}
19 - gcvs 1.0final-7 (low)
20 NOTE: fixed in testing at time of DSA
21 [08 Sep 2005] DSA-805-1 apache2 - several
22 {CAN-2005-1268 CAN-2005-2088 CAN-2005-2700 CAN-2005-2728}
23 - apache2 2.0.54-5 (medium)
24 NOTE: not fixed in testing at time of DSA (too young)
25 [08 Sep 2005] DSA-804-1 kdelibs - insecure permissions
26 {CAN-2005-1920}
27 - kdelibs 4:3.4.2-1 (medium)
28 NOTE: not fixed in testing at time of DSA (kde transition)
29 [07 Sep 2005] DSA-803-1 apache - programming error
30 {CAN-2005-2088}
31 - apache 1.3.33-8 (medium)
32 NOTE: not fixed in testing at time of DSA (too young)
33 [07 Sep 2005] DSA-802-1 cvs - insecure temporary files
34 {CAN-2005-2693}
35 - cvs 1:1.11.5-4 (low)
36 NOTE: fixed in testing at time of DSA
37 [05 Sep 2005] DSA-801-1 ntp - programming error
38 {CAN-2005-2496}
39 - ntp 1:4.2.0a+stable-4 (medium)
40 NOTE: not fixed in testing at time of DSA (RC bugs)
41 [02 Sep 2005] DSA-800-1 pcre3 - integer overflow
42 {CAN-2005-2491}
43 - pcre3 6.3-0.1etch1 (high)
44 NOTE: not fixed in testing at time of DSA (glibc transition)
45 NOTE: however, fixed in secure-testing archive
46 [02 Sep 2005] DSA-799-1 webcalendar - input validation
47 {CAN-2005-2717}
48 - webcalendar (unfixed; bug #326223; high)
49 NOTE: not fixed in testing at time of DSA (coordinated disclosure)
50 [02 Sep 2005] DSA-798-1 phpgroupware - several
51 {CAN-2005-2498 CAN-2005-2600 CAN-2005-2761}
52 - phpgroupware 0.9.16.008-1 (high)
53 NOTE: not fixed in testing at time of DSA (too young)
54 [01 Sep 2005] DSA-797-1 zsync - buffer overflow
55 {CAN-2005-1849 CAN-2005-2096}
56 - zsync 0.4.0-2 (medium)
57 NOTE: fixed in testing at time of DSA
58 [01 Sep 2005] DSA-796-1 affix - unsafe use of popen
59 {CAN-2005-2716}
60 - affix 2.1.2-3 (medium)
61 NOTE: not fixed in testing at time of DSA (glibc transition, builds)
62 [01 Sep 2005] DSA-795-2 proftpd - format string error
63 {CAN-2005-2390}
64 - proftpd 1.2.10-20 (medium)
65 NOTE: fixed in testing at time of DSA
66 NOTE: Initial -1 release had a build problem
67 [01 Sep 2005] DSA-794-1 polygen - programming error
68 {CAN-2005-2656}
69 - polygen 1.0.6-9 (low)
70 NOTE: not fixed in testing at time of DSA (too young)
71 [21 Aug 2005] DSA-779-2 mozilla-firefox - several
72 NOTE: Essentially 1.0.6 with rolled-back version number, backported version had regressions
73 {CAN-2005-2260 CAN-2005-2261 CAN-2005-2262 CAN-2005-2263 CAN-2005-2264 CAN-2005-2265 CAN-2005-2266 CAN-2005-2267 CAN-2005-2268 CAN-2005-2269 CAN-2005-2270}
74 - mozilla-firefox 1.0.4-2sarge3 (medium)
75 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
76 NOTE: Fixed in DTSA, which will have the same regressions, should be checked/reverted
77 [01 Sep 2005] DSA-793-1 courier - missing input sanitising
78 {CAN-2005-2724}
79 - courier 0.47-8 (medium)
80 NOTE: not fixed in testing at time of DSA (glibc transition, too young)
81 [31 Aug 2005] DSA-792-1 pstotext - missing input sanitising
82 {CAN-2005-2536}
83 - pstotext 1.9-2 (medium)
84 NOTE: not fixed in testing at time of DSA (glibc transition, builds)
85 [30 Aug 2005] DSA-791-1 maildrop - missing privilege release
86 {CAN-2005-2655}
87 - maildrop 1.5.3-1.1etch1 (medium)
88 NOTE: not fixed in testing at time of DSA (glibc transition)
89 NOTE: but fixed in secure-testing repo
90 [30 Aug 2005] DSA-790-1 phpldapadmin - programming error
91 {CAN-2005-2654}
92 - phpldapadmin 0.9.6c-5 (medium)
93 NOTE: fixed in testing at time of DSA
94 [29 Aug 2005] DSA-789-1 php4 - several
95 {CAN-2005-1751 CAN-2005-1921 CAN-2005-2498}
96 - php4 4.3.10-16etch1 (high)
97 NOTE: not fixed in testing at time of DSA (not uploaded yet)
98 [29 Aug 2005] DSA-788-1 kismet - several
99 {CAN-2005-2626 CAN-2005-2627}
100 - kismet 2005.08.R1-1 (medium)
101 NOTE: not fixed in testing at time of DSA (glibc transition)
102 NOTE: but fixed in secure-testing repo
103 [26 Aug 2005] DSA-787-1 backup-manager - insecure permissions and tempfile
104 {CAN-2005-1855 CAN-2005-1856}
105 - backup-manager 0.5.8-2 (medium)
106 NOTE: fixed in testing at time of DSA
107 [26 Aug 2005] DSA-786-1 simpleproxy - format string vulnerability
108 {CAN-2005-1857}
109 - simpleproxy 3.2-4 (medium)
110 NOTE: not fixed in testing at time of DSA (embargoed disclosure)
111 [25 Aug 2005] DSA-785-1 libpam-ldap - authentication bypass
112 {CAN-2005-2641}
113 - libpam-ldap 178-1sarge1 (medium)
114 NOTE: not fixed in testing at time of DSA (embargoed disclosure)
115 [25 Aug 2005] DSA-784-1 courier - programming error
116 {CAN-2005-2151}
117 - courier 0.47-6 (low)
118 NOTE: not fixed in testing at time of DSA (glibc transition)
119 [24 Aug 2005] DSA-783-1 mysql-dfsg-4.1 - insecure temporary file
120 {CAN-2005-1636}
121 - mysql-dfsg-4.1 4.1.12 (medium)
122 NOTE: not fixed in testing at time of DSA (glibc transition)
123 - mysql-dfsg-5.0 5.0.11beta-3 (medium)
124 NOTE: not fixed in testing at time of DSA (glibc transition)
125 [23 Aug 2005] DSA-782-1 bluez-utils - missing input sanitising
126 {CAN-2005-2547}
127 - bluez-utils 2.19-1 (high)
128 NOTE: not fixed in testing at time of DSA (missing builds)
129 [23 Aug 2005] DSA-781-1 mozilla-thunderbird - several
130 {CAN-2005-0989 CAN-2005-1159 CAN-2005-1160 CAN-2005-1532 CAN-2005-2261 CAN-2005-2265 CAN-2005-2266 CAN-2005-2269 CAN-2005-2270}
131 - mozilla-thunderbird 1.0.6-1 (medium)
132 NOTE: not fixed in testing at time of DSA (missing builds)
133 [22 Aug 2005] DSA-780-1 kdegraphics - wrong input sanitising
134 {CAN-2005-2097}
135 - kdegraphics 4:3.4.2-1 (bug #322458; low)
136 NOTE: not fixed in testing at time of DSA (nor in unstable; C++ ABI transition)
137 [21 Aug 2005] DSA-779-1 mozilla-firefox - several
138 {CAN-2005-2260 CAN-2005-2261 CAN-2005-2262 CAN-2005-2263 CAN-2005-2264 CAN-2005-2265 CAN-2005-2266 CAN-2005-2267 CAN-2005-2268 CAN-2005-2269 CAN-2005-2270}
139 - mozilla-firefox 1.0.4-2sarge3 (medium)
140 NOTE: not fixed in testing at time of DSA (build and deps)
141 [19 Aug 2005] DSA-778-1 mantis - missing input sanitising
142 {CAN-2005-2556 CAN-2005-2557}
143 - mantis 0.19.2-4 (medium)
144 NOTE: not fixed in testing at time of DSA (nor unstable)
145 [17 Aug 2005] DSA-777-1 mozilla - frame injection spoofing
146 {CAN-2004-0718 CAN-2005-1937}
147 - mozilla-browser 1.7.10-1 (medium)
148 NOTE: not fixed in testing at time of DSA (waiting on builds)
149 [16 Aug 2005] DSA-776-1 clamav - integer overflows, infinite loop
150 {CAN-2005-2450}
151 - clamav 0.86.2-1 (medium)
152 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
153 [12 Aug 2005] DSA-775-1 mozilla-firefox - frame injection spoofing
154 {CAN-2004-0718 CAN-2005-1937}
155 - mozilla-firefox 1.0.4-2sarge3 (medium)
156 NOTE: IMO the information about the sid fix in the DSA is wrong, pinged security@
157 NOTE: fixed in testing at time of DSA
158 [12 Aug 2005] DSA-774-1 fetchmail - buffer overflow
159 {CAN-2005-2335}
160 - fetchmail 6.2.5-16 (medium)
161 NOTE: fixed in testing at time of DSA
162 [11 Aug 2005] DSA-773-1 New amd64 packages fix several bugs
163 NOTE: amd64 catch-up DSA, no new holes
164 [03 Aug 2005] DSA-772-1 apt-cacher - missing input sanitising
165 {CAN-2005-1854}
166 - apt-cacher 0.9.10 (high)
167 NOTE: not fixed in testing at time of DSA (not uploaded to unstable yet)
168 [01 Aug 2005] DSA-771-1 pdns - several
169 {CAN-2005-2301 CAN-2005-2302}
170 - pdns 2.9.18-1 (medium)
171 NOTE: not fixed in testing at time of DSA (too young)
172 [29 Jul 2005] DSA-770-1 gopher - insecure tmpfile handling
173 {CAN-2005-1853}
174 - gopher 3.0.10
175 NOTE: not fixed in testing at time of DSA (Debian server outage)
176 [29 Jul 2005] DSA-769-1 gaim - memory alignment bug
177 {CAN-2005-2370}
178 - gaim 1:1.4.0-5 (high)
179 NOTE: not fixed in testing at time of DSA (?)
180 [27 Jul 2005] DSA-768-1 phpbb2 - missing input validation
181 {CAN-2005-2161}
182 - phpbb2 2.0.13-6sarge1
183 NOTE: not fixed in testing at time of DSA (Debian server outage)
184 [27 Jul 2005] DSA-767-1 ekg - integer overflows
185 {CAN-2005-1852}
186 - ekg 1.5+20050718+1.6rc3-1 (medium)
187 NOTE: not fixed in testing at time of DSA (Debian server outage)
188 [26 Jul 2005] DSA-766-1 webcalendar - authorisation failure
189 {CAN-2005-2320}
190 - webcalendar (unfixed; bug #315671; medium)
191 NOTE: not fixed in testing at time of DSA (Debian server outage)
192 [22 Jul 2005] DSA-765-1 heimdal - buffer overflow
193 {CAN-2005-0469}
194 - heimdal 0.6.3-10 (medium)
195 NOTE: fixed in testing at time of DSA
196 [21 Jul 2005] DSA-764-1 cacti - several
197 {CAN-2005-1524 CAN-2005-1525 CAN-2005-1526 CAN-2005-2148 CAN-2005-2149}
198 - cacti 0.8.6f-1 (high)
199 NOTE: fixed in testing at time of DSA
200 NOTE: DSA information is incorrect, sid fix is 6f, not 6e
201 [20 Jul 2005] DSA-763-1 zlib - buffer overflow
202 {CAN-2005-1849}
203 - zlib 1.2.3-1 (medium)
204 NOTE: not fixed in testing at time of DSA (only 1/2 days old, not built on s390)
205 [19 Jul 2005] DSA-762-1 affix - several
206 {CAN-2005-2250 CAN-2005-2277}
207 - affix 2.1.2-2 (medium)
208 NOTE: not fixed in testing at time of DSA (only 2/2 days old)
209 [19 Jul 2005] DSA-761-2 heartbeat - insecure temporary files
210 {CAN-2005-2231}
211 - heartbeat 1.2.3-12 (medium)
212 NOTE: not fixed in testing at time of DSA (only 0/2 days old)
213 [18 Jul 2005] DSA-760-1 ekg - several
214 {CAN-2005-1850 CAN-2005-1851 CAN-2005-1916}
215 - ekg 1.5+20050712+1.6rc2-1 (low)
216 NOTE: not fixed in testing at time of DSA (waiting on dependencies, not built on five archs)
217 [18 Jul 2005] DSA-759-1 phppgadmin - missing input sanitising
218 {CAN-2005-2256}
219 - phppgadmin 3.5.4-1 (medium)
220 NOTE: not fixed in testing at time of DSA (only 0/10 days old)
221 [18 Jul 2005] DSA-758-1 heimdal - buffer overflow
222 {CAN-2005-2040}
223 - heimdal 0.6.3-11 (medium)
224 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
225 [17 Jul 2005] DSA-757-1 krb5 - buffer overflow, double-free memory
226 {CAN-2005-1689 CAN-2005-1174 CAN-2005-1175}
227 - krb5 1.3.6-4 (medium)
228 NOTE: not fixed in testing at time of DSA (waiting on dependencies, not built on m68k)
229 [14 Jul 2005] DSA-746-1 phpgroupware - remote command execution
230 {CAN-2005-1921}
231 - phpgroupware 0.9.16.006-1 (high)
232 NOTE: fixed in testing at time of DSA
233 [13 Jul 2005] DSA-756-1 squirrelmail - several
234 {CAN-2005-1769 CAN-2005-2095}
235 - squirrelmail 2:1.4.4-6 (medium)
236 NOTE: not fixed in testing at time of DSA (only 0/2 days old)
237 [13 Jul 2005] DSA-755-1 tiff - buffer overflow
238 {CAN-2005-1544}
239 - tiff 3.7.2-3 (medium)
240 NOTE: fixed in testing at time of DSA
241 [13 Jul 2005] DSA-754-1 centericq - insecure temporary file
242 {CAN-2005-1914}
243 - centericq 4.20.0-7 (low)
244 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
245 [12 Jul 2005] DSA-753-1 gedit - format string
246 {CAN-2005-1686}
247 - gedit 2.10.3-1 (low)
248 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
249 [11 Jul 2005] DSA-752-1 gzip - several
250 {CAN-2005-0988 CAN-2005-1228}
251 - gzip 1.3.5-10
252 NOTE: fixed in testing at time of DSA
253 [11 Jul 2005] DSA-751-1 squid - IP spoofind
254 {CAN-2005-1519}
255 - squid 2.5.9-9
256 NOTE: fixed in testing at time of DSA
257 [10 Jul 2005] DSA-748-1 ruby1.8 - bad default value
258 {CAN-2005-1992}
259 - ruby1.8 1.8.2-8 (medium)
260 NOTE: not fixed in testing at time of DSA (waiting on dependencies)
261 [11 Jul 2005] DSA-750-1 dhcpcd - out-of-bound memory access
262 {CAN-2005-1848}
263 - dhcpcd 1.3.22pl4-22
264 NOTE: fixed in testing at time of DSA
265 [10 Jul 2005] DSA-749-1 ettercap - format string error
266 {CAN-2005-1796}
267 - ettercap 0.7.3-1 (medium)
268 NOTE: fixed in testing at time of DSA
269 [10 Jul 2005] DSA-747-1 egroupware - input validation error
270 {CAN-2005-1921}
271 - egroupware 1.0.0.007-3.dfsg-1 (high)
272 NOTE: not fixed in testing at time of DSA (only 1/2 days old)
273 [10 Jul 2005] DSA-745-1 drupal - arbitrary command execution
274 {CAN-2005-1921 CAN-2005-2106 CAN-2005-2116}
275 - drupal 4.5.4-1 (high)
276 NOTE: fixed in testing at time of DSA
277 [08 Jul 2005] DSA-744-1 fuse - programming error
278 {CAN-2005-1858}
279 - fuse 2.3.0-1
280 NOTE: fixed in testing at time of DSA
281 [08 Jul 2005] DSA-743-1 ht - buffer overflows, integer overflows
282 {CAN-2005-1545 CAN-2005-1546}
283 - ht 0.8.0-3
284 NOTE: fixed in testing at time of DSA
285 [09 Jul 2005] DSA-742-1 cvs - buffer overflow
286 {CAN-2005-0753}
287 - cvs 1:1.12.9-13 (high)
288 NOTE: fixed in testing at time of DSA
289 [07 Jul 2005] DSA-741-1 bzip2 - infinite loop
290 {CAN-2005-1260}
291 - bzip2 1.0.2-7 (low)
292 NOTE: fixed in testing at time of DSA
293 [06 Jul 2005] DSA-740-1 zlib - buffer overflow
294 {CAN-2005-2096}
295 - zlib 1.2.2-7 (medium)
296 NOTE: anything statically linking zlib needs rebuild
297 NOTE: not fixed in testing at time of DSA (embargoed disclosure)
298 [06 Jul 2005] DSA-739-1 trac - missing input sanitising
299 {CAN-2005-2007}
300 - trac 0.8.4-1 (medium)
301 NOTE: fixed in testing at time of DSA
302 [19 May 2005] DSA-725-2 ppxp - missing privilege release
303 {CAN-2005-0392}
304 - ppxp 0.2001080415-11
305 NOTE: fixed in testing at time of DSA
306 [05 Jul 2005] DSA-738-1 razor - email header parsing error
307 {CAN-2005-2024}
308 - razor 2.720-1 (low)
309 NOTE: not fixed in testing at time of DSA (not built on arm)
310 [05 Jul 2005] DSA-737-1 clamav - various DOS vulnerabilities
311 {CAN-2005-1922 CAN-2005-1923 CAN-2005-2056 CAN-2005-2070}
312 - clamav 0.86.1-1 (medium)
313 NOTE: not fixed in testing at time of DSA (uploaded with low urgency only, one fix missing for sid)
314 [05 Jul 2005] DSA-734-1 gaim - denial of service
315 {CAN-2005-1269 CAN-2005-1934}
316 - gaim 1.3.1-1
317 NOTE: not fixed in testing at time of DSA (not built on sparc)
318 [01 Jul 2005] DSA-736-2 spamassassin - mail header parsing error
319 {CAN-2005-1266}
320 - spamassassin 3.0.4-1 (medium)
321 NOTE: fixed in testing at time of DSA
322 [01 Jul 2005] DSA-736-1 spamassassin - mail header parsing error
323 {CAN-2005-1266}
324 - spamassassin 3.0.4-1 (medium)
325 NOTE: fixed in testing at time of DSA
326 [08 Jul 2005] DSA-735-2 sudo - pathname validation race
327 {CAN-2005-1993}
328 - sudo 1.6.8p9-1 (medium)
329 NOTE: fixed in testing at time of DSA
330 [01 Jul 2005] DSA-735-1 sudo - pathname validation race
331 {CAN-2005-1993}
332 - sudo 1.6.8p9-1 (medium)
333 NOTE: not fixed in testing at time of DSA
334 [30 Jun 2005] DSA-733-1 crip - insecure temporary files
335 {CAN-2005-0393}
336 - crip 3.5-1sarge2 (low)
337 NOTE: not fixed in testing at time of DSA (reserved)
338 [03 Jun 2005] DSA-732-1 mailutils - several
339 {CAN-2005-1520 CAN-2005-1521 CAN-2005-1522 CAN-2005-1523}
340 - mailutils 0.6.1-4
