security-commits April 2008

security-commits@lists.fedoraproject.org

1 participants
36 discussions

fedora-security/audit f8, 1.212, 1.213 f9, 1.202, 1.203 fc7, 1.368, 1.369
by fedora-security-commits＠redhat.com 29 Apr '08

29 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv21629/audit Modified Files: f8 f9 fc7 Log Message: update WebKit, note perl Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.212 retrieving revision 1.213 diff -u -r1.212 -r1.213 --- f8 28 Apr 2008 12:47:58 -0000 1.212 +++ f8 29 Apr 2008 08:26:54 -0000 1.213 @@ -11,6 +11,7 @@ CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only CVE-2008-1930 ignore (wordpress, fixed 2.5.1) [since wordpress-2.5.1-1.fc8] only for wp 2.5.0 CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443940 +CVE-2008-1927 VULNERABLE (perl) [since perl-5.8.8-39.fc8] CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-2.fc8] CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc8] PMASA-2008-3 CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897 @@ -127,7 +128,7 @@ CVE-2008-1066 fixed (gallery2) #438058 [since FEDORA-2008-2587] CVE-2008-1066 VULNERABLE (php-pear-PhpDocumentor) #438062 CVE-2008-1026 version (WebKit, fixed r31388) [since FEDORA-2008-3229] -**CVE-2008-1025 VULNERABLE (WebKit) may be fixed in SVN and hence in our packages +CVE-2008-1025 version (WebKit, fixed r31438) [since FEDORA-2008-3229] CVE-2008-1011 version (WebKit) [since FEDORA-2008-3229] CVE-2008-1010 version (WebKit) [since FEDORA-2008-3229] CVE-2008-0983 fixed (lighttpd) #435807 [since FEDORA-2008-2262] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.202 retrieving revision 1.203 diff -u -r1.202 -r1.203 --- f9 28 Apr 2008 12:47:58 -0000 1.202 +++ f9 29 Apr 2008 08:26:54 -0000 1.203 @@ -125,7 +125,7 @@ CVE-2008-1066 VULNERABLE (gallery2) #438060 CVE-2008-1066 VULNERABLE (php-pear-PhpDocumentor) #438064 CVE-2008-1026 version (WebKit, fixed r31388) [since WebKit-1.0.0-0.8.svn31787.fc9] -**CVE-2008-1025 VULNERABLE (WebKit) may be fixed in SVN and hence in our packages +CVE-2008-1025 version (WebKit, fixed r31438) [since WebKit-1.0.0-0.8.svn31787.fc9] CVE-2008-1011 version (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc9] CVE-2008-1010 version (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc9] CVE-2008-0983 backport (lighttpd) #435809 [since lighttpd-1.4.18-6.fc9] Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.368 retrieving revision 1.369 diff -u -r1.368 -r1.369 --- fc7 28 Apr 2008 12:47:58 -0000 1.368 +++ fc7 29 Apr 2008 08:26:54 -0000 1.369 @@ -12,6 +12,7 @@ CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only CVE-2008-1930 ignore (wordpress, fixed 2.5.1) [since wordpress-2.5.1-1.fc7] only for wp 2.5.0 CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443939 +CVE-2008-1927 VULNERABLE (perl) [since perl-5.8.8-29.fc7] CVE-2008-1926 VULNERABLE (util-linux) CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc7] PMASA-2008-3 CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897 @@ -128,7 +129,7 @@ CVE-2008-1066 fixed (gallery2) #438059 [since FEDORA-2008-2650] CVE-2008-1066 fixed (php-pear-PhpDocumentor) #438063 [since FEDORA-2008-2656] CVE-2008-1026 VULNERABLE (WebKit, fixed r31388) [since WebKit-1.0.0-0.8.svn31787.fc7] -**CVE-2008-1025 VULNERABLE (WebKit) may be fixed in SVN and hence in our packages +CVE-2008-1025 VULNERABLE (WebKit, fixed r31438) [since WebKit-1.0.0-0.8.svn31787.fc7] CVE-2008-1011 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7] CVE-2008-1010 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7] CVE-2008-0983 fixed (lighttpd) #435808 [since FEDORA-2008-2278]

1 0

fedora-security/audit f8, 1.211, 1.212 f9, 1.201, 1.202 fc7, 1.367, 1.368
by fedora-security-commits＠redhat.com 28 Apr '08

