| 1 |
[20 Jan 2005] DSA-651-1 squid - buffer overflow, integer overflow
|
| 2 |
{CAN-2005-0094 CAN-2005-0095}
|
| 3 |
- squid 2.5.7-4
|
| 4 |
NOTE: not fixed in testing at time of DSA
|
| 5 |
[20 Jan 2005] DSA-650-1 sword - missing input sanitising
|
| 6 |
{CAN-2005-0015}
|
| 7 |
- sword 1.5.7-7
|
| 8 |
NOTE: not fixed in testing at time of DSA
|
| 9 |
[20 Jan 2005] DSA-649-1 xtrlock - buffer overflow
|
| 10 |
{CAN-2005-0079}
|
| 11 |
- xtrlock 2.0-9
|
| 12 |
NOTE: fixed in testing at time of DSA
|
| 13 |
[19 Jan 2005] DSA-648-1 xpdf - buffer overflow
|
| 14 |
{CAN-2005-0064}
|
| 15 |
- xpdf 3.00-12
|
| 16 |
NOTE: not fixed in testing at time of DSA
|
| 17 |
[19 Jan 2005] DSA-647-1 mysql - insecure temporary files
|
| 18 |
{CAN-2005-0004}
|
| 19 |
- mysql-dfsg 4.0.23-3
|
| 20 |
- mysql-dfsg-4.1 4.1.8a-6
|
| 21 |
NOTE: not fixed in testing at time of DSA
|
| 22 |
[19 Jan 2005] DSA-646-1 imagemagick - buffer overflow
|
| 23 |
{CAN-2005-0005}
|
| 24 |
- imagemagick 6.0.6.2-2
|
| 25 |
NOTE: not fixed in testing at time of DSA
|
| 26 |
[19 Jan 2005] DSA-645-1 cupsys - buffer overflow
|
| 27 |
{CAN-2005-0064}
|
| 28 |
NOTE: cupsys not affected in sarge, though other programs are vulnerable
|
| 29 |
NOTE: see CAN/list
|
| 30 |
NOTE: not fixed in testing at time of DSA
|
| 31 |
[18 Jan 2005] DSA-644-1 chbg - buffer overflow
|
| 32 |
{CAN-2004-1264}
|
| 33 |
- chbg 1.5-4
|
| 34 |
NOTE: fixed in testing at time of DSA
|
| 35 |
[18 Jan 2005] DSA-643-1 queue - buffer overflows
|
| 36 |
{CAN-2004-0555}
|
| 37 |
- queue 1.30.1-5
|
| 38 |
NOTE: not fixed in testing at time of DSA
|
| 39 |
[17 Jan 2005] DSA-642-1 gallery - several
|
| 40 |
{CAN-2004-1106}
|
| 41 |
- gallery 1.4.4-pl4-1
|
| 42 |
NOTE: fixed in testing at time of DSA
|
| 43 |
[17 Jan 2005] DSA-641-1 playmidi - buffer overflow
|
| 44 |
{CAN-2005-0020}
|
| 45 |
- playmidi 2.4debian-3
|
| 46 |
NOTE: not fixed in testing at time of DSA
|
| 47 |
[17 Jan 2005] DSA-640-1 gatos - buffer overflow
|
| 48 |
{CAN-2005-0016}
|
| 49 |
- gatos 0.0.5-15
|
| 50 |
NOTE: not fixed in testing at time of DSA
|
| 51 |
[14 Jan 2005] DSA-639-1 mc - several
|
| 52 |
{CAN-2004-1004 CAN-2004-1005 CAN-2004-1009 CAN-2004-1090 CAN-2004-1091 CAN-2004-1092 CAN-2004-1093 CAN-2004-1174 CAN-2004-1175 CAN-2004-1176}
|
| 53 |
NOTE: unstable not vulnerable according to dsa
|
| 54 |
NOTE: fixed in testing at time of DSA
|
| 55 |
[13 Jan 2005] DSA-638-1 gopher - several
|
| 56 |
{CAN-2004-0560 CAN-2004-0561}
|
| 57 |
NOTE: not in sarge
|
| 58 |
[13 Jan 2005] DSA-637-1 exim-tls - buffer overflow
|
| 59 |
{CAN-2005-0021}
|
| 60 |
NOTE: not in sarge
|
| 61 |
[12 Jan 2005] DSA-636-1 glibc - insecure temporary files
|
| 62 |
{CAN-2004-0968}
|
| 63 |
- glibc 2.3.2.ds1-20
|
| 64 |
NOTE: fixed in testing at time of DSA
|
| 65 |
[12 Jan 2005] DSA-635-1 exim - buffer overflow
|
| 66 |
{CAN-2005-0021}
|
| 67 |
- exim4 4.34-10
|
| 68 |
NOTE: fixed in testing at time of DSA
|
| 69 |
- exim 3.36-13
|
| 70 |
NOTE: not fixed in testing at time of DSA
|
| 71 |
[11 Jan 2005] DSA-634-1 hylafax - weak hostname and username validation
|
| 72 |
{CAN-2004-1182}
|
| 73 |
- hylafax 4.2.1-1
|
| 74 |
NOTE: fixed in testing at time of DSA
|
| 75 |
[11 Jan 2005] DSA-633-1 bmv - insecure temporary file
|
| 76 |
{CAN-2003-0014}
|
| 77 |
- bmv 1.2-17
|
| 78 |
NOTE: fixed in testing at time of DSA
|
| 79 |
[10 Jan 2005] DSA-632-1 linpopup - buffer overflow
|
| 80 |
{CAN-2004-1282}
|
| 81 |
- linpopup 1.2.0-7
|
| 82 |
NOTE: fixed in testing at time of DSA
|
| 83 |
[10 Jan 2005] DSA-631-1 kdelibs - unsanitised input
|
| 84 |
{CAN-2004-1165}
|
| 85 |
- kdelibs 4:3.3.2-1
|
| 86 |
NOTE: not fixed in testing at time of DSA
|
| 87 |
[10 Jan 2005] DSA-630-1 lintian - insecure temporary directory
|
| 88 |
{CAN-2004-1000}
|
| 89 |
- lintian 1.23.6
|
| 90 |
NOTE: not fixed in testing at time of DSA
|
| 91 |
[07 Jan 2005] DSA-629-1 krb5 - buffer overflow
|
| 92 |
{CAN-2004-1189}
|
| 93 |
- krb5 1.3.6-1
|
| 94 |
NOTE: not fixed in testing at time of DSA
|
| 95 |
[06 Jan 2005] DSA-628-1 imlib2 - integer overflows
|
| 96 |
{CAN-2004-1026}
|
| 97 |
- imlib2 1.1.2-2.1
|
| 98 |
NOTE: not fixed in testing at time of DSA
|
| 99 |
[06 Jan 2005] DSA-627-1 namazu2 - unsanitised input
|
| 100 |
{CAN-2004-1318}
|
| 101 |
- namazu2 2.0.14-1
|
| 102 |
NOTE: not fixed in testing at time of DSA
|
| 103 |
[06 Jan 2005] DSA-626-1 tiff - unsanitised input
|
| 104 |
{CAN-2004-1183}
|
| 105 |
- libtiff4 3.6.1-5
|
| 106 |
NOTE: not fixed in testing at time of DSA
|
| 107 |
[05 Jan 2005] DSA-625-1 pcal - buffer overflows
|
| 108 |
{CAN-2004-1289}
|
| 109 |
- pcal 4.8.0-1
|
| 110 |
NOTE: not fixed in testing at time of DSA
|
| 111 |
[05 Jan 2005] DSA-624-1 zip - buffer overflow
|
| 112 |
{CAN-2004-1010}
|
| 113 |
- zip 2.30-8
|
| 114 |
NOTE: fixed in testing at time of DSA
|
| 115 |
[04 Jan 2005] DSA-623-1 nasm - buffer overflow
|
| 116 |
{CAN-2004-1287}
|
| 117 |
- nasm 0.98.38-1.1
|
| 118 |
[03 Jan 2005] DSA-622-1 htmlheadline - insecure temporary files
|
| 119 |
{CAN-2004-1181}
|
| 120 |
NOTE: not in unstable
|
| 121 |
[31 Dec 2004] DSA-621-1 cupsys - buffer overflow
|
| 122 |
{CAN-2004-1125}
|
| 123 |
- cupsys 1.1.22-2
|
| 124 |
[30 Dec 2004] DSA-620-1 perl - insecure temporary files / directories
|
| 125 |
{CAN-2004-0452 CAN-2004-0976}
|
| 126 |
- perl 5.8.4-5
|
| 127 |
[30 Dev 2004] DSA-619-1 xpdf - buffer overflow
|
| 128 |
{CAN-2004-1125}
|
| 129 |
- xpdf 3.00-11
|
| 130 |
[24 Dec 2004] DSA-618-1 imlib - buffer overflows, integer overflows
|
| 131 |
{CAN-2004-1025 CAN-2004-1026}
|
| 132 |
- imlib 1.9.14-17.1
|
| 133 |
- imlib-png2 1.9.14-16.1
|
| 134 |
[24 Dec 2004] DSA-617-1 libtiff - insufficient input validation
|
| 135 |
{CAN-2004-1308}
|
| 136 |
- libtiff4 3.6.1-4
|
| 137 |
[23 Dec 2004] DSA-616-1 telnetd-ssl - format string
|
| 138 |
{CAN-2004-0998}
|
| 139 |
- telnetd-ssl 0.17.24+0.1-6
|
| 140 |
[22 Dec 2004] DSA-615-1 debmake - insecure temporary file
|
| 141 |
{CAN-2004-1179}
|
| 142 |
- debmake 3.7.7
|
| 143 |
[21 Dec 2004] DSA-614-1 xzgv - integer overflows
|
| 144 |
{CAN-2004-0994}
|
| 145 |
- xzgv 0.8-3
|
| 146 |
[21 Dec 2004] DSA-613-1 ethereal - inifinite loop
|
| 147 |
{CAN-2004-114}
|
| 148 |
- ethereal 0.10.8-1
|
| 149 |
[21 Dec 2004] DSA-614-1 xzgv - integer overflows
|
| 150 |
{CAN-2004-0994}
|
| 151 |
- xzgv 0.8-3
|
| 152 |
[20 Dec 2004] DSA-612-1 a2ps - unsanitised input
|
| 153 |
{CAN-2004-1170}
|
| 154 |
- a2ps 4.13b-4.2
|
| 155 |
[20 Dec 2004] DSA-611-1 htget - buffer overflow
|
| 156 |
{CAN-2004-0852}
|
| 157 |
NOTE: htget not in sarge or unstable
|
| 158 |
[17 Dec 2004] DSA-610-1 cscope - insecure temporary file
|
| 159 |
{CAN-2004-0996}
|
| 160 |
- cscope 15.5-1
|
| 161 |
[14 Dec 2004] DSA-609-1 atari800 - buffer overflows
|
| 162 |
{CAN-2004-1076}
|
| 163 |
- atari800 1.3.2-1
|
| 164 |
[14 Dec 2004] DSA-608-1 zgv - integer overflows, unsanitised input
|
| 165 |
{CAN-2004-1095 CAN-2004-0999}
|
| 166 |
- zgv 5.7-1.3
|
| 167 |
NOTE: changelog says he only patched 1095, but diff comparison
|
| 168 |
NOTE: shows 0999 was also fixed.