341 NOTE: fixed in testing at time of DSA
342 [02 Jun 2005] DSA-731-1 krb4 - buffer overflows
343 {CAN-2005-0468 CAN-2005-0469}
344 - krb4 1.2.2-11.2
345 NOTE: fixed in testing at time of DSA
346 [27 May 2005] DSA-730-1 bzip2 - race condition
347 {CAN-2005-0953}
348 - bzip2 1.0.2-6
349 NOTE: fixed in testing at time of DSA
350 [26 May 2005] DSA-729-1 php4 - missing input sanitising
351 {CAN-2005-0525}
352 - php4 4.3.10-10
353 NOTE: fixed in testing at time of DSA
354 [25 May 2005] DSA-728-1 qpopper - missing privilege release
355 {CAN-2005-1151 CAN-2005-1152}
356 - qpopper 4.0.5-4sarge1
357 NOTE: fixed in testing at time of DSA by security team
358 [20 May 2005] DSA-727-1 libconvert-uulib-perl - buffer overflow
359 {CAN-2005-1349}
360 - libconvert-uulib-perl 1.0.5.1-1
361 NOTE: fixed in testing at time of DSA
362 [20 May 2005] DSA-726-1 oops - format string vulnerability
363 {CAN-2005-1121}
364 - oops (unfixed; bug #307360)
365 NOTE: not in testing at time of DSA
366 [19 May 2005] DSA-725-1 ppxp - missing privilege release
367 {CAN-2005-0392}
368 - ppxp 0.2001080415-11
369 NOTE: not fixed in testing at time of DSA
370 [18 May 2005] DSA-724-1 phpsysinfo - design flaw
371 {CAN-2005-0870}
372 - phpsysinfo 2.3-3
373 NOTE: fixed in testing at time of DSA
374 [09 May 2005] DSA-723-1 xfree86 - buffer overflow
375 {CAN-2005-0605}
376 - xfree86 4.3.0.dfsg.1-13
377 NOTE: not fixed in testing at time of DSA
378 [09 May 2005] DSA-722-1 smail - buffer overflow
379 {CAN-2005-0892}
380 NOTE: Package not in testing at time of DSA
381 [06 May 2005] DSA-721-1 squid - design flaw
382 {CAN-2005-1345}
383 - squid 2.5.9-7
384 NOTE: not fixed in testing at time of DSA
385 [03 May 2005] DSA-720-1 smartlist - wrong input processing
386 {CAN-2005-0157}
387 - smartlist 3.15-18
388 NOTE: fixed in testing at time of DSA
389 [28 Apr 2005] DSA-719-1 prozilla - format string problems
390 {CAN-2005-0523}
391 - prozilla 1:1.3.7.4-1
392 NOTE: fixed in testing at time of DSA
393 [28 Apr 2005] DSA-718-1 ethereal - buffer overflow
394 {CAN-2005-0739}
395 - ethereal 0.10.10-1
396 NOTE: fixed in testing at time of DSA
397 [27 Apr 2005] DSA-717-1 lsh-utils - buffer overflow, typo
398 {CAN-2003-0826 CAN-2005-0814}
399 - lsh-utils 2.0.1-2
400 NOTE: fixed in testing at time of DSA
401 [27 Apr 2005] DSA-716-1 gaim - denial of service
402 {CAN-2005-0472}
403 - gaim 1.1.3-1
404 NOTE: fixed in testing at time of DSA
405 [27 Apr 2005] DSA-715-1 cvs - several
406 {CAN-2004-1342 CAN-2004-1343}
407 - cvs 1.12.9-12
408 NOTE: not fixed in testing at time of DSA
409 [26 Apr 2005] DSA-714-1 kdelibs - several
410 {CAN-2005-1046}
411 - kdelibs 4:3.3.2-5
412 NOTE: not fixed in testing at time of DSA
413 [21 Apr 2005] DSA-701-2 samba - integer overflows
414 NOTE: only a bug in the backported fix to stable, testing is ok
415 [21 Apr 2005] DSA-713-1 junkbuster - several
416 {CAN-2005-1108 CAN-2005-1109}
417 NOTE: package not in testing/unstable
418 [19 Apr 2005] DSA-712-1 geneweb - insecure file operations
419 {CAN-2005-0391}
420 - geneweb 4.10-7
421 NOTE: fixed in testing at time of DSA
422 [19 Apr 2005] DSA-711-1 info2www - missing input sanitising
423 {CAN-2004-1341}
424 - info2www 1.2.2.9-23
425 NOTE: fixed in testing at time of DSA
426 [18 Apr 2005] DSA-710-1 gtkhtml - null pointer dereference
427 {CAN-2003-0541}
428 - gtkhtml 1.0.4-6.2
429 NOTE: fixed in testing at time of DSA
430 [15 Apr 2005] DSA-709-1 libexif - buffer overflow
431 {CAN-2005-0664}
432 - libexif 0.6.9-5
433 [15 Apr 2005] DSA-708-1 php3 - missing input sanitising
434 {CAN-2005-0525}
435 - php3 3.0.18-31
436 [13 Apr 2005] DSA-707-1 mysql - several
437 {CAN-2004-0957 CAN-2005-0709 CAN-2005-0710 CAN-2005-0711}
438 - mysql-dfsg 4.0.24-5
439 - mysql-dfsg-4.1 4.1.10a-6
440 NOTE: not fixed in testing at time of DSA
441 [13 Apr 2005] DSA-706-1 axel - buffer overflow
442 {CAN-2005-0390}
443 - axel 1.0b-1
444 NOTE: fixed in testing at time of DSA
445 [04 Apr 2005] DSA-705-1 wu-ftpd - missing input sanitising
446 {CAN-2005-0256 CAN-2003-0854}
447 - wu-ftpd 2.6.2-19
448 [04 Apr 2005] DSA-704-1 remstats - tempfile, missing input sanitising
449 {CAN-2005-0387 CAN-2005-0388}
450 - remstats 1.0.13a-5
451 NOTE: not fixed in testing at time of DSA
452 [01 Apr 2005] DSA-703-1 krb5 - buffer overflows
453 {CAN-2005-0468 CAN-2005-0469}
454 - krb5 1.3.6-1
455 [01 Apr 2005] DSA-702-1 imagemagick - several
456 {CAN-2005-0397 CAN-2005-0759 CAN-2005-0760 CAN-2005-0762}
457 - imagemagick 6.0.6.2-2.2
458 [31 Mar 2005] DSA-701-1 samba - integer overflows
459 {CAN-2004-1154}
460 - samba 3.0.10-1
461 [30 Mar 2005] DSA-700-1 mailreader - missing input sanitising
462 {CAN-2005-0386}
463 - mailreader 2.3.29-11
464 NOTE: not fixed in testing at time of DSA
465 [29 Mar 2005] DSA-699-1 netkit-telnet-ssl - buffer overflow
466 {CAN-2005-0469}
467 - netkit-telnet-ssl 0.17.24+0.1-7.1
468 NOTE: not fixed in testing at time of DSA
469 [29 Mar 2005] DSA-698-1 mc - buffer overflow
470 {CAN-2005-0763}
471 NOTE: Not clear which unstable/testing version fixed this,
472 NOTE: but advisory says it's fixed.
473 [29 Mar 2005] DSA-697-1 netkit-telnet - buffer overflow
474 {CAN-2005-0469}
475 - netkit-telnet 0.17-28
476 NOTE: not fixed in testing at time of DSA
477 [22 Mar 2005] DSA-696-1 perl - design flaw
478 {CAN-2005-0448}
479 - perl 5.8.4-8
480 NOTE: fixed in testing at time of DSA
481 [21 Mar 2005] DSA-695-1 xli - buffer overflow, input sanitising, integer overflow
482 {CAN-2001-0775 CAN-2005-0638 CAN-2005-0639}
483 - xli 1.17.0-18
484 NOTE: not fixed in testing at time of DSA
485 [21 Mar 2005] DSA-694-1 xloadimage - missing input sanitising, integer overflow
486 {CAN-2005-0638 CAN-2005-0639}
487 - xloadimage 4.1-14.2
488 NOTE: not fixed in testing at time of DSA
489 [14 Mar 2005] DSA-693-1 luxman - buffer overflow
490 {CAN-2005-0385}
491 NOTE: not fixed in testing at time of DSA
492 NOTE: not in unstable at time of DSA though DSA claimed it was
493 - luxman 0.41-20
494 [14 Mar 2005] DSA-662-2 squirrelmail - several
495 NOTE: only an update to a prior DSA, did not affct sid/sarge.
496 [08 Mar 2005] DSA-692-1 kppp - design flaw
497 {CAN-2005-0205}
498 - kppp 4:3.1.6
499 NOTE: fixed in testing at time of DSA
500 [07 Mar 2005] DSA-691-1 abuse - several
501 {CAN-2005-0098 CAN-2005-0099}
502 NOTE: not in unstable/testing
503 [25 Feb 2005] DSA-690-1 bsmtpd - missing input sanitising
504 {CAN-2005-0107}
505 - bsmtpd 2.3pl8b-16
506 NOTE: not fixed in testing at time of DSA
507 [23 Feb 2005] DSA-689-1 libapache-mod-python - missing input sanitising
508 {CAN-2005-0088}
509 - libapache-mod-python 2.7.10-4
510 NOTE: fixed in testing at time of DSA
511 - libapache2-mod-python 3.1.3-3
512 NOTE: fixed in testing at time of DSA
513 [23 Feb 2005] DSA-688-1 squid - mising input sanitising
514 {CAN-2005-0446}
515 - squid 2.5.8-3
516 NOTE: fixed in testing at time of DSA
517 [21 Feb 2005] DSA-674-3 mailman - cross-site scripting, directory traversal
518 NOTE: only fixed bug in DSA
519 [18 Feb 2005] DSA-687-1 bidwatcher - format string
520 {CAN-2005-0158}
521 - bidwatcher 1.3.17-1
522 NOTE: not fixed in testing at time of DSA
523 [17 Feb 2005] DSA-686-1 gftp - missing input sanitising
524 {CAN-2005-0372}
525 - gftp 2.0.18-1
526 NOTE: not fixed in testing at time of DSA
527 [17 Feb 2005] DSA-685-1 emacs21 - format string
528 {CAN-2005-0100}
529 - emacs21 21.3+1-9
530 NOTE: not fixed in testing at time of DSA
531 [16 Feb 2005] DSA-684-1 typespeed - format string
532 {CAN-2005-0105}
533 - typespeed 0.4.4-8
534 NOTE: not fixed in testing at time of DSA
535 [15 Feb 2005] DSA-683-1 postgresql - buffer overflows
536 {CAN-2005-0245 CAN-2005-0247}
537 - postgresql 7.4.7-2
538 NOTE: fixed in testing at time of DSA
539 [15 Feb 2005] DSA-682-1 awstats - missing input sanitising
540 {CAN-2005-0363}
541 - awstats 6.2-1.2
542 NOTE: not fixed in testing at time of DSA
543 [14 Feb 2005] DSA-681-1 synaesthesia - privilege escalation
544 {CAN-2005-0070}
545 NOTE: does not apply for sarge, program is not setuid anymore
546 [14 Feb 2005] DSA-680-1 htdig - unsanitised input
547 {CAN-2005-0085}
548 - htdig 3.1.6-11
549 NOTE: fixed in testing at time of DSA
550 [14 Feb 2005] DSA-679-1 toolchain-source - insecure temporary files
551 {CAN-2005-0159}
552 - toolchain-source 3.4-5
553 NOTE: not fixed in testing at time of DSA
554 [11 Feb 2005] DSA-678-1 netkit-rwho - missing input validation
555 {CAN-2004-1180}
556 - netkit-rwho 0.17-8
557 NOTE: not fixed in testing at time of DSA
558 [11 Feb 2005] DSA-677-1 sympa - buffer overflow
559 {CAN-2005-0073}
560 - sympa 4.1.2-2.1
561 NOTE: not fixed in testing at time of DSA
562 [11 Feb 2005] DSA-676-1 xpcd - buffer overflow
563 {CAN-2005-0074}
564 - xpcd 2.08-11.1
565 NOTE: not fixed in testing at time of DSA
566 [11 Feb 2005] DSA-674-2 mailman - cross-site scripting, directory traversal
567 NOTE: only fixed bug in DSA
568 [10 Feb 2005] DSA-675-1 hztty - privilege escalation
569 {CAN-2005-0019}
570 - hztty 2.0-6.1
571 NOTE: not fixed in testing at time of DSA
572 [10 Feb 2005] DSA-674-1 mailman - cross-site scripting, directory traversal
573 {CAN-2004-1177}
574 - mailman 2.1.5-5
575 NOTE: fixed in testing at time of DSA
576 {CAN-2005-0202}
577 - mailman 2.1.5-6
578 NOTE: not fixed in testing at time of DSA
579 [10 Feb 2005] DSA-673-1 evolution - integer overflow
580 {CAN-2005-0102}
581 - evolution 2.0.3-1.2
582 NOTE: fixed in testing at time of DSA
583 [09 Feb 2005] DSA-672-1 xview - buffer overflows
584 {CAN-2005-0076}
585 - xview 3.2p1.4-19
586 NOTE: not fixed in testing at time of DSA
587 [08 Feb 2005] DSA-671-1 xemacs21 - format string
588 {CAN-2005-0100}
589 NOTE: not fixed in testing at time of DSA
590 - xemacs21 21.4.16-2
591 [08 Feb 2005] DSA-670-1 emacs20 - format string
592 {CAN-2005-0100}
593 NOTE: also affects emacs21 in unstable, fixed
594 [04 Feb 2005] DSA-669-1 php3 - several
595 {CAN-2004-0594 CAN-2004-0595}
596 - php3 3.0.18-27
597 NOTE: fixed in testing at time of DSA
598 [04 Feb 2005] DSA-668-1 postgresql - privilege escalation
599 {CAN-2005-0227}
600 - postgresql 7.4.7-1
601 NOTE: not fixed in testing at time of DSA
602 [04 Feb 2005] DSA-667-1 squid - several
603 {CAN-2005-0173 CAN-2005-0175 CAN-2005-0194 CAN-2005-0211}
604 - squid 2.5.7-7
605 NOTE: not fixed in testing at time of DSA
606 [04 Feb 2005] DSA-666-1 python2.2 - design flaw
607 {CAN-2005-0089}
608 - python2.2 2.2.3-14
609 - python2.3 2.3.4-20
610 - python2.4 2.4-5
611 NOTE: not fixed in testing at time of DSA
612 [04 Feb 2005] DSA-665-1 ncpfs - missing privilege release
613 {CAN-2005-0013}
614 - ncpfs 2.2.6-1
615 NOTE: not fixed in testing at time of DSA
616 [02 Feb 2005] DSA-664-1 cpio - broken file permissions
617 {CAN-1999-1572}
618 - cpio 2.5-1.2
619 NOTE: not fixed in testing at time of DSA
620 [02 Feb 2005] DSA-663-1 prozilla - buffer overflows
621 {CAN-2004-1120}
622 - prozilla 1.3.7.3-1
623 NOTE: fixed in testing at time of DSA
624 [01 Feb 2005] DSA-662-1 squirrelmail - several
625 {CAN-2005-0104 CAN-2005-0152}
626 NOTE: CAN-2005-0152 only exists in 1.2.6 version
627 - squirrelmail 1.4.4
628 NOTE: fixed in testing at time of DSA
629 [20 Apr 2005] DSA-661-2 f2c - insecure temporary files
630 {CAN-2005-0017 CAN-2005-0018}
631 - f2c 20020621-3.3
632 NOTE: not fixed in testing at time of DSA
633 [26 Jan 2005] DSA-660-1 kdebase - missing return value check
634 {CAN-2005-0078}
635 - kdebase 4:3.0.5
636 NOTE: fixed in testing at time of DSA
637 [26 Jan 2005] DSA-659-1 libpam-radius-auth - information leak, integer underflow
638 {CAN-2004-1340 CAN-2005-0108}
639 - libpam-radius-auth 1.3.16-3
640 NOTE: 1/2 fixed in testing at time of DSA
641 [25 Jan 2005] DSA-658-1 libdbi-perl - insecure temporary file
642 {CAN-2005-0077}
643 - libdbi-perl 1.46-6
644 NOTE: not fixed in testing at time of DSA
645 [25 Jan 2005] DSA-657-1 xine-lib - buffer overflow
646 {CAN-2004-1379}
647 - xine-lib 1-rc6a-1
648 NOTE: fixed in testing at time of DSA
649 [25 Jan 2005] DSA-656-1 vdr - insecure file access
650 {CAN-2005-0071}
651 - vdr 1.2.6-6
652 NOTE: not fixed in testing at time of DSA
653 [25 Jan 2005] DSA-655-1 zhcon - missing privilege release
654 {CAN-2005-0072}
655 - zhcon 1:0.2.3-8.1
656 NOTE: not fixed in testing at time of DSA
657 [21 Jan 2005] DSA-654-1 enscript - several
658 {CAN-2004-1184 CAN-2004-1185 CAN-2004-1186}
659 - enscript 1.6.4-6
660 NOTE: not fixed in testing at time of DSA
661 [21 Jan 2005] DSA-653-1 ethereal - buffer overflow
662 {CAN-2005-0084}
663 - ethereal 0.10.9-1
664 NOTE: not fixed in testing at time of DSA
665 [21 Jan 2005] DSA-652-1 unarj
666 {CAN-2004-0947 CAN-2004-1027}
667 NOTE: not-for-us (unarj)
668 [20 Jan 2005] DSA-651-1 squid - buffer overflow, integer overflow
669 {CAN-2005-0094 CAN-2005-0095}
670 - squid 2.5.7-4
671 NOTE: not fixed in testing at time of DSA
672 [20 Jan 2005] DSA-650-1 sword - missing input sanitising
673 {CAN-2005-0015}
674 - sword 1.5.7-7
675 NOTE: not fixed in testing at time of DSA
676 [20 Jan 2005] DSA-649-1 xtrlock - buffer overflow
677 {CAN-2005-0079}
678 - xtrlock 2.0-9
679 NOTE: fixed in testing at time of DSA
680 [19 Jan 2005] DSA-648-1 xpdf - buffer overflow
681 {CAN-2005-0064}
682 - xpdf 3.00-12
683 NOTE: not fixed in testing at time of DSA
684 [19 Jan 2005] DSA-647-1 mysql - insecure temporary files
685 {CAN-2005-0004}
686 - mysql-dfsg 4.0.23-3
687 - mysql-dfsg-4.1 4.1.8a-6
688 NOTE: not fixed in testing at time of DSA
689 [19 Jan 2005] DSA-646-1 imagemagick - buffer overflow
690 {CAN-2005-0005}
691 - imagemagick 6.0.6.2-2
692 NOTE: not fixed in testing at time of DSA
693 [19 Jan 2005] DSA-645-1 cupsys - buffer overflow
694 {CAN-2005-0064}
695 NOTE: cupsys not affected in sarge, though other programs are vulnerable
696 NOTE: see CAN/list
697 NOTE: not fixed in testing at time of DSA
698 [18 Jan 2005] DSA-644-1 chbg - buffer overflow
699 {CAN-2004-1264}
700 - chbg 1.5-4
701 NOTE: fixed in testing at time of DSA
702 [18 Jan 2005] DSA-643-1 queue - buffer overflows
703 {CAN-2004-0555}
704 - queue 1.30.1-5
705 NOTE: not fixed in testing at time of DSA
706 [17 Jan 2005] DSA-642-1 gallery - several
707 {CAN-2004-1106}
708 - gallery 1.4.4-pl4-1
709 NOTE: fixed in testing at time of DSA
710 [17 Jan 2005] DSA-641-1 playmidi - buffer overflow
711 {CAN-2005-0020}
712 - playmidi 2.4debian-3
713 NOTE: not fixed in testing at time of DSA
714 [17 Jan 2005] DSA-640-1 gatos - buffer overflow
715 {CAN-2005-0016}
716 - gatos 0.0.5-15
717 NOTE: not fixed in testing at time of DSA
718 [14 Jan 2005] DSA-639-1 mc - several
719 {CAN-2004-1004 CAN-2004-1005 CAN-2004-1009 CAN-2004-1090 CAN-2004-1091 CAN-2004-1092 CAN-2004-1093 CAN-2004-1174 CAN-2004-1175 CAN-2004-1176}
