fedora-security/audit f8, 1.212, 1.213 f9, 1.202, 1.203 fc7, 1.368, 1.369
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv21629/audit
Modified Files:
f8 f9 fc7
Log Message:
update WebKit, note perl
Index: f8
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f8,v
retrieving revision 1.212
retrieving revision 1.213
diff -u -r1.212 -r1.213
--- f8 28 Apr 2008 12:47:58 -0000 1.212
+++ f8 29 Apr 2008 08:26:54 -0000 1.213
@@ -11,6 +11,7 @@
CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only
CVE-2008-1930 ignore (wordpress, fixed 2.5.1) [since wordpress-2.5.1-1.fc8] only for wp 2.5.0
CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443940
+CVE-2008-1927 VULNERABLE (perl) [since perl-5.8.8-39.fc8]
CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-2.fc8]
CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc8] PMASA-2008-3
CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897
@@ -127,7 +128,7 @@
CVE-2008-1066 fixed (gallery2) #438058 [since FEDORA-2008-2587]
CVE-2008-1066 VULNERABLE (php-pear-PhpDocumentor) #438062
CVE-2008-1026 version (WebKit, fixed r31388) [since FEDORA-2008-3229]
-**CVE-2008-1025 VULNERABLE (WebKit) may be fixed in SVN and hence in our packages
+CVE-2008-1025 version (WebKit, fixed r31438) [since FEDORA-2008-3229]
CVE-2008-1011 version (WebKit) [since FEDORA-2008-3229]
CVE-2008-1010 version (WebKit) [since FEDORA-2008-3229]
CVE-2008-0983 fixed (lighttpd) #435807 [since FEDORA-2008-2262]
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.202
retrieving revision 1.203
diff -u -r1.202 -r1.203
--- f9 28 Apr 2008 12:47:58 -0000 1.202
+++ f9 29 Apr 2008 08:26:54 -0000 1.203
@@ -125,7 +125,7 @@
CVE-2008-1066 VULNERABLE (gallery2) #438060
CVE-2008-1066 VULNERABLE (php-pear-PhpDocumentor) #438064
CVE-2008-1026 version (WebKit, fixed r31388) [since WebKit-1.0.0-0.8.svn31787.fc9]
-**CVE-2008-1025 VULNERABLE (WebKit) may be fixed in SVN and hence in our packages
+CVE-2008-1025 version (WebKit, fixed r31438) [since WebKit-1.0.0-0.8.svn31787.fc9]
CVE-2008-1011 version (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc9]
CVE-2008-1010 version (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc9]
CVE-2008-0983 backport (lighttpd) #435809 [since lighttpd-1.4.18-6.fc9]
Index: fc7
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/fc7,v
retrieving revision 1.368
retrieving revision 1.369
diff -u -r1.368 -r1.369
--- fc7 28 Apr 2008 12:47:58 -0000 1.368
+++ fc7 29 Apr 2008 08:26:54 -0000 1.369
@@ -12,6 +12,7 @@
CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only
CVE-2008-1930 ignore (wordpress, fixed 2.5.1) [since wordpress-2.5.1-1.fc7] only for wp 2.5.0
CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443939
+CVE-2008-1927 VULNERABLE (perl) [since perl-5.8.8-29.fc7]
CVE-2008-1926 VULNERABLE (util-linux)
CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc7] PMASA-2008-3
CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897
@@ -128,7 +129,7 @@
CVE-2008-1066 fixed (gallery2) #438059 [since FEDORA-2008-2650]
CVE-2008-1066 fixed (php-pear-PhpDocumentor) #438063 [since FEDORA-2008-2656]
CVE-2008-1026 VULNERABLE (WebKit, fixed r31388) [since WebKit-1.0.0-0.8.svn31787.fc7]
-**CVE-2008-1025 VULNERABLE (WebKit) may be fixed in SVN and hence in our packages
+CVE-2008-1025 VULNERABLE (WebKit, fixed r31438) [since WebKit-1.0.0-0.8.svn31787.fc7]
CVE-2008-1011 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7]
CVE-2008-1010 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7]
CVE-2008-0983 fixed (lighttpd) #435808 [since FEDORA-2008-2278]
15 years, 11 months
fedora-security/audit f8, 1.211, 1.212 f9, 1.201, 1.202 fc7, 1.367, 1.368
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11655/audit
Modified Files:
f8 f9 fc7
Log Message:
add zoneminder
Index: f8
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f8,v
retrieving revision 1.211
retrieving revision 1.212
diff -u -r1.211 -r1.212
--- f8 28 Apr 2008 09:04:54 -0000 1.211
+++ f8 28 Apr 2008 12:47:58 -0000 1.212
@@ -61,6 +61,7 @@
CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442363
CVE-2008-1382 VULNERABLE (libpng, fixed 1.2.27) minimal impact, affected api rarely used
CVE-2008-1382 VULNERABLE (libpng10) minimal impact, affected api rarely used
+CVE-2008-1381 VULNERABLE (zoneminder, fixed 1.23.3) #444436
CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14)
CVE-2008-1380 fixed (seamonkey, fixed 1.1.10) #442851 [since FEDORA-2008-3264]
CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442856
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.201
retrieving revision 1.202
diff -u -r1.201 -r1.202
--- f9 28 Apr 2008 09:04:54 -0000 1.201
+++ f9 28 Apr 2008 12:47:58 -0000 1.202
@@ -61,6 +61,7 @@
CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9]
CVE-2008-1382 VULNERABLE (libpng, fixed 1.2.27) minimal impact, affected api rarely used