|
| 169 |
[10 Dec 2004] DSA-607-1 xfree86 - several
|
| 170 |
{CAN-2004-0914}
|
| 171 |
- xfree86 4.3.0.dfsg.1-9
|
| 172 |
[08 Dec 2004] DSA-606-1 nfs-utils - wrong signal handler
|
| 173 |
{CAN-2004-1014}
|
| 174 |
- nfs-utils 1:1.0.6-3.1
|
| 175 |
[06 Dec 2004] DSA-605-1 viewcvs - settings not honored
|
| 176 |
{CAN-2004-0915}
|
| 177 |
- viewcvs 0.9.2+cvs.1.0.dev.2004.07.28-1.2
|
| 178 |
[03 Dec 2004] DSA-604-1 hpsockd - missing input sanitising
|
| 179 |
{CAN-2004-0993}
|
| 180 |
- hpsockd 0.14
|
| 181 |
[01 Dec 2004] DSA-603-1 openssl - insecure temporary file
|
| 182 |
{CAN-2004-0975}
|
| 183 |
- openssl 0.9.7e-1
|
| 184 |
[29 Nov 2004] DSA-602-1 libgd2 - integer overlow
|
| 185 |
{CAN-2004-0941 CAN-2004-0990}
|
| 186 |
NOTE: different from fixes from earlier DSA for these CANs; 2004-0941 new
|
| 187 |
- libgd2 2.0.33-1.1
|
| 188 |
[29 Nov 2004] DSA-601-1 libgd1 - integer overflow
|
| 189 |
{CAN-2004-0941 CAN-2004-0990}
|
| 190 |
NOTE: different from fixes from earlier DSA for these CANs; 2004-0941 new
|
| 191 |
- libgd 1.8.4-36.1
|
| 192 |
[25 Nov 2004] DSA-599-1 tetex-bin - integer overflows
|
| 193 |
{CAN-2004-0888}
|
| 194 |
- tetex-bin 2.0.2-23
|
| 195 |
[25 Nov 2004] DSA-598-1 yardradius - buffer overflow
|
| 196 |
{CAN-2004-0987}
|
| 197 |
- yardradius 1.0.20-15
|
| 198 |
[25 Nov 2004] DSA-597-1 cyrus-imapd - buffer overflow
|
| 199 |
{CAN-2004-1012 CAN-2004-1013}
|
| 200 |
- cyrus21-imapd 2.1.17-1
|
| 201 |
[24 Nov 2004] DSA-596-2 sudo - missing input sanitising
|
| 202 |
{CAN-2004-1051}
|
| 203 |
- sudo 1.6.8p3-1
|
| 204 |
[24 Nov 2004] DSA-596-1 sudo - missing input sanitising
|
| 205 |
{CAN-2004-1051}
|
| 206 |
- sudo 1.6.8p3-1
|
| 207 |
[24 Nov 2004] DSA-595-1 bnc - buffer overflow
|
| 208 |
{CAN-2004-1052}
|
| 209 |
NOTE: package not in sarge or sid
|
| 210 |
[17 Nov 2004] DSA-594-1 apache - buffer overflows
|
| 211 |
{CAN-2004-0940}
|
| 212 |
- apache 1.3.33-2
|
| 213 |
[16 Nov 2004] DSA-593-1 imagemagick - buffer overflow
|
| 214 |
{CAN-2004-0981}
|
| 215 |
- imagemagick 6:6.0.6.2-1.5
|
| 216 |
[12 Nov 2004] DSA-592-1 ez-ipupdate - format string
|
| 217 |
{CAN-2004-0980}
|
| 218 |
- ez-ipupdate 3.0.11b8-8
|
| 219 |
[09 Nov 2004] DSA-591-1 libgd2 - integer overflows
|
| 220 |
{CAN-2004-0990}
|
| 221 |
- libgd2 2.0.30-1
|
| 222 |
[09 Nov 2004] DSA-590-1 gnats - format string vulnerability
|
| 223 |
{CAN-2004-0623}
|
| 224 |
NOTE: DSA got version of fix for unstable wrong
|
| 225 |
- gnats 4.0-6.1
|
| 226 |
[09 Nov 2004] DSA-589-1 libgd - integer overflows
|
| 227 |
{CAN-2004-0990}
|
| 228 |
- libgd1 1.8.4-36.1
|
| 229 |
[08 Nov 2004] DSA-588-1 gzip - insecure temporary files
|
| 230 |
{CAN-2004-0970}
|
| 231 |
NOTE: dsa says sid not affected
|
| 232 |
[08 Nov 2004] DSA-587-1 freeamp - buffer overflow
|
| 233 |
{CAN-2004-0964}
|
| 234 |
NOTE: DSA says zinf not vulnerable in sarge
|
| 235 |
[08 Nov 2004] DSA-586-1 ruby - infinite loop
|
| 236 |
{CAN-2004-0983}
|
| 237 |
- ruby1.6 1.6.8-12
|
| 238 |
- ruby1.8 1.8.1+1.8.2pre2-4
|
| 239 |
[05 Nov 2004] DSA-585-1 shadow - programming error
|
| 240 |
{CAN-2004-1001}
|
| 241 |
- shadow 1:4.0.3-30.3
|
| 242 |
[04 Nov 2004] DSA-584-1 dhcp - format string vulnerability
|
| 243 |
{CAN-2004-1006}
|
| 244 |
- dhcp 2.0pl5-19.1
|
| 245 |
[03 Nov 2004] DSA-583-1 lvm10 - insecure temporary directory
|
| 246 |
{CAN-2004-0972}
|
| 247 |
[02 Nov 2004] DSA-582-1 libxml - buffer overflow
|
| 248 |
{CAN-2004-0989}
|
| 249 |
- libxml 1.8.17-9
|
| 250 |
- libxml2 2.6.11-5
|
| 251 |
[01 Nov 2004] DSA-581-1 xpdf - integer overflows
|
| 252 |
{CAN-2004-0888}
|
| 253 |
- xpdf 3.00-9
|
| 254 |
[01 Nov 2004] DSA-580-1 iptables - missing initialisation
|
| 255 |
{CAN-2004-0986}
|
| 256 |
- iptables 1.2.11-4
|
| 257 |
[01 Nov 2004] DSA-579-1 abiword - buffer overflow
|
| 258 |
{CAN-2004-0645}
|
| 259 |
NOTE: according to DSA, sid's abiword is not affected. sarge is same
|
| 260 |
[01 Nov 2004] DSA-578-1 mpg123 - buffer overflow
|
| 261 |
{CAN-2004-0982}
|
| 262 |
- mpg123 0.59r-17
|
| 263 |
[29 Oct 2004] DSA-577-1 postgresql - symlink vulnerability
|
| 264 |
{CAN-2004-0977}
|
| 265 |
- postgresql 7.4.6-1
|
| 266 |
[29 Oct 2004] DSA-576-1 squid - multiple
|
| 267 |
{CVE-1999-0710 CAN-2004-0918}
|
| 268 |
- squid 2.5.7-1
|
| 269 |
[28 Oct 2004] DSA-575-1 catdoc - insecure temporary file
|
| 270 |
{CAN-2003-0193}
|
| 271 |
- catdoc 0.91.5-2
|
| 272 |
[28 Oct 2004] DSA-574-1 cabextract - missing directory sanitising
|
| 273 |
{CAN-2004-0916}
|
| 274 |
- cabextract 1.1-1
|
| 275 |
[21 Oct 2004] DSA-573-1 cupsys - integer overflows
|
| 276 |
{CAN-2004-0888}
|
| 277 |
- cupsys 1.1.20final+rc1-10
|
| 278 |
{CAN-2004-0889}
|
| 279 |
- xpdf 3.00-10
|
| 280 |
TODO: kpdf and kfax not fixed in sarge, bug #278173 has a backported patch for the kpdf hole
|
| 281 |
- kpdf 4:3.3.1-1
|
| 282 |
- gpdf 2.8.0-1
|
| 283 |
- kfax 4:3.3.1-1
|
| 284 |
[21 Oct 2004] DSA-572-1 ecartis - multiple
|
| 285 |
{CAN-2004-0913}
|
| 286 |
- ecartis 1.0.0+cvs.20030911-8
|
| 287 |
[20 Oct 2004] DSA-571-1 libpng3 - buffer overflows, integer overflow
|
| 288 |
{CAN-2004-0955}
|
| 289 |
- libpng3 1.2.5.0-9
|
| 290 |
[20 Oct 2004] DSA-570-1 libpng - integer overflow
|
| 291 |
{CAN-2004-0955}
|
| 292 |
- libpng 1.0.15-8
|
| 293 |
[18 Oct 2004] DSA-569-1 netkit-telnet-ssl - invalid free(3)
|
| 294 |
{CAN-2004-0911}
|
| 295 |
- netkit-telnet-ssl 0.17.24+0.1-4
|
| 296 |
[16 Oct 2004] DSA-568-1 cyrus-sasl-mit - unsanitised input
|
| 297 |
{CAN-2004-0884}
|
| 298 |
NOTE removed from testing
|
| 299 |
NOTE maintainer reports hole not in cyrus-sasl2-mit
|
| 300 |
[15 Oct 2004] DSA-567-1 tiff - heap overflows
|
| 301 |
{CAN-2004-0803 CAN-2004-0804 CAN-2004-0886}
|
| 302 |
- tiff 3.6.1-2
|
| 303 |
- tiff3g 3.6.1-2
|
| 304 |
[14 Oct 2004] DSA-566-1 cupsys - unsanitised input
|
| 305 |
{CAN-2004-0923}
|
| 306 |
- cupsys 1.1.20final+rc1-9
|
| 307 |
[13 Oct 2004] DSA-565-1 sox - buffer overflows
|
| 308 |
{CAN-2004-0557}
|
| 309 |
- sox 12.17.4-9
|
| 310 |
[13 Oct 2004] DSA-564-1 mpg123 - missing user input sanitising
|
| 311 |
{CAN-2004-0805}
|
| 312 |
- mpg123 0.59r-16
|
| 313 |
[12 Oct 2004] DSA-563-1 cyrus-sasl - unsanitised input
|
| 314 |
{CAN-2004-0884}
|
| 315 |
- cyrus-sasl 1.5.28-6.2
|
| 316 |
- cyrus-sasl2 2.1.19-1.3
|
| 317 |
[11 Oct 2004] DSA-562-2 mysql - several vulnerabilities
|
| 318 |
{CAN-2004-0835 CAN-2004-0836 CAN-2004-0837}
|
| 319 |
- mysql 4.0.21-1
|
| 320 |
[11 Oct 2004] DSA-561-1 xfree86 - integer and stack overflows
|
| 321 |
{CAN-2004-0687 CAN-2004-0688}
|
| 322 |
- xfree86 4.3.0.dfsg.1-8
|
| 323 |
[07 Oct 2004] DSA-600-1 samba - arbitrary file access
|
| 324 |
{CAN-2004-0815}
|
| 325 |
NOTE: not affected according to DSA
|
| 326 |
[07 Oct 2004] DSA-560-1 lesstif1-1 - integer and stack overflows
|
| 327 |
{CAN-2004-0687 CAN-2004-0688}
|
| 328 |
- lesstif1-1 0.93.94-10
|
| 329 |
[06 Oct 2004] DSA-559-1 net-acct - insecure temporary file
|
| 330 |
{CAN-2004-0851}
|
| 331 |
- net-acct 0.71-7
|
| 332 |
[06 Oct 2004] DSA-558-1 libapache-mod-dav - null pointer dereference
|
| 333 |
{CAN-2004-0809}
|
| 334 |
- libapache-mod-dav 1.0.3-10
|
| 335 |
- apache2 2.0.51-1
|
| 336 |
[04 Oct 2004] DSA-557-1 pppoe - missing privilegue dropping
|
| 337 |
{CAN-2004-0564}
|
| 338 |
- pppoe 3.5-4
|
| 339 |
[03 Oct 2004] DSA-556-1 netkit-telnet - invalid free(3)
|
| 340 |
{CAN-2004-0911}
|
| 341 |
- netkit-telnet 0.17-26
|
| 342 |
[30 Sep 2004] DSA-555-1 freenet6 - file permissions
|
| 343 |
{CAN-2004-0563}
|
| 344 |
- freenet6 1.0-2.2
|
| 345 |
[27 Sep 2004] DSA-554-1 sendmail - pre-set password
|
| 346 |
{CAN-2004-0833}
|
| 347 |
- sendmail 8.13.1-13
|
| 348 |
[27 Sep 2004] DSA-553-1 getmail - symlink vulnerability
|
| 349 |
{CAN-2004-0880 CAN-2004-0881}
|
| 350 |
- getmail 3.2.5-1
|
| 351 |
[22 Sep 2004] DSA-552-1 imlib2 - unsanitised input
|
| 352 |
{CAN-2004-0802}
|
| 353 |
- imlib2 1.1.0-12.4
|
| 354 |
[21 Sep 2004] DSA-551-1 lukemftpd - incorrect internal variable handling
|
| 355 |
{CAN-2004-0794}
|
| 356 |
- lukemftpd 1.1-2.2
|
| 357 |
[20 Sep 2004] DSA-550-1 wv - buffer overflow
|
| 358 |
{CAN-2004-0645}
|
| 359 |
- wv 1.0.2-0.1
|
| 360 |
[17 Sep 2004] DSA-549-1 gtk+2.0 - multiple holes
|
| 361 |
{CAN-2004-0782 CAN-2004-0783 CAN-2004-0788}
|
| 362 |
- gtk+2.0 2.4.9-2
|
| 363 |
[16 Sep 2004] DSA-548-1 imlib - unsanitised input
|
| 364 |
{CAN-2004-0817}
|
| 365 |
- imlib 1.9.14-17
|
| 366 |
- imlib+png2 1.9.14-16.2
|
| 367 |
[16 Sep 2004] DSA-547-1 imagemagic - buffer overflows
|
| 368 |
{CAN-2004-0827}
|
| 369 |
- imagemagic 6.0.6.2-1
|
| 370 |
[16 Sep 2004] DSA-546-1 gdk-pixbuf - multiple holes
|
| 371 |
{CAN-2004-0753 CAN-2004-0782 CAN-2004-0788}
|
| 372 |
- gdk-pixbuf 0.22.0-7
|
| 373 |
[15 Sep 2004] DSA-545-1 cupsys - denial of service
|
| 374 |
{CAN-2004-0558}
|
| 375 |
- cupsys 1.1.20final+rc1-6
|
| 376 |
[14 Sep 2004] DSA-544-1 webmin - insecure temporary directory
|
| 377 |
{CAN-2004-0559}
|
| 378 |
- webmin 1.160-1
|
| 379 |
- usermin 1.090-1
|
| 380 |
[31 Aug 2004] DSA-543-1 krb5 -- several vulnerabilities
|
| 381 |
{CAN-2004-0642 CAN-2004-0643 CAN-2004-0644 CAN-2004-0772}
|
| 382 |
- krb5 1.3.4-3
|
| 383 |
[31 Aug 2004] DSA-458-2 python2.2 - buffer overflow
|
| 384 |
{CAN-2004-0150}
|
| 385 |
NOTE: not affected according to DSA
|
| 386 |
[30 Aug 2004] DSA-542-1 qt - unsanitised input
|
| 387 |
{CAN-2004-0691 CAN-2004-0692 CAN-2004-0693}
|
| 388 |
- qt-x11-free 3.3.3-4
|
| 389 |
[25 Aug 2004] DSA-541 icecast-server - cross site scripting
|
| 390 |
{CAN-2004-0781}
|
| 391 |
- icecast-server 1.3.12-8
|
| 392 |
[18 Aug 2004] DSA-540 mysql-dfsg - insecure file creation
|
| 393 |
{CAN-2004-0457}
|
| 394 |
- mysql-dfsg 4.0.20-11
|
| 395 |
[18 Aug 2004] DSA-539 kdelibs - denial of service
|
| 396 |
{CAN-2004-0689}
|
| 397 |
- kdelibs 4:3.2.3-3.sarge.1
|
| 398 |
[17 Aug 2004] DSA-538 rsync - unauthorised directory traversal and file access
|
| 399 |
- rsync 2.6.2-3
|
| 400 |
[16 Aug 2004] DSA-537 ruby - insecure file permissions
|
| 401 |
{CAN-2004-0755}
|
| 402 |
- ruby1.8 1.8.1+1.8.2pre1-4
|
| 403 |
HELP: is ruby1.6 vulnerable?
|
| 404 |
[04 Aug 2004] DSA-536 libpng - several vulnerabilities
|
| 405 |
{CAN-2004-0597 CAN-2004-0598 CAN-2004-0599 CAN-2004-0768}
|
| 406 |
- libpng 1.0.15-6
|
| 407 |
- libpng3 1.2.5.0-7
|
| 408 |
[02 Aug 2004] DSA-535 squirrelmail - several vulnerabilities
|
| 409 |
{CAN-2004-0519 CAN-2004-0520 CAN-2004-0521 CAN-2004-0639}
|
| 410 |
- squirrelmail 2:1.4.3a-0.1
|
| 411 |
[22 Jul 2004] DSA-534 mailreader - directory traversal
|
| 412 |
{CAN-2002-1581}
|
| 413 |
- mailreader 2.3.29-9
|
| 414 |
[22 Jul 2004] DSA-533 courier - cross-site scripting
|
| 415 |
{CAN-2004-0591}
|
| 416 |
- courier 0.45.4-4
|
| 417 |
[22 Jul 2004] DSA-532 libapache-mod-ssl - several vulnerabilities
|
| 418 |
{CAN-2004-0488 CAN-2004-0700}
|
| 419 |
- libapache-mod-ssl 2.8.19-1
|
| 420 |
[20 Jul 2004] DSA-531 php4 - several vulnerabilities
|
| 421 |
{CAN-2004-0594 CAN-2004-0595}
|
| 422 |
! php4 4:4.3.8-1
|
| 423 |
[17 Jul 2004] DSA-530 l2tpd - buffer overflow
|
| 424 |
{CAN-2004-0649}
|
| 425 |
- l2tpd 0.70-pre20031121-2
|
| 426 |
[17 Jul 2004] DSA-529 netkit-telnet-ssl - format string
|
| 427 |
{CAN-2004-0640}
|
| 428 |
! netkit-telnet-ssl 0.17.24+0.1-2
|
| 429 |
[17 Jul 2004] DSA-528 ethereal - denial of service
|
| 430 |
{CAN-2004-0635}
|
| 431 |
- ethereal 0.10.5-1
|
| 432 |
[03 Jul 2004] DSA-527 pavuk - buffer overflow
|
| 433 |
{CAN-2004-0456}
|
| 434 |
NOTE: DSA is incorrect; pavuk is in sarge and unstable.