28 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv11655/audit Modified Files: f8 f9 fc7 Log Message: add zoneminder Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.211 retrieving revision 1.212 diff -u -r1.211 -r1.212 --- f8 28 Apr 2008 09:04:54 -0000 1.211 +++ f8 28 Apr 2008 12:47:58 -0000 1.212 @@ -61,6 +61,7 @@ CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442363 CVE-2008-1382 VULNERABLE (libpng, fixed 1.2.27) minimal impact, affected api rarely used CVE-2008-1382 VULNERABLE (libpng10) minimal impact, affected api rarely used +CVE-2008-1381 VULNERABLE (zoneminder, fixed 1.23.3) #444436 CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14) CVE-2008-1380 fixed (seamonkey, fixed 1.1.10) #442851 [since FEDORA-2008-3264] CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442856 Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.201 retrieving revision 1.202 diff -u -r1.201 -r1.202 --- f9 28 Apr 2008 09:04:54 -0000 1.201 +++ f9 28 Apr 2008 12:47:58 -0000 1.202 @@ -61,6 +61,7 @@ CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9] CVE-2008-1382 VULNERABLE (libpng, fixed 1.2.27) minimal impact, affected api rarely used CVE-2008-1382 VULNERABLE (libpng10) minimal impact, affected api rarely used +CVE-2008-1381 VULNERABLE (zoneminder, fixed 1.23.3) #444437 CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14) CVE-2008-1380 VULNERABLE (seamonkey, fixed 1.1.10) #442852 CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442857 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.367 retrieving revision 1.368 diff -u -r1.367 -r1.368 --- fc7 28 Apr 2008 09:04:54 -0000 1.367 +++ fc7 28 Apr 2008 12:47:58 -0000 1.368 @@ -62,6 +62,7 @@ CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442362 CVE-2008-1382 ignore (libpng, fixed 1.2.27) minimal impact, affected api rarely used CVE-2008-1382 ignore (libpng10) minimal impact, affected api rarely used +CVE-2008-1381 VULNERABLE (zoneminder, fixed 1.23.3) #444435 CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14) CVE-2008-1380 fixed (seamonkey, fixed 1.1.10) #442850 [since FEDORA-2008-3231] CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442855

1 0

fedora-security/audit f8, 1.210, 1.211 f9, 1.200, 1.201 fc7, 1.366, 1.367
by fedora-security-commits＠redhat.com 28 Apr '08

28 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv5100/audit Modified Files: f8 f9 fc7 Log Message: add kdelibs, kronolith, xine-lib, wordpress, some of them are non-issues for us Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.210 retrieving revision 1.211 diff -u -r1.210 -r1.211 --- f8 25 Apr 2008 15:23:13 -0000 1.210 +++ f8 28 Apr 2008 09:04:54 -0000 1.211 @@ -6,7 +6,10 @@ rhbz293031 fixed (nx) #293031 [since FEDORA-2008-2258] rhbz249840 VULNERABLE (tor) +CVE-2008-1974 VULNERABLE (kronolith, fixed 3.1.8) #444404 +CVE-2008-1964 ignore (xine-lib) bogus vulnerability report CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only +CVE-2008-1930 ignore (wordpress, fixed 2.5.1) [since wordpress-2.5.1-1.fc8] only for wp 2.5.0 CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443940 CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-2.fc8] CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc8] PMASA-2008-3 @@ -29,6 +32,9 @@ CVE-2008-1687 