CVE-2008-1382 VULNERABLE (libpng10) minimal impact, affected api rarely used
+CVE-2008-1381 VULNERABLE (zoneminder, fixed 1.23.3) #444437
CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14)
CVE-2008-1380 VULNERABLE (seamonkey, fixed 1.1.10) #442852
CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442857
Index: fc7
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/fc7,v
retrieving revision 1.367
retrieving revision 1.368
diff -u -r1.367 -r1.368
--- fc7 28 Apr 2008 09:04:54 -0000 1.367
+++ fc7 28 Apr 2008 12:47:58 -0000 1.368
@@ -62,6 +62,7 @@
CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442362
CVE-2008-1382 ignore (libpng, fixed 1.2.27) minimal impact, affected api rarely used
CVE-2008-1382 ignore (libpng10) minimal impact, affected api rarely used
+CVE-2008-1381 VULNERABLE (zoneminder, fixed 1.23.3) #444435
CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14)
CVE-2008-1380 fixed (seamonkey, fixed 1.1.10) #442850 [since FEDORA-2008-3231]
CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442855
15 years, 12 months
fedora-security/audit f8, 1.210, 1.211 f9, 1.200, 1.201 fc7, 1.366, 1.367
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv5100/audit
Modified Files:
f8 f9 fc7
Log Message:
add kdelibs, kronolith, xine-lib, wordpress, some of them are non-issues for us
Index: f8
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f8,v
retrieving revision 1.210
retrieving revision 1.211
diff -u -r1.210 -r1.211
--- f8 25 Apr 2008 15:23:13 -0000 1.210
+++ f8 28 Apr 2008 09:04:54 -0000 1.211
@@ -6,7 +6,10 @@
rhbz293031 fixed (nx) #293031 [since FEDORA-2008-2258]
rhbz249840 VULNERABLE (tor)
+CVE-2008-1974 VULNERABLE (kronolith, fixed 3.1.8) #444404
+CVE-2008-1964 ignore (xine-lib) bogus vulnerability report
CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only
+CVE-2008-1930 ignore (wordpress, fixed 2.5.1) [since wordpress-2.5.1-1.fc8] only for wp 2.5.0
CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443940
CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-2.fc8]
CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc8] PMASA-2008-3
@@ -29,6 +32,9 @@
CVE-2008-1687 ignore (m4, fixed 1.4.11) not really a security issue
CVE-2008-1686 fixed (libfishsound, fixed 0.9.1) #441247 [since FEDORA-2008-3059]
CVE-2008-1686 fixed (speex) #442572 [since FEDORA-2008-3103]
+CVE-2008-1671 ignore (kdelibs) start_kdeinit not setuid
+CVE-2008-1670 ignore (kdelibs) kdelibs 4.x only
+CVE-2008-1670 VULNERABLE (kdelibs4) #444399 kdelibs 4.x only
CVE-2008-1658 fixed (PolicyKit) #439995 [since FEDORA-2008-2987]
CVE-2008-1657 VULNERABLE (openssh, fixed 4.9) #440375
CVE-2008-1652 version (Perlbal, fixed 1.70) [since FEDORA-2008-2778]
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.200
retrieving revision 1.201
diff -u -r1.200 -r1.201
--- f9 25 Apr 2008 15:23:13 -0000 1.200
+++ f9 28 Apr 2008 09:04:54 -0000 1.201
@@ -5,7 +5,10 @@
# (mozilla) = (gecko-libs dependent stuff)
rhbz249840 VULNERABLE (tor)
+CVE-2008-1974 VULNERABLE (kronolith, fixed 3.1.8) #444405
+CVE-2008-1964 ignore (xine-lib) bogus vulnerability report
CVE-2008-1937 VULNERABLE (moin, fixed 1.6.3) [since moin-1.6.3-1.fc9]
+CVE-2008-1930 ignore (wordpress, fixed 2.5.1) only for wp 2.5.0
CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443941
CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-8.1.fc9]
CVE-2008-1924 version (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc9] PMASA-2008-3
@@ -30,6 +33,8 @@
CVE-2008-1687 ignore (m4, fixed 1.4.11) not really a security issue
CVE-2008-1686 version (libfishsound, fixed 0.9.1) #441248 [since libfishsound-0.9.1-1.fc9]
CVE-2008-1686 backport (speex) [since speex-1.2-0.7.beta3]
+CVE-2008-1671 ignore (kdelibs) start_kdeinit not shipped
+CVE-2008-1670 VULNERABLE (kdelibs) [since kdelibs-4.0.3-7.fc9]
CVE-2008-1658 backport (PolicyKit) #439996 [since PolicyKit-0.7-7.fc9]
CVE-2008-1657 version (openssh, fixed 4.9) #440376 [since openssh-5.0p1-1.fc9]
CVE-2008-1652 version (Perlbal, fixed 1.70) [since Perlbal-1.70-1.fc9]
Index: fc7
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/fc7,v
retrieving revision 1.366
retrieving revision 1.367
diff -u -r1.366 -r1.367
--- fc7 25 Apr 2008 15:23:13 -0000 1.366
+++ fc7 28 Apr 2008 09:04:54 -0000 1.367
@@ -7,7 +7,10 @@
rhbz293031 fixed (nx) #293031 [since FEDORA-2008-2258]
rhbz249840 version (tor, fixed 0.1.2.15) #249840 [since FEDORA-2007-1674]
+CVE-2008-1974 VULNERABLE (kronolith, fixed 3.1.8) #444403
+CVE-2008-1964 ignore (xine-lib) bogus vulnerability report
CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only
+CVE-2008-1930 ignore (wordpress, fixed 2.5.1) [since wordpress-2.5.1-1.fc7] only for wp 2.5.0
CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443939
CVE-2008-1926 VULNERABLE (util-linux)
CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc7] PMASA-2008-3
@@ -30,6 +33,9 @@
CVE-2008-1687 ignore (m4, fixed 1.4.11) not really a security issue
CVE-2008-1686 VULNERABLE (libfishsound, fixed 0.9.1) #441246 [since FEDORA-2008-3117]
CVE-2008-1686 fixed (speex) #442571 [since FEDORA-2008-3191]
+CVE-2008-1671 ignore (kdelibs) start_kdeinit not setuid
+CVE-2008-1670 ignore (kdelibs) kdelibs 4.x only
+CVE-2008-1670 VULNERABLE (kdelibs4) #444398 kdelibs 4.x only
CVE-2008-1657 VULNERABLE (openssh, fixed 4.9) #280461
CVE-2008-1652 version (Perlbal, fixed 1.70) [since FEDORA-2008-2788]
CVE-2008-1637 fixed (pdns-recursor, fixed 3.1.5) #440248 [since FEDORA-2008-3010]
15 years, 12 months
fedora-security/audit f8, 1.209, 1.210 f9, 1.199, 1.200 fc7, 1.365, 1.366
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv10508/audit
Modified Files:
f8 f9 fc7
Log Message:
misc cleanups
Index: f8
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f8,v
retrieving revision 1.209
retrieving revision 1.210
diff -u -r1.209 -r1.210
--- f8 25 Apr 2008 13:24:29 -0000 1.209
+++ f8 25 Apr 2008 15:23:13 -0000 1.210
@@ -103,6 +103,7 @@
CVE-2008-1161 version (xine-lib, fixed 1.1.10.1) [since FEDORA-2008-1543]
CVE-2008-1149 version (phpMyAdmin, fixed 2.11.5) [since FEDORA-2008-2189]
CVE-2008-1145 version (ruby, fixed 1.8.6-p114) [since FEDORA-2008-2443]
+CVE-2008-1136 version (vdccm, fixed 0.10.1) [since FEDORA-2008-0680]
CVE-2008-1133 ignore (drupal) #435816 drupal 6.x only
CVE-2008-1131 ignore (drupal) #435816 drupal 6.x only
CVE-2008-1111 fixed (lighttpd) #435807 [since FEDORA-2008-2262]
@@ -234,7 +235,7 @@
CVE-2008-0003 fixed (tog-pegasus, fixed 2.7.0) #427829 [since FEDORA-2008-0572]
CVE-2008-0002 fixed (tomcat5) #432474 [since FEDORA-2008-1467]
CVE-2007-6714 VULNERABLE (dbmail, fixed 2.2.9) #443021
-CVE-2007-6703 VULNERABLE (vdccm) #436025
+CVE-2007-6703 fixed (vdccm, fixed 0.10.1) #436026 [since FEDORA-2008-0680]
CVE-2007-6698 version (openldap, fixed 2.3.36)
CVE-2007-6697 fixed (SDL_image, fixed 1.2.7) #430241 [since FEDORA-2008-1208]
CVE-2007-6693 version (gallery2, fixed 2.2.4) [since FEDORA-2007-4778]
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.199
retrieving revision 1.200
diff -u -r1.199 -r1.200
--- f9 25 Apr 2008 13:24:29 -0000 1.199
+++ f9 25 Apr 2008 15:23:13 -0000 1.200
@@ -11,10 +11,10 @@
CVE-2008-1924 version (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc9] PMASA-2008-3
CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897
CVE-2008-1897 version (asterisk, fixed 1.6.0.beta3) [since asterisk-1.6.0-0.13.beta8.fc9]
-CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443056 nsf demuxer overflow
+CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443056 nsf demuxer overflow [since xine-lib-1.1.12-2.fc9]
CVE-2008-1845 version (mksh, fixed 33d) [since mksh-33d-1.fc9] what is real impact on fedora?
CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped
-CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442364
+CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9]
CVE-2008-1835 ignore (clamav, fixed 0.93) unrar code not shipped
CVE-2008-1834 version (swfdec, fixed 0.6.4) [since swfdec-0.6.4-1.fc9]
CVE-2008-1833 version (clamav, fixed 0.93-rc1) [since clamav-0.93-0.0.rc1.fc9]
@@ -53,14 +53,14 @@
CVE-2008-1467 fixed (centerim) #438871
CVE-2008-1394 ignore (plone)
CVE-2008-1390 version (asterisk, fixed 1.6.0-beta6) #438134 [since asterisk-1.6.0-0.6.beta6.fc9]
-CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442364
+CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9]
CVE-2008-1382 VULNERABLE (libpng, fixed 1.2.27) minimal impact, affected api rarely used
CVE-2008-1382 VULNERABLE (libpng10) minimal impact, affected api rarely used
CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14)
CVE-2008-1380 VULNERABLE (seamonkey, fixed 1.1.10) #442852
CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442857
CVE-2008-1374 ignore (cups) only affects old cups versions in RHEL
-CVE-2008-1373 VULNERABLE (cups) #440041
+CVE-2008-1373 VULNERABLE (cups) #440041 [since cups-1.3.6-9.fc9]
CVE-2008-1372 version (bzip2, fixed 1.0.5) [since bzip2-1.0.5-1.fc9]
CVE-2008-1360 VULNERABLE (nagios) #437852
CVE-2008-1353 ignore (zabbix) #437848 Needs authorization
@@ -102,12 +102,13 @@
CVE-2008-1149 version (phpMyAdmin, fixed 2.11.5) [since phpMyAdmin-2.11.5-1.fc9]
CVE-2008-1145 version (ruby, fixed 1.8.6-p114) [since ruby-1.8.6.114-1.fc9]
CVE-2008-1142 ignore (rxvt) http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296
+CVE-2008-1136 version (vdccm, fixed 0.10.1) [since vdccm-0.10.1-1.fc9]
CVE-2008-1133 version (drupal, fixed 6.1) #435817 [since drupal-6.1-1.fc9]
CVE-2008-1131 version (drupal, fixed 6.1) #435817 [since drupal-6.1-1.fc9]
CVE-2008-1111 backport (lighttpd) #435809 [since lighttpd-1.4.18-6.fc9]