|
| 435 |
! pavuk 0.9pl28-3
|
| 436 |
[03 Jul 2004] DSA-526 webmin - several vulnerabilities
|
| 437 |
{CAN-2004-0582 CAN-2004-0583}
|
| 438 |
- webmin 1.150-1
|
| 439 |
[24 Jun 2004] DSA-525 apache - buffer overflow
|
| 440 |
{CAN-2004-0492}
|
| 441 |
- apache 1.3.31-2
|
| 442 |
[19 Jun 2004] DSA-524 rlpr - several vulnerabilities
|
| 443 |
{CAN-2004-0393 CAN-2004-0454}
|
| 444 |
- rlpr 2.02-7.1
|
| 445 |
[19 Jun 2004] DSA-523 www-sql - buffer overflow
|
| 446 |
{CAN-2004-0455}
|
| 447 |
- www-sql 0.5.7-18
|
| 448 |
[19 Jun 2004] DSA-522 super - format string vulnerability
|
| 449 |
{CAN-2004-0579}
|
| 450 |
- super 3.23.0-1
|
| 451 |
[18 Jun 2004] DSA-521 sup - format string vulnerability
|
| 452 |
{CAN-2004-0451}
|
| 453 |
- sup 1.8-11
|
| 454 |
[16 Jun 2004] DSA-520 krb5 - buffer overflows
|
| 455 |
{CAN-2004-0523}
|
| 456 |
- krb5 1.3.3-2
|
| 457 |
[15 Jun 2004] DSA-519 cvs - several vulnerabilities
|
| 458 |
{CAN-2004-0416 CAN-2004-0417 CAN-2004-0418}
|
| 459 |
- cvs 1:1.12.9-1
|
| 460 |
[14 Jun 2004] DSA-518 kdelibs - unsanitised input
|
| 461 |
{CAN-2004-0411}
|
| 462 |
- kdelibs 3.2.3
|
| 463 |
[10 Jun 2004] DSA-517 cvs - buffer overflow
|
| 464 |
{CAN-2004-0414]
|
| 465 |
- cvs 1.12.9-1
|
| 466 |
[07 Jun 2004] DSA-516 postgresql - buffer overflow
|
| 467 |
{CAN-2004-0547}
|
| 468 |
- postgresql 07.03.0200-3.
|
| 469 |
[05 Jun 2004] DSA-515 lha - several vulnerabilities
|
| 470 |
{CAN-2004-0234 CAN-2004-0235}
|
| 471 |
! lha 1.14i-8
|
| 472 |
NOTE: If 1.14i-8 cannot get into testing, the fix for 1.14i-2.0.1
|
| 473 |
from the DSA could to updated via t-p-u.
|
| 474 |
[04 Jun 2004] DSA-514 kernel-image-sparc-2.2 - failing function and TLB flush
|
| 475 |
{CAN-2004-0077}
|
| 476 |
- kernel-image-sparc-2.2 9.1
|
| 477 |
NOTE: did not check other versions of the kernel
|
| 478 |
[03 Jun 2004] DSA-513 log2mail - format string
|
| 479 |
{CAN-2004-0450}
|
| 480 |
! log2mail 0.2.8-3
|
| 481 |
[02 Jun 2004] DSA-512 gallery - unauthenticated access
|
| 482 |
{CAN-2004-0522}
|
| 483 |
- gallery 1.4.3-pl2-1
|
| 484 |
[30 May 2004] DSA-511 ethereal - buffer overflows
|
| 485 |
{CAN-2004-0176
|
| 486 |
- ethereal 0.10.3-1
|
| 487 |
[29 May 2004] DSA-510 jftpgw - format string
|
| 488 |
{CAN-2004-0448}
|
| 489 |
- jftpgw 0.13.4-1
|
| 490 |
[29 May 2004] DSA-509 gatos - privilege escalation
|
| 491 |
{CAN-2004-0395}
|
| 492 |
- gatos 0.0.5-12
|
| 493 |
[22 May 2004] DSA-508 xpcd - buffer overflow
|
| 494 |
{CAN-2004-0402}
|
| 495 |
- xpcd 2.08-10
|
| 496 |
[19 May 2004] DSA-507 cadaver - buffer overflow
|
| 497 |
{CAN-2004-0398}
|
| 498 |
- cadaver 0.22.1-3
|
| 499 |
[19 May 2004] DSA-506 neon - buffer overflow
|
| 500 |
{CAN-2004-0398}
|
| 501 |
- neon 0.24.6.dfsg-1
|
| 502 |
[19 May 2004] DSA-505 cvs - heap overflow
|
| 503 |
{CAN-2004-0396}
|
| 504 |
- cvs 1.12.5-6
|
| 505 |
[18 May 2004] DSA-504 heimdal - missing input sanitising
|
| 506 |
{CAN-2004-0434}
|
| 507 |
- heimdal 0.6.2-1
|
| 508 |
[13 May 2004] DSA-503 mah-jong - missing argument check
|
| 509 |
{CAN-2004-0458}
|
| 510 |
- mah-jong 1.6.2-1
|
| 511 |
[11 May 2004] DSA-502 exim-tls - buffer overflow
|
| 512 |
{CAN-2004-0399 CAN-2004-0400}
|
| 513 |
NOTE: exim-tls not in sarge
|
| 514 |
[07 May 2004] DSA-501 exim - buffer overflow
|
| 515 |
{CAN-2004-0399 CAN-2004-0400}
|
| 516 |
- exim 3.36-11
|
| 517 |
- exim4 4.33-1
|
| 518 |
[01 May 2004] DSA-500 flim - insecure temporary file
|
| 519 |
{CAN-2004-0422}
|
| 520 |
- flim 1:1.14.6+0.20040415-1
|
| 521 |
[01 May 2004] DSA-499 rsync - directory traversal
|
| 522 |
{CAN-2004-0426}
|
| 523 |
- rsync 2.6.1-1
|
| 524 |
[30 Apr 2004] DSA-498 libpng - out of bound access
|
| 525 |
{CAN-2004-0421}
|
| 526 |
- libpng 1.0.15-5
|
| 527 |
- libpng3 1.2.5.0-6
|
| 528 |
[29 Apr 2004] DSA-497 mc - several vulnerabilities
|
| 529 |
{CAN-2004-0226 CAN-2004-0231 CAN-2004-0232}
|
| 530 |
- mc 1:4.6.0-4.6.1-pre1-2
|
| 531 |
[29 Apr 2004] DSA-496 eterm - missing input sanitising
|
| 532 |
{CAN-2003-0068}
|
| 533 |
- eterm 0.9.2-6
|
| 534 |
[26 Apr 2004] DSA-495 linux-kernel-2.4.16-arm - several vulnerabilities
|
| 535 |
{CAN-2003-0127 CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
|
| 536 |
NOTE: 2.4.16 not present. Did not check newer kernels.
|
| 537 |
[21 Apr 2004] DSA-494 ident2 - buffer overflow
|
| 538 |
{CAN-2004-0408}
|
| 539 |
- ident2 1.04-2
|
| 540 |
[21 Apr 2004] DSA-493 xchat - buffer overflow
|
| 541 |
{CAN-2004-0409}
|
| 542 |
- xchat 2.0.8-1
|
| 543 |
[18 Apr 2004] DSA-492 iproute - denial of service
|
| 544 |
{CAN-2003-0856}
|
| 545 |
- iproute 20010824-13.1
|
| 546 |
[17 Apr 2004] DSA-491 linux-kernel-2.4.19-mips - several vulnerabilities
|
| 547 |
{CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
|
| 548 |
NOTE: 2.4.19 not present. Did not check newer kernels.
|
| 549 |
[17 Apr 2004] DSA-490 zope - arbitrary code execution
|
| 550 |
{CVE-2002-0688}
|
| 551 |
- zope 2.6.0-0.1
|
| 552 |
[17 Apr 2004] DSA-489 linux-kernel-2.4.17-mips+mipsel - several vulnerabilities
|
| 553 |
{CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
|
| 554 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 555 |
[16 Apr 2004] DSA-488 logcheck - insecure temporary directory
|
| 556 |
{CAN-2004-0404}
|
| 557 |
- logcheck 1.1.1-13.2
|
| 558 |
[16 Apr 2004] DSA-487 neon - format string
|
| 559 |
{CAN-2004-0179}
|
| 560 |
- newo 0.24.5-1
|
| 561 |
[16 Apr 2004] DSA-486 cvs - several vulnerabilities
|
| 562 |
{CAN-2004-0180 CAN-2004-0405}
|
| 563 |
- cvs 1:1.12.5-4
|
| 564 |
[14 Apr 2004] DSA-485 ssmtp - format string
|
| 565 |
{CAN-2004-0156}
|
| 566 |
- ssmtp 2.60.7
|
| 567 |
[14 Apr 2004] DSA-484 xonix - failure to drop privileges
|
| 568 |
{CAN-2004-0157}
|
| 569 |
- xonix 1.4-21
|
| 570 |
[14 Apr 2004] DSA-483 mysql - insecure temporary file creation
|
| 571 |
{CAN-2004-0381}
|
| 572 |
- mysql-dfsg 4.0.18-4
|
| 573 |
{CAN-2004-0388}
|
| 574 |
! mysql-dfsg 4.0.18-6
|
| 575 |
[14 Apr 2004] DSA-482 linux-kernel-2.4.17-apus+s390 - several vulnerabilities
|
| 576 |
{CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
|
| 577 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 578 |
[14 Apr 2004] DSA-481 linux-kernel-2.4.17-ia64 - several vulnerabilities
|
| 579 |
{CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
|
| 580 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 581 |
[14 Apr 2004] DSA-480 linux-kernel-2.4.17+2.4.18-hppa - several vulnerabilities
|
| 582 |
{CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
|
| 583 |
NOTE: 2.4.17/18 not present. Did not check newer kernels.
|
| 584 |
[14 Apr 2004] DSA-479 linux-kernel-2.4.18-alpha+i386+powerpc - several vulnerabilities
|
| 585 |
{CAN-2004-0003 CAN-2004-0010 CAN-2004-0109 CAN-2004-0177 CAN-2004-0178}
|
| 586 |
NOTE: 2.4.18 not present. Did not check newer kernels.
|
| 587 |
[06 Apr 2004] DSA-478 tcpdump - denial of service
|
| 588 |
{CAN-2004-0183 CAN-2004-0184}
|
| 589 |
- tcpdump 3.7.2-4
|
| 590 |
[06 Apr 2004] DSA-477 xine-ui - insecure temporary file creation
|
| 591 |
{CAN-2004-0372}
|
| 592 |
- xine-ui 0.99.1-1
|
| 593 |
[06 Apr 2004] DSA-476 heimdal - cross-realm
|
| 594 |
{CAN-2004-0371}
|
| 595 |
- heimdal 0.6.1-1
|
| 596 |
[05 Apr 2004] DSA-475 linux-kernel-2.4.18-hppa - several vulnerabilities
|
| 597 |
{CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
|
| 598 |
NOTE: 2.4.18 not present. Did not check newer kernels.
|
| 599 |
[03 Apr 2004] DSA-474 squid - ACL bypass
|
| 600 |
{CAN-2004-0189}
|
| 601 |
- squid 2.5.5-1
|
| 602 |
[03 Apr 2004] DSA-473 oftpd - denial of service
|
| 603 |
{CAN-2004-0376}
|
| 604 |
- oftpd 20040304-1
|
| 605 |
[03 Apr 2004] DSA-472 fte - several vulnerabilities
|
| 606 |
{CAN-2003-0648}
|
| 607 |
- fte 0.50.0-1.1
|
| 608 |
[02 Apr 2004] DSA-471 interchange - missing input sanitising
|
| 609 |
{CAN-2004-0374}
|
| 610 |
- interchange 5.0.1-1
|
| 611 |
[01 Apr 2004] DSA-470 linux-kernel-2.4.17-hppa - several vulnerabilities
|
| 612 |
{CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
|
| 613 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 614 |
[29 Mar 2004] DSA-469 pam-pgsql - missing input sanitising
|
| 615 |
{CAN-2004-0366}
|
| 616 |
- pam-pgsql 0.5.2-7.1
|
| 617 |
[24 Mar 2004] DSA-468 emil - several vulnerabilities
|
| 618 |
{CAN-2004-0152 CAN-2004-0153}
|
| 619 |
- emil 2.1.0-beta9-14
|
| 620 |
[23 Mar 2004] DSA-467 ecartis - several vulnerabilities
|
| 621 |
{CAN-2003-0781 CAN-2003-0782}
|
| 622 |
- ecartis 1.0.0+cvs.20030911
|
| 623 |
[18 Mar 2004] DSA-466 linux-kernel-2.2.10-powerpc-apus - failing function and TLB flush
|
| 624 |
{CAN-2004-0077}
|
| 625 |
NOTE: 2.2.10 not present. Did not check newer kernels.
|
| 626 |
[17 Mar 2004] DSA-465 openssl - several vulnerabilities
|
| 627 |
{CAN-2004-0079 CAN-2004-0081}
|
| 628 |
- openssl 0.9.7d-1
|
| 629 |
NOTE: CAN-2004-0081 only affects 0.9.6.
|
| 630 |
NOTE: 0.9.7d also fixes CAN-2004-0112
|
| 631 |
- openssl 0.9.6l
|
| 632 |
- openssl096 0.9.6m-1
|
| 633 |
[16 Mar 2004] DSA-464 gdk-pixbuf - broken image handling
|
| 634 |
{CAN-2004-0111}
|
| 635 |
- gdk-pixbuf 0.22.0-3
|
| 636 |
[12 Mar 2004] DSA-463 samba - privilege escalation
|
| 637 |
{CAN-2004-0186}
|
| 638 |
- samba 3.0.2-2
|
| 639 |
[12 Mar 2004] DSA-462 xitalk - missing privilege release
|
| 640 |
{CAN-2004-0151}
|
| 641 |
- xitalk 1.1.11-11
|
| 642 |
[11 Mar 2004] DSA-461 calife - buffer overflow
|
| 643 |
{CAN-2004-0188}
|
| 644 |
- calife 2.8.6-1
|
| 645 |
[10 Mar 2004] DSA-460 sysstat - insecure temporary file
|
| 646 |
{CAN-2004-0108}
|
| 647 |
- sysstat 5.0.2-1
|
| 648 |
[10 Mar 2004] DSA-459 kdelibs - cookie path traversal
|
| 649 |
{CAN-2003-0592}
|
| 650 |
- kdelibs 4:3.1.3-1
|
| 651 |
[09 Mar 2004] DSA-458 python2.2 - buffer overflow
|
| 652 |
{CAN-2004-0150}
|
| 653 |
NOTE: not affected according to DSA
|
| 654 |
[08 Mar 2004] DSA-457 wu-ftpd - several vulnerabilities
|
| 655 |
{CAN-2004-0148 CAN-2004-0185}
|
| 656 |
- wu-ftpd 2.6.2-17.1
|
| 657 |
[06 Mar 2004] DSA-456 linux-kernel-2.2.19-arm - failing function and TLB flush
|
| 658 |
{CAN-2004-0077}
|
| 659 |
NOTE: 2.2.19 not present. Did not check newer kernels.