ignore (m4, fixed 1.4.11) not really a security issue CVE-2008-1686 fixed (libfishsound, fixed 0.9.1) #441247 [since FEDORA-2008-3059] CVE-2008-1686 fixed (speex) #442572 [since FEDORA-2008-3103] +CVE-2008-1671 ignore (kdelibs) start_kdeinit not setuid +CVE-2008-1670 ignore (kdelibs) kdelibs 4.x only +CVE-2008-1670 VULNERABLE (kdelibs4) #444399 kdelibs 4.x only CVE-2008-1658 fixed (PolicyKit) #439995 [since FEDORA-2008-2987] CVE-2008-1657 VULNERABLE (openssh, fixed 4.9) #440375 CVE-2008-1652 version (Perlbal, fixed 1.70) [since FEDORA-2008-2778] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.200 retrieving revision 1.201 diff -u -r1.200 -r1.201 --- f9 25 Apr 2008 15:23:13 -0000 1.200 +++ f9 28 Apr 2008 09:04:54 -0000 1.201 @@ -5,7 +5,10 @@ # (mozilla) = (gecko-libs dependent stuff) rhbz249840 VULNERABLE (tor) +CVE-2008-1974 VULNERABLE (kronolith, fixed 3.1.8) #444405 +CVE-2008-1964 ignore (xine-lib) bogus vulnerability report CVE-2008-1937 VULNERABLE (moin, fixed 1.6.3) [since moin-1.6.3-1.fc9] +CVE-2008-1930 ignore (wordpress, fixed 2.5.1) only for wp 2.5.0 CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443941 CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-8.1.fc9] CVE-2008-1924 version (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc9] PMASA-2008-3 @@ -30,6 +33,8 @@ CVE-2008-1687 ignore (m4, fixed 1.4.11) not really a security issue CVE-2008-1686 version (libfishsound, fixed 0.9.1) #441248 [since libfishsound-0.9.1-1.fc9] CVE-2008-1686 backport (speex) [since speex-1.2-0.7.beta3] +CVE-2008-1671 ignore (kdelibs) start_kdeinit not shipped +CVE-2008-1670 VULNERABLE (kdelibs) [since kdelibs-4.0.3-7.fc9] CVE-2008-1658 backport (PolicyKit) #439996 [since PolicyKit-0.7-7.fc9] CVE-2008-1657 version (openssh, fixed 4.9) #440376 [since openssh-5.0p1-1.fc9] CVE-2008-1652 version (Perlbal, fixed 1.70) [since Perlbal-1.70-1.fc9] Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.366 retrieving revision 1.367 diff -u -r1.366 -r1.367 --- fc7 25 Apr 2008 15:23:13 -0000 1.366 +++ fc7 28 Apr 2008 09:04:54 -0000 1.367 @@ -7,7 +7,10 @@ rhbz293031 fixed (nx) #293031 [since FEDORA-2008-2258] rhbz249840 version (tor, fixed 0.1.2.15) #249840 [since FEDORA-2007-1674] +CVE-2008-1974 VULNERABLE (kronolith, fixed 3.1.8) #444403 +CVE-2008-1964 ignore (xine-lib) bogus vulnerability report CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only +CVE-2008-1930 ignore (wordpress, fixed 2.5.1) [since wordpress-2.5.1-1.fc7] only for wp 2.5.0 CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443939 CVE-2008-1926 VULNERABLE (util-linux) CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc7] PMASA-2008-3 @@ -30,6 +33,9 @@ CVE-2008-1687 ignore (m4, fixed 1.4.11) not really a security issue CVE-2008-1686 VULNERABLE (libfishsound, fixed 0.9.1) #441246 [since FEDORA-2008-3117] CVE-2008-1686 fixed (speex) #442571 [since FEDORA-2008-3191] +CVE-2008-1671 ignore (kdelibs) start_kdeinit not setuid +CVE-2008-1670 ignore (kdelibs) kdelibs 4.x only +CVE-2008-1670 VULNERABLE (kdelibs4) #444398 kdelibs 4.x only CVE-2008-1657 VULNERABLE (openssh, fixed 4.9) #280461 CVE-2008-1652 version (Perlbal, fixed 1.70) [since FEDORA-2008-2788] CVE-2008-1637 fixed (pdns-recursor, fixed 3.1.5) #440248 [since FEDORA-2008-3010]

