8:18 a.m.
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv19216/audit
Modified Files:
f10 f11 f9
Log Message:
large pile of updates
Index: f10
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f10,v
retrieving revision 1.33
retrieving revision 1.34
diff -u -r1.33 -r1.34
--- f10 19 Dec 2008 19:22:21 -0000 1.33
+++ f10 27 Jan 2009 14:18:01 -0000 1.34
@@ -4,8 +4,33 @@
# *CVE are items that need verification for Fedora 10
# (mozilla) = (gecko-libs dependent stuff)
+CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025
+CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1)
+CVE-2009-0136 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0550]
+CVE-2009-0135 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0550]
+CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc10] not security according to
upstream
+CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific
+CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) [since asterisk-1.6.0.5-2.fc10]
AST-2009-001
+CVE-2009-0025 fixed (bind, fixed 9.5.1-P1,9.6.0-P1) [since FEDORA-2009-0451]
+CVE-2009-0022 fixed (samba, fixed 3.2.7) [since FEDORA-2009-0160]
+CVE-2009-0021 fixed (ntp, fixed 4.2.4p6) [since FEDORA-2009-0544]
+CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1)
+CVE-2008-5916 fixed (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since
FEDORA-2008-11678]
+CVE-2008-5906 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10]
+CVE-2008-5905 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10]
+CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7
+CVE-2008-5744 ignore (zaptel) kernel modules not shipped
+CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2)
+CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed
+CVE-2008-5714 VULNERABLE (kvm)
+CVE-2008-5714 VULNERABLE (qemu)
+CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10)
+CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10)
+CVE-2008-5698 ignore (konqueror) KDE3 and DoS only
CVE-2008-5695 version (wordpress, fixed 2.3.3)
CVE-2008-5695 version (wordpress-mu, fixed 1.3.3)
+CVE-2008-5688 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743]
+CVE-2008-5687 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743]
CVE-2008-5676 version (mod_security, fixed 2.5.6) [since mod_security-2.5.6-1.fc10]
CVE-2008-5660 fixed (vinagre, fixed 0.5.2,2.24.2) [since FEDORA-2008-10956]
CVE-2008-5657 version (quassel, fixed 0.3.0.3) [since quassel-0.3.0.3-1.fc10]
@@ -13,48 +38,57 @@
CVE-2008-5646 VULNERABLE (trac, fixed 0.11.2)
CVE-2008-5622 fixed (phpMyAdmin, fixed 3.1.1) [since FEDORA-2008-11257] PMASA-2008-10,
same as CVE-2008-5621?
CVE-2008-5621 fixed (phpMyAdmin, fixed 3.1.1) [since FEDORA-2008-11257] PMASA-2008-10
-CVE-2008-5620 VULNERABLE (roundcubemail, fixed 0.2-rc) [since
roundcubemail-0.2-5.beta.fc10]
+CVE-2008-5620 fixed (roundcubemail, fixed 0.2-rc) [since FEDORA-2008-11456]
CVE-2008-5619 fixed (roundcubemail, fixed 0.2-rc) [since FEDORA-2008-11247]
-CVE-2008-5618 VULNERABLE (rsyslog, fixed 3.20.2,3.21.9) [since rsyslog-3.21.9-1.fc10]
-CVE-2008-5617 VULNERABLE (rsyslog, fixed 3.20.1,3.21.8) [since rsyslog-3.21.9-1.fc10]
+CVE-2008-5618 fixed (rsyslog, fixed 3.20.2,3.21.9) [since FEDORA-2008-11476]
+CVE-2008-5617 fixed (rsyslog, fixed 3.20.1,3.21.8) [since FEDORA-2008-11476]
CVE-2008-5587 VULNERABLE (phpPgAdmin, fixed 4.2.2) [phpPgAdmin-4.2.2-1.fc10]
CVE-2008-5558 ignore (asterisk) AST-2008-012, not affected
-CVE-2008-5513 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5512 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10]
-CVE-2008-5512 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5511 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10]
-CVE-2008-5511 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5510 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10]
-CVE-2008-5510 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5508 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10]