720 NOTE: unstable not vulnerable according to DSA
721 NOTE: DSA was wrong..
722 - mc 1:4.6.0-4.6.1-pre3-1
723 NOTE: not fixed in testing at time of DSA
724 [13 Jan 2005] DSA-638-1 gopher - several
725 {CAN-2004-0560 CAN-2004-0561}
726 NOTE: not in sarge
727 [13 Jan 2005] DSA-637-1 exim-tls - buffer overflow
728 {CAN-2005-0021}
729 NOTE: not in sarge
730 [12 Jan 2005] DSA-636-1 glibc - insecure temporary files
731 {CAN-2004-0968}
732 - glibc 2.3.2.ds1-20
733 NOTE: fixed in testing at time of DSA
734 [12 Jan 2005] DSA-635-1 exim - buffer overflow
735 {CAN-2005-0021}
736 - exim4 4.34-10
737 NOTE: fixed in testing at time of DSA
738 - exim 3.36-13
739 NOTE: not fixed in testing at time of DSA
740 [11 Jan 2005] DSA-634-1 hylafax - weak hostname and username validation
741 {CAN-2004-1182}
742 - hylafax 4.2.1-1
743 NOTE: fixed in testing at time of DSA
744 [11 Jan 2005] DSA-633-1 bmv - insecure temporary file
745 {CAN-2003-0014}
746 - bmv 1.2-17
747 NOTE: fixed in testing at time of DSA
748 [10 Jan 2005] DSA-632-1 linpopup - buffer overflow
749 {CAN-2004-1282}
750 - linpopup 1.2.0-7
751 NOTE: fixed in testing at time of DSA
752 [10 Jan 2005] DSA-631-1 kdelibs - unsanitised input
753 {CAN-2004-1165}
754 - kdelibs 4:3.3.2-1
755 NOTE: not fixed in testing at time of DSA
756 [10 Jan 2005] DSA-630-1 lintian - insecure temporary directory
757 {CAN-2004-1000}
758 - lintian 1.23.6
759 NOTE: not fixed in testing at time of DSA
760 [07 Jan 2005] DSA-629-1 krb5 - buffer overflow
761 {CAN-2004-1189}
762 - krb5 1.3.6-1
763 NOTE: not fixed in testing at time of DSA
764 [06 Jan 2005] DSA-628-1 imlib2 - integer overflows
765 {CAN-2004-1026}
766 - imlib2 1.1.2-2.1
767 NOTE: not fixed in testing at time of DSA
768 [06 Jan 2005] DSA-627-1 namazu2 - unsanitised input
769 {CAN-2004-1318}
770 - namazu2 2.0.14-1
771 NOTE: not fixed in testing at time of DSA
772 [06 Jan 2005] DSA-626-1 tiff - unsanitised input
773 {CAN-2004-1183}
774 - libtiff4 3.6.1-5
775 NOTE: not fixed in testing at time of DSA
776 [05 Jan 2005] DSA-625-1 pcal - buffer overflows
777 {CAN-2004-1289}
778 - pcal 4.8.0-1
779 NOTE: not fixed in testing at time of DSA
780 [05 Jan 2005] DSA-624-1 zip - buffer overflow
781 {CAN-2004-1010}
782 - zip 2.30-8
783 NOTE: fixed in testing at time of DSA
784 [04 Jan 2005] DSA-623-1 nasm - buffer overflow
785 {CAN-2004-1287}
786 - nasm 0.98.38-1.1
787 [03 Jan 2005] DSA-622-1 htmlheadline - insecure temporary files
788 {CAN-2004-1181}
789 NOTE: not in unstable
790 [31 Dec 2004] DSA-621-1 cupsys - buffer overflow
791 {CAN-2004-1125}
792 - cupsys 1.1.22-2
793 [30 Dec 2004] DSA-620-1 perl - insecure temporary files / directories
794 {CAN-2004-0452 CAN-2004-0976}
795 - perl 5.8.4-5
796 [30 Dec 2004] DSA-619-1 xpdf - buffer overflow
797 {CAN-2004-1125}
798 - xpdf 3.00-11
799 [24 Dec 2004] DSA-618-1 imlib - buffer overflows, integer overflows
800 {CAN-2004-1025 CAN-2004-1026}
801 - imlib 1.9.14-17.1
802 - imlib-png2 1.9.14-16.1
803 [24 Dec 2004] DSA-617-1 libtiff - insufficient input validation
804 {CAN-2004-1308}
805 - libtiff4 3.6.1-4
806 [23 Dec 2004] DSA-616-1 telnetd-ssl - format string
807 {CAN-2004-0998}
808 - telnetd-ssl 0.17.24+0.1-6
809 [22 Dec 2004] DSA-615-1 debmake - insecure temporary file
810 {CAN-2004-1179}
811 - debmake 3.7.7
812 [21 Dec 2004] DSA-614-1 xzgv - integer overflows
813 {CAN-2004-0994}
814 - xzgv 0.8-3
815 [21 Dec 2004] DSA-613-1 ethereal - inifinite loop
816 {CAN-2004-1142}
817 - ethereal 0.10.8-1
818 [20 Dec 2004] DSA-612-1 a2ps - unsanitised input
819 {CAN-2004-1170}
820 - a2ps 4.13b-4.2
821 [20 Dec 2004] DSA-611-1 htget - buffer overflow
822 {CAN-2004-0852}
823 NOTE: htget not in sarge or unstable
824 [17 Dec 2004] DSA-610-1 cscope - insecure temporary file
825 {CAN-2004-0996}
826 - cscope 15.5-1
827 [14 Dec 2004] DSA-609-1 atari800 - buffer overflows
828 {CAN-2004-1076}
829 - atari800 1.3.2-1
830 [14 Dec 2004] DSA-608-1 zgv - integer overflows, unsanitised input
831 {CAN-2004-1095 CAN-2004-0999}
832 - zgv 5.7-1.3
833 NOTE: changelog says he only patched 1095, but diff comparison
834 NOTE: shows 0999 was also fixed.
835 [10 Dec 2004] DSA-607-1 xfree86 - several
836 {CAN-2004-0914}
837 - xfree86 4.3.0.dfsg.1-9
838 [08 Dec 2004] DSA-606-1 nfs-utils - wrong signal handler
839 {CAN-2004-1014}
840 - nfs-utils 1:1.0.6-3.1
841 [06 Dec 2004] DSA-605-1 viewcvs - settings not honored
842 {CAN-2004-0915}
843 - viewcvs 0.9.2+cvs.1.0.dev.2004.07.28-1.2
844 [03 Dec 2004] DSA-604-1 hpsockd - missing input sanitising
845 {CAN-2004-0993}
846 - hpsockd 0.14
847 [01 Dec 2004] DSA-603-1 openssl - insecure temporary file
848 {CAN-2004-0975}
849 - openssl 0.9.7e-3
850 [29 Nov 2004] DSA-602-1 libgd2 - integer overlow
851 {CAN-2004-0941 CAN-2004-0990}
852 NOTE: different from fixes from earlier DSA for these CANs; 2004-0941 new
853 - libgd2 2.0.33-1.1
854 [29 Nov 2004] DSA-601-1 libgd1 - integer overflow
855 {CAN-2004-0941 CAN-2004-0990}
856 NOTE: different from fixes from earlier DSA for these CANs; 2004-0941 new
857 - libgd 1.8.4-36.1
858 [25 Nov 2004] DSA-599-1 tetex-bin - integer overflows
859 {CAN-2004-0888}
860 - tetex-bin 2.0.2-23
861 [25 Nov 2004] DSA-598-1 yardradius - buffer overflow
862 {CAN-2004-0987}
863 - yardradius 1.0.20-15
864 [25 Nov 2004] DSA-597-1 cyrus-imapd - buffer overflow
865 {CAN-2004-1012 CAN-2004-1013}
866 - cyrus21-imapd 2.1.17-1
867 [24 Nov 2004] DSA-596-2 sudo - missing input sanitising
868 {CAN-2004-1051}
869 - sudo 1.6.8p3-1
870 [24 Nov 2004] DSA-596-1 sudo - missing input sanitising
871 {CAN-2004-1051}
872 - sudo 1.6.8p3-1
873 [24 Nov 2004] DSA-595-1 bnc - buffer overflow
874 {CAN-2004-1052}
875 NOTE: package not in sarge or sid
876 [17 Nov 2004] DSA-594-1 apache - buffer overflows
877 {CAN-2004-0940}
878 - apache 1.3.33-2
879 [16 Nov 2004] DSA-593-1 imagemagick - buffer overflow
880 {CAN-2004-0981}
881 - imagemagick 6:6.0.6.2-1.5
882 [12 Nov 2004] DSA-592-1 ez-ipupdate - format string
883 {CAN-2004-0980}
884 - ez-ipupdate 3.0.11b8-8
885 [09 Nov 2004] DSA-591-1 libgd2 - integer overflows
886 {CAN-2004-0990}
887 - libgd2 2.0.30-1
888 [09 Nov 2004] DSA-590-1 gnats - format string vulnerability
889 {CAN-2004-0623}
890 NOTE: DSA got version of fix for unstable wrong
891 - gnats 4.0-6.1
892 [09 Nov 2004] DSA-589-1 libgd - integer overflows
893 {CAN-2004-0990}
894 - libgd1 1.8.4-36.1
895 [08 Nov 2004] DSA-588-1 gzip - insecure temporary files
896 {CAN-2004-0970}
897 NOTE: dsa says sid not affected
898 [08 Nov 2004] DSA-587-1 freeamp - buffer overflow
899 {CAN-2004-0964}
900 NOTE: DSA says zinf not vulnerable in sarge
901 [08 Nov 2004] DSA-586-1 ruby - infinite loop
902 {CAN-2004-0983}
903 - ruby1.6 1.6.8-12
904 - ruby1.8 1.8.1+1.8.2pre2-4
905 [05 Nov 2004] DSA-585-1 shadow - programming error
906 {CAN-2004-1001}
907 - shadow 1:4.0.3-30.3
908 [04 Nov 2004] DSA-584-1 dhcp - format string vulnerability
909 {CAN-2004-1006}
910 - dhcp 2.0pl5-19.1
911 [03 Nov 2004] DSA-583-1 lvm10 - insecure temporary directory
912 {CAN-2004-0972}
913 [02 Nov 2004] DSA-582-1 libxml - buffer overflow
914 {CAN-2004-0989}
915 - libxml 1.8.17-9
916 - libxml2 2.6.11-5
917 [01 Nov 2004] DSA-581-1 xpdf - integer overflows
918 {CAN-2004-0888}
919 - xpdf 3.00-9
920 [01 Nov 2004] DSA-580-1 iptables - missing initialisation
921 {CAN-2004-0986}
922 - iptables 1.2.11-4
923 [01 Nov 2004] DSA-579-1 abiword - buffer overflow
924 {CAN-2004-0645}
925 NOTE: according to DSA, sid's abiword is not affected. sarge is same
926 [01 Nov 2004] DSA-578-1 mpg123 - buffer overflow
927 {CAN-2004-0982}
928 - mpg123 0.59r-17
929 [29 Oct 2004] DSA-577-1 postgresql - symlink vulnerability
930 {CAN-2004-0977}
931 - postgresql 7.4.6-1
932 [29 Oct 2004] DSA-576-1 squid - multiple
933 {CVE-1999-0710 CAN-2004-0918}
934 - squid 2.5.7-1
935 [28 Oct 2004] DSA-575-1 catdoc - insecure temporary file
936 {CAN-2003-0193}
937 - catdoc 0.91.5-2
938 [28 Oct 2004] DSA-574-1 cabextract - missing directory sanitising
939 {CAN-2004-0916}
940 - cabextract 1.1-1
941 [21 Oct 2004] DSA-573-1 cupsys - integer overflows
942 {CAN-2004-0888}
943 - cupsys 1.1.20final+rc1-10
944 {CAN-2004-0889}
945 - xpdf 3.00-10
946 NOTE: kpdf and kfax are fixed in sarge, bug #278173 and #280373 for reference
947 - kpdf 4:3.3.1-1
948 - gpdf 2.8.0-1
949 - kfax 4:3.3.1-1
950 [21 Oct 2004] DSA-572-1 ecartis - multiple
951 {CAN-2004-0913}
952 - ecartis 1.0.0+cvs.20030911-8
953 [20 Oct 2004] DSA-571-1 libpng3 - buffer overflows, integer overflow
954 {CAN-2004-0955}
955 - libpng3 1.2.5.0-9
956 [20 Oct 2004] DSA-570-1 libpng - integer overflow
957 {CAN-2004-0955}
958 - libpng 1.0.15-8
959 [18 Oct 2004] DSA-569-1 netkit-telnet-ssl - invalid free(3)
960 {CAN-2004-0911}
961 - netkit-telnet-ssl 0.17.24+0.1-4
962 [16 Oct 2004] DSA-568-1 cyrus-sasl-mit - unsanitised input
963 {CAN-2004-0884}
964 NOTE: removed from testing
965 NOTE: maintainer reports hole not in cyrus-sasl2-mit
966 [15 Oct 2004] DSA-567-1 tiff - heap overflows