1 0

fedora-security/audit f8, 1.209, 1.210 f9, 1.199, 1.200 fc7, 1.365, 1.366
by fedora-security-commits＠redhat.com 25 Apr '08

25 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv10508/audit Modified Files: f8 f9 fc7 Log Message: misc cleanups Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.209 retrieving revision 1.210 diff -u -r1.209 -r1.210 --- f8 25 Apr 2008 13:24:29 -0000 1.209 +++ f8 25 Apr 2008 15:23:13 -0000 1.210 @@ -103,6 +103,7 @@ CVE-2008-1161 version (xine-lib, fixed 1.1.10.1) [since FEDORA-2008-1543] CVE-2008-1149 version (phpMyAdmin, fixed 2.11.5) [since FEDORA-2008-2189] CVE-2008-1145 version (ruby, fixed 1.8.6-p114) [since FEDORA-2008-2443] +CVE-2008-1136 version (vdccm, fixed 0.10.1) [since FEDORA-2008-0680] CVE-2008-1133 ignore (drupal) #435816 drupal 6.x only CVE-2008-1131 ignore (drupal) #435816 drupal 6.x only CVE-2008-1111 fixed (lighttpd) #435807 [since FEDORA-2008-2262] @@ -234,7 +235,7 @@ CVE-2008-0003 fixed (tog-pegasus, fixed 2.7.0) #427829 [since FEDORA-2008-0572] CVE-2008-0002 fixed (tomcat5) #432474 [since FEDORA-2008-1467] CVE-2007-6714 VULNERABLE (dbmail, fixed 2.2.9) #443021 -CVE-2007-6703 VULNERABLE (vdccm) #436025 +CVE-2007-6703 fixed (vdccm, fixed 0.10.1) #436026 [since FEDORA-2008-0680] CVE-2007-6698 version (openldap, fixed 2.3.36) CVE-2007-6697 fixed (SDL_image, fixed 1.2.7) #430241 [since FEDORA-2008-1208] CVE-2007-6693 version (gallery2, fixed 2.2.4) [since FEDORA-2007-4778] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.199 retrieving revision 1.200 diff -u -r1.199 -r1.200 --- f9 25 Apr 2008 13:24:29 -0000 1.199 +++ f9 25 Apr 2008 15:23:13 -0000 1.200 @@ -11,10 +11,10 @@ CVE-2008-1924 version (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc9] PMASA-2008-3 CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897 CVE-2008-1897 version (asterisk, fixed 1.6.0.beta3) [since asterisk-1.6.0-0.13.beta8.fc9] -CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443056 nsf demuxer overflow +CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443056 nsf demuxer overflow [since xine-lib-1.1.12-2.fc9] CVE-2008-1845 version (mksh, fixed 33d) [since mksh-33d-1.fc9] what is real impact on fedora? CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped -CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442364 +CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9] CVE-2008-1835 ignore (clamav, fixed 0.93) unrar code not shipped CVE-2008-1834 version (swfdec, fixed 0.6.4) [since swfdec-0.6.4-1.fc9] CVE-2008-1833 version (clamav, fixed 0.93-rc1) [since clamav-0.93-0.0.rc1.fc9] @@ -53,14 +53,14 @@ CVE-2008-1467 fixed (centerim) #438871 CVE-2008-1394 ignore (plone) CVE-2008-1390 version (asterisk, fixed 1.6.0-beta6) #438134 [since asterisk-1.6.0-0.6.beta6.fc9] -CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442364 +CVE-2008-1387 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9] CVE-2008-1382 VULNERABLE (libpng, fixed 1.2.27) minimal impact, affected api rarely used CVE-2008-1382 VULNERABLE (libpng10) minimal impact, affected api rarely used CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14) CVE-2008-1380 VULNERABLE (seamonkey, fixed 1.1.10) #442852 CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442857 CVE-2008-1374 ignore (cups) only affects old cups versions in RHEL -CVE-2008-1373 VULNERABLE (cups) #440041 +CVE-2008-1373 VULNERABLE (cups) #440041 [since cups-1.3.6-9.fc9] CVE-2008-1372 version (bzip2, fixed 1.0.5) [since bzip2-1.0.5-1.fc9] CVE-2008-1360 