-CVE-2008-5508 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5507 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10]
-CVE-2008-5507 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5506 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10]
-CVE-2008-5506 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5505 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5503 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10]
-CVE-2008-5502 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5501 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5500 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10]
-CVE-2008-5500 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5517 version (git, fixed 1.5.6)
+CVE-2008-5516 version (git, fixed 1.5.5)
+CVE-2008-5514 fixed (uw-imap, fixed 2007e) [since FEDORA-2009-0413]
+CVE-2008-5513 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5512 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490]
+CVE-2008-5512 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5511 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490]
+CVE-2008-5511 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5510 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490]
+CVE-2008-5510 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5508 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490]
+CVE-2008-5508 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5507 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490]
+CVE-2008-5507 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5506 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490]
+CVE-2008-5506 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5505 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5503 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490]
+CVE-2008-5502 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5501 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
+CVE-2008-5500 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490]
+CVE-2008-5500 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511]
CVE-2008-5432 fixed (moodle, fixed 1.8.7,1.9.3) [since FEDORA-2008-9903]
CVE-2008-5398 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10991]
CVE-2008-5397 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10991]
+CVE-2008-5396 ignore (zaptel) kernel modules not shipped
+CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10)
CVE-2008-5299 VULNERABLE (chm2pdf) #474459
CVE-2008-5298 VULNERABLE (chm2pdf) #474459
CVE-2008-5286 ignore (cups) libpng prevents this
+CVE-2008-5262 fixed (DevIL) [since FEDORA-2009-0867]
+CVE-2008-5252 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743]
+CVE-2008-5250 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743]
+CVE-2008-5249 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743]
CVE-2008-5187 fixed (imlib2) #472579 [since FEDORA-2008-10364]
CVE-2008-5184 version (cups, fixed 1.3.8)
CVE-2008-5183 fixed (cups, fixed 1.3.10) [since FEDORA-2008-10895]
-CVE-2008-5153 VULNERABLE (moodle) #472120
+CVE-2008-5153 fixed (moodle) #472120 [since FEDORA-2009-0819]
CVE-2008-5148 fixed (geda-gnetlist) #472116 [since FEDORA-2008-9730]
CVE-2008-5138 VULNERABLE (pam_mount) #472112
CVE-2008-5113 VULNERABLE (wordpress) #471992
CVE-2008-5110 fixed (syslog-ng) [since FEDORA-2008-10879]
CVE-2008-5101 version (optipng, fixed 0.6.2) [since optipng-0.6.2-1.fc10]
-CVE-2008-5086 VULNERABLE (libvirt) [since libvirt-0.5.1-2.fc10]
-CVE-2008-5081 VULNERABLE (avahi, fixed 0.6.24) [since avahi-0.6.22-12.fc10]
+CVE-2008-5086 fixed (libvirt) [since FEDORA-2008-11443]
+CVE-2008-5081 fixed (avahi, fixed 0.6.24) [since FEDORA-2008-11351]
CVE-2008-5080 fixed (awstats) [since FEDORA-2008-10950]
CVE-2008-5078 ignore (enscript) 1.6.1 only
CVE-2008-5076 fixed (htop) [since FEDORA-2008-9944]
@@ -69,6 +103,7 @@