CVE-2008-1110 version (xine-lib, fixed 1.1.10) [since xine-lib-1.1.10-2.fc9]
-CVE-2008-1102 VULNERABLE (blender) #443937
-CVE-2008-1100 VULNERABLE (clamav, fixed 0.93) #442364
+CVE-2008-1102 VULNERABLE (blender) #443937 [since blender-2.45-12.fc9]
+CVE-2008-1100 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9]
CVE-2008-1099 version (moin, fixed 1.5.9) #438674
CVE-2008-1098 version (moin, fixed 1.5.9) #438674
CVE-2008-1078 VULNERABLE (am-utils) #437746
@@ -196,7 +197,7 @@
CVE-2008-0364 ignore (bittorrent) Windows only
CVE-2008-0320 version (openoffice.org, fixed 2.4)
CVE-2008-0318 fixed (clamav, fixed 0.92.1)
-CVE-2008-0314 VULNERABLE (clamav, fixed 0.93) #442364
+CVE-2008-0314 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9]
CVE-2008-0304 version (seamonkey, fixed 1.1.8) [since seamonkey-1.1.8-3.fc9]
CVE-2008-0304 version (thuderbird, fixed 2.0.0.12) [since thunderbird-2.0.0.12-1.fc9]
CVE-2008-0299 fixed (python-paramiko) #428730 [since python-paramiko-1.7.1-3.fc9]
@@ -230,8 +231,8 @@
CVE-2008-0005 version (httpd, fixed 2.2.8) #427984 [since httpd-2.2.8-2]
CVE-2008-0003 version (tog-pegasus, fixed 2.7.0)
CVE-2008-0002 VULNERABLE (tomcat5) #432476
-CVE-2007-6714 VULNERABLE (dbmail, fixed 2.2.9) #443022
-CVE-2007-6703 VULNERABLE (vdccm) #436027
+CVE-2007-6714 VULNERABLE (dbmail, fixed 2.2.9) #443022 [since dbmail-2.2.9-1.fc9]
+CVE-2007-6703 version (vdccm, fixed 0.10.1) #436027
CVE-2007-6698 version (openldap, fixed 2.3.36)
CVE-2007-6697 backport (SDL_image, fixed 1.2.7) #430238 [since SDL_image-1.2.6-4.fc9]
CVE-2007-6693 version (gallery2, fixed 2.2.4) [since gallery2-2.2.4-1]
Index: fc7
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/fc7,v
retrieving revision 1.365
retrieving revision 1.366
diff -u -r1.365 -r1.366
--- fc7 25 Apr 2008 13:24:29 -0000 1.365
+++ fc7 25 Apr 2008 15:23:13 -0000 1.366
@@ -104,6 +104,7 @@
CVE-2008-1161 version (xine-lib, fixed 1.1.10.1) [since FEDORA-2008-1581]
CVE-2008-1149 version (phpMyAdmin, fixed 2.11.5) [since FEDORA-2008-2229]
CVE-2008-1145 version (ruby, fixed 1.8.6-p114) [since FEDORA-2008-2458]
+CVE-2008-1136 VULNERABLE (vdccm, fixed 0.10.1) #436025
CVE-2008-1133 ignore (drupal) #435815 drupal 6.x only
CVE-2008-1131 ignore (drupal) #435815 drupal 6.x only
CVE-2008-1111 fixed (lighttpd) #435808 [since FEDORA-2008-2278]
@@ -234,7 +235,7 @@
CVE-2008-0003 fixed (tog-pegasus, fixed 2.7.0) #427828 [since FEDORA-2008-0506]
CVE-2008-0002 fixed (tomcat5) #432475 [since FEDORA-2008-1603]
CVE-2007-6714 VULNERABLE (dbmail, fixed 2.2.9) #443020
-CVE-2007-6703 fixed (vdccm) #436026 [since FEDORA-2008-0680]
+CVE-2007-6703 VULNERABLE (vdccm, fixed 0.10.1) #436025
CVE-2007-6698 fixed (openldap, fixed 2.3.36) #431409 [since FEDORA-2008-1307]
CVE-2007-6697 fixed (SDL_image, fixed 1.2.7) #430239 [since FEDORA-2008-1231]
CVE-2007-6693 version (gallery2, fixed 2.2.4) [since FEDORA-2007-4777]
15 years, 12 months
fedora-security/audit f8, 1.208, 1.209 f9, 1.198, 1.199 fc7, 1.364, 1.365
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv24140/audit
Modified Files:
f8 f9 fc7
Log Message:
check-updates
Index: f8
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f8,v
retrieving revision 1.208
retrieving revision 1.209
diff -u -r1.208 -r1.209
--- f8 25 Apr 2008 09:07:57 -0000 1.208
+++ f8 25 Apr 2008 13:24:29 -0000 1.209
@@ -11,7 +11,7 @@
CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-2.fc8]
CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc8] PMASA-2008-3
CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897
-CVE-2008-1897 VULNERABLE (asterisk, fixed 1.4.19.1) [since asterisk-1.4.19.1-1.fc8]
+CVE-2008-1897 VULNERABLE (asterisk, fixed 1.4.19.1) [since asterisk-1.4.19.1-1.fc8]
CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443055 nsf demuxer overflow
CVE-2008-1845 version (mksh, fixed 33d) [since FEDORA-2008-3174]
CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped
@@ -33,11 +33,11 @@
CVE-2008-1657 VULNERABLE (openssh, fixed 4.9) #440375
CVE-2008-1652 version (Perlbal, fixed 1.70) [since FEDORA-2008-2778]
CVE-2008-1637 fixed (pdns-recursor, fixed 3.1.5) #440249 [since FEDORA-2008-3036]
-CVE-2008-1628 VULNERABLE (audit) [since audit-1.6.8-4.fc8]
+CVE-2008-1628 fixed (audit) [since FEDORA-2008-3012]
CVE-2008-1614 version (mod_suphp, fixed 0.6.3) [since FEDORA-2008-2868]
CVE-2008-1612 VULNERABLE (squid, fixed 2.6.STABLE19) [since FEDORA-2008-2740]
CVE-2008-1568 fixed (comix) improper shell escaping, bz#430635 [since FEDORA-2008-2981]
-CVE-2008-1567 VULNERABLE (phpmyadmin, fixed 2.11.5.1)
+CVE-2008-1567 fixed (phpMyAdmin, fixed 2.11.5.1) [since FEDORA-2008-2825]
CVE-2008-1563 fixed (wireshark, fixed 1.0) #435487 [since FEDORA-2008-3040]
CVE-2008-1562 fixed (wireshark, fixed 1.0) #435487 [since FEDORA-2008-3040]
CVE-2008-1561 fixed (wireshark, fixed 1.0) #435487 [since FEDORA-2008-3040]