VULNERABLE (nagios) #437852 CVE-2008-1353 ignore (zabbix) #437848 Needs authorization @@ -102,12 +102,13 @@ CVE-2008-1149 version (phpMyAdmin, fixed 2.11.5) [since phpMyAdmin-2.11.5-1.fc9] CVE-2008-1145 version (ruby, fixed 1.8.6-p114) [since ruby-1.8.6.114-1.fc9] CVE-2008-1142 ignore (rxvt) http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=469296 +CVE-2008-1136 version (vdccm, fixed 0.10.1) [since vdccm-0.10.1-1.fc9] CVE-2008-1133 version (drupal, fixed 6.1) #435817 [since drupal-6.1-1.fc9] CVE-2008-1131 version (drupal, fixed 6.1) #435817 [since drupal-6.1-1.fc9] CVE-2008-1111 backport (lighttpd) #435809 [since lighttpd-1.4.18-6.fc9] CVE-2008-1110 version (xine-lib, fixed 1.1.10) [since xine-lib-1.1.10-2.fc9] -CVE-2008-1102 VULNERABLE (blender) #443937 -CVE-2008-1100 VULNERABLE (clamav, fixed 0.93) #442364 +CVE-2008-1102 VULNERABLE (blender) #443937 [since blender-2.45-12.fc9] +CVE-2008-1100 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9] CVE-2008-1099 version (moin, fixed 1.5.9) #438674 CVE-2008-1098 version (moin, fixed 1.5.9) #438674 CVE-2008-1078 VULNERABLE (am-utils) #437746 @@ -196,7 +197,7 @@ CVE-2008-0364 ignore (bittorrent) Windows only CVE-2008-0320 version (openoffice.org, fixed 2.4) CVE-2008-0318 fixed (clamav, fixed 0.92.1) -CVE-2008-0314 VULNERABLE (clamav, fixed 0.93) #442364 +CVE-2008-0314 VULNERABLE (clamav, fixed 0.93) #442364 [since clamav-0.93-1.fc9] CVE-2008-0304 version (seamonkey, fixed 1.1.8) [since seamonkey-1.1.8-3.fc9] CVE-2008-0304 version (thuderbird, fixed 2.0.0.12) [since thunderbird-2.0.0.12-1.fc9] CVE-2008-0299 fixed (python-paramiko) #428730 [since python-paramiko-1.7.1-3.fc9] @@ -230,8 +231,8 @@ CVE-2008-0005 version (httpd, fixed 2.2.8) #427984 [since httpd-2.2.8-2] CVE-2008-0003 version (tog-pegasus, fixed 2.7.0) CVE-2008-0002 VULNERABLE (tomcat5) #432476 -CVE-2007-6714 VULNERABLE (dbmail, fixed 2.2.9) #443022 -CVE-2007-6703 VULNERABLE (vdccm) #436027 +CVE-2007-6714 VULNERABLE (dbmail, fixed 2.2.9) #443022 [since dbmail-2.2.9-1.fc9] +CVE-2007-6703 version (vdccm, fixed 0.10.1) #436027 CVE-2007-6698 version (openldap, fixed 2.3.36) CVE-2007-6697 backport (SDL_image, fixed 1.2.7) #430238 [since SDL_image-1.2.6-4.fc9] CVE-2007-6693 version (gallery2, fixed 2.2.4) [since gallery2-2.2.4-1] Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.365 retrieving revision 1.366 diff -u -r1.365 -r1.366 --- fc7 25 Apr 2008 13:24:29 -0000 1.365 +++ fc7 25 Apr 2008 15:23:13 -0000 1.366 @@ -104,6 +104,7 @@ CVE-2008-1161 version (xine-lib, fixed 1.1.10.1) [since FEDORA-2008-1581] CVE-2008-1149 version (phpMyAdmin, fixed 2.11.5) [since FEDORA-2008-2229] CVE-2008-1145 version (ruby, fixed 1.8.6-p114) [since FEDORA-2008-2458] +CVE-2008-1136 VULNERABLE (vdccm, fixed 0.10.1) #436025 CVE-2008-1133 ignore (drupal) #435815 drupal 6.x only CVE-2008-1131 ignore (drupal) #435815 drupal 6.x only CVE-2008-1111 fixed (lighttpd) #435808 [since FEDORA-2008-2278] @@ -234,7 +235,7 @@ CVE-2008-0003 fixed (tog-pegasus, fixed 2.7.0) #427828 [since FEDORA-2008-0506] CVE-2008-0002 fixed (tomcat5) #432475 [since FEDORA-2008-1603] CVE-2007-6714 VULNERABLE (dbmail, fixed 2.2.9) #443020 -CVE-2007-6703 fixed (vdccm) #436026 [since FEDORA-2008-0680] +CVE-2007-6703 VULNERABLE (vdccm, fixed 0.10.1) #436025 CVE-2007-6698 fixed (openldap, fixed 2.3.36) #431409 [since FEDORA-2008-1307] CVE-2007-6697 fixed (SDL_image, fixed 1.2.7) #430239 [since FEDORA-2008-1231] CVE-2007-6693 version (gallery2, fixed 2.2.4) [since FEDORA-2007-4777]