|
| 660 |
[03 Mar 2004] DSA-455 libxml - buffer overflows
|
| 661 |
{CAN-2004-0110}
|
| 662 |
- libxml 1.8.17-5
|
| 663 |
- libxml2 2.6.6-1
|
| 664 |
[02 Mar 2004] DSA-454 linux-kernel-2.2.22-alpha - failing function and TLB flush
|
| 665 |
{CAN-2004-0077}
|
| 666 |
NOTE: 2.2.22 not present. Did not check newer kernels.
|
| 667 |
[02 Mar 2004] DSA-453 linux-kernel-2.2.20-i386+m68k+powerpc - failing function and TLB flush
|
| 668 |
{CAN-2004-0077}
|
| 669 |
NOTE: 2.2.20 not present. Did not check newer kernels.
|
| 670 |
[29 Feb 2004] DSA-452 libapache-mod-python - denial of service
|
| 671 |
{CAN-2003-0973}
|
| 672 |
- libapache-mod-python 2:2.7.10-1
|
| 673 |
[27 Feb 2004] DSA-451 xboing - buffer overflows
|
| 674 |
{CAN-2004-0149}
|
| 675 |
- xboing 2.4-26.1
|
| 676 |
[27 Feb 2004] DSA-450 linux-kernel-2.4.19-mips - several vulnerabilities
|
| 677 |
{CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
|
| 678 |
NOTE: 2.4.19 not present. Did not check newer kernels.
|
| 679 |
[24 Feb 2004] DSA-449 metamail - buffer overflow, format string bugs
|
| 680 |
{CAN-2004-0104 CAN-2004-0105}
|
| 681 |
- metamail 2.7-45.2
|
| 682 |
[22 Feb 2004] DSA-448 pwlib - several vulnerabilities
|
| 683 |
{CAN-2004-0097}
|
| 684 |
- pwlib 1.5.2-4
|
| 685 |
[22 Feb 2004] DSA-447 hsftp - format string
|
| 686 |
{CAN-2004-0159}
|
| 687 |
! hsftp 1.15-1
|
| 688 |
[21 Feb 2004] DSA-446 synaesthesia - insecure file creation
|
| 689 |
{CAN-2004-0160}
|
| 690 |
DSA notes not setuid anymore so ok
|
| 691 |
[21 Feb 2004] DSA-445 lbreakout2 - buffer overflow
|
| 692 |
{CAN-2004-0158}
|
| 693 |
- lbreakout2 2.4
|
| 694 |
[20 Feb 2004] DSA-444 linux-kernel-2.4.17-ia64 - missing function return value check
|
| 695 |
{CAN-2004-0077}
|
| 696 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 697 |
[19 Feb 2004] DSA-443 xfree86 - several vulnerabilities
|
| 698 |
{CAN-2003-0690}
|
| 699 |
- xfree86 4.3.0-0pre1v2
|
| 700 |
{CAN-2004-0083 CAN-2004-0084 CAN-2004-0106}
|
| 701 |
- xfree86 4.3.0-1
|
| 702 |
{CAN-2004-0093 CAN-2004-0094}
|
| 703 |
- xfree86 4.2.1-6
|
| 704 |
[19 Feb 2004] DSA-442 linux-kernel-2.4.17-s390 - several vulnerabilities
|
| 705 |
{CAN-2003-0001 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364 CAN-2003-0961 CAN-2003-0985 CAN-2004-0077 CVE-2002-0429}
|
| 706 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 707 |
[18 Feb 2004] DSA-441 linux-kernel-2.4.17-mips+mipsel - missing function return value check
|
| 708 |
{CAN-2004-0077}
|
| 709 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 710 |
[18 Feb 2004] DSA-440 linux-kernel-2.4.17-powerpc-apus - several vulnerabilities
|
| 711 |
{CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
|
| 712 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 713 |
[18 Feb 2004] DSA-439 linux-kernel-2.4.16-arm - several vulnerabilities
|
| 714 |
{CAN-2003-0961 CAN-2003-0985 CAN-2004-0077}
|
| 715 |
NOTE: 2.4.16 not present. Did not check newer kernels.
|
| 716 |
[18 Feb 2004] DSA-438 linux-kernel-2.4.18-alpha+i386+powerpc - missing function return value check
|
| 717 |
{CAN-2004-0077}
|
| 718 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 719 |
[11 Feb 2004] DSA-437 cgiemail - open mail relay
|
| 720 |
{CAN-2002-1575}
|
| 721 |
- cgiemail 1.6-20
|
| 722 |
[08 Feb 2004] DSA-436 mailman - several vulnerabilities
|
| 723 |
{CAN-2003-0991}
|
| 724 |
NOTE: apparently specific to mailman 2.0, not 2.1
|
| 725 |
{CAN-2003-0965}
|
| 726 |
- mailman 2.1.4-1
|
| 727 |
{CAN-2003-0038}
|
| 728 |
- mailman 2.1.1-1
|
| 729 |
[06 Feb 2004] DSA-435 mpg123 - heap overflow
|
| 730 |
{CAN-2003-0865}
|
| 731 |
- mpg123 0.59r-15
|
| 732 |
[05 Feb 2004] DSA-434 gaim - several vulnerabilities
|
| 733 |
{CAN-2004-0005 CAN-2004-0006 CAN-2004-0007 CAN-2004-0008}
|
| 734 |
- gaim 1:0.75-2
|
| 735 |
[04 Feb 2004] DSA-433 kernel-patch-2.4.17-mips - integer overflow
|
| 736 |
{CAN-2003-0961}
|
| 737 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 738 |
[03 Feb 2004] DSA-432 crawl - buffer overflow
|
| 739 |
{CAN-2004-0103}
|
| 740 |
- crawl 4.0.0beta26-4
|
| 741 |
[01 Feb 2004] DSA-431 perl - information leak
|
| 742 |
{CAN-2003-0618}
|
| 743 |
- perl 5.8.3-3
|
| 744 |
[28 Jan 2004] DSA-430 trr19 - missing privilege release
|
| 745 |
{CAN-2004-0047}
|
| 746 |
- trr19 1.0beta5-17.1
|
| 747 |
[26 Jan 2004] DSA-429 gnupg - cryptographic weakness
|
| 748 |
{CAN-2003-0971}
|
| 749 |
- gnupg 1.2.4-1
|
| 750 |
[20 Jan 2004] DSA-428 slocate - buffer overflow
|
| 751 |
{CAN-2003-0848}
|
| 752 |
- slocate 2.7-3
|
| 753 |
[19 Jan 2004] DSA-427 linux-kernel-2.4.17-mips+mipsel - missing boundary check
|
| 754 |
{CAN-2003-0985}
|
| 755 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 756 |
[18 Jan 2004] DSA-426 netpbm-free - insecure temporary files
|
| 757 |
{CAN-2003-0924}
|
| 758 |
- netpbm-free 2:9.25-9
|
| 759 |
[16 Jan 2004] DSA-425 tcpdump - multiple vulnerabilities
|
| 760 |
{CAN-2003-1029 CAN-2003-0989 CAN-2004-0055 CAN-2004-0057}
|
| 761 |
HELP: No idea if this is fixed, we have a new upstream version
|
| 762 |
HELP: that came out after these advisories, but neither the debian nor
|
| 763 |
HELP: the upstream changelog seem to mention them.
|
| 764 |
NOTE: Mailed maintainer.
|
| 765 |
[16 Jan 2004] DSA-424 mc - buffer overflow
|
| 766 |
{CAN-2003-1023}
|
| 767 |
- mc 1:4.6.0-4.6.1-pre1-1
|
| 768 |
[15 Jan 2004] DSA-423 linux-kernel-2.4.17-ia64 - several vulnerabilities
|
| 769 |
{CAN-2003-0001 CAN-2003-0018 CAN-2003-0127 CAN-2003-0461 CAN-2003-0462 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552 CAN-2003-0961 CAN-2003-0985}
|
| 770 |
NOTE: 2.4.17 not present. Did not check newer kernels.
|
| 771 |
[13 Jan 2004] DSA-422 cvs - remote vulnerability
|
| 772 |
- cvs 1.11.11
|
| 773 |
[12 Jan 2004] DSA-421 mod-auth-shadow - password expiration
|
| 774 |
{CAN-2004-0041}
|
| 775 |
- mod-auth-shadow 1.4-1
|
| 776 |
[12 Jan 2004] DSA-420 jitterbug - improperly sanitised input
|
| 777 |
{CAN-2004-0028}
|
| 778 |
- jitterbug 1.6.2-4.5
|
| 779 |
[09 Jan 2004] DSA-419 phpgroupware - missing filename sanitising, SQL injection
|
| 780 |
{CAN-2004-0016 CAN-2004-0017}
|
| 781 |
- phpgroupware 0.9.14.007-4
|
| 782 |
[07 Jan 2004] DSA-418 vbox3 - privilege leak
|
| 783 |
{CAN-2004-0015}
|
| 784 |
- vbox3 0.1.8
|
| 785 |
[07 Jan 2004] DSA-417 linux-kernel-2.4.18-powerpc+alpha - missing boundary check
|
| 786 |
{CAN-2003-0961 CAN-2003-0985}
|
| 787 |
NOTE: 2.4.18 not present. Did not check newer kernels.
|
| 788 |
[06 Jan 2004] DSA-416 fsp - buffer overflow, directory traversal
|
| 789 |
{CAN-2003-1022 CAN-2004-0011}
|
| 790 |
- fsp 2.81.b18-1
|
| 791 |
[06 Jan 2004] DSA-415 zebra - denial of service
|
| 792 |
{CAN-2003-0795 CAN-2003-0858}
|
| 793 |
- quagga 0.96.4x-4
|
| 794 |
[06 Jan 2004] DSA-414 jabber - denial of service
|
| 795 |
{CAN-2004-0013}
|
| 796 |
- jabber 1.4.3-1
|
| 797 |
[06 Jan 2004] DSA-413 linux-kernel-2.4.18 - missing boundary check
|
| 798 |
{CAN-2003-0985}
|
| 799 |
NOTE: 2.4.18 not present. Did not check newer kernels.
|
| 800 |
[05 Jan 2004] DSA-412 nd - buffer overflows
|
| 801 |
{CAN-2004-0014}
|
| 802 |
- nd 0.8.2-1
|
| 803 |
[05 Jan 2004] DSA-411 mpg321 - format string vulnerability
|
| 804 |
{CAN-2003-0969}
|
| 805 |
- mpg321 0.2.10.3
|
| 806 |
[05 Jan 2004] DSA-410 libnids - buffer overflow
|
| 807 |
{CAN-2003-0850}
|
| 808 |
- libnids 1.18-1
|
| 809 |
[05 Jan 2004] DSA-409 bind - denial of service
|
| 810 |
{CAN-2003-0914}
|
| 811 |
- bind 1:8.4.3-1
|
| 812 |
[05 Jan 2004] DSA-408 screen - integer overflow
|
| 813 |
{CAN-2003-0972}
|
| 814 |
- screen 4.0.2-0.1
|
| 815 |
[05 Jan 2004] DSA-407 ethereal - buffer overflows
|
| 816 |
{CAN-2003-0925 CAN-2003-0926 CAN-2003-0927 CAN-2003-1012 CAN-2003-1013
|
| 817 |
- ethereal 0.10.0-1
|
| 818 |
[05 Jan 2004] DSA-406 lftp - buffer overflow
|
| 819 |
- lftp 2.6.10-1
|
| 820 |
[30 Dec 2003] DSA-405 xsok - missing privilege release
|
| 821 |
{CAN-2003-0949}
|
| 822 |
- xsok 1.02-11
|
| 823 |
[04 Dec 2003] DSA-404 rsync - heap overflow
|
| 824 |
{CAN-2003-0962}
|
| 825 |
- rsync 2.5.6-1.1
|
| 826 |
[01 Dec 2003] DSA-403 kernel-image-2.4.18-1-alpha, kernel-image-2.4.18-1-i386, kernel-source-2.4.18 - local root exploit
|
| 827 |
{CAN-2003-0961}
|
| 828 |
NOTE: 2.4.18 not present in sarge, did not check newer kernels.
|
| 829 |
[17 Nov 2003] DSA-402 minimalist - unsanitised input
|
| 830 |
{CAN-2003-0902}
|
| 831 |
- minimalist 2.4-1
|
| 832 |
[17 Nov 2003] DSA-401 hylafax - format strings
|
| 833 |
{CAN-2003-0886}
|
| 834 |
- hylafax 1:4.1.8-1
|
| 835 |
[11 Nov 2003] DSA-400 omega-rpg - buffer overflow
|
| 836 |
{CAN-2003-0932}
|
| 837 |
- omega-rpg 0.90-pa9-11
|
| 838 |
[10 Nov 2003] DSA-399 epic4 - buffer overflow
|
| 839 |
{CAN-2003-0328}
|
| 840 |
- epic4 1:1.1.11.20030409-2
|
| 841 |
[10 Nov 2003] DSA-398 conquest - buffer overflow
|
| 842 |
{CAN-2003-0933}
|
| 843 |
- conquest 7.2-5
|
| 844 |
[07 Nov 2003] DSA-397 postgresql - buffer overflow
|
| 845 |
{CAN-2003-0901}
|
| 846 |
- postgresql 7.3.4
|
| 847 |
[29 Oct 2003] DSA-396 thttpd - missing input sanitizing, wrong calculation
|
| 848 |
{CAN-2002-1562 CAN-2003-0899}
|
| 849 |
- thttpd 2.23beta1-2.3
|
| 850 |
[15 Oct 2003] DSA-395 tomcat4 - incorrect input handling
|
| 851 |
{CAN-2003-0866}
|
| 852 |
! tomcat4 4.1.24-2
|
| 853 |
NOTE another RC (unreproducible?) bug and missing deps (#263201)
|
| 854 |
NOTE are keeping the fix out of testing
|
| 855 |
[11 Oct 2003] DSA-394 openssl095 - ASN.1 parsing vulnerability
|
| 856 |
{CAN-2003-0543 CAN-2003-0544 CAN-2003-0545}
|
| 857 |
- openssl 0.9.7c
|
| 858 |
- openssl096 0.9.6k
|
| 859 |
[01 Oct 2003] DSA-393 openssl - denial of service
|
| 860 |
{CAN-2003-0543 CAN-2003-0544 CAN-2003-0545}
|
| 861 |
- openssl 0.9.7c
|
| 862 |
- openssl096 0.9.6k
|
| 863 |
[29 Sep 2003] DSA-392 webfs - buffer overflows, file and directory exposure
|
| 864 |
{CAN-2003-0832 CAN-2003-0833}
|
| 865 |
- webfs 1.20
|
| 866 |
[28 Sep 2003] DSA-391 freesweep - buffer overflow
|
| 867 |
{CAN-2003-0828}
|
| 868 |
- freesweep 0.88-4.1
|
| 869 |
[26 Sep 2003] DSA-390 marbles - buffer overflow
|
| 870 |
{CAN-2003-0830}
|
| 871 |
NOTE not present in sid, sarge
|
| 872 |
[20 Sep 2003] DSA-389 ipmasq - insecure packet filtering rules
|
| 873 |
{CAN-2003-0785}
|
| 874 |
- ipmasq 3.5.12
|
| 875 |
[19 Sep 2003] DSA-388 kdebase - several vulnerabilities
|
| 876 |
{CAN-2003-0690 CAN-2003-0692}
|
| 877 |
- kdebase 4:3.2
|
| 878 |
[18 Sep 2003] DSA-387 gopher - buffer overflows
|
| 879 |
{CAN-2003-0805}
|
| 880 |
- gopher 3.0.6
|
| 881 |
[18 Sep 2003] DSA-386 libmailtools-perl - input validation bug
|
| 882 |
{CAN-2002-1271}
|
| 883 |
- libmailtools-perl 1.51
|
| 884 |
[18 Sep 2003] DSA-385 hztty - buffer overflows
|
| 885 |
{CAN-2003-0783}
|
| 886 |
- hztty 2.0-6
|
| 887 |
[17 Sep 2003] DSA-384 sendmail - buffer overflows
|
| 888 |
{CAN-2003-0681 CAN-2003-0694}
|
| 889 |
- sendmail 8.12.10-1
|
| 890 |
[17 Sep 2003] DSA-383 ssh-krb5 - possible remote vulnerability
|
| 891 |
{CAN-2003-0693}
|
| 892 |
{CAN-2003-0695}
|
| 893 |
{CAN-2003-0682}
|
| 894 |
HELP: Screwy changelog does not make sense. Filed bug.