967 {CAN-2004-0803 CAN-2004-0804 CAN-2004-0886}
968 - tiff 3.6.1-2
969 - tiff3g 3.6.1-2
970 [14 Oct 2004] DSA-566-1 cupsys - unsanitised input
971 {CAN-2004-0923}
972 - cupsys 1.1.20final+rc1-9
973 [13 Oct 2004] DSA-565-1 sox - buffer overflows
974 {CAN-2004-0557}
975 - sox 12.17.4-9
976 [13 Oct 2004] DSA-564-1 mpg123 - missing user input sanitising
977 {CAN-2004-0805}
978 - mpg123 0.59r-16
979 [12 Oct 2004] DSA-563-1 cyrus-sasl - unsanitised input
980 {CAN-2004-0884}
981 - cyrus-sasl 1.5.28-6.2
982 - cyrus-sasl2 2.1.19-1.3
983 [11 Oct 2004] DSA-562-2 mysql - several vulnerabilities
984 {CAN-2004-0835 CAN-2004-0836 CAN-2004-0837}
985 - mysql 4.0.21-1
986 [11 Oct 2004] DSA-561-1 xfree86 - integer and stack overflows
987 {CAN-2004-0687 CAN-2004-0688}
988 - xfree86 4.3.0.dfsg.1-8
989 [07 Oct 2004] DSA-600-1 samba - arbitrary file access
990 {CAN-2004-0815}
991 NOTE: not affected according to DSA
992 [07 Oct 2004] DSA-560-1 lesstif1-1 - integer and stack overflows
993 {CAN-2004-0687 CAN-2004-0688}
994 - lesstif1-1 0.93.94-10
995 [06 Oct 2004] DSA-559-1 net-acct - insecure temporary file
996 {CAN-2004-0851}
997 - net-acct 0.71-7
998 [06 Oct 2004] DSA-558-1 libapache-mod-dav - null pointer dereference
999 {CAN-2004-0809}
1000 - libapache-mod-dav 1.0.3-10
1001 - apache2 2.0.51-1
1002 [04 Oct 2004] DSA-557-1 pppoe - missing privilegue dropping
1003 {CAN-2004-0564}
1004 - pppoe 3.5-4
1005 [03 Oct 2004] DSA-556-1 netkit-telnet - invalid free(3)
1006 {CAN-2004-0911}
1007 - netkit-telnet 0.17-26
1008 [30 Sep 2004] DSA-555-1 freenet6 - file permissions
1009 {CAN-2004-0563}
1010 - freenet6 1.0-2.2
1011 [27 Sep 2004] DSA-554-1 sendmail - pre-set password
1012 {CAN-2004-0833}
1013 - sendmail 8.13.1-13
1014 [27 Sep 2004] DSA-553-1 getmail - symlink vulnerability
1015 {CAN-2004-0880 CAN-2004-0881}
1016 - getmail 3.2.5-1
1017 [22 Sep 2004] DSA-552-1 imlib2 - unsanitised input
1018 {CAN-2004-0802}
1019 - imlib2 1.1.0-12.4
1020 [21 Sep 2004] DSA-551-1 lukemftpd - incorrect internal variable handling
1021 {CAN-2004-0794}
1022 - lukemftpd 1.1-2.2
1023 [20 Sep 2004] DSA-550-1 wv - buffer overflow
1024 {CAN-2004-0645}
1025 - wv 1.0.2-0.1
1026 [17 Sep 2004] DSA-549-1 gtk+2.0 - multiple holes
1027 {CAN-2004-0782 CAN-2004-0783 CAN-2004-0788}
1028 - gtk+2.0 2.4.9-2
1029 [16 Sep 2004] DSA-548-1 imlib - unsanitised input
1030 {CAN-2004-0817}
1031 - imlib 1.9.14-17
1032 - imlib+png2 1.9.14-16.2
1033 [16 Sep 2004] DSA-547-1 imagemagic - buffer overflows
1034 {CAN-2004-0827}
1035 - imagemagic 6.0.6.2-1
1036 [16 Sep 2004] DSA-546-1 gdk-pixbuf - multiple holes
1037 {CAN-2004-0753 CAN-2004-0782 CAN-2004-0788}
1038 - gdk-pixbuf 0.22.0-7
1039 [15 Sep 2004] DSA-545-1 cupsys - denial of service
1040 {CAN-2004-0558}
1041 - cupsys 1.1.20final+rc1-6
1042 [14 Sep 2004] DSA-544-1 webmin - insecure temporary directory
1043 {CAN-2004-0559}
1044 - webmin 1.160-1
1045 - usermin 1.090-1
1046 [31 Aug 2004] DSA-543-1 krb5 -- several vulnerabilities
1047 {CAN-2004-0642 CAN-2004-0643 CAN-2004-0644 CAN-2004-0772}
1048 - krb5 1.3.4-3
1049 [31 Aug 2004] DSA-458-2 python2.2 - buffer overflow
1050 {CAN-2004-0150}
1051 NOTE: not affected according to DSA
1052 [30 Aug 2004] DSA-542-1 qt - unsanitised input
1053 {CAN-2004-0691 CAN-2004-0692 CAN-2004-0693}
1054 - qt-x11-free 3.3.3-4
1055 [25 Aug 2004] DSA-541 icecast-server - cross site scripting
1056 {CAN-2004-0781}
1057 - icecast-server 1.3.12-8
1058 [18 Aug 2004] DSA-540 mysql-dfsg - insecure file creation
1059 {CAN-2004-0457}
1060 - mysql-dfsg 4.0.20-11
1061 [18 Aug 2004] DSA-539 kdelibs - denial of service
1062 {CAN-2004-0689}
1063 - kdelibs 4:3.2.3-3.sarge.1
1064 [17 Aug 2004] DSA-538 rsync - unauthorised directory traversal and file access
1065 - rsync 2.6.2-3
1066 [16 Aug 2004] DSA-537 ruby - insecure file permissions
1067 {CAN-2004-0755}
1068 - ruby1.8 1.8.1+1.8.2pre1-4
1069 TODO: is ruby1.6 vulnerable?
1070 [04 Aug 2004] DSA-536 libpng - several vulnerabilities
1071 {CAN-2004-0597 CAN-2004-0598 CAN-2004-0599 CAN-2004-0768}
1072 - libpng 1.0.15-6
1073 - libpng3 1.2.5.0-7
1074 [02 Aug 2004] DSA-535 squirrelmail - several vulnerabilities
1075 {CAN-2004-0519 CAN-2004-0520 CAN-2004-0521 CAN-2004-0639}
1076 - squirrelmail 2:1.4.3a-0.1
1077 [22 Jul 2004] DSA-534 mailreader - directory traversal
1078 {CAN-2002-1581}
1079 - mailreader 2.3.29-9
1080 [22 Jul 2004] DSA-533 courier - cross-site scripting
1081 {CAN-2004-0591}
1082 - courier 0.45.4-4
1083 [22 Jul 2004] DSA-532 libapache-mod-ssl - several vulnerabilities
1084 {CAN-2004-0488 CAN-2004-0700}
1085 - libapache-mod-ssl 2.8.19-1
1086 [20 Jul 2004] DSA-531 php4 - several vulnerabilities
1087 {CAN-2004-0594 CAN-2004-0595}
1088 ! php4 4:4.3.8-1
1089 [17 Jul 2004] DSA-530 l2tpd - buffer overflow
1090 {CAN-2004-0649}
1091 - l2tpd 0.70-pre20031121-2
1092 [17 Jul 2004] DSA-529 netkit-telnet-ssl - format string
1093 {CAN-2004-0640}
1094 ! netkit-telnet-ssl 0.17.24+0.1-2
1095 [17 Jul 2004] DSA-528 ethereal - denial of service
1096 {CAN-2004-0635}
1097 - ethereal 0.10.5-1
1098 [03 Jul 2004] DSA-527 pavuk - buffer overflow
1099 {CAN-2004-0456}
1100 NOTE: DSA is incorrect; pavuk is in sarge and unstable.
1101 ! pavuk 0.9pl28-3
1102 [03 Jul 2004] DSA-526 webmin - several vulnerabilities
1103 {CAN-2004-0582 CAN-2004-0583}
1104 - webmin 1.150-1
1105 [24 Jun 2004] DSA-525 apache - buffer overflow
1106 {CAN-2004-0492}
1107 - apache 1.3.31-2
1108 [19 Jun 2004] DSA-524 rlpr - several vulnerabilities
1109 {CAN-2004-0393 CAN-2004-0454}
1110 - rlpr 2.02-7.1
1111 [19 Jun 2004] DSA-523 www-sql - buffer overflow
1112 {CAN-2004-0455}
1113 - www-sql 0.5.7-18
1114 [19 Jun 2004] DSA-522 super - format string vulnerability
1115 {CAN-2004-0579}
1116 - super 3.23.0-1
1117 [18 Jun 2004] DSA-521 sup - format string vulnerability
1118 {CAN-2004-0451}
1119 - sup 1.8-11
1120 [16 Jun 2004] DSA-520 krb5 - buffer overflows
1121 {CAN-2004-0523}
1122 - krb5 1.3.3-2
1123 [15 Jun 2004] DSA-519 cvs - several vulnerabilities
1124 {CAN-2004-0416 CAN-2004-0417 CAN-2004-0418}
1125 - cvs 1:1.12.9-1
1126 [14 Jun 2004] DSA-518 kdelibs - unsanitised input
1127 {CAN-2004-0411}
1128 - kdelibs 3.2.3
1129 [10 Jun 2004] DSA-517 cvs - buffer overflow
1130 {CAN-2004-0414}
1131 - cvs 1.12.9-1
1132 [07 Jun 2004] DSA-516 postgresql - buffer overflow
1133 {CAN-2004-0547}
1134 - postgresql 07.03.0200-3.
1135 [05 Jun 2004] DSA-515 lha - several vulnerabilities
1136 {CAN-2004-0234 CAN-2004-0235}
1137 ! lha 1.14i-8
1138 NOTE: If 1.14i-8 cannot get into testing, the fix for 1.14i-2.0.1
1139 NOTE: from the DSA could to updated via t-p-u.
1140 [04 Jun 2004] DSA-514 kernel-image-sparc-2.2 - failing function and TLB flush
1141 {CAN-2004-0077}
1142 - kernel-image-sparc-2.2 9.1
1143 NOTE: did not check other versions of the kernel
1144 [03 Jun 2004] DSA-513 log2mail - format string
1145 {CAN-2004-0450}
1146 ! log2mail 0.2.8-3
1147 [02 Jun 2004] DSA-512 gallery - unauthenticated access
1148 {CAN-2004-0522}
1149 - gallery 1.4.3-pl2-1
1150 [30 May 2004] DSA-511 ethereal - buffer overflows
1151 {CAN-2004-0176}
1152 - ethereal 0.10.3-1
1153 [29 May 2004] DSA-510 jftpgw - format string
1154 {CAN-2004-0448}
1155 - jftpgw 0.13.4-1
1156 [29 May 2004] DSA-509 gatos - privilege escalation
1157 {CAN-2004-0395}
1158 - gatos 0.0.5-12
1159 [22 May 2004] DSA-508 xpcd - buffer overflow
1160 {CAN-2004-0402}
1161 - xpcd 2.08-10
1162 [19 May 2004] DSA-507 cadaver - buffer overflow
1163 {CAN-2004-0398}
1164 - cadaver 0.22.1-3
1165 [19 May 2004] DSA-506 neon - buffer overflow
1166 {CAN-2004-0398}
1167 - neon 0.24.6.dfsg-1
1168 [19 May 2004] DSA-505 cvs - heap overflow
1169 {CAN-2004-0396}
1170 - cvs 1.12.5-6
1171 [18 May 2004] DSA-504 heimdal - missing input sanitising
1172 {CAN-2004-0434}
1173 - heimdal 0.6.2-1
1174 [13 May 2004] DSA-503 mah-jong - missing argument check
1175 {CAN-2004-0458}
1176 - mah-jong 1.6.2-1
1177 [11 May 2004] DSA-502 exim-tls - buffer overflow
1178 {CAN-2004-0399 CAN-2004-0400}
1179 NOTE: exim-tls not in sarge
1180 [07 May 2004] DSA-501 exim - buffer overflow
1181 {CAN-2004-0399 CAN-2004-0400}
1182 - exim 3.36-11
1183 - exim4 4.33-1
1184 [01 May 2004] DSA-500 flim - insecure temporary file
1185 {CAN-2004-0422}
1186 - flim 1:1.14.6+0.20040415-1
1187 [01 May 2004] DSA-499 rsync - directory traversal
1188 {CAN-2004-0426}
1189 - rsync 2.6.1-1
1190 [30 Apr 2004] DSA-498 libpng - out of bound access
1191 {CAN-2004-0421}
1192 - libpng 1.0.15-5
1193 - libpng3 1.2.5.0-6
1194 [29 Apr 2004] DSA-497 mc - several vulnerabilities
1195 {CAN-2004-0226 CAN-2004-0231 CAN-2004-0232}
1196 - mc 1:4.6.0-4.6.1-pre1-2
1197 [29 Apr 2004] DSA-496 eterm - missing input sanitising
1198 {CAN-2003-0068}
1199 - eterm 0.9.2-6
1200 [26 Apr 2004] DSA-495 linux-kernel-2.4.16-arm - several vulnerabilities
1201 {CAN-2003-0127 CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1202 NOTE: 2.4.16 not present. Did not check newer kernels.