1 0

fedora-security/audit f8, 1.208, 1.209 f9, 1.198, 1.199 fc7, 1.364, 1.365
by fedora-security-commits＠redhat.com 25 Apr '08

25 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv24140/audit Modified Files: f8 f9 fc7 Log Message: check-updates Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.208 retrieving revision 1.209 diff -u -r1.208 -r1.209 --- f8 25 Apr 2008 09:07:57 -0000 1.208 +++ f8 25 Apr 2008 13:24:29 -0000 1.209 @@ -11,7 +11,7 @@ CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-2.fc8] CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc8] PMASA-2008-3 CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897 -CVE-2008-1897 VULNERABLE (asterisk, fixed 1.4.19.1) [since asterisk-1.4.19.1-1.fc8] +CVE-2008-1897 VULNERABLE (asterisk, fixed 1.4.19.1) [since asterisk-1.4.19.1-1.fc8] CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443055 nsf demuxer overflow CVE-2008-1845 version (mksh, fixed 33d) [since FEDORA-2008-3174] CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped @@ -33,11 +33,11 @@ CVE-2008-1657 VULNERABLE (openssh, fixed 4.9) #440375 CVE-2008-1652 version (Perlbal, fixed 1.70) [since FEDORA-2008-2778] CVE-2008-1637 fixed (pdns-recursor, fixed 3.1.5) #440249 [since FEDORA-2008-3036] -CVE-2008-1628 VULNERABLE (audit) [since audit-1.6.8-4.fc8] +CVE-2008-1628 fixed (audit) [since FEDORA-2008-3012] CVE-2008-1614 version (mod_suphp, fixed 0.6.3) [since FEDORA-2008-2868] CVE-2008-1612 VULNERABLE (squid, fixed 2.6.STABLE19) [since FEDORA-2008-2740] CVE-2008-1568 fixed (comix) improper shell escaping, bz#430635 [since FEDORA-2008-2981] -CVE-2008-1567 VULNERABLE (phpmyadmin, fixed 2.11.5.1) +CVE-2008-1567 fixed (phpMyAdmin, fixed 2.11.5.1) [since FEDORA-2008-2825] CVE-2008-1563 fixed (wireshark, fixed 1.0) #435487 [since FEDORA-2008-3040] CVE-2008-1562 fixed (wireshark, fixed 1.0) #435487 [since FEDORA-2008-3040] CVE-2008-1561 fixed (wireshark, fixed 1.0) #435487 [since FEDORA-2008-3040] @@ -56,7 +56,7 @@ CVE-2008-1382 VULNERABLE (libpng, fixed 1.2.27) minimal impact, affected api rarely used CVE-2008-1382 VULNERABLE (libpng10) minimal impact, affected api rarely used CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14) -CVE-2008-1380 VULNERABLE (seamonkey, fixed 1.1.10) #442851 +CVE-2008-1380 fixed (seamonkey, fixed 1.1.10) #442851 [since FEDORA-2008-3264] CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442856 CVE-2008-1374 ignore (cups) only affects old cups versions in RHEL CVE-2008-1373 fixed (cups) #440040 [since FEDORA-2008-2131] @@ -197,7 +197,7 @@ CVE-2008-0404 fixed (mantis) #429552 [since FEDORA-2008-0796] CVE-2008-0386 fixed (xdg-utils) #429513 [since FEDORA-2008-1015] CVE-2008-0364 ignore (bittorrent) Windows only -CVE-2008-0320 VULNERABLE (openoffice.org, fixed 2.4) #442846 +CVE-2008-0320 fixed (openoffice.org, fixed 2.4) #442846 [since FEDORA-2008-3251] CVE-2008-0318 fixed (clamav, fixed 0.92.1) [since FEDORA-2008-1625] CVE-2008-0314 VULNERABLE (clamav, fixed 0.93) #442363 CVE-2008-0304 version (seamonkey, fixed 1.1.8) [since FEDORA-2008-1459] @@ -279,7 +279,7 @@ CVE-2007-6437 fixed (syslog-ng) #426306 [since FEDORA-2008-0523] CVE-2007-6430 version (asterisk, fixed 1.4.16) [since FEDORA-2007-4651] CVE-2007-6389 fixed (gnome-screensaver) #426170 [since FEDORA-2008-2872] -CVE-2007-6353 VULNERABLE (exiv2) #425923 +CVE-2007-6353 fixed (exiv2) #425923 [since FEDORA-2007-4551] CVE-2007-6352 fixed (libexif) #425631 [since FEDORA-2007-4667] CVE-2007-6351 fixed (libexif) #425631 [since FEDORA-2007-4667] CVE-2007-6350 fixed (scponly) #429731 [since FEDORA-2008-1728] rsync vector only @@ -360,9 +360,9 @@ CVE-2007-5760 fixed (xorg-x11-server, fixed 1.4.1) #429126 [since FEDORA-2008-0760] CVE-2007-5759 ignore (clamav, fixed 0.92) duplicate of CVE-2007-6335 CVE-2007-5751 backport (liferea, fixed 1.4.6) #360641 [since FEDORA-2007-2853] -CVE-2007-5747 VULNERABLE (openoffice.org, fixed 2.4) #442846 -CVE-2007-5746 VULNERABLE (openoffice.org, fixed 2.4) #442846 -CVE-2007-5745 VULNERABLE (openoffice.org, fixed 2.4) #442846 +CVE-2007-5747 fixed (openoffice.org, fixed 2.4) #442846 [since FEDORA-2008-3251] +CVE-2007-5746 fixed (openoffice.org, fixed 2.4) #442846 [since FEDORA-2008-3251] +CVE-2007-5745 fixed (openoffice.org, fixed 2.4) #442846 [since FEDORA-2008-3251] CVE-2007-5742 version (wesnoth, fixed 1.2.8) [since FEDORA-2007-3989] CVE-2007-5712 version (Django, fixed 0.96.1) #362771 [since FEDORA-2007-2788] CVE-2007-5708 version (openldap, fixed 2.3.39) #362991 [since FEDORA-2007-2796] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.198 retrieving revision 1.199 diff -u -r1.198 -r1.199 --- f9 25 Apr 2008 09:07:57 -0000 1.198 +++ f9 25 Apr 2008 13:24:29 -0000 1.199 @@ -38,7 +38,7 @@ CVE-2008-1614 version (mod_suphp, fixed 0.6.3) [since mod_suphp-0.6.3-1.fc9] CVE-2008-1612 ignore (squid, fixed 2.6.STABLE19) 3.0 was not affected CVE-2008-1568 fixed (comix) [since comix-3.6.4-6.fc9] -CVE-2008-1567 version (phpmyadmin, fixed 2.11.5.1) [since phpMyAdmin-2.11.5.1-1.fc9] +CVE-2008-1567 version (phpMyAdmin, fixed 2.11.5.1) [since phpMyAdmin-2.11.5.1-1.fc9] CVE-2008-1563 version (wireshark, fixed 1.0) #435488 [since wireshark-1.0.0-2.fc9] CVE-2008-1562 version (wireshark, fixed 1.0) #435488 [since wireshark-1.0.0-2.fc9] CVE-2008-1561 version (wireshark, fixed 1.0) #435488 [since wireshark-1.0.0-2.fc9] Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.364 retrieving revision 1.365 diff -u -r1.364 -r1.365 --- fc7 25 Apr 2008 09:07:57 -0000 1.364 +++ fc7 25 Apr 2008 13:24:29 -0000 1.365 @@ -12,7 +12,7 @@ CVE-2008-1926 VULNERABLE (util-linux) CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc7] PMASA-2008-3 CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897 -CVE-2008-1897 VULNERABLE (asterisk, fixed 1.4.19.1) [since asterisk-1.4.19.1-1.fc7] +CVE-2008-1897 VULNERABLE (asterisk, fixed 1.4.19.1) [since asterisk-1.4.19.1-1.fc7] CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443054 nsf demuxer overflow CVE-2008-1845 version (mksh, fixed 33d) [since FEDORA-2008-3070] CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped @@ -37,7 +37,7 @@ CVE-2008-1614 version (mod_suphp, fixed 0.6.3) [since FEDORA-2008-2815] CVE-2008-1612 backport (squid, fixed 2.6.STABLE19) [since FEDORA-2008-2729] CVE-2008-1568 fixed (comix) improper shell escaping, bz#430635 [since FEDORA-2008-2993] -CVE-2008-1567 VULNERABLE (phpmyadmin, fixed 2.11.5.1) +CVE-2008-1567 fixed (phpMyAdmin, fixed 2.11.5.1) [since FEDORA-2008-2874] CVE-2008-1563 fixed (wireshark, fixed 1.0) #435485 [since FEDORA-2008-2941] CVE-2008-1562 fixed (wireshark, fixed 1.0) #435485 [since FEDORA-2008-2941] CVE-2008-1561 fixed (wireshark, fixed 1.0) #435485 [since FEDORA-2008-2941] @@ -57,7 +57,7 @@ CVE-2008-1382 ignore (libpng, fixed 1.2.27) minimal impact, affected api rarely used CVE-2008-1382 ignore (libpng10) minimal impact, affected api rarely used CVE-2008-1380 VULNERABLE (firefox, fixed 2.0.0.14) -CVE-2008-1380 VULNERABLE (seamonkey, fixed 1.1.10) #442850 +CVE-2008-1380 fixed (seamonkey, fixed 1.1.10) #442850 [since FEDORA-2008-3231] CVE-2008-1380 VULNERABLE (thunderbird, fixed 2.0.0.14) #442855 CVE-2008-1374 ignore (cups) only affects old cups versions in RHEL CVE-2008-1373 fixed (cups) #440042 [since FEDORA-2008-2897] @@ -119,10 +119,10 @@ CVE-2008-1066 version (php-Smarty, fixed 2.6.19) #435812 [since FEDORA-2008-1928] CVE-2008-1066 fixed (gallery2) #438059 [since FEDORA-2008-2650] CVE-2008-1066 fixed (php-pear-PhpDocumentor) #438063 [since FEDORA-2008-2656] -CVE-2008-1026 VULNERABLE (WebKit, fixed r31388) [since WebKit-1.0.0-0.8.svn31787.fc7] +CVE-2008-1026 VULNERABLE (WebKit, fixed r31388) [since WebKit-1.0.0-0.8.svn31787.fc7] **CVE-2008-1025 VULNERABLE (WebKit) may be fixed in SVN and hence in our packages -CVE-2008-1011 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7] -CVE-2008-1010 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7] +CVE-2008-1011 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7] +CVE-2008-1010 VULNERABLE (WebKit) [since WebKit-1.0.0-0.8.svn31787.fc7] CVE-2008-0983 fixed (lighttpd) #435808 [since FEDORA-2008-2278] CVE-2008-0947 fixed (krb5, fixed 1.6.4) #438022 [since FEDORA-2008-2637] CVE-2008-0932 fixed (sword) #433725 [since FEDORA-2008-1951] why? diatheke.pl is not shipped...