CVE-2008-4985 ignore (vdr) Debian-specific
CVE-2008-4982 fixed (rkhunter) [since rkhunter-1.3.2-5.fc10]
CVE-2008-4977 ignore (postfix) Debian-specific
+CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10)
CVE-2008-4956 ignore (fwbuilder) fwb_install not shipped
CVE-2008-4937 ignore (openoffice.org) not affected
CVE-2008-4936 fixed (mgetty) patched for ages
@@ -82,6 +117,7 @@
CVE-2008-4789 version (drupal, fixed 6.5) [since drupal-6.5-1.fc10]
CVE-2008-4776 version (libgadu, fixed 1.8.2) [since libgadu-1.8.2-1.fc10]
CVE-2008-4775 version (phpMyAdmin, fixed 3.0.1.1) [since phpMyAdmin-3.0.1.1-1.fc10]
+CVE-2008-4770 fixed (vnc, fixed 4.1.3) [since FEDORA-2009-0991]
CVE-2008-4769 version (wordpress)
CVE-2008-4690 fixed (lynx) [since FEDORA-2008-9952]
CVE-2008-4641 VULNERABLE (jhead)
@@ -96,6 +132,7 @@
CVE-2008-4434 ignore (bittorrent) 6.x only
CVE-2008-4422 backport (libxml2, fixed 2.7.2) [since libxml2-2.7.1-2.fc10]
CVE-2008-4408 version (mediawiki, fixed 1.13.2) [since mediawiki-1.13.2-41.fc10]
+CVE-2008-4405 VULNERABLE (xen)
CVE-2008-4360 version (lighttpd, fixed 1.4.20) [since lighttpd-1.4.20-0.1.r2303.fc10]
CVE-2008-4359 version (lighttpd, fixed 1.4.20) #465754 [since lighttpd-1.4.20-1.fc10]
CVE-2008-4326 version (phpMyAdmin, fixed 2.11.9.2) [since phpMyAdmin-2.11.9.2-1.fc10]
@@ -108,7 +145,7 @@
CVE-2008-4306 fixed (enscript) [since enscript-1.6.4-11.fc10]
CVE-2008-4298 version (lighttpd, fixed 1.4.20) [since lighttpd-1.4.20-0.1.r2303.fc10]
CVE-2008-4297 version (mercurial, fixed 1.0.2) [since mercurial-1.0.2-1.fc10]
-CVE-2008-4242 VULNERABLE (proftpd) #464130
+CVE-2008-4242 fixed (proftpd) #464130 [since FEDORA-2009-0089]
CVE-2008-4226 fixed (libxml2) [since FEDORA-2008-10038]
CVE-2008-4225 fixed (libxml2) [since FEDORA-2008-10038]
CVE-2008-4191 backport (emacspeak) [since emacspeak-28.0-3.fc10]
@@ -181,8 +218,8 @@
CVE-2008-3828 version (condor, fixed 7.0.5) #466076 [since condor-7.0.5-1.fc10]
CVE-2008-3826 version (condor, fixed 7.0.5) #466076 [since condor-7.0.5-1.fc10]
CVE-2008-3825 version (pam_krb5, 2.3.2) [since pam_krb5-2.3.2-1.fc10]
-CVE-2008-3824 VULNERABLE (horde) oCERT-2008-012
-CVE-2008-3823 VULNERABLE (horde) oCERT-2008-012
+CVE-2008-3824 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012
+CVE-2008-3823 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012
CVE-2008-3796 version (swfdec, fixed 0.6.8) [since swfdec-0.7.4-1.fc10]
CVE-2008-3790 backport (ruby) [since ruby-1.8.6.287-2.fc10]
CVE-2008-3789 version (samba, fixed 3.2.3) [since samba-3.2.4-0.22.fc10]
@@ -331,6 +368,9 @@
CVE-2008-2426 backport (imlib2) [since imlib2-1.4.0-7.fc10]
CVE-2008-2420 version (stunnel, fixed 4.24) [since stunnel-4.24-2]
CVE-2008-2392 ignore (wordpress) issue only in certain deployments, not affected by
default
+CVE-2008-2383 fixed (xterm, fixed 238) [since FEDORA-2009-0091]
+CVE-2008-2382 VULNERABLE (qemu)
+CVE-2008-2382 fixed (kvm, fixed 82) [since FEDORA-2008-11727]
CVE-2008-2377 version (gnutls, fixed 2.4.1) [since gnutls-2.4.1-1.fc10]
CVE-2008-2376 backport (ruby, fixed 1.8.6-p257) [since ruby-1.8.6.230-4.fc10]
CVE-2008-2375 ignore (vsftpd) pre-2.0.5 versions only
@@ -435,11 +475,12 @@
CVE-2007-5907 version (xen) #390121
CVE-2007-5906 version (xen) #390121
CVE-2007-5803 version (nagios, fixed 2.12) #446383 [since nagios-2.12-3.fc10]
+CVE-2007-5729 VULNERABLE (kvm, fixed 82)
CVE-2007-5615 backport (jetty) [since jetty-5.1.14-1jpp.2.fc10]
CVE-2007-5614 backport (jetty) [since jetty-5.1.14-1jpp.2.fc10]
CVE-2007-5613 backport (jetty) [since jetty-5.1.14-1jpp.2.fc10]
CVE-2007-5079 VULNERABLE (gdm) #363041 Red Hat specific problem
-CVE-2007-4829 VULNERABLE (perl, not fixed upstream) #364291 perl-Archive-Tar directory
traversal
+CVE-2007-4829 fixed (perl, fixed 1.40) [since FEDORA-2008-11736] #364291 perl-Archive-Tar
directory traversal
CVE-2007-4559 VULNERABLE (python, not fixed upstream) #315291 Upstream WONTFIX. See where
we use the code.