|
| 895 |
[16 Sep 2003] DSA-382 ssh - possible remote vulnerability
|
| 896 |
{CAN-2003-0693}
|
| 897 |
- openssh 1:3.6.1p2-6.0
|
| 898 |
{CAN-2003-0695}
|
| 899 |
- openssh 1:3.7.1
|
| 900 |
{CAN-2003-0682}
|
| 901 |
- openssh 1:3.6.1p2-9
|
| 902 |
[13 Sep 2003] DSA-381 mysql - buffer overflow
|
| 903 |
{CAN-2003-0780}
|
| 904 |
- mysql-dfsg 4.0.15-1
|
| 905 |
[12 Sep 2003] DSA-380 xfree86 - buffer overflows, denial of service
|
| 906 |
{CAN-2003-0063}
|
| 907 |
- xfree86 4.2.1-11
|
| 908 |
{CAN-2003-0071}
|
| 909 |
- xfree86 4.2.1-11
|
| 910 |
{CAN-2002-0164}
|
| 911 |
- xfree86 4.2.1-11
|
| 912 |
{CAN-2003-0730}
|
| 913 |
- xfree86 4.2.1-12
|
| 914 |
[11 Sep 2003] DSA-379 sane-backends - several vulnerabilities
|
| 915 |
{CAN-2003-0773 CAN-2003-0774 CAN-2003-0775 CAN-2003-0776 CAN-2003-0777 CAN-2003-0778}
|
| 916 |
- sane-backends 1.0.11-1
|
| 917 |
[07 Sep 2003] DSA-378 mah-jong - buffer overflows, denial of service
|
| 918 |
{CAN-2003-0705 CAN-2003-0706}
|
| 919 |
- mah-jong 1.5.6-2
|
| 920 |
[04 Sep 2003] DSA-377 wu-ftpd - insecure program execution
|
| 921 |
{CVE-1999-0997}
|
| 922 |
- wu-ftpd 2.6.2-15
|
| 923 |
[04 Sep 2003] DSA-376 exim - buffer overflow
|
| 924 |
{CAN-2003-0743}
|
| 925 |
- exim 3.36-8
|
| 926 |
[29 Aug 2003] DSA-375 node - buffer overflow, format string
|
| 927 |
{CAN-2003-0707 CAN-2003-0708}
|
| 928 |
- node 0.3.2-1
|
| 929 |
[26 Aug 2003] DSA-374 libpam-smb - buffer overflow
|
| 930 |
{CAN-2003-0686}
|
| 931 |
NOTE: not in sid/sarge
|
| 932 |
[16 Aug 2003] DSA-373 autorespond - buffer overflow
|
| 933 |
{CAN-2003-0654}
|
| 934 |
- autorespond 2.0.4-1
|
| 935 |
[16 Aug 2003] DSA-372 netris - buffer overflow
|
| 936 |
{CAN-2003-0685}
|
| 937 |
- netris 0.52-1
|
| 938 |
[11 Aug 2003] DSA-371 perl - cross-site scripting
|
| 939 |
{CAN-2003-0615}
|
| 940 |
- perl 5.8.0-19
|
| 941 |
[08 Aug 2003] DSA-370 pam-pgsql - format string
|
| 942 |
{CAN-2003-0672}
|
| 943 |
- pam-pgsql 0.5.2-7
|
| 944 |
[08 Aug 2003] DSA-369 zblast - buffer overflow
|
| 945 |
{CAN-2003-0613}
|
| 946 |
- zblast 1.2.1-7
|
| 947 |
[08 Aug 2003] DSA-368 xpcd - buffer overflow
|
| 948 |
{CAN-2003-0649}
|
| 949 |
- xpcd 2.08-9
|
| 950 |
[08 Aug 2003] DSA-367 xtokkaetama - buffer overflow
|
| 951 |
{CAN-2003-0652}
|
| 952 |
- xtokkaetama 1.0b-9
|
| 953 |
[05 Aug 2003] DSA-366 eroaster - insecure temporary file
|
| 954 |
{CAN-2003-0656}
|
| 955 |
- eroaster 2.2.0-0.5-1
|
| 956 |
[05 Aug 2003] DSA-365 phpgroupware - several vulnerabilities
|
| 957 |
{CAN-2003-0504 CAN-2003-0599 CAN-2003-0657}
|
| 958 |
- phpgroupware 0.9.14.007-1)
|
| 959 |
[04 Aug 2003] DSA-364 man-db - buffer overflows, arbitrary command execution
|
| 960 |
{CAN-2003-0620 CAN-2003-0645}
|
| 961 |
- man-db 2.4.1-13
|
| 962 |
[03 Aug 2003] DSA-363 postfix - denial of service, bounce-scanning
|
| 963 |
{CAN-2003-0468 CAN-2003-0540}
|
| 964 |
- postfix 1.1.12
|
| 965 |
[02 Aug 2003] DSA-362 mindi - insecure temporary file
|
| 966 |
{CAN-2003-0617}
|
| 967 |
- mindi 0.86-1
|
| 968 |
[01 Aug 2003] DSA-361 kdelibs, kdelibs-crypto - several vulnerabilities
|
| 969 |
{CAN-2003-0459 CAN-2003-0370}
|
| 970 |
- kdelibs 4:3.1.3-1
|
| 971 |
[01 Aug 2003] DSA-360 xfstt - several vulnerabilities
|
| 972 |
{CAN-2003-0581}
|
| 973 |
- xfstt 1.5-1
|
| 974 |
{CAN-2003-0625}
|
| 975 |
- xfstt 1.5.1-1
|
| 976 |
[31 Jul 2003] DSA-359 atari800 - buffer overflows
|
| 977 |
{CAN-2003-0630}
|
| 978 |
- atari800 1.3.1-2
|
| 979 |
[31 Jul 2003] DSA-358 linux-kernel-2.4.18 - several vulnerabilities
|
| 980 |
{CAN-2003-0461 CAN-2003-0462 CAN-2003-0476 CAN-2003-0501 CAN-2003-0550 CAN-2003-0551 CAN-2003-0552 CAN-2003-0018 CAN-2003-0619 CAN-2003-0643}
|
| 981 |
NOTE: 2.4.18/2.4.20 not in unstable/testing. Did not check newer ones.
|
| 982 |
[31 Jul 2003] DSA-357 wu-ftpd - remote root exploit
|
| 983 |
{CAN-2003-0466}
|
| 984 |
- wu-ftpd 2.6.2-12
|
| 985 |
[30 Jul 2003] DSA-356 xtokkaetama - buffer overflows
|
| 986 |
{CAN-2003-0611}
|
| 987 |
- xtokkaetama 1.0b-8
|
| 988 |
[30 Jul 2003] DSA-355 gallery - cross-site scripting
|
| 989 |
{CAN-2003-0614}
|
| 990 |
- gallery 1.3.4-3
|
| 991 |
[29 Jul 2003] DSA-354 xconq - buffer overflows
|
| 992 |
{CAN-2003-0607}
|
| 993 |
- xconq 7.4.1-2.1
|
| 994 |
[29 Jul 2003] DSA-353 sup - insecure temporary file
|
| 995 |
{CAN-2003-0606}
|
| 996 |
- sup 1.8-9
|
| 997 |
[22 Jul 2003] DSA-352 fdclone - insecure temporary directory
|
| 998 |
{CAN-2003-0596}
|
| 999 |
- fdclone 2.04-1
|
| 1000 |
[16 Jul 2003] DSA-351 php4 - cross-site scripting
|
| 1001 |
{CAN-2003-0442}
|
| 1002 |
- php4 4:4.3.2+rc3-1
|
| 1003 |
[15 Jul 2003] DSA-350 falconseye - buffer overflow
|
| 1004 |
{CAN-2003-0358}
|
| 1005 |
NOTE: not in testing, fixed in unstable
|
| 1006 |
- falconseye 1.9.3-9
|
| 1007 |
[14 Jul 2003] DSA-349 nfs-utils - buffer overflow
|
| 1008 |
{CAN-2003-0252}
|
| 1009 |
- nfs-utils 1:1.0.3-2
|
| 1010 |
[11 Jul 2003] DSA-348 traceroute-nanog - integer overflow, buffer overflow
|
| 1011 |
{CAN-2003-0453}
|
| 1012 |
- traceroute-nanog 6.1.1-1.3
|
| 1013 |
[08 Jul 2003] DSA-347 teapop - SQL injection
|
| 1014 |
{CAN-2003-0515}
|
| 1015 |
- teapop 0.3.5-2
|
| 1016 |
[08 Jul 2003] DSA-346 phpsysinfo - directory traversal
|
| 1017 |
{CAN-2003-0536}
|
| 1018 |
- phpsysinfo 2.1-1
|
| 1019 |
[08 Jul 2003] DSA-345 xbl - buffer overflow
|
| 1020 |
{CAN-2003-0535}
|
| 1021 |
- xbl 1.0k-6
|
| 1022 |
[08 Jul 2003] DSA-344 unzip - directory traversal
|
| 1023 |
{CAN-2003-0282}
|
| 1024 |
- unzip 5.50-3
|
| 1025 |
[08 Jul 2003] DSA-343 skk, ddskk - insecure temporary file
|
| 1026 |
{CAN-2003-0539}
|
| 1027 |
- skk 10.62a-6
|
| 1028 |
- ddskk 12.1.cvs.20030622-1
|
| 1029 |
[07 Jul 2003] DSA-342 mozart - unsafe mailcap configuration
|
| 1030 |
{CAN-2003-0538}
|
| 1031 |
NOTE: mozart is not in sarge
|
| 1032 |
- mozart 1.2.5.20030212-2
|
| 1033 |
[07 Jul 2003] DSA-341 liece - insecure temporary file
|
| 1034 |
{CAN-2003-0537}
|
| 1035 |
- liece 2.0+0.20030527cvs-1
|
| 1036 |
[06 Jul 2003] DSA-340 x-face-el - insecure temporary file
|
| 1037 |
- x-face-el 1.3.6.23-1
|
| 1038 |
[06 Jul 2003] DSA-339 semi - insecure temporary file
|
| 1039 |
{CAN-2003-0440}
|
| 1040 |
- semi 1.14.5+20030609-1
|
| 1041 |
[29 Jun 2003] DSA-338 proftpd - SQL injection
|
| 1042 |
{CAN-2003-0500}
|
| 1043 |
- proftpd 1.2.8-8
|
| 1044 |
[29 Jun 2003] DSA-337 gtksee - buffer overflow
|
| 1045 |
{CAN-2003-0444}
|
| 1046 |
! gtksee 0.5.6-1
|
| 1047 |
[29 Jun 2003] DSA-336 linux-kernel-2.2.20 - several vulnerabilities
|
| 1048 |
{CAN-2002-1380 CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0364 CAN-2003-0246 CAN-2003-0244 CAN-2003-0247 CAN-2003-0248}
|
| 1049 |
- kernel-source-2.2.25 2.2.25-3
|
| 1050 |
NOTE: did not check newer kernels
|
| 1051 |
[28 Jun 2003] DSA-335 mantis - incorrect permissions
|
| 1052 |
{CAN-2003-0499}
|
| 1053 |
- mantis 0.17.5-6
|
| 1054 |
[28 Jun 2003] DSA-334 xgalaga - buffer overflows
|
| 1055 |
{CAN-2003-0454}
|
| 1056 |
- xgalaga 2.0.34-22
|
| 1057 |
[27 Jun 2003] DSA-333 acm - integer overflow
|
| 1058 |
{CVE-2002-0391}
|
| 1059 |
- acm 5.0-10
|
| 1060 |
[27 Jun 2003] DSA-332 linux-kernel-2.4.17 - several vulnerabilities
|
| 1061 |
{CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364}
|
| 1062 |
NOTE: note in the archive, and did not check newer kernels
|
| 1063 |
[27 Jun 2003] DSA-331 imagemagick - insecure temporary file
|
| 1064 |
{CAN-2003-0455}
|
| 1065 |
- imagemagick 4:5.5.7-1
|
| 1066 |
[23 Jun 2003] DSA-330 tcptraceroute - failure to drop root privileges
|
| 1067 |
{CAN-2003-0489}
|
| 1068 |
- tcptraceroute 1.4-4
|
| 1069 |
[20 Jun 2003] DSA-329 osh - buffer overflows
|
| 1070 |
{CAN-2003-0452}
|
| 1071 |
- osh 1.7-12
|
| 1072 |
[19 Jun 2003] DSA-328 webfs - buffer overflow
|
| 1073 |
{CAN-2003-0445}
|
| 1074 |
- webfs 1.20
|
| 1075 |
[19 Jun 2003] DSA-327 xbl - buffer overflows
|
| 1076 |
{CAN-2003-0451}
|
| 1077 |
- xbl 1.0k-5
|
| 1078 |
[19 Jun 2003] DSA-326 orville-write - buffer overflows
|
| 1079 |
{CAN-2003-0441}
|
| 1080 |
- orville-write 2.54-1
|
| 1081 |
[19 Jun 2003] DSA-325 eldav - insecure temporary file
|
| 1082 |
{CAN-2003-0438}
|
| 1083 |
- eldav 0.7.2-1
|
| 1084 |
[18 Jun 2003] DSA-324 ethereal - several vulnerabilities
|
| 1085 |
{CAN-2003-0428 CAN-2003-0429 CAN-2003-0431 CAN-2003-0432}
|
| 1086 |
- ethereal 0.9.13-1.