@@ -56,7 +56,7 @@
CVE-2008-1382 VULNERABLE (libpng, fixed 1.2.27) minimal impact, affected api rarely used
CVE-2008-1382 VULNERABLE (libpng10) minimal impact, affected api rarely used
CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14)
-CVE-2008-1380 VULNERABLE (seamonkey, fixed 1.1.10) #442851
+CVE-2008-1380 fixed (seamonkey, fixed 1.1.10) #442851 [since FEDORA-2008-3264]
CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442856
CVE-2008-1374 ignore (cups) only affects old cups versions in RHEL
CVE-2008-1373 fixed (cups) #440040 [since FEDORA-2008-2131]
@@ -197,7 +197,7 @@
CVE-2008-0404 fixed (mantis) #429552 [since FEDORA-2008-0796]
CVE-2008-0386 fixed (xdg-utils) #429513 [since FEDORA-2008-1015]
CVE-2008-0364 ignore (bittorrent) Windows only
-CVE-2008-0320 VULNERABLE (openoffice.org, fixed 2.4) #442846
+CVE-2008-0320 fixed (openoffice.org, fixed 2.4) #442846 [since FEDORA-2008-3251]
CVE-2008-0318 fixed (clamav, fixed 0.92.1) [since FEDORA-2008-1625]
CVE-2008-0314 VULNERABLE (clamav, fixed 0.93) #442363
CVE-2008-0304 version (seamonkey, fixed 1.1.8) [since FEDORA-2008-1459]
@@ -279,7 +279,7 @@
CVE-2007-6437 fixed (syslog-ng) #426306 [since FEDORA-2008-0523]
CVE-2007-6430 version (asterisk, fixed 1.4.16) [since FEDORA-2007-4651]
CVE-2007-6389 fixed (gnome-screensaver) #426170 [since FEDORA-2008-2872]
-CVE-2007-6353 VULNERABLE (exiv2) #425923
+CVE-2007-6353 fixed (exiv2) #425923 [since FEDORA-2007-4551]
CVE-2007-6352 fixed (libexif) #425631 [since FEDORA-2007-4667]
CVE-2007-6351 fixed (libexif) #425631 [since FEDORA-2007-4667]
CVE-2007-6350 fixed (scponly) #429731 [since FEDORA-2008-1728] rsync vector only
@@ -360,9 +360,9 @@
CVE-2007-5760 fixed (xorg-x11-server, fixed 1.4.1) #429126 [since FEDORA-2008-0760]
CVE-2007-5759 ignore (clamav, fixed 0.92) duplicate of CVE-2007-6335
CVE-2007-5751 backport (liferea, fixed 1.4.6) #360641 [since FEDORA-2007-2853]
-CVE-2007-5747 VULNERABLE (openoffice.org, fixed 2.4) #442846
-CVE-2007-5746 VULNERABLE (openoffice.org, fixed 2.4) #442846
-CVE-2007-5745 VULNERABLE (openoffice.org, fixed 2.4) #442846
+CVE-2007-5747 fixed (openoffice.org, fixed 2.4) #442846 [since FEDORA-2008-3251]
+CVE-2007-5746 fixed (openoffice.org, fixed 2.4) #442846 [since FEDORA-2008-3251]
+CVE-2007-5745 fixed (openoffice.org, fixed 2.4) #442846 [since FEDORA-2008-3251]
CVE-2007-5742 version (wesnoth, fixed 1.2.8) [since FEDORA-2007-3989]
CVE-2007-5712 version (Django, fixed 0.96.1) #362771 [since FEDORA-2007-2788]
CVE-2007-5708 version (openldap, fixed 2.3.39) #362991 [since FEDORA-2007-2796]
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.198
retrieving revision 1.199
diff -u -r1.198 -r1.199
--- f9 25 Apr 2008 09:07:57 -0000 1.198
+++ f9 25 Apr 2008 13:24:29 -0000 1.199
@@ -38,7 +38,7 @@
CVE-2008-1614 version (mod_suphp, fixed 0.6.3) [since mod_suphp-0.6.3-1.fc9]
CVE-2008-1612 ignore (squid, fixed 2.6.STABLE19) 3.0 was not affected
CVE-2008-1568 fixed (comix) [since comix-3.6.4-6.fc9]
-CVE-2008-1567 version (phpmyadmin, fixed 2.11.5.1) [since phpMyAdmin-2.11.5.1-1.fc9]
+CVE-2008-1567 version (phpMyAdmin, fixed 2.11.5.1) [since phpMyAdmin-2.11.5.1-1.fc9]
CVE-2008-1563 version (wireshark, fixed 1.0) #435488 [since wireshark-1.0.0-2.fc9]
CVE-2008-1562 version (wireshark, fixed 1.0) #435488 [since wireshark-1.0.0-2.fc9]
CVE-2008-1561 version (wireshark, fixed 1.0) #435488 [since wireshark-1.0.0-2.fc9]
Index: fc7
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/fc7,v
retrieving revision 1.364
retrieving revision 1.365
diff -u -r1.364 -r1.365
--- fc7 25 Apr 2008 09:07:57 -0000 1.364
+++ fc7 25 Apr 2008 13:24:29 -0000 1.365
@@ -12,7 +12,7 @@
CVE-2008-1926 VULNERABLE (util-linux)
CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc7] PMASA-2008-3
CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897
-CVE-2008-1897 VULNERABLE (asterisk, fixed 1.4.19.1) [since asterisk-1.4.19.1-1.fc7]
+CVE-2008-1897 VULNERABLE (asterisk, fixed 1.4.19.1) [since asterisk-1.4.19.1-1.fc7]
CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443054 nsf demuxer overflow
CVE-2008-1845 version (mksh, fixed 33d) [since FEDORA-2008-3070]
CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped
@@ -37,7 +37,7 @@
CVE-2008-1614 version (mod_suphp, fixed 0.6.3) [since FEDORA-2008-2815]
CVE-2008-1612 backport (squid, fixed 2.6.STABLE19) [since FEDORA-2008-2729]
CVE-2008-1568 fixed (comix) improper shell escaping, bz#430635 [since FEDORA-2008-2993]
-CVE-2008-1567 VULNERABLE (phpmyadmin, fixed 2.11.5.1)
+CVE-2008-1567 fixed (phpMyAdmin, fixed 2.11.5.1) [since FEDORA-2008-2874]
CVE-2008-1563 fixed (wireshark, fixed 1.0) #435485 [since FEDORA-2008-2941]
CVE-2008-1562 fixed (wireshark, fixed 1.0) #435485 [since FEDORA-2008-2941]
CVE-2008-1561 fixed (wireshark, fixed 1.0) #435485 [since FEDORA-2008-2941]
@@ -57,7 +57,7 @@