1203 [21 Apr 2004] DSA-494 ident2 - buffer overflow
1204 {CAN-2004-0408}
1205 - ident2 1.04-2
1206 [21 Apr 2004] DSA-493 xchat - buffer overflow
1207 {CAN-2004-0409}
1208 - xchat 2.0.8-1
1209 [18 Apr 2004] DSA-492 iproute - denial of service
1210 {CAN-2003-0856}
1211 - iproute 20010824-13.1
1212 [17 Apr 2004] DSA-491 linux-kernel-2.4.19-mips - several vulnerabilities
1213 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1214 NOTE: 2.4.19 not present. Did not check newer kernels.
1215 [17 Apr 2004] DSA-490 zope - arbitrary code execution
1216 {CVE-2002-0688}
1217 - zope 2.6.0-0.1
1218 [17 Apr 2004] DSA-489 linux-kernel-2.4.17-mips+mipsel - several vulnerabilities
1219 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1220 NOTE: 2.4.17 not present. Did not check newer kernels.
1221 [16 Apr 2004] DSA-488 logcheck - insecure temporary directory
1222 {CAN-2004-0404}
1223 - logcheck 1.1.1-13.2
1224 [16 Apr 2004] DSA-487 neon - format string
1225 {CAN-2004-0179}
1226 - newo 0.24.5-1
1227 [16 Apr 2004] DSA-486 cvs - several vulnerabilities
1228 {CAN-2004-0180 CAN-2004-0405}
1229 - cvs 1:1.12.5-4
1230 [14 Apr 2004] DSA-485 ssmtp - format string
1231 {CAN-2004-0156}
1232 - ssmtp 2.60.7
1233 [14 Apr 2004] DSA-484 xonix - failure to drop privileges
1234 {CAN-2004-0157}
1235 - xonix 1.4-21
1236 [14 Apr 2004] DSA-483 mysql - insecure temporary file creation
1237 {CAN-2004-0381}
1238 - mysql-dfsg 4.0.18-4
1239 {CAN-2004-0388}
1240 - mysql-dfsg 4.0.18-6
1241 [14 Apr 2004] DSA-482 linux-kernel-2.4.17-apus+s390 - several vulnerabilities
1242 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1243 NOTE: 2.4.17 not present. Did not check newer kernels.
1244 [14 Apr 2004] DSA-481 linux-kernel-2.4.17-ia64 - several vulnerabilities
1245 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1246 NOTE: 2.4.17 not present. Did not check newer kernels.
1247 [14 Apr 2004] DSA-480 linux-kernel-2.4.17+2.4.18-hppa - several vulnerabilities
1248 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1249 NOTE: 2.4.17/18 not present. Did not check newer kernels.
1250 [14 Apr 2004] DSA-479 linux-kernel-2.4.18-alpha+i386+powerpc - several vulnerabilities
1251 {CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
1252 NOTE: 2.4.18 not present. Did not check newer kernels.
1253 [06 Apr 2004] DSA-478 tcpdump - denial of service
1254 {CAN-2004-0183 CAN-2004-0184}
1255 - tcpdump 3.7.2-4
1256 [06 Apr 2004] DSA-477 xine-ui - insecure temporary file creation
1257 {CAN-2004-0372}
1258 - xine-ui 0.99.1-1
1259 [06 Apr 2004] DSA-476 heimdal - cross-realm
1260 {CAN-2004-0371}
1261 - heimdal 0.6.1-1
1262 [05 Apr 2004] DSA-475 linux-kernel-2.4.18-hppa - several vulnerabilities
1263 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1264 NOTE: 2.4.18 not present. Did not check newer kernels.
1265 [03 Apr 2004] DSA-474 squid - ACL bypass
1266 {CAN-2004-0189}
1267 - squid 2.5.5-1
1268 [03 Apr 2004] DSA-473 oftpd - denial of service
1269 {CAN-2004-0376}
1270 - oftpd 20040304-1
1271 [03 Apr 2004] DSA-472 fte - several vulnerabilities
1272 {CAN-2003-0648}
1273 - fte 0.50.0-1.1
1274 [02 Apr 2004] DSA-471 interchange - missing input sanitising
1275 {CAN-2004-0374}
1276 - interchange 5.0.1-1
1277 [01 Apr 2004] DSA-470 linux-kernel-2.4.17-hppa - several vulnerabilities
1278 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1279 NOTE: 2.4.17 not present. Did not check newer kernels.
1280 [29 Mar 2004] DSA-469 pam-pgsql - missing input sanitising
1281 {CAN-2004-0366}
1282 - pam-pgsql 0.5.2-7.1
1283 [24 Mar 2004] DSA-468 emil - several vulnerabilities
1284 {CAN-2004-0152 CAN-2004-0153}
1285 - emil 2.1.0-beta9-14
1286 [23 Mar 2004] DSA-467 ecartis - several vulnerabilities
1287 {CAN-2003-0781 CAN-2003-0782}
1288 - ecartis 1.0.0+cvs.20030911
1289 [18 Mar 2004] DSA-466 linux-kernel-2.2.10-powerpc-apus - failing function and TLB flush
1290 {CAN-2004-0077}
1291 NOTE: 2.2.10 not present. Did not check newer kernels.
1292 [17 Mar 2004] DSA-465 openssl - several vulnerabilities
1293 {CAN-2004-0079 CAN-2004-0081}
1294 - openssl 0.9.7d-1
1295 NOTE: CAN-2004-0081 only affects 0.9.6.
1296 NOTE: 0.9.7d also fixes CAN-2004-0112
1297 - openssl 0.9.6l
1298 - openssl096 0.9.6m-1
1299 [16 Mar 2004] DSA-464 gdk-pixbuf - broken image handling
1300 {CAN-2004-0111}
1301 - gdk-pixbuf 0.22.0-3
1302 [12 Mar 2004] DSA-463 samba - privilege escalation
1303 {CAN-2004-0186}
1304 - samba 3.0.2-2
1305 [12 Mar 2004] DSA-462 xitalk - missing privilege release
1306 {CAN-2004-0151}
1307 - xitalk 1.1.11-11
1308 [11 Mar 2004] DSA-461 calife - buffer overflow
1309 {CAN-2004-0188}
1310 - calife 2.8.6-1
1311 [10 Mar 2004] DSA-460 sysstat - insecure temporary file
1312 {CAN-2004-0108}
1313 - sysstat 5.0.2-1
1314 [10 Mar 2004] DSA-459 kdelibs - cookie path traversal
1315 {CAN-2003-0592}
1316 - kdelibs 4:3.1.3-1
1317 [09 Mar 2004] DSA-458 python2.2 - buffer overflow
1318 {CAN-2004-0150}
1319 NOTE: not affected according to DSA
1320 [08 Mar 2004] DSA-457 wu-ftpd - several vulnerabilities
1321 {CAN-2004-0148 CAN-2004-0185}
1322 - wu-ftpd 2.6.2-17.1
1323 [06 Mar 2004] DSA-456 linux-kernel-2.2.19-arm - failing function and TLB flush
1324 {CAN-2004-0077}
1325 NOTE: 2.2.19 not present. Did not check newer kernels.
1326 [03 Mar 2004] DSA-455 libxml - buffer overflows
1327 {CAN-2004-0110}
1328 - libxml 1.8.17-5
1329 - libxml2 2.6.6-1
1330 [02 Mar 2004] DSA-454 linux-kernel-2.2.22-alpha - failing function and TLB flush
1331 {CAN-2004-0077}
1332 NOTE: 2.2.22 not present. Did not check newer kernels.
1333 [02 Mar 2004] DSA-453 linux-kernel-2.2.20-i386+m68k+powerpc - failing function and TLB flush
1334 {CAN-2004-0077}
1335 NOTE: 2.2.20 not present. Did not check newer kernels.
1336 [29 Feb 2004] DSA-452 libapache-mod-python - denial of service
1337 {CAN-2003-0973}
1338 - libapache-mod-python 2:2.7.10-1
1339 [27 Feb 2004] DSA-451 xboing - buffer overflows
1340 {CAN-2004-0149}
1341 - xboing 2.4-26.1
1342 [27 Feb 2004] DSA-450 linux-kernel-2.4.19-mips - several vulnerabilities
1343 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1344 NOTE: 2.4.19 not present. Did not check newer kernels.
1345 [24 Feb 2004] DSA-449 metamail - buffer overflow, format string bugs
1346 {CAN-2004-0104 CAN-2004-0105}
1347 - metamail 2.7-45.2
1348 [22 Feb 2004] DSA-448 pwlib - several vulnerabilities
1349 {CAN-2004-0097}
1350 - pwlib 1.5.2-4
1351 [22 Feb 2004] DSA-447 hsftp - format string
1352 {CAN-2004-0159}
1353 ! hsftp 1.15-1
1354 [21 Feb 2004] DSA-446 synaesthesia - insecure file creation
1355 {CAN-2004-0160}
1356 NOTE: DSA notes not setuid anymore so ok
1357 [21 Feb 2004] DSA-445 lbreakout2 - buffer overflow
1358 {CAN-2004-0158}
1359 - lbreakout2 2.4
1360 [20 Feb 2004] DSA-444 linux-kernel-2.4.17-ia64 - missing function return value check
1361 {CAN-2004-0077}
1362 NOTE: 2.4.17 not present. Did not check newer kernels.
1363 [19 Feb 2004] DSA-443 xfree86 - several vulnerabilities
1364 {CAN-2003-0690}
1365 - xfree86 4.3.0-0pre1v2
1366 {CAN-2004-0083 CAN-2004-0084 CAN-2004-0106}
1367 - xfree86 4.3.0-1
1368 {CAN-2004-0093 CAN-2004-0094}
1369 - xfree86 4.2.1-6
1370 [19 Feb 2004] DSA-442 linux-kernel-2.4.17-s390 - several vulnerabilities
1371 {CAN-2003-0001 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364 CAN-2003-0961 CAN-2003-0985 CAN-2004-0077 CVE-2002-0429}
1372 NOTE: 2.4.17 not present. Did not check newer kernels.
1373 [18 Feb 2004] DSA-441 linux-kernel-2.4.17-mips+mipsel - missing function return value check
1374 {CAN-2004-0077}
1375 NOTE: 2.4.17 not present. Did not check newer kernels.
1376 [18 Feb 2004] DSA-440 linux-kernel-2.4.17-powerpc-apus - several vulnerabilities
1377 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1378 NOTE: 2.4.17 not present. Did not check newer kernels.
1379 [18 Feb 2004] DSA-439 linux-kernel-2.4.16-arm - several vulnerabilities
1380 {CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
1381 NOTE: 2.4.16 not present. Did not check newer kernels.
1382 [18 Feb 2004] DSA-438 linux-kernel-2.4.18-alpha+i386+powerpc - missing function return value check
1383 {CAN-2004-0077}
1384 NOTE: 2.4.17 not present. Did not check newer kernels.
1385 [11 Feb 2004] DSA-437 cgiemail - open mail relay
1386 {CAN-2002-1575}
1387 - cgiemail 1.6-20
1388 [08 Feb 2004] DSA-436 mailman - several vulnerabilities
1389 {CAN-2003-0991}
1390 NOTE: apparently specific to mailman 2.0, not 2.1
1391 {CAN-2003-0965}
1392 - mailman 2.1.4-1
1393 {CAN-2003-0038}
1394 - mailman 2.1.1-1
1395 [06 Feb 2004] DSA-435 mpg123 - heap overflow
1396 {CAN-2003-0865}
1397 - mpg123 0.59r-15
1398 [05 Feb 2004] DSA-434 gaim - several vulnerabilities
1399 {CAN-2004-0005 CAN-2004-0006 CAN-2004-0007 CAN-2004-0008}
1400 - gaim 1:0.75-2
1401 [04 Feb 2004] DSA-433 kernel-patch-2.4.17-mips - integer overflow
1402 {CAN-2003-0961}
1403 NOTE: 2.4.17 not present. Did not check newer kernels.
1404 [03 Feb 2004] DSA-432 crawl - buffer overflow
1405 {CAN-2004-0103}
1406 - crawl 4.0.0beta26-4
1407 [01 Feb 2004] DSA-431 perl - information leak
1408 {CAN-2003-0618}
1409 - perl 5.8.3-3
1410 [28 Jan 2004] DSA-430 trr19 - missing privilege release
1411 {CAN-2004-0047}
1412 - trr19 1.0beta5-17.1
1413 [26 Jan 2004] DSA-429 gnupg - cryptographic weakness
1414 {CAN-2003-0971}
1415 - gnupg 1.2.4-1
1416 [20 Jan 2004] DSA-428 slocate - buffer overflow
1417 {CAN-2003-0848}
1418 - slocate 2.7-3
1419 [19 Jan 2004] DSA-427 linux-kernel-2.4.17-mips+mipsel - missing boundary check
1420 {CAN-2003-0985}
1421 NOTE: 2.4.17 not present. Did not check newer kernels.
1422 [18 Jan 2004] DSA-426 netpbm-free - insecure temporary files
1423 {CAN-2003-0924}
1424 - netpbm-free 2:9.25-9
1425 [16 Jan 2004] DSA-425 tcpdump - multiple vulnerabilities
1426 {CAN-2003-1029 CAN-2003-0989 CAN-2004-0055 CAN-2004-0057}
1427 TODO: No idea if this is fixed, we have a new upstream version
1428 TODO: that came out after these advisories, but neither the debian nor
1429 TODO: the upstream changelog seem to mention them.
1430 NOTE: Mailed maintainer.
1431 [16 Jan 2004] DSA-424 mc - buffer overflow
1432 {CAN-2003-1023}
1433 - mc 1:4.6.0-4.6.1-pre1-1
1434 [15 Jan 2004] DSA-423 linux-kernel-2.4.17-ia64 - several vulnerabilities
1435 {CAN-2003-0001 CAN-2003-0018 CAN-2003-0127 CAN-2003-0461 CAN-2003-0462 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552 CAN-2003-0961 CAN-2003-0985}
1436 NOTE: 2.4.17 not present. Did not check newer kernels.
1437 [13 Jan 2004] DSA-422 cvs - remote vulnerability
1438 - cvs 1.11.11
1439 [12 Jan 2004] DSA-421 mod-auth-shadow - password expiration
1440 {CAN-2004-0041}
1441 - mod-auth-shadow 1.4-1
1442 [12 Jan 2004] DSA-420 jitterbug - improperly sanitised input
1443 {CAN-2004-0028}
1444 - jitterbug 1.6.2-4.5
1445 [09 Jan 2004] DSA-419 phpgroupware - missing filename sanitising, SQL injection
1446 {CAN-2004-0016 CAN-2004-0017}
1447 - phpgroupware 0.9.14.007-4
1448 [07 Jan 2004] DSA-418 vbox3 - privilege leak
1449 {CAN-2004-0015}
1450 - vbox3 0.1.8
1451 [07 Jan 2004] DSA-417 linux-kernel-2.4.18-powerpc+alpha - missing boundary check