|
| 1087 |
[16 Jun 2003] DSA-323 noweb - insecure temporary files
|
| 1088 |
{CAN-2003-0381}
|
| 1089 |
- noweb 2.10c-2
|
| 1090 |
[16 Jun 2003] DSA-322 typespeed - buffer overflow
|
| 1091 |
{CAN-2003-0435}
|
| 1092 |
- typespeed 0.4.4
|
| 1093 |
[13 Jun 2003] DSA-321 radiusd-cistron - buffer overflow
|
| 1094 |
{CAN-2003-0450}
|
| 1095 |
- radiusd-cistron 1.6.6-2
|
| 1096 |
[13 Jun 2003] DSA-320 mikmod - buffer overflow
|
| 1097 |
{CAN-2003-0427}
|
| 1098 |
- mikmod 3.1.6-6
|
| 1099 |
[12 Jun 2003] DSA-319 webmin - session ID spoofing
|
| 1100 |
{CAN-2003-0101}
|
| 1101 |
- webmin 1.070-1
|
| 1102 |
[12 Jun 2003] DSA-318 lyskom-server - denial of service
|
| 1103 |
{CAN-2003-0366}
|
| 1104 |
- lyskom-server 2.0.7-2
|
| 1105 |
[11 Jun 2003] DSA-317 cupsys - denial of service
|
| 1106 |
{CAN-2003-0195}
|
| 1107 |
- cupsys 1.1.19final-1
|
| 1108 |
[11 Jun 2003] DSA-316 nethack - buffer overflow, incorrect permissions
|
| 1109 |
{CAN-2003-0358 CAN-2003-0359}
|
| 1110 |
- nethack 3.4.1-1
|
| 1111 |
- slashem 0.0.6E4F8-6
|
| 1112 |
- jnethack 1.1.5-15
|
| 1113 |
NOTE: DSA contains some strange non-nethack version numbers
|
| 1114 |
[11 Jun 2003] DSA-315 gnocatan - buffer overflows, denial of service
|
| 1115 |
{CAN-2003-0433}
|
| 1116 |
HELP: no mention of any security fixes in debian changelog,
|
| 1117 |
HELP: upstream changelog. Mailed maintainer.
|
| 1118 |
[11 Jun 2003] DSA-314 atftp - buffer overflow
|
| 1119 |
{CAN-2003-0380}
|
| 1120 |
- atftp 0.6.2
|
| 1121 |
[11 Jun 2003] DSA-313 ethereal - buffer overflows, integer overflows
|
| 1122 |
{CAN-2003-0356 CAN-2003-0357}
|
| 1123 |
- ethereal 0.9.12-1
|
| 1124 |
[09 Jun 2003] DSA-312 kernel-patch-2.4.18-powerpc - several vulnerabilities
|
| 1125 |
{CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248}
|
| 1126 |
NOTE: not in unstable/testing. Did not check other versions.
|
| 1127 |
[08 Jun 2003] DSA-311 linux-kernel-2.4.18 - several vulnerabilities
|
| 1128 |
{CVE-2002-0429 CAN-2003-0001 CAN-2003-0127 CAN-2003-0244 CAN-2003-0246 CAN-2003-0247 CAN-2003-0248 CAN-2003-0364}
|
| 1129 |
NOTE: not in unstable/testing. Did not check other versions.
|
| 1130 |
[08 Jun 2003] DSA-310 xaos - improper setuid-root execution
|
| 1131 |
{CAN-2003-0385}
|
| 1132 |
- xaos 3.1r-4
|
| 1133 |
[06 Jun 2003] DSA-309 eterm - buffer overflow
|
| 1134 |
{CAN-2003-0382}
|
| 1135 |
- eterm 0.9.2-1
|
| 1136 |
[06 Jun 2003] DSA-308 gzip - insecure temporary files
|
| 1137 |
{CVE-1999-1332 CAN-2003-0367}
|
| 1138 |
- gzip 1.3.5-6
|
| 1139 |
[27 May 2003] DSA-307 gps - multiple vulnerabilities
|
| 1140 |
{CAN-2003-0361 CAN-2003-0360 CAN-2003-0362}
|
| 1141 |
- gps 1.1.0-1
|
| 1142 |
[19 May 2003] DSA-306 ircii-pana - buffer overflows, integer overflow
|
| 1143 |
{CAN-2003-0321 CAN-2003-0322 CAN-2003-0328}
|
| 1144 |
- ircii-pana 1:1.0-0c19-8
|
| 1145 |
[15 May 2003] DSA-305 sendmail - insecure temporary files
|
| 1146 |
{CAN-2003-0308}
|
| 1147 |
- sendmail 8.12.9-2
|
| 1148 |
[15 May 2003] DSA-304 lv - privilege escalation
|
| 1149 |
{CAN-2003-0188}
|
| 1150 |
- lv 4.49.5-2
|
| 1151 |
[15 May 2003] DSA-303 mysql - privilege escalation
|
| 1152 |
{CAN-2003-0073}
|
| 1153 |
- mysql-dfsg 4.0.12-2
|
| 1154 |
{CAN-2003-0150}
|
| 1155 |
HELP: not sure if this is fixed
|
| 1156 |
[07 May 2003] DSA-302 fuzz - privilege escalation
|
| 1157 |
{CAN-2003-0261}
|
| 1158 |
- fuzz 0.6-7.1
|
| 1159 |
[07 May 2003] DSA-301 libgtop - buffer overflow
|
| 1160 |
{CAN-2001-0928}
|
| 1161 |
- libgtop 1.0.13-4
|
| 1162 |
[06 May 2003] DSA-300 balsa - buffer overflow
|
| 1163 |
{CAN-2003-0167}
|
| 1164 |
- balse 2.0.10
|
| 1165 |
[06 May 2003] DSA-299 leksbot - improper setuid-root execution
|
| 1166 |
{CAN-2003-0262}
|
| 1167 |
- lexbot 1.2-5
|
| 1168 |
[02 May 2003] DSA-298 epic4 - buffer overflows
|
| 1169 |
{CAN-2003-0323}
|
| 1170 |
- epic4 1:1.1.11.20030409-1
|
| 1171 |
[01 May 2003] DSA-297 snort - integer overflow, buffer overflow
|
| 1172 |
{CAN-2003-0033 CAN-2003-0209}
|
| 1173 |
- snort 2.0.0-1
|
| 1174 |
[30 Apr 2003] DSA-296 kdebase - insecure execution
|
| 1175 |
{CAN-2003-0204}
|
| 1176 |
- kdebase 4:3.1.0-1
|
| 1177 |
[30 Apr 2003] DSA-295 pptpd - buffer overflow
|
| 1178 |
{CAN-2003-0213}
|
| 1179 |
- pptpd 1.1.4-0.b3.2
|
| 1180 |
[23 Apr 2003] DSA-294 gkrellm-newsticker - missing quoting, incomplete parser
|
| 1181 |
{CAN-2003-0205 CAN-2003-0206}
|
| 1182 |
NOTE: not in unstable/testing
|
| 1183 |
[23 Apr 2003] DSA-293 kdelibs - insecure execution
|
| 1184 |
{CAN-2003-0204}
|
| 1185 |
- kdebase 4:3.1.0-1
|
| 1186 |
[22 Apr 2003] DSA-292 mime-support - insecure temporary file creation
|
| 1187 |
{CAN-2003-0214}
|
| 1188 |
- mime-support 3.23-1
|
| 1189 |
[22 Apr 2003] DSA-291 ircii - buffer overflows
|
| 1190 |
{CAN-2003-0323}
|
| 1191 |
- ircii 20030315-1
|
| 1192 |
[17 Apr 2003] DSA-290 sendmail-wide - char-to-int conversion
|
| 1193 |
{CAN-2003-0161}
|
| 1194 |
- sendmail-wide 8.12.9+3.5Wbeta-1
|
| 1195 |
[17 Apr 2003] DSA-289 rinetd - incorrect memory resizing
|
| 1196 |
{CAN-2003-0212}
|
| 1197 |
- rinetd 0.61-2
|
| 1198 |
[17 Apr 2003] DSA-288 openssl - several vulnerabilities
|
| 1199 |
{CAN-2003-0147 CAN-2003-0131}
|
| 1200 |
- openssl 0.9.7b-1
|
| 1201 |
- openssl096 0.9.6j-1
|
| 1202 |
[15 Apr 2003] DSA-287 epic - buffer overflows
|
| 1203 |
{CAN-2003-0324}
|
| 1204 |
- epic4 1:1.1.11.20030409-1
|
| 1205 |
[14 Apr 2003] DSA-286 gs-common - insecure temporary file
|
| 1206 |
{CAN-2003-0207}
|
| 1207 |
- gs-common 0.3.3.1
|
| 1208 |
[14 Apr 2003] DSA-285 lprng - insecure temporary file
|
| 1209 |
{CAN-2003-0136}
|
| 1210 |
- lprng 3.8.20-4.
|
| 1211 |
[12 Apr 2003] DSA-284 kdegraphics - insecure execution
|
| 1212 |
{CAN-2003-0204}
|
| 1213 |
- kdegraphics 4:3.1.0-1
|
| 1214 |
[11 Apr 2003] DSA-283 xfsdump - insecure file creation
|
| 1215 |
{CAN-2003-0173}
|
| 1216 |
- xfsdump 2.2.8-1
|
| 1217 |
[09 Apr 2003] DSA-282 glibc - integer overflow
|
| 1218 |
{CAN-2003-0028}
|
| 1219 |
- glibc 2.3.1-16
|
| 1220 |
[08 Apr 2003] DSA-281 moxftp - buffer overflow
|
| 1221 |
{CAN-2003-0203}
|
| 1222 |
- moxftp 2.2-18.20
|
| 1223 |
[07 Apr 2003] DSA-280 samba - buffer overflow
|
| 1224 |
{CAN-2003-0201 CAN-2003-0196}
|
| 1225 |
- samba 3.0
|
| 1226 |
[07 Apr 2003] DSA-279 metrics - insecure temporary file creation
|
| 1227 |
{CAN-2003-0202}
|
| 1228 |
NOTE: note in unstable/testing
|
| 1229 |
[04 Apr 2003] DSA-278 sendmail - char-to-int conversion
|
| 1230 |
{CAN-2003-0161}
|
| 1231 |
- sendmail 8.12.9-1
|
| 1232 |
[03 Apr 2003] DSA-277 apcupsd - buffer overflows, format string
|
| 1233 |
{CAN-2003-0098 CAN-2003-0099}
|
| 1234 |
- apcupsd 3.8.5-1.2
|
| 1235 |
[03 Apr 2003] DSA-276 linux-kernel-s390 - local privilege escalation
|
| 1236 |
{CAN-2003-0127}
|
| 1237 |
NOTE: this version is not in sarge, did not check others
|
| 1238 |
[02 Apr 2003] DSA-275 lpr-ppd - buffer overflow
|
| 1239 |
{CAN-2003-0144}
|
| 1240 |
- lpr-ppd 1:0.72-3
|
| 1241 |
[28 Mar 2003] DSA-274 mutt - buffer overflow
|
| 1242 |
{CAN-2003-0167}
|
| 1243 |
- mutt 1.4.0
|
| 1244 |
[28 Mar 2003] DSA-273 krb4 - Cryptographic weakness
|
| 1245 |
{CAN-2003-0138 CAN-2003-0139}
|
| 1246 |
- krb4 1.2.2-1
|
| 1247 |
[28 Mar 2003] DSA-272 dietlibc - integer overflow
|
| 1248 |
{CAN-2003-0028}
|
| 1249 |
- dietlibc 0.22-2
|
| 1250 |
[27 Mar 2003] DSA-271 ecartis - unauthorized password change
|
| 1251 |
{CAN-2003-0162}
|
| 1252 |
- ecartis 1.0.0+cvs.20030321-1
|
| 1253 |
[27 Mar 2003] DSA-270 linux-kernel-mips - local privilege escalation
|
| 1254 |
{CAN-2003-0127}
|
| 1255 |
NOTE: not in unstable/testing, did not check other versions
|
| 1256 |
[26 Mar 2003] DSA-269 heimdal - Cryptographic weakness
|
| 1257 |
{CAN-2003-0138}
|
| 1258 |
- heimdal 0.5.2-1
|
| 1259 |
[25 Mar 2003] DSA-268 mutt - buffer overflow
|
| 1260 |
{CAN-2003-0140}
|
| 1261 |
- mutt 1.5.4-1
|
| 1262 |
[24 Mar 2003] DSA-267 lpr - buffer overflow
|
| 1263 |
{CAN-2003-0144}
|
| 1264 |
- lpr 1:2000.05.07-4.20
|
| 1265 |
[24 Mar 2003] DSA-266 krb5 - several vulnerabilities
|
| 1266 |
{CAN-2003-0028}
|
| 1267 |
- krb5 1.3.3-2
|
| 1268 |
NOTE: changelog does not mention this one, verified patch from
|
| 1269 |
NOTE: Tom Yu was applied to this version.
|
| 1270 |
{CAN-2003-0072}
|
| 1271 |
- krb5 1.2.7-3
|
| 1272 |
NOTE: changelog does not mention this one, verified patch from
|
| 1273 |
NOTE: upstream was applied to this version.