CVE-2007-1320 VULNERABLE (qemu)
CVE-2007-1320 version (kvm, fixed 70)
Index: f11
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f11,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- f11 19 Dec 2008 16:13:54 -0000 1.4
+++ f11 27 Jan 2009 14:18:01 -0000 1.5
@@ -4,6 +4,31 @@
# *CVE are items that need verification for Fedora 10
# (mozilla) = (gecko-libs dependent stuff)
+CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025
+CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1)
+CVE-2009-0136 version (amarok, fixed 2.0.1.1) [since amarok-2.0.1.1-1.fc11]
+CVE-2009-0135 version (amarok, fixed 2.0.1.1) [since amarok-2.0.1.1-1.fc11]
+CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc11] not security according to
upstream
+CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific
+CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) AST-2009-001
+CVE-2009-0025 version (bind, fixed 9.5.1-P1,9.6.0-P1) [since bind-9.6.0-2.P1.fc11]
+CVE-2009-0022 VULNERABLE (samba, fixed 3.2.7)
+CVE-2009-0021 version (ntp, fixed 4.2.4p6) [since ntp-4.2.4p6-1.fc11]
+CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1)
+CVE-2008-5916 version (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since
git-1.6.0.6-1.fc11]
+CVE-2008-5906 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10]
+CVE-2008-5905 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10]
+CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7
+CVE-2008-5744 ignore (zaptel) kernel modules not shipped
+CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2)
+CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed
+CVE-2008-5714 VULNERABLE (kvm)
+CVE-2008-5714 VULNERABLE (qemu)
+CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10)
+CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10)
+CVE-2008-5698 ignore (konqueror) KDE3 and DoS only
+CVE-2008-5688 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11]
+CVE-2008-5687 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11]
CVE-2008-5676 version (mod_security, fixed 2.5.6) [since mod_security-2.5.6-1.fc10]
CVE-2008-5660 version (vinagre, fixed 0.5.2,2.24.2) [since vinagre-2.25.3-1.fc11]
CVE-2008-5657 version (quassel, fixed 0.3.0.3) [since quassel-0.3.0.3-1.fc11]
@@ -17,61 +42,76 @@
CVE-2008-5617 version (rsyslog, fixed 3.20.1,3.21.8) [since rsyslog-3.21.9-1.fc11]
CVE-2008-5587 version (phpPgAdmin, fixed 4.2.2) [since phpPgAdmin-4.2.2-1.fc11]
CVE-2008-5558 ignore (asterisk) AST-2008-012, not affected
-CVE-2008-5513 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5517 version (git, fixed 1.5.6)
+CVE-2008-5516 version (git, fixed 1.5.5)
+CVE-2008-5514 version (uw-imap, fixed 2007e) [since uw-imap-2007e-1.fc11]
+CVE-2008-5513 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5512 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11]
-CVE-2008-5512 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5512 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5511 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11]
-CVE-2008-5511 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5511 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5510 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11]
-CVE-2008-5510 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5510 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5508 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11]
-CVE-2008-5508 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5508 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5507 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11]
-CVE-2008-5507 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5507 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5506 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11]
-CVE-2008-5506 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5505 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5506 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
+CVE-2008-5505 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5503 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11]
-CVE-2008-5502 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
-CVE-2008-5501 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5502 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