1452 {CAN-2003-0961 CAN-2003-0985}
1453 NOTE: 2.4.18 not present. Did not check newer kernels.
1454 [06 Jan 2004] DSA-416 fsp - buffer overflow, directory traversal
1455 {CAN-2003-1022 CAN-2004-0011}
1456 - fsp 2.81.b18-1
1457 [06 Jan 2004] DSA-415 zebra - denial of service
1458 {CAN-2003-0795 CAN-2003-0858}
1459 - quagga 0.96.4x-4
1460 [06 Jan 2004] DSA-414 jabber - denial of service
1461 {CAN-2004-0013}
1462 - jabber 1.4.3-1
1463 [06 Jan 2004] DSA-413 linux-kernel-2.4.18 - missing boundary check
1464 {CAN-2003-0985}
1465 NOTE: 2.4.18 not present. Did not check newer kernels.
1466 [05 Jan 2004] DSA-412 nd - buffer overflows
1467 {CAN-2004-0014}
1468 - nd 0.8.2-1
1469 [05 Jan 2004] DSA-411 mpg321 - format string vulnerability
1470 {CAN-2003-0969}
1471 - mpg321 0.2.10.3
1472 [05 Jan 2004] DSA-410 libnids - buffer overflow
1473 {CAN-2003-0850}
1474 - libnids 1.18-1
1475 [05 Jan 2004] DSA-409 bind - denial of service
1476 {CAN-2003-0914}
1477 - bind 1:8.4.3-1
1478 [05 Jan 2004] DSA-408 screen - integer overflow
1479 {CAN-2003-0972}
1480 - screen 4.0.2-0.1
1481 [05 Jan 2004] DSA-407 ethereal - buffer overflows
1482 {CAN-2003-0925 CAN-2003-0926 CAN-2003-0927 CAN-2003-1012 CAN-2003-1013}
1483 - ethereal 0.10.0-1
1484 [05 Jan 2004] DSA-406 lftp - buffer overflow
1485 - lftp 2.6.10-1
1486 [30 Dec 2003] DSA-405 xsok - missing privilege release
1487 {CAN-2003-0949}
1488 - xsok 1.02-11
1489 [04 Dec 2003] DSA-404 rsync - heap overflow
1490 {CAN-2003-0962}
1491 - rsync 2.5.6-1.1
1492 [01 Dec 2003] DSA-403 kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18 - local root exploit
1493 {CAN-2003-0961}
1494 NOTE: 2.4.18 not present in sarge, did not check newer kernels.
1495 [17 Nov 2003] DSA-402 minimalist - unsanitised input
1496 {CAN-2003-0902}
1497 - minimalist 2.4-1
1498 [17 Nov 2003] DSA-401 hylafax - format strings
1499 {CAN-2003-0886}
1500 - hylafax 1:4.1.8-1
1501 [11 Nov 2003] DSA-400 omega-rpg - buffer overflow
1502 {CAN-2003-0932}
1503 - omega-rpg 0.90-pa9-11
1504 [10 Nov 2003] DSA-399 epic4 - buffer overflow
1505 {CAN-2003-0328}
1506 - epic4 1:1.1.11.20030409-2
1507 [10 Nov 2003] DSA-398 conquest - buffer overflow
1508 {CAN-2003-0933}
1509 - conquest 7.2-5
1510 [07 Nov 2003] DSA-397 postgresql - buffer overflow
1511 {CAN-2003-0901}
1512 - postgresql 7.3.4
1513 [29 Oct 2003] DSA-396 thttpd - missing input sanitizing, wrong calculation
1514 {CAN-2002-1562 CAN-2003-0899}
1515 - thttpd 2.23beta1-2.3
1516 [15 Oct 2003] DSA-395 tomcat4 - incorrect input handling
1517 {CAN-2003-0866}
1518 ! tomcat4 4.1.24-2
1519 NOTE: another RC (unreproducible?) bug and missing deps (#263201)
1520 NOTE: are keeping the fix out of testing
1521 [11 Oct 2003] DSA-394 openssl095 - ASN.1 parsing vulnerability
1522 {CAN-2003-0543 CAN-2003-0544 CAN-2003-0545}
1523 - openssl 0.9.7c
1524 - openssl096 0.9.6k
1525 [01 Oct 2003] DSA-393 openssl - denial of service
1526 {CAN-2003-0543 CAN-2003-0544 CAN-2003-0545}
1527 - openssl 0.9.7c
1528 - openssl096 0.9.6k
1529 [29 Sep 2003] DSA-392 webfs - buffer overflows, file and directory exposure
1530 {CAN-2003-0832 CAN-2003-0833}
1531 - webfs 1.20
1532 [28 Sep 2003] DSA-391 freesweep - buffer overflow
1533 {CAN-2003-0828}
1534 - freesweep 0.88-4.1
1535 [26 Sep 2003] DSA-390 marbles - buffer overflow
1536 {CAN-2003-0830}
1537 NOTE: not present in sid, sarge
1538 [20 Sep 2003] DSA-389 ipmasq - insecure packet filtering rules
1539 {CAN-2003-0785}
1540 - ipmasq 3.5.12
1541 [19 Sep 2003] DSA-388 kdebase - several vulnerabilities
1542 {CAN-2003-0690 CAN-2003-0692}
1543 - kdebase 4:3.2
1544 [18 Sep 2003] DSA-387 gopher - buffer overflows
1545 {CAN-2003-0805}
1546 - gopher 3.0.6
1547 [18 Sep 2003] DSA-386 libmailtools-perl - input validation bug
1548 {CAN-2002-1271}
1549 - libmailtools-perl 1.51
1550 [18 Sep 2003] DSA-385 hztty - buffer overflows
1551 {CAN-2003-0783}
1552 - hztty 2.0-6
1553 [17 Sep 2003] DSA-384 sendmail - buffer overflows
1554 {CAN-2003-0681 CAN-2003-0694}
1555 - sendmail 8.12.10-1
1556 [17 Sep 2003] DSA-383 ssh-krb5 - possible remote vulnerability
1557 {CAN-2003-0693}
1558 {CAN-2003-0695}
1559 {CAN-2003-0682}
1560 TODO: Screwy changelog does not make sense. Filed bug.
1561 [16 Sep 2003] DSA-382 ssh - possible remote vulnerability
1562 {CAN-2003-0693}
1563 - openssh 1:3.6.1p2-6.0
1564 {CAN-2003-0695}
1565 - openssh 1:3.7.1
1566 {CAN-2003-0682}
1567 - openssh 1:3.6.1p2-9
1568 [13 Sep 2003] DSA-381 mysql - buffer overflow
1569 {CAN-2003-0780}
1570 - mysql-dfsg 4.0.15-1
1571 [12 Sep 2003] DSA-380 xfree86 - buffer overflows, denial of service
1572 {CAN-2003-0063}
1573 - xfree86 4.2.1-11
1574 {CAN-2003-0071}
1575 - xfree86 4.2.1-11
1576 {CAN-2002-0164}
1577 - xfree86 4.2.1-11
1578 {CAN-2003-0730}
1579 - xfree86 4.2.1-12
1580 [11 Sep 2003] DSA-379 sane-backends - several vulnerabilities
1581 {CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778}
1582 - sane-backends 1.0.11-1
1583 [07 Sep 2003] DSA-378 mah-jong - buffer overflows, denial of service
1584 {CAN-2003-0705 CAN-2003-0706}
1585 - mah-jong 1.5.6-2
1586 [04 Sep 2003] DSA-377 wu-ftpd - insecure program execution
1587 {CVE-1999-0997}
1588 - wu-ftpd 2.6.2-15
1589 [04 Sep 2003] DSA-376 exim - buffer overflow
1590 {CAN-2003-0743}
1591 - exim 3.36-8
1592 [29 Aug 2003] DSA-375 node - buffer overflow, format string
1593 {CAN-2003-0707 CAN-2003-0708}
1594 - node 0.3.2-1
1595 [26 Aug 2003] DSA-374 libpam-smb - buffer overflow
1596 {CAN-2003-0686}
1597 NOTE: not in sid/sarge
1598 [16 Aug 2003] DSA-373 autorespond - buffer overflow
1599 {CAN-2003-0654}
1600 - autorespond 2.0.4-1
1601 [16 Aug 2003] DSA-372 netris - buffer overflow
1602 {CAN-2003-0685}
1603 - netris 0.52-1
1604 [11 Aug 2003] DSA-371 perl - cross-site scripting
1605 {CAN-2003-0615}
1606 - perl 5.8.0-19
1607 [08 Aug 2003] DSA-370 pam-pgsql - format string
1608 {CAN-2003-0672}
1609 - pam-pgsql 0.5.2-7
1610 [08 Aug 2003] DSA-369 zblast - buffer overflow
1611 {CAN-2003-0613}
1612 - zblast 1.2.1-7
1613 [08 Aug 2003] DSA-368 xpcd - buffer overflow
1614 {CAN-2003-0649}
1615 - xpcd 2.08-9
1616 [08 Aug 2003] DSA-367 xtokkaetama - buffer overflow
1617 {CAN-2003-0652}
1618 - xtokkaetama 1.0b-9
1619 [05 Aug 2003] DSA-366 eroaster - insecure temporary file
1620 {CAN-2003-0656}
1621 - eroaster 2.2.0-0.5-1
1622 [05 Aug 2003] DSA-365 phpgroupware - several vulnerabilities
1623 {CAN-2003-0504 CAN-2003-0599 CAN-2003-0657}
1624 - phpgroupware 0.9.14.007-1
1625 [04 Aug 2003] DSA-364 man-db - buffer overflows, arbitrary command execution
1626 {CAN-2003-0620 CAN-2003-0645}
1627 - man-db 2.4.1-13
1628 [03 Aug 2003] DSA-363 postfix - denial of service, bounce-scanning
1629 {CAN-2003-0468 CAN-2003-0540}
1630 - postfix 1.1.12
1631 [02 Aug 2003] DSA-362 mindi - insecure temporary file
1632 {CAN-2003-0617}
1633 - mindi 0.86-1
1634 [01 Aug 2003] DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities
1635 {CAN-2003-0459 CAN-2003-0370}
1636 - kdelibs 4:3.1.3-1
1637 [01 Aug 2003] DSA-360 xfstt - several vulnerabilities
1638 {CAN-2003-0581}
1639 - xfstt 1.5-1
1640 {CAN-2003-0625}
1641 - xfstt 1.5.1-1
1642 [31 Jul 2003] DSA-359 atari800 - buffer overflows
1643 {CAN-2003-0630}
1644 - atari800 1.3.1-2
1645 [31 Jul 2003] DSA-358 linux-kernel-2.4.18 - several vulnerabilities
1646 {CAN-2003-0461 CAN-2003-0462 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552 CAN-2003-0018 CAN-2003-0619 CAN-2003-0643}
1647 NOTE: 2.4.18/2.4.20 not in unstable/testing. Did not check newer ones.
1648 [31 Jul 2003] DSA-357 wu-ftpd - remote root exploit
1649 {CAN-2003-0466}
1650 - wu-ftpd 2.6.2-12
1651 [30 Jul 2003] DSA-356 xtokkaetama - buffer overflows
1652 {CAN-2003-0611}
1653 - xtokkaetama 1.0b-8
1654 [30 Jul 2003] DSA-355 gallery - cross-site scripting
1655 {CAN-2003-0614}
1656 - gallery 1.3.4-3
1657 [29 Jul 2003] DSA-354 xconq - buffer overflows
1658 {CAN-2003-0607}
1659 - xconq 7.4.1-2.1
1660 [29 Jul 2003] DSA-353 sup - insecure temporary file
1661 {CAN-2003-0606}
1662 - sup 1.8-9
1663 [22 Jul 2003] DSA-352 fdclone - insecure temporary directory
1664 {CAN-2003-0596}
1665 - fdclone 2.04-1
1666 [16 Jul 2003] DSA-351 php4 - cross-site scripting
1667 {CAN-2003-0442}
1668 - php4 4:4.3.2+rc3-1
1669 [15 Jul 2003] DSA-350 falconseye - buffer overflow
1670 {CAN-2003-0358}
1671 NOTE: not in testing, fixed in unstable
1672 - falconseye 1.9.3-9
1673 [14 Jul 2003] DSA-349 nfs-utils - buffer overflow
1674 {CAN-2003-0252}
1675 - nfs-utils 1:1.0.3-2
1676 [11 Jul 2003] DSA-348 traceroute-nanog - integer overflow, buffer overflow
1677 {CAN-2003-0453}
1678 - traceroute-nanog 6.1.1-1.3
1679 [08 Jul 2003] DSA-347 teapop - SQL injection
1680 {CAN-2003-0515}
1681 - teapop 0.3.5-2
1682 [08 Jul 2003] DSA-346 phpsysinfo - directory traversal
1683 {CAN-2003-0536}
1684 - phpsysinfo 2.1-1
1685 [08 Jul 2003] DSA-345 xbl - buffer overflow
1686 {CAN-2003-0535}
1687 - xbl 1.0k-6
1688 [08 Jul 2003] DSA-344 unzip - directory traversal
1689 {CAN-2003-0282}
1690 - unzip 5.50-3
1691 [08 Jul 2003] DSA-343 skk, ddskk - insecure temporary file
1692 {CAN-2003-0539}
1693 - skk 10.62a-6
1694 - ddskk 12.1.cvs.20030622-1
1695 [07 Jul 2003] DSA-342 mozart - unsafe mailcap configuration
1696 {CAN-2003-0538}
1697 NOTE: mozart is not in sarge
1698 - mozart 1.2.5.20030212-2
1699 [07 Jul 2003] DSA-341 liece - insecure temporary file
1700 {CAN-2003-0537}
1701 - liece 2.0+0.20030527cvs-1
1702 [06 Jul 2003] DSA-340 x-face-el - insecure temporary file
1703 - x-face-el 1.3.6.23-1
1704 [06 Jul 2003] DSA-339 semi - insecure temporary file
1705 {CAN-2003-0440}
1706 - semi 1.14.5+20030609-1
1707 [29 Jun 2003] DSA-338 proftpd - SQL injection
1708 {CAN-2003-0500}
1709 - proftpd 1.2.8-8
1710 [29 Jun 2003] DSA-337 gtksee - buffer overflow
1711 {CAN-2003-0444}
1712 ! gtksee 0.5.6-1
1713 [29 Jun 2003] DSA-336 linux-kernel-2.2.20 - several vulnerabilities
1714 {CAN-2002-1380 CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0364 CAN-2003-0246 CAN-2003-0244 CAN-2003-0247 CAN-2003-0248}
1715 - kernel-source-2.2.25 2.2.25-3
1716 NOTE: did not check newer kernels
1717 [28 Jun 2003] DSA-335 mantis - incorrect permissions
1718 {CAN-2003-0499}
1719 - mantis 0.17.5-6
1720 [28 Jun 2003] DSA-334 xgalaga - buffer overflows
1721 {CAN-2003-0454}
1722 - xgalaga 2.0.34-22
1723 [27 Jun 2003] DSA-333 acm - integer overflow
1724 {CVE-2002-0391}
1725 - acm 5.0-10
1726 [27 Jun 2003] DSA-332 linux-kernel-2.4.17 - several vulnerabilities
1727 {CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364}
1728 NOTE: note in the archive, and did not check newer kernels
1729 [27 Jun 2003] DSA-331 imagemagick - insecure temporary file
1730 {CAN-2003-0455}
1731 - imagemagick 4:5.5.7-1
1732 [23 Jun 2003] DSA-330 tcptraceroute - failure to drop root privileges
1733 {CAN-2003-0489}
1734 - tcptraceroute 1.4-4
1735 [20 Jun 2003] DSA-329 osh - buffer overflows
1736 {CAN-2003-0452}
1737 - osh 1.7-12
1738 [19 Jun 2003] DSA-328 webfs - buffer overflow
1739 {CAN-2003-0445}
1740 - webfs 1.20
1741 [19 Jun 2003] DSA-327 xbl - buffer overflows
1742 {CAN-2003-0451}
1743 - xbl 1.0k-5
1744 [19 Jun 2003] DSA-326 orville-write - buffer overflows
1745 {CAN-2003-0441}
1746 - orville-write 2.54-1
1747 [19 Jun 2003] DSA-325 eldav - insecure temporary file
1748 {CAN-2003-0438}
1749 - eldav 0.7.2-1
1750 [18 Jun 2003] DSA-324 ethereal - several vulnerabilities
1751 {CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432}
1752 - ethereal 0.9.13-1.