CVE-2008-1382 ignore (libpng, fixed 1.2.27) minimal impact, affected api rarely used
CVE-2008-1382 ignore (libpng10) minimal impact, affected api rarely used
CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14)
-CVE-2008-1380 VULNERABLE (seamonkey, fixed 1.1.10) #442850
+CVE-2008-1380 fixed (seamonkey, fixed 1.1.10) #442850 [since FEDORA-2008-3231]
CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442855
CVE-2008-1374 ignore (cups) only affects old cups versions in RHEL
CVE-2008-1373 fixed (cups) #440042 [since FEDORA-2008-2897]
@@ -119,10 +119,10 @@
CVE-2008-1066 version (php-Smarty, fixed 2.6.19) #435812 [since FEDORA-2008-1928]
CVE-2008-1066 fixed (gallery2) #438059 [since FEDORA-2008-2650]
CVE-2008-1066 fixed (php-pear-PhpDocumentor) #438063 [since FEDORA-2008-2656]
-CVE-2008-1026 VULNERABLE (WebKit, fixed r31388) [since WebKit-1.0.0-0.8.svn31787.fc7]
+CVE-2008-1026 VULNERABLE (WebKit, fixed r31388) [since WebKit-1.0.0-0.8.svn31787.fc7]
**CVE-2008-1025 VULNERABLE (WebKit) may be fixed in SVN and hence in our packages
-CVE-2008-1011 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7]
-CVE-2008-1010 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7]
+CVE-2008-1011 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7]
+CVE-2008-1010 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7]
CVE-2008-0983 fixed (lighttpd) #435808 [since FEDORA-2008-2278]
CVE-2008-0947 fixed (krb5, fixed 1.6.4) #438022 [since FEDORA-2008-2637]
CVE-2008-0932 fixed (sword) #433725 [since FEDORA-2008-1951] why? diatheke.pl is not shipped...
15 years, 12 months
fedora-security/tools/scripts check-updates, 1.4, 1.5
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/tools/scripts
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv23562/tools/scripts
Modified Files:
check-updates
Log Message:
fix debug message
btw, debug output is enabled by default
Index: check-updates
===================================================================
RCS file: /cvs/fedora/fedora-security/tools/scripts/check-updates,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -r1.4 -r1.5
--- check-updates 25 Apr 2008 13:00:00 -0000 1.4
+++ check-updates 25 Apr 2008 13:12:25 -0000 1.5
@@ -69,7 +69,7 @@
}
if ($debug) {
- print " -> Found: ", grep($_ eq $update_nvr, @{ $u->{'_NVRs'} });
+ print " -> Found: ", grep(/^$entry->{component}-/, @{ $u->{'_NVRs'} });
}
# Modify the line accordingly
15 years, 12 months
fedora-security/tools/scripts check-updates, 1.3, 1.4
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/tools/scripts
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv16755/tools/scripts
Modified Files:
check-updates
Log Message:
Add support for using 'since' in check-updates. So far, only tracking bugs
were supported. That is pain, if we learn about some issue from submitted
update request (cough ... asterisk ... cough). At that time, updated packages
are already built and filing tracking bugs just for tracking purposes will just
annoy developer. You can now add '[since nvr]' to tracking file istead of
tracking bug id.
Index: check-updates
===================================================================
RCS file: /cvs/fedora/fedora-security/tools/scripts/check-updates,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- check-updates 14 Jan 2008 16:33:12 -0000 1.3
+++ check-updates 25 Apr 2008 13:00:00 -0000 1.4
@@ -10,23 +10,87 @@
use Libexig::Audit;
use Libexig::Bodhi;
+my $debug= 1;
+
# Parse the audit file
my $audit = new Libexig::Audit ({file => $ARGV[0]});
foreach my $entry (@{$audit->{audit}}) {
$entry->{'status'} eq 'VULNERABLE' or next;
- # See if the VULNERABLE bug was referenced by an update
+ # Check if we have some info to compare against
+ if (!defined($entry->{'bug'}) && !defined($entry->{'since'})) {
+ next;
+ }
+
+ if ($debug) {
+ print "Checking... $entry->{'cve'} $entry->{'component'}";
+ if (defined($entry->{'bug'})) {
+ print " #$entry->{'bug'}";
+ }
+ if (defined($entry->{'since'})) {
+ print " [since $entry->{'since'}]";
+ }
+ print "\n";
+ }
+
+ # Figure out if since is update id or nvr
+ my ($update_nvr, $update_id);
+ if (defined($entry->{'since'})) {
+ if ($entry->{'since'} =~ /^FEDORA-/) {
+ $update_id= $entry->{'since'};
+ } else {
+ $update_nvr= $entry->{'since'};
+ }
+ }
+
+ # Go through the updates
foreach my $u (Libexig::Bodhi::get_updates ($entry->{component})) {
- $u->{'_Bugs'}->{$entry->{bug}} or next;
+ if (
+ # See if the VULNERABLE bug was referenced by an update
+ (defined($entry->{'bug'}) &&
+ defined($u->{'_Bugs'}->{$entry->{bug}}) ) ||
+
+ # See if since Update ID was found
+ (defined($update_id) &&
+ defined($u->{'Update ID'}) &&
+ $u->{'Update ID'} eq $update_id ) ||
+
+ # See if since NVR was found
+ # TODO: check also higher NVRs to deal with obsoleted update
+ # requests?