+CVE-2008-5501 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5500 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11]
-CVE-2008-5500 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10]
+CVE-2008-5500 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11]
CVE-2008-5432 version (moodle, fixed 1.8.7,1.9.3) [since moodle-1.9.3-3.fc11]
CVE-2008-5398 version (tor, fixed 0.2.0.32) [since tor-0.2.0.32-1.fc11]
CVE-2008-5397 version (tor, fixed 0.2.0.32) [since tor-0.2.0.32-1.fc11]
+CVE-2008-5396 ignore (zaptel) kernel modules not shipped
+CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10)
CVE-2008-5299 VULNERABLE (chm2pdf)
CVE-2008-5298 VULNERABLE (chm2pdf)
CVE-2008-5286 ignore (cups) libpng prevents this
+CVE-2008-5262 backport (DevIL) [since DevIL-1.7.5-2.fc11]
+CVE-2008-5252 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11]
+CVE-2008-5250 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11]
+CVE-2008-5249 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11]
CVE-2008-5184 version (cups, fixed 1.3.8)
CVE-2008-5183 VULNERABLE (cups, fixed 1.3.10) [since cups-1.4-0.b1.5.fc11]
-CVE-2008-5153 VULNERABLE (moodle)
+CVE-2008-5153 backport (moodle) [since moodle-1.9.3-5.fc11]
CVE-2008-5138 VULNERABLE (pam_mount)
CVE-2008-5113 VULNERABLE (wordpress) #471992
CVE-2008-5110 version (syslog-ng, fixed 2.0.10) [since syslog-ng-2.0.10-1.fc11]
CVE-2008-5086 backport (libvirt) [since libvirt-0.5.1-2.fc11]
CVE-2008-5081 version (avahi, fixed 0.6.24) [since avahi-0.6.24-1.fc11]
CVE-2008-5080 backport (awstats) [since awstats-6.8-3.fc11]
+CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10)
CVE-2008-4863 backport (blender) [blender-2.48a-4.fc10]
+CVE-2008-4770 VULNERABLE (vnc, fixed 4.1.3)
CVE-2008-4690 backport (lynx) [since lynx-2.8.6-18.fc10]
CVE-2008-4641 VULNERABLE (jhead)
CVE-2008-4640 VULNERABLE (jhead)
CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5)
+CVE-2008-4405 VULNERABLE (xen)
CVE-2008-4315 fixed (tog-pegasus) [since tog-pegasus-2.7.2-2.fc11]
CVE-2008-4314 version (samba, fixed 3.0.33,3.2.5) [since samba-3.2.5-0.23.fc11]
CVE-2008-4313 fixed (tog-pegasus) [since tog-pegasus-2.7.2-2.fc11]
CVE-2008-4311 version (dbus, fixed 1.2.6) [since dbus-1.2.6-1.fc11]
CVE-2008-4309 version (net-snmp, fixed 5.4.2.1) [since net-snmp-5.4.2.1-1.fc10]
-CVE-2008-4242 VULNERABLE (proftpd) #464130
+CVE-2008-4242 version (proftpd, fixed 1.3.2) #464130 [since 1.3.2-0.1.rc3]
CVE-2008-4190 VULNERABLE (openswan)
-CVE-2008-4130 VULNERABLE (gallery2, fixed 2.2.6)
-CVE-2008-4129 VULNERABLE (gallery2, fixed 2.2.6)
+CVE-2008-4130 version (gallery2, fixed 2.2.6) [since gallery2-2.3-1.fc11]
+CVE-2008-4129 version (gallery2, fixed 2.2.6) [since gallery2-2.3-1.fc11]
CVE-2008-4100 VULNERABLE (adns) #462754 upstream design decision
CVE-2008-3949 VULNERABLE (emacs, fixed 22.3)
CVE-2008-3927 VULNERABLE (tiger)
-CVE-2008-3824 VULNERABLE (horde) oCERT-2008-012
-CVE-2008-3823 VULNERABLE (horde) oCERT-2008-012
-CVE-2008-3662 VULNERABLE (gallery2, fixed 2.2.6)
+CVE-2008-3824 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012
+CVE-2008-3823 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012
+CVE-2008-3662 version (gallery2, fixed 2.2.6) [since gallery2-2.3-1.fc11]
CVE-2008-3381 VULNERABLE (moin) #457364
+CVE-2008-2383 version (xterm, fixed 238) [since xterm-238-1.fc11]
+CVE-2008-2382 VULNERABLE (qemu)
+CVE-2008-2382 VULNERABLE (kvm, fixed 82)
CVE-2008-2363 VULNERABLE (pan) #449335
CVE-2008-2004 VULNERABLE (qemu) fix mostly useless without libvirt changes
CVE-2008-2004 VULNERABLE (kvm) fix mostly useless without libvirt changes
@@ -79,8 +119,9 @@
CVE-2008-1103 VULNERABLE (blender) not fixed upstream
CVE-2007-6318 VULNERABLE (wordpress) #426434
CVE-2007-6131 VULNERABLE (scanbuttond)
+CVE-2007-5729 VULNERABLE (kvm, fixed 82)
CVE-2007-5079 VULNERABLE (gdm) #363041 Red Hat specific problem
-CVE-2007-4829 VULNERABLE (perl, not fixed upstream) #364291 perl-Archive-Tar directory
traversal
+CVE-2007-4829 version (perl, fixed 1.40) [since perl-5.10.0-52.fc11] #364291
perl-Archive-Tar directory traversal
CVE-2007-4559 VULNERABLE (python, not fixed upstream) #315291 Upstream WONTFIX. See where
we use the code.