1753 [16 Jun 2003] DSA-323 noweb - insecure temporary files
1754 {CAN-2003-0381}
1755 - noweb 2.10c-2
1756 [16 Jun 2003] DSA-322 typespeed - buffer overflow
1757 {CAN-2003-0435}
1758 - typespeed 0.4.4
1759 [13 Jun 2003] DSA-321 radiusd-cistron - buffer overflow
1760 {CAN-2003-0450}
1761 - radiusd-cistron 1.6.6-2
1762 [13 Jun 2003] DSA-320 mikmod - buffer overflow
1763 {CAN-2003-0427}
1764 - mikmod 3.1.6-6
1765 [12 Jun 2003] DSA-319 webmin - session ID spoofing
1766 {CAN-2003-0101}
1767 - webmin 1.070-1
1768 [12 Jun 2003] DSA-318 lyskom-server - denial of service
1769 {CAN-2003-0366}
1770 - lyskom-server 2.0.7-2
1771 [11 Jun 2003] DSA-317 cupsys - denial of service
1772 {CAN-2003-0195}
1773 - cupsys 1.1.19final-1
1774 [11 Jun 2003] DSA-316 nethack - buffer overflow, incorrect permissions
1775 {CAN-2003-0358 CAN-2003-0359}
1776 - nethack 3.4.1-1
1777 - slashem 0.0.6E4F8-6
1778 - jnethack 1.1.5-15
1779 NOTE: DSA contains some strange non-nethack version numbers
1780 [11 Jun 2003] DSA-315 gnocatan - buffer overflows, denial of service
1781 {CAN-2003-0433}
1782 TODO: no mention of any security fixes in debian changelog,
1783 TODO: upstream changelog. Mailed maintainer.
1784 [11 Jun 2003] DSA-314 atftp - buffer overflow
1785 {CAN-2003-0380}
1786 - atftp 0.6.2
1787 [11 Jun 2003] DSA-313 ethereal - buffer overflows, integer overflows
1788 {CAN-2003-0356 CAN-2003-0357}
1789 - ethereal 0.9.12-1
1790 [09 Jun 2003] DSA-312 kernel-patch-2.4.18-powerpc - several vulnerabilities
1791 {CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248}
1792 NOTE: not in unstable/testing. Did not check other versions.
1793 [08 Jun 2003] DSA-311 linux-kernel-2.4.18 - several vulnerabilities
1794 {CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364}
1795 NOTE: not in unstable/testing. Did not check other versions.
1796 [08 Jun 2003] DSA-310 xaos - improper setuid-root execution
1797 {CAN-2003-0385}
1798 - xaos 3.1r-4
1799 [06 Jun 2003] DSA-309 eterm - buffer overflow
1800 {CAN-2003-0382}
1801 - eterm 0.9.2-1
1802 [06 Jun 2003] DSA-308 gzip - insecure temporary files
1803 {CVE-1999-1332 CAN-2003-0367}
1804 - gzip 1.3.5-6
1805 [27 May 2003] DSA-307 gps - multiple vulnerabilities
1806 {CAN-2003-0361 CAN-2003-0360 CAN-2003-0362}
1807 - gps 1.1.0-1
1808 [19 May 2003] DSA-306 ircii-pana - buffer overflows, integer overflow
1809 {CAN-2003-0321 CAN-2003-0322 CAN-2003-0328}
1810 - ircii-pana 1:1.0-0c19-8
1811 [15 May 2003] DSA-305 sendmail - insecure temporary files
1812 {CAN-2003-0308}
1813 - sendmail 8.12.9-2
1814 [15 May 2003] DSA-304 lv - privilege escalation
1815 {CAN-2003-0188}
1816 - lv 4.49.5-2
1817 [15 May 2003] DSA-303 mysql - privilege escalation
1818 {CAN-2003-0073}
1819 - mysql-dfsg 4.0.12-2
1820 {CAN-2003-0150}
1821 TODO: not sure if this is fixed
1822 [07 May 2003] DSA-302 fuzz - privilege escalation
1823 {CAN-2003-0261}
1824 - fuzz 0.6-7.1
1825 [07 May 2003] DSA-301 libgtop - buffer overflow
1826 {CAN-2001-0928}
1827 - libgtop 1.0.13-4
1828 [06 May 2003] DSA-300 balsa - buffer overflow
1829 {CAN-2003-0167}
1830 - balse 2.0.10
1831 [06 May 2003] DSA-299 leksbot - improper setuid-root execution
1832 {CAN-2003-0262}
1833 - lexbot 1.2-5
1834 [02 May 2003] DSA-298 epic4 - buffer overflows
1835 {CAN-2003-0323}
1836 - epic4 1:1.1.11.20030409-1
1837 [01 May 2003] DSA-297 snort - integer overflow, buffer overflow
1838 {CAN-2003-0033 CAN-2003-0209}
1839 - snort 2.0.0-1
1840 [30 Apr 2003] DSA-296 kdebase - insecure execution
1841 {CAN-2003-0204}
1842 - kdebase 4:3.1.0-1
1843 [30 Apr 2003] DSA-295 pptpd - buffer overflow
1844 {CAN-2003-0213}
1845 - pptpd 1.1.4-0.b3.2
1846 [23 Apr 2003] DSA-294 gkrellm-newsticker - missing quoting, incomplete parser
1847 {CAN-2003-0205 CAN-2003-0206}
1848 NOTE: not in unstable/testing
1849 [23 Apr 2003] DSA-293 kdelibs - insecure execution
1850 {CAN-2003-0204}
1851 - kdebase 4:3.1.0-1
1852 [22 Apr 2003] DSA-292 mime-support - insecure temporary file creation
1853 {CAN-2003-0214}
1854 - mime-support 3.23-1
1855 [22 Apr 2003] DSA-291 ircii - buffer overflows
1856 {CAN-2003-0323}
1857 - ircii 20030315-1
1858 [17 Apr 2003] DSA-290 sendmail-wide - char-to-int conversion
1859 {CAN-2003-0161}
1860 - sendmail-wide 8.12.9+3.5Wbeta-1
1861 [17 Apr 2003] DSA-289 rinetd - incorrect memory resizing
1862 {CAN-2003-0212}
1863 - rinetd 0.61-2
1864 [17 Apr 2003] DSA-288 openssl - several vulnerabilities
1865 {CAN-2003-0147 CAN-2003-0131}
1866 - openssl 0.9.7b-1
1867 - openssl096 0.9.6j-1
1868 [15 Apr 2003] DSA-287 epic - buffer overflows
1869 {CAN-2003-0324}
1870 - epic4 1:1.1.11.20030409-1
1871 [14 Apr 2003] DSA-286 gs-common - insecure temporary file
1872 {CAN-2003-0207}
1873 - gs-common 0.3.3.1
1874 [14 Apr 2003] DSA-285 lprng - insecure temporary file
1875 {CAN-2003-0136}
1876 - lprng 3.8.20-4.
1877 [12 Apr 2003] DSA-284 kdegraphics - insecure execution
1878 {CAN-2003-0204}
1879 - kdegraphics 4:3.1.0-1
1880 [11 Apr 2003] DSA-283 xfsdump - insecure file creation
1881 {CAN-2003-0173}
1882 - xfsdump 2.2.8-1
1883 [09 Apr 2003] DSA-282 glibc - integer overflow
1884 {CAN-2003-0028}
1885 - glibc 2.3.1-16
1886 [08 Apr 2003] DSA-281 moxftp - buffer overflow
1887 {CAN-2003-0203}
1888 - moxftp 2.2-18.20
1889 [07 Apr 2003] DSA-280 samba - buffer overflow
1890 {CAN-2003-0201 CAN-2003-0196}
1891 - samba 3.0
1892 [07 Apr 2003] DSA-279 metrics - insecure temporary file creation
1893 {CAN-2003-0202}
1894 NOTE: note in unstable/testing
1895 [04 Apr 2003] DSA-278 sendmail - char-to-int conversion
1896 {CAN-2003-0161}
1897 - sendmail 8.12.9-1
1898 [03 Apr 2003] DSA-277 apcupsd - buffer overflows, format string
1899 {CAN-2003-0098 CAN-2003-0099}
1900 - apcupsd 3.8.5-1.2
1901 [03 Apr 2003] DSA-276 linux-kernel-s390 - local privilege escalation
1902 {CAN-2003-0127}
1903 NOTE: this version is not in sarge, did not check others
1904 [02 Apr 2003] DSA-275 lpr-ppd - buffer overflow
1905 {CAN-2003-0144}
1906 - lpr-ppd 1:0.72-3
1907 [28 Mar 2003] DSA-274 mutt - buffer overflow
1908 {CAN-2003-0167}
1909 - mutt 1.4.0
1910 [28 Mar 2003] DSA-273 krb4 - Cryptographic weakness
1911 {CAN-2003-0138 CAN-2003-0139}
1912 - krb4 1.2.2-1
1913 [28 Mar 2003] DSA-272 dietlibc - integer overflow
1914 {CAN-2003-0028}
1915 - dietlibc 0.22-2
1916 [27 Mar 2003] DSA-271 ecartis - unauthorized password change
1917 {CAN-2003-0162}
1918 - ecartis 1.0.0+cvs.20030321-1
1919 [27 Mar 2003] DSA-270 linux-kernel-mips - local privilege escalation
1920 {CAN-2003-0127}
1921 NOTE: not in unstable/testing, did not check other versions
1922 [26 Mar 2003] DSA-269 heimdal - Cryptographic weakness
1923 {CAN-2003-0138}
1924 - heimdal 0.5.2-1
1925 [25 Mar 2003] DSA-268 mutt - buffer overflow
1926 {CAN-2003-0140}
1927 - mutt 1.5.4-1
1928 [24 Mar 2003] DSA-267 lpr - buffer overflow
1929 {CAN-2003-0144}
1930 - lpr 1:2000.05.07-4.20
1931 [24 Mar 2003] DSA-266 krb5 - several vulnerabilities
1932 {CAN-2003-0028}
1933 - krb5 1.3.3-2
1934 NOTE: changelog does not mention this one, verified patch from
1935 NOTE: Tom Yu was applied to this version.
1936 {CAN-2003-0072}
1937 - krb5 1.2.7-3
1938 NOTE: changelog does not mention this one, verified patch from
1939 NOTE: upstream was applied to this version.
1940 {CAN-2003-0082}
1941 - krb5 1.3.3-2
1942 {CAN-2003-0138 VU#623217}
1943 - krb5 1.2.7-3
1944 {CAN-2003-0139 VU#442569}
1945 - krb5 1.2.7-3
1946 [21 Mar 2003] DSA-265 bonsai - several vulnerabilities
1947 {CAN-2003-0152 CAN-2003-0153 CAN-2003-0154 CAN-2003-0155}
1948 - bonsai 1.3+cvs20030317-1
1949 [19 Mar 2003] DSA-264 lxr - missing filename sanitizing
1950 {CAN-2003-0156}
1951 - lxr 0.3-4
1952 [17 Mar 2003] DSA-263 netpbm-free - math overflow errors
1953 {CAN-2003-0146}
1954 - netpbm-free 2:9.20-9
1955 [15 Mar 2003] DSA-262 samba - remote exploit
1956 {CAN-2003-0085 CAN-2003-0086}
1957 - samba 2.2.8
1958 [14 Mar 2003] DSA-261 tcpdump - infinite loop
1959 {CAN-2003-0093 CAN-2003-0145}
1960 NOTE: DSA reports sid was not affected, sarge has sid version
1961 [13 Mar 2003] DSA-260 file - buffer overflow
1962 {CAN-2003-0102}
1963 - file 3.40-1.1
1964 [12 Mar 2003] DSA-259 qpopper - mail user privilege escalation
1965 {CAN-2003-0143}
1966 - qpopper 4.0.4-9
1967 [10 Mar 2003] DSA-258 ethereal - format string vulnerability
1968 {CAN-2003-0081}
1969 - ethereal 0.9.9-2
1970 [04 Mar 2003] DSA-257 sendmail - remote exploit
1971 {CAN-2002-1337}
1972 - sendmail 8.12.8
1973 [28 Feb 2003] DSA-256 mhc - insecure temporary file
1974 {CAN-2003-0120}
1975 - mhc 0.25+20030224-1
1976 [27 Feb 2003] DSA-255 tcpdump - infinite loop
1977 {CAN-2003-0108 CAN-2002-0380}
1978 - tcpdump 3.7.1-1.2
1979 [27 Feb 2003] DSA-254 traceroute-nanog - buffer overflow
1980 {CAN-2002-1051 CAN-2002-1364 CAN-2002-1386 CAN-2002-1387}
1981 - traceroute-nanog 6.3.0-1
1982 [24 Feb 2003] DSA-253 openssl - information leak
1983 {CAN-2003-0078}
1984 - openssl 0.9.7a-1
1985 [21 Feb 2003] DSA-252 slocate - buffer overflow
1986 {CAN-2003-0056}
1987 - slocate 2.7-1
1988 [14 Feb 2003] DSA-251 w3m - missing HTML quoting
1989 {CAN-2002-1335 CAN-2002-1348}
1990 - w3m 0.3.2.2-1
1991 [12 Feb 2003] DSA-250 w3mmee-ssl - missing HTML quoting
1992 {CAN-2002-1335 CAN-2002-1348}
1993 NOTE: not in sid/sarge
1994 [11 Feb 2003] DSA-249 w3mmee - missing HTML quoting
1995 {CAN-2002-1335 CAN-2002-1348}
1996 - w3mmee 0.3.p24.17-3
1997 [31 Jan 2003] DSA-248 hypermail - buffer overflows
1998 {CAN-2003-0057}
1999 - hypermail 2.1.6-1
2000 [30 Jan 2003] DSA-247 courier-ssl - missing input sanitizing
2001 {CAN-2003-0040}
2002 - courier 0.40.2-3
2003 [29 Jan 2003] DSA-246 tomcat - information exposure, cross site scripting
2004 {CAN-2003-0042 CAN-2003-0043 CAN-2003-0044}
2005 NOTE: tomcat not in sid/sarge
2006 NOTE: tomcat4 not affected
2007 [28 Jan 2003] DSA-245 dhcp3 - ignored counter boundary
2008 {CAN-2003-0039}
2009 - dhcp3 1.1.2-1
2010 [27 Jan 2003] DSA-244 noffle - buffer overflows
2011 {CAN-2003-0037}
2012 - noffle 1.1.2-1
2013 [24 Jan 2003] DSA-243 kdemultimedia - several vulnerabilities
2014 {CAN-2002-1393}
2015 - kdemultimedia 4:3.1
2016 [24 Jan 2003] DSA-242 kdebase - several vulnerabilities
2017 {CAN-2002-1393}
2018 - kdebase 4:3.1
2019 [24 Jan 2003] DSA-241 kdeutils - several vulnerabilities
2020 {CAN-2002-1393}
2021 - kdeutils 4:3.1
2022 [23 Jan 2003] DSA-240 kdegames - several vulnerabilities
2023 {CAN-2002-1393}
2024 - kdegames 4:3.1
2025 [23 Jan 2003] DSA-239 kdesdk - several vulnerabilities
2026 {CAN-2002-1393}
2027 - kdesdk 4:3.1
2028 [23 Jan 2003] DSA-238 kdepim - several vulnerabilities
2029 {CAN-2002-1393}
2030 - kdepim 4:3.1
2031 [22 Jan 2003] DSA-237 kdenetwork - several vulnerabilities
2032 {CAN-2002-1393}
2033 - kdenetwork 4:3.1
2034 [22 Jan 2003] DSA-236 kdelibs - several vulnerabilities
2035 {CAN-2002-1393}
2036 - kdelibs 4:3.1
2037 [22 Jan 2003] DSA-235 kdegraphics - several vulnerabilities
2038 {CAN-2002-1393}
2039 - kdegraphics 4:3.1
2040 [22 Jan 2003] DSA-234 kdeadmin - several vulnerabilities
2041 {CAN-2002-1393}
2042 - kdeadmin 4:3.1
2043 [21 Jan 2003] DSA-233 cvs - doubly freed memory
2044 {CAN-2003-0015}
2045 - cvs 1.11.2-5.1
2046 [20 Jan 2003] DSA-232 cupsys - several vulnerabilities
2047 {CAN-2002-1366 CAN-2002-1367 CAN-2002-1368 CAN-2002-1369 CAN-2002-1371 CAN-2002-1372 CAN-2002-1383 CAN-2002-1384}
2048 - cupsys 1.1.18-1
2049 [17 Jan 2003] DSA-231 dhcp3 - stack overflows
2050 {CAN-2003-0026}
2051 - dhcp3 3.0+3.0.1rc11-1
2052 [16 Jan 2003] DSA-230 bugzilla - insecure permissions, spurious backup files