+ (defined($update_nvr) &&
+ scalar(grep($_ eq $update_nvr, @{ $u->{'_NVRs'} })) > 0)
+ ) {
+ ; # update was found, do nothing
+ } else {
+ next; # try next update
+ }
+
+ if ($debug) {
+ print " -> Found: ", grep($_ eq $update_nvr, @{ $u->{'_NVRs'} });
+ }
+
# Modify the line accordingly
- $entry->{since} = $u->{'Update ID'};
- $u->{'Status'} eq 'stable' and $entry->{status} = 'fixed';
+ if (defined($u->{'Update ID'})) {
+ $entry->{'since'}= $u->{'Update ID'};
+ if ($debug) {
+ print " ($u->{'Update ID'})";
+ }
+ }
+ if ($u->{'Status'} eq 'stable') {
+ $entry->{status}= 'fixed';
+ }
Libexig::Audit::update_entry ($entry);
+ if ($debug) {
+ print " - status: $u->{'Status'}\n";
+ }
+
last;
};
}
$audit->save;
+
15 years, 12 months
fedora-security/audit f8, 1.207, 1.208 f9, 1.197, 1.198 fc7, 1.363, 1.364
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv19774/audit
Modified Files:
f8 f9 fc7
Log Message:
clamav cleanup
Index: f8
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f8,v
retrieving revision 1.207
retrieving revision 1.208
diff -u -r1.207 -r1.208
--- f8 25 Apr 2008 08:01:07 -0000 1.207
+++ f8 25 Apr 2008 09:07:57 -0000 1.208
@@ -253,8 +253,8 @@
CVE-2007-6601 fixed (postgresql, fixed 8.2.6) #427773 [since FEDORA-2008-0478]
CVE-2007-6600 fixed (postgresql, fixed 8.2.6) #427773 [since FEDORA-2008-0478]
CVE-2007-6598 ignore (dovecot) Needs knowledge of victim's password
-CVE-2007-6596 VULNERABLE (clamav) #427287 Might be considered a mail client flaw
-CVE-2007-6595 VULNERABLE (clamav) #427287
+CVE-2007-6596 ignore (clamav) Might be considered a mail client flaw, not security for upstream
+CVE-2007-6595 version (clamav, fixed 0.92.1) #427288 issue (2) not security for upstream
CVE-2007-6532 version (libxfcegui4) #412761 [since FEDORA-2007-4368]
CVE-2007-6531 version (xfce-panel) #412761 [since FEDORA-2007-4368]
CVE-2007-6465 version (ganglia, fixed 3.0.6) [since FEDORA-2007-4562]
@@ -319,6 +319,7 @@
CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) [since FEDORA-2007-3639]
CVE-2007-6067 fixed (postgresql, fixed 8.2.6) #427773 [since FEDORA-2008-0478]
CVE-2007-6061 VULNERABLE (audacity) #393251
+CVE-2007-6029 ignore (clamav) insufficient information about the issue
CVE-2007-6018 fixed (horde) #428628 [since FEDORA-2008-2040]
CVE-2007-6018 fixed (imp) #428632 [since FEDORA-2008-2040]
CVE-2007-6018 fixed (wordpress) #426433 [since FEDORA-2008-0103]
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.197
retrieving revision 1.198
diff -u -r1.197 -r1.198
--- f9 25 Apr 2008 08:01:07 -0000 1.197
+++ f9 25 Apr 2008 09:07:57 -0000 1.198
@@ -252,8 +252,8 @@
CVE-2007-6601 version (postgresql, fixed 8.2.6) #427774 [since postgresql-8.2.6-1.fc9]
CVE-2007-6600 version (postgresql, fixed 8.2.6) #427774 [since postgresql-8.2.6-1.fc9]
CVE-2007-6598 ignore (dovecot) Needs knowledge of victim's password
-CVE-2007-6596 VULNERABLE (clamav) #427289 Might be considered a mail client flaw
-CVE-2007-6595 VULNERABLE (clamav) #427289
+CVE-2007-6596 ignore (clamav) Might be considered a mail client flaw, not security for upstream
+CVE-2007-6595 version (clamav, fixed 0.92.1) #427289 issue (2) not security for upstream
CVE-2007-6465 version (ganglia, fixed 3.0.6) [since ganglia-3.0.6-1.fc9]
CVE-2007-6451 version (wireshark, fixed 0.99.7) [since wireshark-0.99.7-1.fc9]
CVE-2007-6450 version (wireshark, fixed 0.99.7) [since wireshark-0.99.7-1.fc9]
@@ -317,6 +317,7 @@
CVE-2007-6067 version (postgresql, fixed 8.2.6) #427774 [since postgresql-8.2.6-1.fc9]
CVE-2007-6061 VULNERABLE (audacity) #393251
CVE-2007-6035 version (cacti, fixed 0.8.7a) #392001 [since cacti-0.8.7a-1.fc9]
+CVE-2007-6029 ignore (clamav) insufficient information about the issue
CVE-2007-6018 version (horde, fixed 3.1.6) #428630 [since horde-3.1.6-1.fc9]
CVE-2007-6018 version (imp, fixed 4.1.6) #428634 [since imp-4.1.6-1.fc9]
CVE-2007-6018 VULNERABLE (wordpress) #426434
Index: fc7
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/fc7,v
retrieving revision 1.363
retrieving revision 1.364
diff -u -r1.363 -r1.364
--- fc7 25 Apr 2008 08:01:07 -0000 1.363
+++ fc7 25 Apr 2008 09:07:57 -0000 1.364
@@ -252,8 +252,8 @@
CVE-2007-6601 fixed (postgresql, fixed 8.2.6) #427772 [since FEDORA-2008-0552]
CVE-2007-6600 fixed (postgresql, fixed 8.2.6) #427772 [since FEDORA-2008-0552]
CVE-2007-6598 ignore (dovecot) Needs knowledge of victim's password
-CVE-2007-6596 VULNERABLE (clamav) #427288 Might be considered a mail client flaw
-CVE-2007-6595 VULNERABLE (clamav) #427288
+CVE-2007-6596 ignore (clamav) Might be considered a mail client flaw, not security for upstream
+CVE-2007-6595 version (clamav, fixed 0.92.1) #427287 issue (2) not security for upstream
CVE-2007-6532 version (libxfcegui4) #412751 [since FEDORA-2007-4385]
CVE-2007-6531 version (xfce-panel) #412751 [since FEDORA-2007-4385]
CVE-2007-6465 version (ganglia, fixed 3.0.6) [since FEDORA-2007-4584]
@@ -319,6 +319,7 @@
CVE-2007-6067 fixed (postgresql, fixed 8.2.6) #427772 [since FEDORA-2008-0552]
CVE-2007-6061 VULNERABLE (audacity) #393251