CVE-2007-1320 VULNERABLE (qemu)
CVE-2006-1390 VULNERABLE (nethack) bz#187353, but requires other access to games group
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.243
retrieving revision 1.244
diff -u -r1.243 -r1.244
--- f9 19 Dec 2008 19:22:22 -0000 1.243
+++ f9 27 Jan 2009 14:18:01 -0000 1.244
@@ -5,7 +5,32 @@
# (mozilla) = (gecko-libs dependent stuff)
rhbz249840 version (tor, fixed 0.1.2.15)
+CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025
+CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1)
+CVE-2009-0136 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0715]
+CVE-2009-0135 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0715]
+CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc9] not security according to
upstream
+CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific
+CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) [since asterisk-1.6.0.5-2.fc9]
AST-2009-001
+CVE-2009-0025 fixed (bind, fixed 9.5.1-P1,9.6.0-P1) [since FEDORA-2009-0350]
+CVE-2009-0022 fixed (samba, fixed 3.2.7) [since FEDORA-2009-0268]
+CVE-2009-0021 fixed (ntp, fixed 4.2.4p6) [since FEDORA-2009-0547]
+CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1)
+CVE-2008-5916 fixed (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since
FEDORA-2008-11650]
+CVE-2008-5906 fixed (ktorrent, fixed 3.1.4) [since FEDORA-2008-9167]
+CVE-2008-5905 fixed (ktorrent, fixed 3.1.4) [since FEDORA-2008-9167]
+CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7
+CVE-2008-5744 ignore (zaptel) kernel modules not shipped
+CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2)
+CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed
+CVE-2008-5714 VULNERABLE (kvm)
+CVE-2008-5714 VULNERABLE (qemu)
+CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10)
+CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10)
+CVE-2008-5698 ignore (konqueror) KDE3 and DoS only
CVE-2008-5695 version (wordpress, fixed 2.3.3)
+CVE-2008-5688 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802]
+CVE-2008-5687 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802]
CVE-2008-5676 version (mod_security, fixed 2.5.6) [since mod_security-2.5.6-1.fc9]
CVE-2008-5660 fixed (vinagre, fixed 0.5.2,2.24.2) [since FEDORA-2008-10932]
CVE-2008-5657 fixed (quassel, fixed 0.3.0.3) [since FEDORA-2008-9658]
@@ -15,43 +40,52 @@
CVE-2008-5621 fixed (phpMyAdmin, fixed 3.1.1) [since FEDORA-2008-11208] PMASA-2008-10
CVE-2008-5620 VULNERABLE (roundcubemail, fixed 0.2-rc)
CVE-2008-5619 fixed (roundcubemail, fixed 0.2-rc) [since FEDORA-2008-11234]
-CVE-2008-5618 VULNERABLE (rsyslog, fixed 3.20.2,3.21.9) [since rsyslog-3.20.2-2.fc9]
-CVE-2008-5617 VULNERABLE (rsyslog, fixed 3.20.1,3.21.8) [since rsyslog-3.20.2-2.fc9]
-CVE-2008-5587 VULNERABLE (phpPgAdmin, fixed 4.2.2) [since phpPgAdmin-4.2.2-1.fc9]
+CVE-2008-5618 fixed (rsyslog, fixed 3.20.2,3.21.9) [since FEDORA-2008-11538]
+CVE-2008-5617 fixed (rsyslog, fixed 3.20.1,3.21.8) [since FEDORA-2008-11538]
+CVE-2008-5587 fixed (phpPgAdmin, fixed 4.2.2) [since FEDORA-2008-11602]
CVE-2008-5558 ignore (asterisk) AST-2008-012, not affected
-CVE-2008-5513 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5512 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9]
-CVE-2008-5512 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5511 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9]
-CVE-2008-5511 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5510 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9]
-CVE-2008-5510 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5508 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9]