2053 NOTE: not in testing due to 3 newer security holes
2054 {CAN-2003-0012}
2055 - bugzilla 2.16.2
2056 {CAN-2003-0013}
2057 - bugzilla 2.16.2
2058 [15 Jan 2003] DSA-229 imp - SQL injection
2059 {CAN-2003-0025}
2060 NOTE: I think imp3 is ok.
2061 [14 Jan 2003] DSA-228 libmcrypt - buffer overflows and memory leak
2062 {CAN-2003-0031 CAN-2003-0032}
2063 - libmcrypt 2.5.5-1
2064 [13 Jan 2003] DSA-227 openldap2 - buffer overflows and other bugs
2065 {CAN-2002-1378 CAN-2002-1379 CAN-2002-1508}
2066 - openldap2 2.0.27-3
2067 [10 Jan 2003] DSA-226 xpdf-i - integer overflow
2068 {CAN-2002-1384}
2069 - xpdf 2.01-2
2070 [09 Jan 2003] DSA-225 tomcat4 - source disclosure
2071 {CAN-2002-1394}
2072 ! tomcat4 4.1.16-1
2073 NOTE: another RC (unreproducible?) bug and missing deps (#263201)
2074 NOTE: are keeping the fix out of testing
2075 NOTE: this is the second unfixed security hole in tomcat4 in testing..
2076 [08 Jan 2003] DSA-224 canna - buffer overflow and more
2077 {CAN-2002-1158 CAN-2002-1159}
2078 - canna 3.6p1-1
2079 [07 Jan 2003] DSA-223 geneweb - information exposure
2080 {CAN-2002-1390}
2081 - geneweb 4.09-1
2082 [06 Jan 2003] DSA-222 xpdf - integer overflow
2083 {CAN-2002-1384}
2084 - xpdf 2.01-2
2085 [03 Jan 2003] DSA-221 mhonarc - cross site scripting
2086 {CAN-2002-1388}
2087 - mhonarc 2.5.14-1
2088 [02 Jan 2003] DSA-220 squirrelmail - cross site scripting
2089 {CAN-2002-1341}
2090 - squirrelmail 1:1.3.2-2
2091
2092 ------- These processed by Djoumé SALVETTI <salvetti@crans.org> -----
2093
2094 [31 Dec 2002] DSA-219 dhcpcd - remote command execution
2095 {CAN-2002-1403}
2096 - dhcpcd 1.3.22pl2-2
2097 [30 Dec 2002] DSA-218 bugzilla - cross site scripting
2098 NOTE: not in testing, fixed in unstable (bugzilla 2.16.2-1).
2099 [27 Dec 2002] DSA-217 typespeed - buffer overflow
2100 {CAN-2002-1389}
2101 - typespeed 0.4.2-2
2102 [24 Dec 2002] DSA-216 fetchmail - buffer overflow
2103 {CAN-2002-1365}
2104 - fetchmail 6.2.0-1
2105 [23 Dec 2002] DSA-215 cyrus-imapd - buffer overflow
2106 {CAN-2002-1580}
2107 - cyrus-imapd 1.5.19-9.10
2108 [20 Dec 2002] DSA-214 kdnetwork - buffer overflows
2109 {CAN-2002-1306}
2110 - kdenetwork 2.2.2-14.20
2111 NOTE: there is a typo in the DSA, the name of the package is kdenetwork.
2112 [19 Dec 2002] DSA-213 libpng - buffer overflow
2113 {CAN-2002-1363}
2114 - libpng 1.0.12-7
2115 - libpng3 1.2.5-8
2116 [17 Dec 2002] DSA-212 mysql - multiple problems
2117 {CAN-2002-1373 CAN-2002-1374 CAN-2002-1375 CAN-2002-1376}
2118 - mysql-dfsg 4.0.7.gamma-1
2119 [13 Dec 2002] DSA-211 micq - denial of service
2120 {CAN-2002-1362}
2121 NOTE: not in testing nor unstable (was fixed in 0.4.9.4-1)
2122 [13 Dec 2002] DSA-210 lynx - CRLF injection
2123 {CAN-2002-1405}
2124 - lynx 2.8.4.1b-4
2125 NOTE: lynx-ssl not in testing nor unstable.
2126 [12 Dec 2002] DSA-209 wget - directory traversal
2127 {CAN-2002-1344}
2128 - wget 1.8.2-8
2129 [12 Dec 2002] DSA-208 perl - broken safe compartment
2130 {CAN-2002-1323}
2131 - perl 5.8.0-14
2132 [11 Dec 2002] DSA-207 tetex-bin - arbitrary command execution
2133 {CAN-2002-0836}
2134 - tetex-bin 1.0.7+20021025-4
2135 [10 Dec 2002] DSA-206 tcpdump - denial of service
2136 {CAN-2002-1350}
2137 - tcpdump 3.7.2-1
2138 [10 Dec 2002] DSA-205 gtetrinet - buffer overflow
2139 - gtetrinet 0.4.4-1
2140 NOTE: no CAN not CVE for this one
2141 [05 Dec 2002] DSA-204 kdelibs - arbitrary program execution
2142 {CAN-2002-1281 CAN-2002-1282}
2143 - kdelibs 4:3.1.0-1
2144 [04 Dec 2002] DSA-203 smb2www - arbitrary command execution
2145 {CAN-2002-1342}
2146 - smb2www 980804-17
2147 [03 Dec 2002] DSA-202 im - insecure temporary files
2148 {CAN-2002-1395}
2149 - im 141-20
2150 [02 Dec 2002] DSA-201 freeswan - denial of service
2151 {CAN-2002-0666 VU#459371}
2152 - freeswan 1.99-1
2153 [22 Nov 2002] DSA-200 samba - remote exploit
2154 {CAN-2002-1318}
2155 - samba 2.99.cvs.20020713-1
2156 [19 Nov 2002] DSA-199 mhonarc - cross site scripting
2157 {CAN-2002-1307}
2158 - mhonarc 2.5.13-1
2159 [18 Nov 2002] DSA-198 nullmailer - denial of service
2160 {CAN-2002-1313}
2161 - nullmailer 1.00RC5-17
2162 [15 Nov 2002] DSA-197 courier - buffer overflow
2163 {CAN-2002-1311}
2164 - courier 0.40.0-1
2165 [14 Nov 2002] DSA-196 bind - several vulnerabilities
2166 {CAN-2002-0029 CAN-2002-1219 CAN-2002-1220 CAN-2002-1221}
2167 - bind 8.3.3-3
2168 [13 Nov 2002] DSA-195 apache-perl - several vulnerabilities
2169 {CAN-2002-0839 CAN-2002-0840 CAN-2002-0843 CAN-2001-0131 CAN-2002-1233}
2170 - apache-perl 1.3.26-1.1-1.27-3-1
2171 [12 Nov 2002] DSA-194 masqmail - buffer overflows
2172 {CAN-2002-1279}
2173 - masqmail 0.2.15-1
2174 [11 Nov 2002] DSA-193 kdenetwork - buffer overflow
2175 {CAN-2002-1247}
2176 - kdenetwok 2.2.2-14.3
2177 [08 Nov 2002] DSA-192 html2ps - arbitrary code execution
2178 {CAN-2002-1275}
2179 - html2ps 1.0b3-2
2180 [07 Nov 2002] DSA-191 squirrelmail - cross site scripting
2181 {CAN-2002-1131 CAN-2002-1132 CAN-2002-1276}
2182 - squirrelmail 1.2.8-1.1
2183 [07 Nov 2002] DSA-190 wmaker - buffer overflow
2184 {CAN-2002-1277}
2185 - wmaker 0.80.1-4
2186 [06 Nov 2002] DSA-189 luxman - local root exploit
2187 {CAN-2002-1245}
2188 - luxman 0.41-19
2189 [05 Nov 2002] DSA-188 apache-ssl - several vulnerabilities
2190 TODO: The DSA is for apache-ssl, but the bug entries are for apache.
2191 {CAN-2002-0839 CAN-2002-0840 CAN-2002-0843}
2192 - apache 1.3.27-0.1
2193 {CAN-2001-0131 CAN-2002-1233}
2194 - apache 1.3.27-1
2195 TODO: CAN-2002-0843 appears to be listed twice in this DSA
2196 TODO: (once with NO-CAN)
2197 [04 Nov 2002] DSA-187 apache - several vulnerabilities
2198 {CAN-2002-0839 CAN-2002-0840 CAN-2002-0843}
2199 - apache 1.3.27-0.1
2200 {CAN-2001-0131 CAN-2002-1233}
2201 - apache 1.3.27-1
2202 TODO: CAN-2002-0843 appears to be listed twice in this DSA
2203 TODO: (once with NO-CAN)
2204 [01 Nov 2002] DSA-186 log2mail - buffer overflow
2205 {CAN-2002-1251}
2206 - log2mail 0.2.6-1
2207 [31 Oct 2002] DSA-185 heimdal - buffer overflow
2208 {CAN-2002-1235}
2209 - heimdal 0.4e-22
2210 [30 Oct 2002] DSA-184 krb4 - buffer overflow
2211 {CAN-2002-1235}
2212 - krb4 1.1-11-8
2213 [29 Oct 2002] DSA-183 krb5 - buffer overflow
2214 {CAN-2002-1235}
2215 - krb5 1.2.6-2
2216 [28 Oct 2002] DSA-182 kdegraphics - buffer overflow
2217 {CAN-2002-0838}
2218 - kdegraphics 2.2.2-6.9
2219 [22 Oct 2002] DSA-181 libapache-mod-ssl - cross site scripting
2220 {CAN-2002-1157}
2221 - libapache-mod-ssl 2.8.9-2.3
2222 [21 Oct 2002] DSA-180 nis - information leak
2223 {CAN-2002-1232}
2224 - nis 3.9-6.2
2225 [18 Oct 2002] DSA-179 gnome-gv - buffer overflow
2226 {CAN-2002-0838}
2227 - gnome-gv 1.99.7-9
2228 [17 Oct 2002] DSA-178 heimdal - remote command execution
2229 {CAN-2002-1225 CAN-2002-1226}
2230 - heimdal 0.4e-21
2231 [17 Oct 2002] DSA-177 pam - serious security violation
2232 {CAN-2002-1227}
2233 - pam 0.76-6
2234 [16 Oct 2002] DSA-176 gv - buffer overflow
2235 {CAN-2002-0838}
2236 - gv 3.5.8-27
2237 [15 Oct 2002] DSA-175 syslog-ng - buffer overflow
2238 {CAN-2002-1200}
2239 - syslog-ng 1.5.21-1
2240 [14 Oct 2002] DSA-174 heartbeat - buffer overflow
2241 {CAN-2002-1215}
2242 - heartbeat 0.4.9.2-1
2243 [09 Oct 2002] DSA-173 bugzilla - privilege escalation
2244 {CAN-2002-1196}
2245 NOTE: not in testing, fixed in unstable (bugzilla 2.16.0-2.1)
2246 [08 Oct 2002] DSA-172 tkmail - insecure temporary files
2247 {CAN-2002-1193}
2248 NOTE: not in testing nor unstable (was fixed in 4.0beta9-9)
2249 [07 Oct 2002] DSA-171 fetchmail - buffer overflows
2250 {CAN-2002-1175 CAN-2002-1174}
2251 - fetchmail 6.1.0-1
2252 NOTE: fetchmail-ssl not in testing, fixed in unstable (fetchmail-ssl 6.1.0-1)
2253 [04 Oct 2002] DSA-170 tomcat4 - source code disclosure
2254 {CAN-2002-1148}
2255 ! tomcat4 4.1.12-1
2256 NOTE: only 4.0.4-4 in testing (which seems to be vulnerable)
2257 [25 Sep 2002] DSA-169 htcheck - cross site scripting
2258 {CAN-2002-1195}
2259 - htcheck 1.1-1.2
2260 [18 Sep 2002] DSA-168 php - bypassing safe_mode, CRLF injection
2261 {CAN-2002-0985 CAN-2002-0986}
2262 - php3 3.0.18-23.2
2263 - php4 4.2.3-3
2264 NOTE: php3 is not in testing, it seems to be wait for tiff and gcc transition
2265 NOTE: and is out of date on alpha and arm
2266 [16 Sep 2002] DSA-167 kdelibs - cross site scripting
2267 {CAN-2002-1151}
2268 - kdelibs 2.2.2-14
2269 NOTE: there is a typo in the DSA that mentionned Konquerer instead of kdelibs
2270 [13 Sep 2002] DSA-166 purity - buffer overflows
2271 {CAN-2002-1124}
2272 - purity 1-16
2273 [12 Sep 2002] DSA-165 postgresql - buffer overflows
2274 {CAN-2002-0972 CAN-2002-1398 CAN-2002-1400 CAN-2002-1401 CVE-2002-1402}
2275 - postgresql 7.2.2-2
2276 [10 Sep 2002] DSA-164 cacti - arbitrary code execution
2277 {CAN-2002-1477 CAN-2002-1478}
2278 - cacti 0.6.8a-2
2279 [09 Sep 2002] DSA-163 mhonarc - cross site scripting
2280 {CVE-2002-0738}
2281 - mhonarc 2.5.11-1
2282 [06 Sep 2002] DSA-162 ethereal - buffer overflow
2283 {CAN-2002-0834}
2284 - ethereal 0.9.6-1
2285 [04 Sep 2002] DSA-161 mantis - privilege escalation
2286 {CAN-2002-1115 CAN-2002-1116}
2287 - mantis 0.17.5-2
2288 [03 Sep 2002] DSA-160 scrollkeeper - insecure temporary file creation
2289 {CAN-2002-0662}
2290 - scrollkeeper 0.3.11-2
2291 [28 Aug 2002] DSA-159 python - insecure temporary files
2292 {CAN-2002-1119}
2293 - python2.1 2.1.3-6a
2294 - python2.2 2.2.1-8
2295 NOTE: python1.5 not in testing nor unstable (was fixed in 1.5.2-24)
2296 NOTE: python2.3 is not vulnerable
2297 [27 Aug 2002] DSA-158 gaim - arbitrary program execution
2298 {CVE-2002-0989}
2299 - gaim 0.59.1-2
2300 [23 Aug 2002] DSA-157 irssi-text - denial of service
2301 {CAN-2002-0983}
2302 - irssi-text 0.8.5-2
2303 [22 Aug 2002] DSA-156 epic4-script-light - arbitrary script execution
2304 {CVE-2002-0984}
2305 - epic4-script-light 2.7.30p5-2
2306 [17 Aug 2002] DSA-155 kdelibs - privacy escalation with Konqueror
2307 {CAN-2002-0970}
2308 - kdelibs 4:2.2.2-14
2309 [15 Aug 2002] DSA-154 fam - privilege escalation
2310 {CVE-2002-0875}
2311 - fam 2.6.8-1
2312 [14 Aug 2002] DSA-153 mantis - cross site code execution and privilege escalation
2313 {CAN-2002-1114 CAN-2002-1113 CAN-2002-1112 CAN-2002-1111 CAN-2002-1110}
2314 - mantis 0.17.4a-2
2315 [13 Aug 2002] DSA-152 l2tpd - missing random seed
2316 {CVE-2002-0872 CVE-2002-0873}
2317 NOTE: not in testing (was fixed in unstable 0.68-1)
2318 [13 Aug 2002] DSA-151 xinetd - pipe exposure
2319 {CVE-2002-0871}
2320 - xinetd 2.3.7-1
2321 [13 Aug 2002] DSA-150 interchange - illegal file exposition
2322 {CAN-2002-0874}
2323 - interchange 4.8.6-1
2324 [13 Aug 2002] DSA-149 glibc - integer overflow
2325 {CVE-2002-0391}
2326 - glibc 2.2.5-13
2327 [12 Aug 2002] DSA-148 hylafax - buffer overflows and format string vulnerabilities
2328 {CVE-2002-1049 CVE-2002-1050 CAN-2001-1034}
2329 - hylafax 4.1.2-2.1
2330 [08 Aug 2002] DSA-147 mailman - cross-site scripting
2331 {CAN-2002-0388 CAN-2002-0855}
2332 - mailman 2.0.12-1
2333 [08 Aug 2002] DSA-146 dietlibc - integer overflow
2334 {CVE-2002-0391}
2335 - dietlibc 0.20-0cvs20020808
2336 [07 Aug 2002] DSA-145 tinyproxy - doubly freed memory
2337 {CVE-2002-0847}
2338 - tinyproxy 1.4.3-3
2339 [06 Aug 2002] DSA-144 wwwoffle - improper input handling
2340 {CVE-2002-0818}
2341 - wwwoffle 2.7d-1
2342 [05 Aug 2002] DSA-143 krb5 - integer overflow
2343 {CVE-2002-0391}
2344 - krb5 1.2.5-2
2345 [05 Aug 2002] DSA-142 openafs - integer overflow
2346 {CVE-2002-0391}
2347 - openafs 1.2.6-1
2348 [01 Aug 2002] DSA-141 mpack - buffer overflow
2349 {CAN-2002-1425}
2350 - mpack 1.5-9
2351 [05 Aug 2002] DSA-140 libpng - buffer overflow
2352 {CAN-2002-0660 CAN-2002-0728}
2353 - libpng 1.0.12-4
2354 - libpng3 1.2.1-2
2355 [01 Aug 2002] DSA-139 super - format string vulnerability
2356 {CVE-2002-0817}
2357 - super 3.18.0-3
2358 [01 Aug 2002] DSA-138 gallery - remote exploit
2359 {CAN-2002-1412}
2360 - gallery 1.3-3
2361 [30 Jul 2002] DSA-137 mm - insecure temporary files
2362 {CVE-2002-0658}
2363 - mm 1.1.3-7
2364 [30 Jul 2002] DSA-136 openssl - multiple remote exploits
2365 {CAN-2002-0655 CAN-2002-0656 CAN-2002-0657 CAN-2002-0659}
2366 - openssl 0.9.6e-1
  ViewVC Help
Powered by ViewVC 1.1.5