CVE-2007-6035 version (cacti, fixed 0.8.7a) #391981 [since FEDORA-2007-3683]
+CVE-2007-6029 ignore (clamav) insufficient information about the issue
CVE-2007-6018 fixed (horde) #428629 [since FEDORA-2008-2087]
CVE-2007-6018 fixed (imp) #428633 [since FEDORA-2008-2087]
CVE-2007-6018 fixed (wordpress) #426432 [since FEDORA-2008-0126]
15 years, 12 months
fedora-security/audit f8, 1.206, 1.207 f9, 1.196, 1.197 fc7, 1.362, 1.363
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6184/audit
Modified Files:
f8 f9 fc7
Log Message:
note one moin CVE id
Index: f8
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f8,v
retrieving revision 1.206
retrieving revision 1.207
diff -u -r1.206 -r1.207
--- f8 24 Apr 2008 18:18:18 -0000 1.206
+++ f8 25 Apr 2008 08:01:07 -0000 1.207
@@ -6,6 +6,7 @@
rhbz293031 fixed (nx) #293031 [since FEDORA-2008-2258]
rhbz249840 VULNERABLE (tor)
+CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only
CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443940
CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-2.fc8]
CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc8] PMASA-2008-3
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.196
retrieving revision 1.197
diff -u -r1.196 -r1.197
--- f9 24 Apr 2008 18:18:18 -0000 1.196
+++ f9 25 Apr 2008 08:01:07 -0000 1.197
@@ -5,6 +5,7 @@
# (mozilla) = (gecko-libs dependent stuff)
rhbz249840 VULNERABLE (tor)
+CVE-2008-1937 VULNERABLE (moin, fixed 1.6.3) [since moin-1.6.3-1.fc9]
CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443941
CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-8.1.fc9]
CVE-2008-1924 version (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc9] PMASA-2008-3
Index: fc7
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/fc7,v
retrieving revision 1.362
retrieving revision 1.363
diff -u -r1.362 -r1.363
--- fc7 24 Apr 2008 18:18:18 -0000 1.362
+++ fc7 25 Apr 2008 08:01:07 -0000 1.363
@@ -7,6 +7,7 @@
rhbz293031 fixed (nx) #293031 [since FEDORA-2008-2258]
rhbz249840 version (tor, fixed 0.1.2.15) #249840 [since FEDORA-2007-1674]
+CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only
CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443939
CVE-2008-1926 VULNERABLE (util-linux)
CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc7] PMASA-2008-3
15 years, 12 months
fedora-security/audit f8, 1.205, 1.206 f9, 1.195, 1.196 fc7, 1.361, 1.362
by fedora-security-commits@redhat.com
Author: thoger
Update of /cvs/fedora/fedora-security/audit
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv22448/audit
Modified Files:
f8 f9 fc7
Log Message:
update on clamav, note mksh in F9
Index: f8
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f8,v
retrieving revision 1.205
retrieving revision 1.206
diff -u -r1.205 -r1.206
--- f8 24 Apr 2008 15:12:04 -0000 1.205
+++ f8 24 Apr 2008 18:18:18 -0000 1.206
@@ -14,7 +14,7 @@
CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443055 nsf demuxer overflow
CVE-2008-1845 version (mksh, fixed 33d) [since FEDORA-2008-3174]
CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped
-CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442363
+CVE-2008-1836 ignore (clamav, fixed 0.93) affected code introduced after 0.92.1
CVE-2008-1835 ignore (clamav, fixed 0.93) unrar code not shipped
CVE-2008-1833 VULNERABLE (clamav, fixed 0.93-rc1) #442363
CVE-2008-1796 fixed (comix) [since FEDORA-2008-2981]
Index: f9
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/f9,v
retrieving revision 1.195
retrieving revision 1.196
diff -u -r1.195 -r1.196
--- f9 24 Apr 2008 15:12:04 -0000 1.195
+++ f9 24 Apr 2008 18:18:18 -0000 1.196
@@ -11,7 +11,7 @@
CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897
CVE-2008-1897 version (asterisk, fixed 1.6.0.beta3) [since asterisk-1.6.0-0.13.beta8.fc9]
CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443056 nsf demuxer overflow
-CVE-2008-1845 VULNERABLE (mksh, fixed 33d) [since mksh-33d-1.fc9] what is real impact on fedora?
+CVE-2008-1845 version (mksh, fixed 33d) [since mksh-33d-1.fc9] what is real impact on fedora?
CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped
CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442364
CVE-2008-1835 ignore (clamav, fixed 0.93) unrar code not shipped
Index: fc7
===================================================================
RCS file: /cvs/fedora/fedora-security/audit/fc7,v
retrieving revision 1.361
retrieving revision 1.362
diff -u -r1.361 -r1.362
--- fc7 24 Apr 2008 15:12:04 -0000 1.361
+++ fc7 24 Apr 2008 18:18:18 -0000 1.362
@@ -15,7 +15,7 @@
CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443054 nsf demuxer overflow
CVE-2008-1845 version (mksh, fixed 33d) [since FEDORA-2008-3070]
CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped
-CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442362
+CVE-2008-1836 ignore (clamav, fixed 0.93) affected code introduced after 0.92.1
CVE-2008-1835 ignore (clamav, fixed 0.93) unrar code not shipped
CVE-2008-1833 VULNERABLE (clamav, fixed 0.93-rc1) #442362
CVE-2008-1796 fixed (comix) [since FEDORA-2008-2993]
15 years, 12 months