-CVE-2008-5508 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5507 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9]
-CVE-2008-5507 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5506 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9]
-CVE-2008-5506 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5505 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5503 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9]
-CVE-2008-5502 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5501 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
-CVE-2008-5500 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9]
-CVE-2008-5500 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9]
+CVE-2008-5517 version (git, fixed 1.5.6)
+CVE-2008-5516 version (git, fixed 1.5.5)
+CVE-2008-5514 fixed (uw-imap, fixed 2007e) [since FEDORA-2009-0371]
+CVE-2008-5513 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5512 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586]
+CVE-2008-5512 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5511 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586]
+CVE-2008-5511 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5510 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586]
+CVE-2008-5510 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5508 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586]
+CVE-2008-5508 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5507 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586]
+CVE-2008-5507 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5506 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586]
+CVE-2008-5506 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5505 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5503 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586]
+CVE-2008-5502 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5501 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
+CVE-2008-5500 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586]
+CVE-2008-5500 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598]
CVE-2008-5432 fixed (moodle, fixed 1.8.7,1.9.3) [since FEDORA-2008-9508]
CVE-2008-5398 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10989]
CVE-2008-5397 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10989]
+CVE-2008-5396 ignore (zaptel) kernel modules not shipped
+CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10)
CVE-2008-5286 ignore (cups) libpng prevents this
+CVE-2008-5262 fixed (DevIL) [since FEDORA-2009-0856]
+CVE-2008-5252 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802]
+CVE-2008-5250 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802]
+CVE-2008-5249 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802]
CVE-2008-5187 fixed (imlib2) #472578 [since FEDORA-2008-10287]
CVE-2008-5184 version (cups, fixed 1.3.8)
CVE-2008-5183 fixed (cups, fixed 1.3.10) [since FEDORA-2008-10917]
-CVE-2008-5153 VULNERABLE (moodle) #472119
+CVE-2008-5153 fixed (moodle) #472119 [since FEDORA-2009-0814]
CVE-2008-5148 fixed (geda-gnetlist) #472115 [since FEDORA-2008-9730]
CVE-2008-5138 VULNERABLE (pam_mount) #472111
CVE-2008-5113 VULNERABLE (wordpress) #471991
CVE-2008-5110 fixed (syslog-ng) #471986 [since FEDORA-2008-10752]
CVE-2008-5101 fixed (optipng, fixed 0.6.2) [since FEDORA-2008-9633]
-CVE-2008-5086 VULNERABLE (libvirt) [since libvirt-0.5.1-2.fc9]
+CVE-2008-5086 fixed (libvirt) [since FEDORA-2008-11433]
CVE-2008-5081 VULNERABLE (avahi, fixed 0.6.24)
CVE-2008-5080 fixed (awstats) [since FEDORA-2008-10962]