|
| 1274 |
{CAN-2003-0082}
|
| 1275 |
- krb5 1.3.3-2
|
| 1276 |
{CAN-2003-0138 VU#623217}
|
| 1277 |
- krb5 1.2.7-3
|
| 1278 |
{CAN-2003-0139 VU#442569}
|
| 1279 |
- krb5 1.2.7-3
|
| 1280 |
[21 Mar 2003] DSA-265 bonsai - several vulnerabilities
|
| 1281 |
{CAN-2003-0152 CAN-2003-0153 CAN-2003-0154 CAN-2003-0155}
|
| 1282 |
- bonsai 1.3+cvs20030317-1
|
| 1283 |
[19 Mar 2003] DSA-264 lxr - missing filename sanitizing
|
| 1284 |
{CAN-2003-0156}
|
| 1285 |
- lxr 0.3-4
|
| 1286 |
[17 Mar 2003] DSA-263 netpbm-free - math overflow errors
|
| 1287 |
{CAN-2003-0146}
|
| 1288 |
- netpbm-free 2:9.20-9
|
| 1289 |
[15 Mar 2003] DSA-262 samba - remote exploit
|
| 1290 |
{CAN-2003-0085 CAN-2003-0086}
|
| 1291 |
- samba 2.2.8
|
| 1292 |
[14 Mar 2003] DSA-261 tcpdump - infinite loop
|
| 1293 |
{CAN-2003-0093 CAN-2003-0145}
|
| 1294 |
NOTE: DSA reports sid was not affected, sarge has sid version
|
| 1295 |
[13 Mar 2003] DSA-260 file - buffer overflow
|
| 1296 |
{CAN-2003-0102}
|
| 1297 |
- file 3.40-1.1
|
| 1298 |
[12 Mar 2003] DSA-259 qpopper - mail user privilege escalation
|
| 1299 |
{CAN-2003-0143}
|
| 1300 |
- qpopper 4.0.4-9
|
| 1301 |
[10 Mar 2003] DSA-258 ethereal - format string vulnerability
|
| 1302 |
{CAN-2003-0081}
|
| 1303 |
- ethereal 0.9.9-2
|
| 1304 |
[04 Mar 2003] DSA-257 sendmail - remote exploit
|
| 1305 |
{CAN-2002-1337}
|
| 1306 |
- sendmail 8.12.8
|
| 1307 |
[28 Feb 2003] DSA-256 mhc - insecure temporary file
|
| 1308 |
{CAN-2003-0120}
|
| 1309 |
- mhc 0.25+20030224-1
|
| 1310 |
[27 Feb 2003] DSA-255 tcpdump - infinite loop
|
| 1311 |
{CAN-2003-0108 CAN-2002-0380}
|
| 1312 |
- tcpdump 3.7.1-1.2
|
| 1313 |
[27 Feb 2003] DSA-254 traceroute-nanog - buffer overflow
|
| 1314 |
{CAN-2002-1051 CAN-2002-1364 CAN-2002-1386 CAN-2002-1387}
|
| 1315 |
- traceroute-nanog 6.3.0-1
|
| 1316 |
[24 Feb 2003] DSA-253 openssl - information leak
|
| 1317 |
{CAN-2003-0078}
|
| 1318 |
- openssl 0.9.7a-1
|
| 1319 |
[21 Feb 2003] DSA-252 slocate - buffer overflow
|
| 1320 |
{CAN-2003-0056}
|
| 1321 |
- slocate 2.7-1
|
| 1322 |
[14 Feb 2003] DSA-251 w3m - missing HTML quoting
|
| 1323 |
{CAN-2002-1335 CAN-2002-1348}
|
| 1324 |
- w3m 0.3.2.2-1
|
| 1325 |
[12 Feb 2003] DSA-250 w3mmee-ssl - missing HTML quoting
|
| 1326 |
{CAN-2002-1335 CAN-2002-1348}
|
| 1327 |
NOTE: not in sid/sarge
|
| 1328 |
[11 Feb 2003] DSA-249 w3mmee - missing HTML quoting
|
| 1329 |
{CAN-2002-1335 CAN-2002-1348}
|
| 1330 |
- w3mmee 0.3.p24.17-3
|
| 1331 |
[31 Jan 2003] DSA-248 hypermail - buffer overflows
|
| 1332 |
{CAN-2003-0057}
|
| 1333 |
- hypermail 2.1.6-1
|
| 1334 |
[30 Jan 2003] DSA-247 courier-ssl - missing input sanitizing
|
| 1335 |
{CAN-2003-0040}
|
| 1336 |
- courier 0.40.2-3
|
| 1337 |
[29 Jan 2003] DSA-246 tomcat - information exposure, cross site scripting
|
| 1338 |
{CAN-2003-0042 CAN-2003-0043 CAN-2003-0044}
|
| 1339 |
NOTE: tomcat not in sid/sarge
|
| 1340 |
NOTE: tomcat4 not affected
|
| 1341 |
[28 Jan 2003] DSA-245 dhcp3 - ignored counter boundary
|
| 1342 |
{CAN-2003-0039}
|
| 1343 |
- dhcp3 1.1.2-1
|
| 1344 |
[27 Jan 2003] DSA-244 noffle - buffer overflows
|
| 1345 |
{CAN-2003-0037}
|
| 1346 |
- noffle 1.1.2-1
|
| 1347 |
[24 Jan 2003] DSA-243 kdemultimedia - several vulnerabilities
|
| 1348 |
{CAN-2002-1393}
|
| 1349 |
- kdemultimedia 4:3.1
|
| 1350 |
[24 Jan 2003] DSA-242 kdebase - several vulnerabilities
|
| 1351 |
{CAN-2002-1393}
|
| 1352 |
- kdebase 4:3.1
|
| 1353 |
[24 Jan 2003] DSA-241 kdeutils - several vulnerabilities
|
| 1354 |
{CAN-2002-1393}
|
| 1355 |
- kdeutils 4:3.1
|
| 1356 |
[23 Jan 2003] DSA-240 kdegames - several vulnerabilities
|
| 1357 |
{CAN-2002-1393}
|
| 1358 |
- kdegames 4:3.1
|
| 1359 |
[23 Jan 2003] DSA-239 kdesdk - several vulnerabilities
|
| 1360 |
{CAN-2002-1393}
|
| 1361 |
- kdesdk 4:3.1
|
| 1362 |
[23 Jan 2003] DSA-238 kdepim - several vulnerabilities
|
| 1363 |
{CAN-2002-1393}
|
| 1364 |
- kdepim 4:3.1
|
| 1365 |
[22 Jan 2003] DSA-237 kdenetwork - several vulnerabilities
|
| 1366 |
{CAN-2002-1393}
|
| 1367 |
- kdenetwork 4:3.1
|
| 1368 |
[22 Jan 2003] DSA-236 kdelibs - several vulnerabilities
|
| 1369 |
{CAN-2002-1393}
|
| 1370 |
- kdelibs 4:3.1
|
| 1371 |
[22 Jan 2003] DSA-235 kdegraphics - several vulnerabilities
|
| 1372 |
{CAN-2002-1393}
|
| 1373 |
- kdegraphics 4:3.1
|
| 1374 |
[22 Jan 2003] DSA-234 kdeadmin - several vulnerabilities
|
| 1375 |
{CAN-2002-1393}
|
| 1376 |
- kdeadmin 4:3.1
|
| 1377 |
[21 Jan 2003] DSA-233 cvs - doubly freed memory
|
| 1378 |
{CAN-2003-0015}
|
| 1379 |
- cvs 1.11.2-5.1
|
| 1380 |
[20 Jan 2003] DSA-232 cupsys - several vulnerabilities
|
| 1381 |
{CAN-2002-1366 CAN-2002-1367 CAN-2002-1368 CAN-2002-1369 CAN-2002-1371 CAN-2002-1372 CAN-2002-1383 CAN-2002-1384}
|
| 1382 |
- cupsys 1.1.18-1
|
| 1383 |
[17 Jan 2003] DSA-231 dhcp3 - stack overflows
|
| 1384 |
{CAN-2003-0026}
|
| 1385 |
- dhcp3 3.0+3.0.1rc11-1
|
| 1386 |
[16 Jan 2003] DSA-230 bugzilla - insecure permissions, spurious backup files
|
| 1387 |
NOTE: not in testing due to 3 newer security holes
|
| 1388 |
{CAN-2003-0012}
|
| 1389 |
- bugzilla 2.16.2
|
| 1390 |
{CAN-2003-0013}
|
| 1391 |
- bugzilla 2.16.2
|
| 1392 |
[15 Jan 2003] DSA-229 imp - SQL injection
|
| 1393 |
{CAN-2003-0025}
|
| 1394 |
NOTE: I think imp3 is ok.
|
| 1395 |
[14 Jan 2003] DSA-228 libmcrypt - buffer overflows and memory leak
|
| 1396 |
{CAN-2003-0031 CAN-2003-0032}
|
| 1397 |
- libmcrypt 2.5.5-1
|
| 1398 |
[13 Jan 2003] DSA-227 openldap2 - buffer overflows and other bugs
|
| 1399 |
{CAN-2002-1378 CAN-2002-1379 CAN-2002-1508}
|
| 1400 |
- openldap2 2.0.27-3
|
| 1401 |
[10 Jan 2003] DSA-226 xpdf-i - integer overflow
|
| 1402 |
{CAN-2002-1384}
|
| 1403 |
- xpdf 2.01-2
|
| 1404 |
[09 Jan 2003] DSA-225 tomcat4 - source disclosure
|
| 1405 |
{CAN-2002-1394}
|
| 1406 |
! tomcat4 4.1.16-1
|
| 1407 |
NOTE another RC (unreproducible?) bug and missing deps (#263201)
|
| 1408 |
NOTE are keeping the fix out of testing
|
| 1409 |
NOTE this is the second unfixed security hole in tomcat4 in testing..
|
| 1410 |
[08 Jan 2003] DSA-224 canna - buffer overflow and more
|
| 1411 |
{CAN-2002-1158 CAN-2002-1159}
|
| 1412 |
- canna 3.6p1-1
|
| 1413 |
[07 Jan 2003] DSA-223 geneweb - information exposure
|
| 1414 |
{CAN-2002-1390}
|
| 1415 |
- geneweb 4.09-1
|
| 1416 |
[06 Jan 2003] DSA-222 xpdf - integer overflow
|
| 1417 |
{CAN-2002-1384}
|
| 1418 |
- xpdf 2.01-2
|
| 1419 |
[03 Jan 2003] DSA-221 mhonarc - cross site scripting
|
| 1420 |
{CAN-2002-1388}
|
| 1421 |
- mhonarc 2.5.14-1
|
| 1422 |
[02 Jan 2003] DSA-220 squirrelmail - cross site scripting
|
| 1423 |
{CAN-2002-1341}
|
| 1424 |
- squirrelmail 1:1.3.2-2
|
| 1425 |
|
| 1426 |
------- These processed by Djoumé SALVETTI <salvetti@crans.org> -----
|
| 1427 |
|
| 1428 |
[31 Dec 2002] DSA-219 dhcpcd - remote command execution
|
| 1429 |
{CAN-2002-1403}
|
| 1430 |
- dhcpcd 1.3.22pl2-2
|
| 1431 |
[30 Dec 2002] DSA-218 bugzilla - cross site scripting
|
| 1432 |
NOTE: not in testing, fixed in unstable (bugzilla 2.16.2-1).
|
| 1433 |
[27 Dec 2002] DSA-217 typespeed - buffer overflow
|
| 1434 |
{CAN-2002-1389}
|
| 1435 |
- typespeed 0.4.2-2
|
| 1436 |
[24 Dec 2002] DSA-216 fetchmail - buffer overflow
|
| 1437 |
{CAN-2002-1365}
|
| 1438 |
- fetchmail 6.2.0-1
|
| 1439 |
[23 Dec 2002] DSA-215 cyrus-imapd - buffer overflow
|
| 1440 |
{CAN-2002-1580}
|
| 1441 |
- cyrus-imapd 1.5.19-9.10
|
| 1442 |
[20 Dec 2002] DSA-214 kdnetwork - buffer overflows
|
| 1443 |
{CAN-2002-1306}
|
| 1444 |
- kdenetwork 2.2.2-14.20
|
| 1445 |
NOTE: there is a typo in the DSA, the name of the package is kdenetwork.
|
| 1446 |
[19 Dec 2002] DSA-213 libpng - buffer overflow
|
| 1447 |
{CAN-2002-1363}
|
| 1448 |
- libpng 1.0.12-7
|
| 1449 |
- libpng3 1.2.5-8
|
| 1450 |
[17 Dec 2002] DSA-212 mysql - multiple problems
|
| 1451 |
{CAN-2002-1373 CAN-2002-1374 CAN-2002-1375 CAN-2002-1376}
|
| 1452 |
- mysql-dfsg 4.0.7.gamma-1
|
| 1453 |
[13 Dec 2002] DSA-211 micq - denial of service
|
| 1454 |
{CAN-2002-1362}
|
| 1455 |
NOTE: not in testing nor unstable (was fixed in 0.4.9.4-1)
|
| 1456 |
[13 Dec 2002] DSA-210 lynx - CRLF injection
|
| 1457 |
{CAN-2002-1405}
|
| 1458 |
- lynx 2.8.4.1b-4
|
| 1459 |
NOTE: lynx-ssl not in testing nor unstable.