CVE-2008-5078 ignore (enscript) 1.6.1 only
@@ -67,6 +101,7 @@
CVE-2008-4985 ignore (vdr) Debian-specific
CVE-2008-4982 fixed (rkhunter) [since FEDORA-2008-8314]
CVE-2008-4977 ignore (postfix) Debian-specific
+CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10)
CVE-2008-4956 ignore (fwbuilder) fwb_install not shipped
CVE-2008-4937 fixed (openoffice.org) [since FEDORA-2008-7680]
CVE-2008-4936 fixed (mgetty) patched for ages
@@ -80,6 +115,7 @@
CVE-2008-4789 fixed (drupal, fixed 6.5) [since FEDORA-2008-8852]
CVE-2008-4776 fixed (libgadu, fixed 1.8.2) [since FEDORA-2008-9293]
CVE-2008-4775 fixed (phpMyAdmin, fixed 3.0.1.1) [since FEDORA-2008-9316]
+CVE-2008-4770 fixed (vnc, fixed 4.1.3) [since FEDORA-2009-1001]
CVE-2008-4769 version (wordpress)
CVE-2008-4690 fixed (lynx) #468550 [since FEDORA-2008-9550]
CVE-2008-4641 VULNERABLE (jhead)
@@ -94,6 +130,7 @@
CVE-2008-4434 ignore (bittorrent) 6.x only
CVE-2008-4422 fixed (libxml2, fixed 2.7.2) [since FEDORA-2008-8575]
CVE-2008-4408 fixed (mediawiki, fixed 1.13.2) [since FEDORA-2008-8639]
+CVE-2008-4405 VULNERABLE (xen)
CVE-2008-4360 VULNERABLE (lighttpd, fixed 1.4.20) #464639
CVE-2008-4359 VULNERABLE (lighttpd, fixed 1.4.20) #464639
CVE-2008-4326 fixed (phpMyAdmin, fixed 2.11.9.2) [since FEDORA-2008-8335]
@@ -106,7 +143,7 @@
CVE-2008-4306 fixed (enscript) [since FEDORA-2008-9372]
CVE-2008-4298 VULNERABLE (lighttpd, fixed 1.4.20) #464639
CVE-2008-4297 fixed (mercurial, fixed 1.0.2) [since FEDORA-2008-7490]
-CVE-2008-4242 VULNERABLE (proftpd) #464129
+CVE-2008-4242 fixed (proftpd) #464129 [since FEDORA-2009-0064]
CVE-2008-4226 fixed (libxml2) [since FEDORA-2008-9773]
CVE-2008-4225 fixed (libxml2) [since FEDORA-2008-9773]
CVE-2008-4191 fixed (emacspeak) [since FEDORA-2008-8379]
@@ -179,8 +216,8 @@
CVE-2008-3828 fixed (condor, fixed 7.0.5) #466075 [since FEDORA-2008-8733]
CVE-2008-3826 fixed (condor, fixed 7.0.5) #466075 [since FEDORA-2008-8733]
CVE-2008-3825 fixed (pam_krb5, 2.3.2) [since FEDORA-2008-8618]
-CVE-2008-3824 VULNERABLE (horde) oCERT-2008-012
-CVE-2008-3823 VULNERABLE (horde) oCERT-2008-012
+CVE-2008-3824 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012
+CVE-2008-3823 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012
CVE-2008-3796 version (swfdec, fixed 0.6.8) [since swfdec-0.6.8-1.fc9]
CVE-2008-3790 fixed (ruby) [since FEDORA-2008-8738]
CVE-2008-3789 fixed (samba, fixed 3.2.3) [since FEDORA-2008-7243]
@@ -329,6 +366,9 @@
CVE-2008-2426 fixed (imlib2) [since FEDORA-2008-4871]
CVE-2008-2420 fixed (stunnel, fixed 4.24) [since FEDORA-2008-4531]
CVE-2008-2392 ignore (wordpress) issue only in certain deployments, not affected by
default
+CVE-2008-2383 fixed (xterm, fixed 238) [since FEDORA-2009-0059]
+CVE-2008-2382 VULNERABLE (qemu)
+CVE-2008-2382 fixed (kvm, fixed 82) [since FEDORA-2008-11705]
CVE-2008-2377 ignore (gnutls, fixed 2.4.1) 2.3.5+ only
CVE-2008-2376 fixed (ruby, fixed 1.8.6-p257) [since FEDORA-2008-6033]
CVE-2008-2375 ignore (vsftpd) pre-2.0.5 versions only
@@ -796,6 +836,7 @@
CVE-2007-5746 version (openoffice.org, fixed 2.4)
CVE-2007-5745 version (openoffice.org, fixed 2.4)
CVE-2007-5742 version (wesnoth, fixed 1.2.8) [since wesnoth-1.2.8-3.fc9]
+CVE-2007-5729 VULNERABLE (kvm, fixed 82)
CVE-2007-5712 version (Django, fixed 0.96.1) #362781 [since Django-0.96.1-1.fc9]
CVE-2007-5708 version (openldap, fixed 2.3.39) #360091 [since openldap-2.3.39-1.fc9]
CVE-2007-5707 version (openldap, fixed 2.3.39) #360091 [since openldap-2.3.39-1.fc9]
5580
days inactive
5580
days old
security-commits@lists.fedoraproject.org
0 comments
1 participants
participants (1)
-
fedora-security-commits＠redhat.com