|
| 1460 |
[12 Dec 2002] DSA-209 wget - directory traversal
|
| 1461 |
{CAN-2002-1344}
|
| 1462 |
- wget 1.8.2-8
|
| 1463 |
[12 Dec 2002] DSA-208 perl - broken safe compartment
|
| 1464 |
{CAN-2002-1323}
|
| 1465 |
- perl 5.8.0-14
|
| 1466 |
[11 Dec 2002] DSA-207 tetex-bin - arbitrary command execution
|
| 1467 |
{CAN-2002-0836}
|
| 1468 |
- tetex-bin 1.0.7+20021025-4
|
| 1469 |
[10 Dec 2002] DSA-206 tcpdump - denial of service
|
| 1470 |
{CAN-2002-1350}
|
| 1471 |
- tcpdump 3.7.2-1
|
| 1472 |
[10 Dec 2002] DSA-205 gtetrinet - buffer overflow
|
| 1473 |
- gtetrinet 0.4.4-1
|
| 1474 |
NOTE: no CAN not CVE for this one
|
| 1475 |
[05 Dec 2002] DSA-204 kdelibs - arbitrary program execution
|
| 1476 |
{CAN-2002-1281 CAN-2002-1282}
|
| 1477 |
- kdelibs 4:3.1.0-1
|
| 1478 |
[04 Dec 2002] DSA-203 smb2www - arbitrary command execution
|
| 1479 |
{CAN-2002-1342}
|
| 1480 |
- smb2www 980804-17
|
| 1481 |
[03 Dec 2002] DSA-202 im - insecure temporary files
|
| 1482 |
{CAN-2002-1395}
|
| 1483 |
- im 141-20
|
| 1484 |
[02 Dec 2002] DSA-201 freeswan - denial of service
|
| 1485 |
{CAN-2002-0666 VU#459371}
|
| 1486 |
- freeswan 1.99-1
|
| 1487 |
[22 Nov 2002] DSA-200 samba - remote exploit
|
| 1488 |
{CAN-2002-1318}
|
| 1489 |
- samba 2.99.cvs.20020713-1
|
| 1490 |
[19 Nov 2002] DSA-199 mhonarc - cross site scripting
|
| 1491 |
{CAN-2002-1307}
|
| 1492 |
- mhonarc 2.5.13-1
|
| 1493 |
[18 Nov 2002] DSA-198 nullmailer - denial of service
|
| 1494 |
{CAN-2002-1313}
|
| 1495 |
- nullmailer 1.00RC5-17
|
| 1496 |
[15 Nov 2002] DSA-197 courier - buffer overflow
|
| 1497 |
{CAN-2002-1311}
|
| 1498 |
- courier 0.40.0-1
|
| 1499 |
[14 Nov 2002] DSA-196 bind - several vulnerabilities
|
| 1500 |
{CAN-2002-0029 CAN-2002-1219 CAN-2002-1220 CAN-2002-1221}
|
| 1501 |
- bind 8.3.3-3
|
| 1502 |
[13 Nov 2002] DSA-195 apache-perl - several vulnerabilities
|
| 1503 |
{CAN-2002-0839 CAN-2002-0840 CAN-2002-0843 CAN-2001-0131 CAN-2002-1233}
|
| 1504 |
- apache-perl 1.3.26-1.1-1.27-3-1
|
| 1505 |
[12 Nov 2002] DSA-194 masqmail - buffer overflows
|
| 1506 |
{CAN-2002-1279}
|
| 1507 |
- masqmail 0.2.15-1
|
| 1508 |
[11 Nov 2002] DSA-193 kdenetwork - buffer overflow
|
| 1509 |
{CAN-2002-1247}
|
| 1510 |
- kdenetwok 2.2.2-14.3
|
| 1511 |
[08 Nov 2002] DSA-192 html2ps - arbitrary code execution
|
| 1512 |
{CAN-2002-1275}
|
| 1513 |
- html2ps 1.0b3-2
|
| 1514 |
[07 Nov 2002] DSA-191 squirrelmail - cross site scripting
|
| 1515 |
{CAN-2002-1131 CAN-2002-1132 CAN-2002-1276}
|
| 1516 |
- squirrelmail 1.2.8-1.1
|
| 1517 |
[07 Nov 2002] DSA-190 wmaker - buffer overflow
|
| 1518 |
{CAN-2002-1277}
|
| 1519 |
- wmaker 0.80.1-4
|
| 1520 |
[06 Nov 2002] DSA-189 luxman - local root exploit
|
| 1521 |
{CAN-2002-1245}
|
| 1522 |
- luxman 0.41-19
|
| 1523 |
[05 Nov 2002] DSA-188 apache-ssl - several vulnerabilities
|
| 1524 |
{CAN-2002-0839 CAN-2002-0840 CAN-2002-0843}
|
| 1525 |
- apache 1.3.27-0.1
|
| 1526 |
{CAN-2001-0131 CAN-2002-1233}
|
| 1527 |
- apache 1.3.27-1
|
| 1528 |
HELP: note sure about this
|
| 1529 |
NOTE: I have mailed maintainers
|
| 1530 |
{NO-CAN Several buffer overflows in ApacheBench}
|
| 1531 |
HELP: I don't know about this
|
| 1532 |
NOTE: I have mailed maintainers
|
| 1533 |
[04 Nov 2002] DSA-187 apache - several vulnerabilities
|
| 1534 |
{CAN-2002-0839 CAN-2002-0840 CAN-2002-0843}
|
| 1535 |
- apache 1.3.27-0.1
|
| 1536 |
{CAN-2001-0131 CAN-2002-1233}
|
| 1537 |
- apache 1.3.27-1
|
| 1538 |
HELP: note sure about this
|
| 1539 |
NOTE: I have mailed maintainers
|
| 1540 |
{NO-CAN Several buffer overflows in ApacheBench}
|
| 1541 |
HELP: I don't know about this
|
| 1542 |
NOTE: I have mailed maintainers
|
| 1543 |
[01 Nov 2002] DSA-186 log2mail - buffer overflow
|
| 1544 |
{CAN-2002-1251}
|
| 1545 |
- log2mail 0.2.6-1
|
| 1546 |
[31 Oct 2002] DSA-185 heimdal - buffer overflow
|
| 1547 |
{CAN-2002-1235}
|
| 1548 |
- heimdal 0.4e-22
|
| 1549 |
[30 Oct 2002] DSA-184 krb4 - buffer overflow
|
| 1550 |
{CAN-2002-1235}
|
| 1551 |
- krb4 1.1-11-8
|
| 1552 |
[29 Oct 2002] DSA-183 krb5 - buffer overflow
|
| 1553 |
{CAN-2002-1235}
|
| 1554 |
- krb5 1.2.6-2
|
| 1555 |
[28 Oct 2002] DSA-182 kdegraphics - buffer overflow
|
| 1556 |
{CAN-2002-0838}
|
| 1557 |
- kdegraphics 2.2.2-6.9
|
| 1558 |
[22 Oct 2002] DSA-181 libapache-mod-ssl - cross site scripting
|
| 1559 |
{CAN-2002-1157}
|
| 1560 |
- libapache-mod-ssl 2.8.9-2.3
|
| 1561 |
[21 Oct 2002] DSA-180 nis - information leak
|
| 1562 |
{CAN-2002-1232}
|
| 1563 |
- nis 3.9-6.2
|
| 1564 |
[18 Oct 2002] DSA-179 gnome-gv - buffer overflow
|
| 1565 |
{CAN-2002-0838}
|
| 1566 |
- gnome-gv 1.99.7-9
|
| 1567 |
[17 Oct 2002] DSA-178 heimdal - remote command execution
|
| 1568 |
{CAN-2002-1225 CAN-2002-1226}
|
| 1569 |
- heimdal 0.4e-21
|
| 1570 |
[17 Oct 2002] DSA-177 pam - serious security violation
|
| 1571 |
{CAN-2002-1227}
|
| 1572 |
- pam 0.76-6
|
| 1573 |
[16 Oct 2002] DSA-176 gv - buffer overflow
|
| 1574 |
{CAN-2002-0838}
|
| 1575 |
- gv 3.5.8-27
|
| 1576 |
[15 Oct 2002] DSA-175 syslog-ng - buffer overflow
|
| 1577 |
{CAN-2002-1200}
|
| 1578 |
- syslog-ng 1.5.21-1
|
| 1579 |
[14 Oct 2002] DSA-174 heartbeat - buffer overflow
|
| 1580 |
{CAN-2002-1215}
|
| 1581 |
- heartbeat 0.4.9.2-1
|
| 1582 |
[09 Oct 2002] DSA-173 bugzilla - privilege escalation
|
| 1583 |
{CAN-2002-1196}
|
| 1584 |
NOTE: not in testing, fixed in unstable (bugzilla 2.16.0-2.1)
|
| 1585 |
[08 Oct 2002] DSA-172 tkmail - insecure temporary files
|
| 1586 |
{CAN-2002-1193}
|
| 1587 |
NOTE: not in testing nor unstable (was fixed in 4.0beta9-9)
|
| 1588 |
[07 Oct 2002] DSA-171 fetchmail - buffer overflows
|
| 1589 |
{CAN-2002-1175 CAN-2002-1174}
|
| 1590 |
- fetchmail 6.1.0-1
|
| 1591 |
NOTE: fetchmail-ssl not in testing, fixed in unstable (fetchmail-ssl 6.1.0-1)
|
| 1592 |
[04 Oct 2002] DSA-170 tomcat4 - source code disclosure
|
| 1593 |
{CAN-2002-1148}
|
| 1594 |
! tomcat4 4.1.12-1
|
| 1595 |
NOTE: only 4.0.4-4 in testing (which seems to be vulnerable)
|
| 1596 |
[25 Sep 2002] DSA-169 htcheck - cross site scripting
|
| 1597 |
{CAN-2002-1195}
|
| 1598 |
- htcheck 1.1-1.2
|
| 1599 |
[18 Sep 2002] DSA-168 php - bypassing safe_mode, CRLF injection
|
| 1600 |
{CAN-2002-0985 CAN-2002-0986}
|
| 1601 |
- php3 3.0.18-23.2
|
| 1602 |
- php4 4.2.3-3
|
| 1603 |
NOTE: php3 is not in testing, it seems to be wait for tiff and gcc transition
|
| 1604 |
NOTE: and is out of date on alpha and arm
|
| 1605 |
[16 Sep 2002] DSA-167 kdelibs - cross site scripting
|
| 1606 |
{CAN-2002-1151}
|
| 1607 |
- kdelibs 2.2.2-14
|
| 1608 |
NOTE: there is a typo in the DSA that mentionned Konquerer instead of kdelibs
|
| 1609 |
[13 Sep 2002] DSA-166 purity - buffer overflows
|
| 1610 |
{CAN-2002-1124}
|
| 1611 |
- purity 1-16
|
| 1612 |
[12 Sep 2002] DSA-165 postgresql - buffer overflows
|
| 1613 |
{CAN-2002-0972 CAN-2002-1398 CAN-2002-1400 CAN-2002-1401 CVE-2002-1402}
|
| 1614 |
- postgresql 7.2.2-2
|
| 1615 |
[10 Sep 2002] DSA-164 cacti - arbitrary code execution
|
| 1616 |
{CAN-2002-1477 CAN-2002-1478}
|
| 1617 |
- cacti 0.6.8a-2
|
| 1618 |
[09 Sep 2002] DSA-163 mhonarc - cross site scripting
|
| 1619 |
{CVE-2002-0738}
|
| 1620 |
- mhonarc 2.5.11-1
|
| 1621 |
[06 Sep 2002] DSA-162 ethereal - buffer overflow
|
| 1622 |
{CAN-2002-0834}
|
| 1623 |
- ethereal 0.9.6-1
|
| 1624 |
[04 Sep 2002] DSA-161 mantis - privilege escalation
|
| 1625 |
{CAN-2002-1115 CAN-2002-1116}
|
| 1626 |
- mantis 0.17.5-2
|
| 1627 |
[03 Sep 2002] DSA-160 scrollkeeper - insecure temporary file creation
|
| 1628 |
{CAN-2002-0662}
|
| 1629 |
- scrollkeeper 0.3.11-2
|
| 1630 |
[28 Aug 2002] DSA-159 python - insecure temporary files
|
| 1631 |
{CAN-2002-1119}
|
| 1632 |
- python2.1 2.1.3-6a
|
| 1633 |
- python2.2 2.2.1-8
|
| 1634 |
NOTE: python1.5 not in testing nor unstable (was fixed in 1.5.2-24)
|
| 1635 |
NOTE: python2.3 is not vulnerable
|
| 1636 |
[27 Aug 2002] DSA-158 gaim - arbitrary program execution
|
| 1637 |
{CVE-2002-0989}
|
| 1638 |
- gaim 0.59.1-2
|
| 1639 |
[23 Aug 2002] DSA-157 irssi-text - denial of service
|
| 1640 |
{CAN-2002-0983}
|
| 1641 |
- irssi-text 0.8.5-2
|
| 1642 |
[22 Aug 2002] DSA-156 epic4-script-light - arbitrary script execution
|
| 1643 |
{CVE-2002-0984}
|
| 1644 |
- epic4-script-light 2.7.30p5-2
|
| 1645 |
[17 Aug 2002] DSA-155 kdelibs - privacy escalation with Konqueror
|
| 1646 |
{CAN-2002-0970}
|
| 1647 |
- kdelibs 4:2.2.2-14
|
| 1648 |
[15 Aug 2002] DSA-154 fam - privilege escalation
|
| 1649 |
{CVE-2002-0875}
|
| 1650 |
- fam 2.6.8-1
|
| 1651 |
[14 Aug 2002] DSA-153 mantis - cross site code execution and privilege escalation
|
| 1652 |
{CAN-2002-1114 CAN-2002-1113 CAN-2002-1112 CAN-2002-1111 CAN-2002-1110}
|
| 1653 |
- mantis 0.17.4a-2
|
| 1654 |
[13 Aug 2002] DSA-152 l2tpd - missing random seed
|
| 1655 |
{CVE-2002-0872 CVE-2002-0873}
|
| 1656 |
NOTE: not in testing (was fixed in unstable 0.68-1)
|
| 1657 |
[13 Aug 2002] DSA-151 xinetd - pipe exposure
|
| 1658 |
{CVE-2002-0871}
|
| 1659 |
- xinetd 2.3.7-1
|
| 1660 |
[13 Aug 2002] DSA-150 interchange - illegal file exposition
|
| 1661 |
{CAN-2002-0874}
|
| 1662 |
- interchange 4.8.6-1
|
| 1663 |
[13 Aug 2002] DSA-149 glibc - integer overflow
|
| 1664 |
{CVE-2002-0391}
|
| 1665 |
- glibc 2.2.5-13
|
| 1666 |
[12 Aug 2002] DSA-148 hylafax - buffer overflows and format string vulnerabilities
|
| 1667 |
{CVE-2002-1049 CVE-2002-1050 CAN-2001-1034}
|
| 1668 |
- hylafax 4.1.2-2.1
|
| 1669 |
[08 Aug 2002] DSA-147 mailman - cross-site scripting
|
| 1670 |
{CAN-2002-0388 CAN-2002-0855}
|
| 1671 |
- mailman 2.0.12-1
|
| 1672 |
[08 Aug 2002] DSA-146 dietlibc - integer overflow
|
| 1673 |
{CVE-2002-0391}
|
| 1674 |
- dietlibc 0.20-0cvs20020808
|
| 1675 |
[07 Aug 2002] DSA-145 tinyproxy - doubly freed memory
|
| 1676 |
{CVE-2002-0847}
|
| 1677 |
- tinyproxy 1.4.3-3
|
| 1678 |
[06 Aug 2002] DSA-144 wwwoffle - improper input handling
|
| 1679 |
{CVE-2002-0818}
|
| 1680 |
- wwwoffle 2.7d-1
|
| 1681 |
[05 Aug 2002] DSA-143 krb5 - integer overflow
|
| 1682 |
{CVE-2002-0391}
|
| 1683 |
- krb5 1.2.5-2
|
| 1684 |
[05 Aug 2002] DSA-142 openafs - integer overflow
|
| 1685 |
{CVE-2002-0391}
|
| 1686 |
- openafs 1.2.6-1
|
| 1687 |
[01 Aug 2002] DSA-141 mpack - buffer overflow
|
| 1688 |
{CAN-2002-1425}
|
| 1689 |
- mpack 1.5-9
|
| 1690 |
[05 Aug 2002] DSA-140 libpng - buffer overflow
|
| 1691 |
{CAN-2002-0660 CAN-2002-0728}
|
| 1692 |
- libpng 1.0.12-4
|
| 1693 |
- libpng3 1.2.1-2
|
| 1694 |
[01 Aug 2002] DSA-139 super - format string vulnerability
|
| 1695 |
{CVE-2002-0817}
|
| 1696 |
- super 3.18.0-3
|
| 1697 |
[01 Aug 2002] DSA-138 gallery - remote exploit
|
| 1698 |
{CAN-2002-1412}
|
| 1699 |
- gallery 1.3-3
|
| 1700 |
[30 Jul 2002] DSA-137 mm - insecure temporary files
|
| 1701 |
{CVE-2002-0658}
|
| 1702 |
- mm 1.1.3-7
|
| 1703 |
[30 Jul 2002] DSA-136 openssl - multiple remote exploits
|
| 1704 |
{CAN-2002-0655 CAN-2002-0656 CAN-2002-0657 CAN-2002-0659}
|
| 1705 |
- openssl 0.9.6e-1
|
Parent Directory
| 
Revision Log