1 0

fedora-security/tools/scripts check-updates, 1.4, 1.5
by fedora-security-commits＠redhat.com 25 Apr '08

25 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/tools/scripts In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv23562/tools/scripts Modified Files: check-updates Log Message: fix debug message btw, debug output is enabled by default Index: check-updates =================================================================== RCS file: /cvs/fedora/fedora-security/tools/scripts/check-updates,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- check-updates 25 Apr 2008 13:00:00 -0000 1.4 +++ check-updates 25 Apr 2008 13:12:25 -0000 1.5 @@ -69,7 +69,7 @@ } if ($debug) { - print " -> Found: ", grep($_ eq $update_nvr, @{ $u->{'_NVRs'} }); + print " -> Found: ", grep(/^$entry->{component}-/, @{ $u->{'_NVRs'} }); } # Modify the line accordingly

1 0

fedora-security/tools/scripts check-updates, 1.3, 1.4
by fedora-security-commits＠redhat.com 25 Apr '08

25 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/tools/scripts In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv16755/tools/scripts Modified Files: check-updates Log Message: Add support for using 'since' in check-updates. So far, only tracking bugs were supported. That is pain, if we learn about some issue from submitted update request (cough ... asterisk ... cough). At that time, updated packages are already built and filing tracking bugs just for tracking purposes will just annoy developer. You can now add '[since nvr]' to tracking file istead of tracking bug id. Index: check-updates =================================================================== RCS file: /cvs/fedora/fedora-security/tools/scripts/check-updates,v retrieving revision 1.3 retrieving revision 1.4 diff -u -r1.3 -r1.4 --- check-updates 14 Jan 2008 16:33:12 -0000 1.3 +++ check-updates 25 Apr 2008 13:00:00 -0000 1.4 @@ -10,23 +10,87 @@ use Libexig::Audit; use Libexig::Bodhi; +my $debug= 1; + # Parse the audit file my $audit = new Libexig::Audit ({file => $ARGV[0]}); foreach my $entry (@{$audit->{audit}}) { $entry->{'status'} eq 'VULNERABLE' or next; - # See if the VULNERABLE bug was referenced by an update + # Check if we have some info to compare against + if (!defined($entry->{'bug'}) && !defined($entry->{'since'})) { + next; + } + + if ($debug) { + print "Checking... $entry->{'cve'} $entry->{'component'}"; + if (defined($entry->{'bug'})) { + print " #$entry->{'bug'}"; + } + if (defined($entry->{'since'})) { + print " [since $entry->{'since'}]"; + } + print "\n"; + } + + # Figure out if since is update id or nvr + my ($update_nvr, $update_id); + if (defined($entry->{'since'})) { + if ($entry->{'since'} =~ /^FEDORA-/) { + $update_id= $entry->{'since'}; + } else { + $update_nvr= $entry->{'since'}; + } + } + + # Go through the updates foreach my $u (Libexig::Bodhi::get_updates ($entry->{component})) { - $u->{'_Bugs'}->{$entry->{bug}} or next; + if ( + # See if the VULNERABLE bug was referenced by an update + (defined($entry->{'bug'}) && + defined($u->{'_Bugs'}->{$entry->{bug}}) ) || + + # See if since Update ID was found + (defined($update_id) && + defined($u->{'Update ID'}) && + $u->{'Update ID'} eq $update_id ) || + + # See if since NVR was found + # TODO: check also higher NVRs to deal with obsoleted update + # requests? + (defined($update_nvr) && + scalar(grep($_ eq $update_nvr, @{ $u->{'_NVRs'} })) > 0) + ) { + ; # update was found, do nothing + } else { + next; # try next update + } + + if ($debug) { + print " -> Found: ", grep($_ eq $update_nvr, @{ $u->{'_NVRs'} }); + } + # Modify the line accordingly - $entry->{since} = $u->{'Update ID'}; - $u->{'Status'} eq 'stable' and $entry->{status} = 'fixed'; + if (defined($u->{'Update ID'})) { + $entry->{'since'}= $u->{'Update ID'}; + if ($debug) { + print " ($u->{'Update ID'})"; + } + } + if ($u->{'Status'} eq 'stable') { + $entry->{status}= 'fixed'; + } Libexig::Audit::update_entry ($entry); + if ($debug) { + print " - status: $u->{'Status'}\n"; + } + last; }; } $audit->save; +

1 0

fedora-security/audit f8, 1.207, 1.208 f9, 1.197, 1.198 fc7, 1.363, 1.364
by fedora-security-commits＠redhat.com 25 Apr '08

25 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv19774/audit Modified Files: f8 f9 fc7 Log Message: clamav cleanup Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.207 retrieving revision 1.208 diff -u -r1.207 -r1.208 --- f8 25 Apr 2008 08:01:07 -0000 1.207 +++ f8 25 Apr 2008 09:07:57 -0000 1.208 @@ -253,8 +253,8 @@ CVE-2007-6601 fixed (postgresql, fixed 8.2.6) #427773 [since FEDORA-2008-0478] CVE-2007-6600 fixed (postgresql, fixed 8.2.6) #427773 [since FEDORA-2008-0478] CVE-2007-6598 ignore (dovecot) Needs knowledge of victim's password -CVE-2007-6596 VULNERABLE (clamav) #427287 Might be considered a mail client flaw -CVE-2007-6595 VULNERABLE (clamav) #427287 +CVE-2007-6596 ignore (clamav) Might be considered a mail client flaw, not security for upstream +CVE-2007-6595 version (clamav, fixed 0.92.1) #427288 issue (2) not security for upstream CVE-2007-6532 version (libxfcegui4) #412761 [since FEDORA-2007-4368] CVE-2007-6531 version (xfce-panel) #412761 [since FEDORA-2007-4368] CVE-2007-6465 version (ganglia, fixed 3.0.6) [since FEDORA-2007-4562] @@ -319,6 +319,7 @@ CVE-2007-6100 version (phpMyAdmin, fixed 2.11.2.2) [since FEDORA-2007-3639] CVE-2007-6067 fixed (postgresql, fixed 8.2.6) #427773 [since FEDORA-2008-0478] CVE-2007-6061 VULNERABLE (audacity) #393251 +CVE-2007-6029 ignore (clamav) insufficient information about the issue CVE-2007-6018 fixed (horde) #428628 [since FEDORA-2008-2040] CVE-2007-6018 fixed (imp) #428632 [since FEDORA-2008-2040] CVE-2007-6018 fixed (wordpress) #426433 [since FEDORA-2008-0103] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.197 retrieving revision 1.198 diff -u -r1.197 -r1.198 --- f9 25 Apr 2008 08:01:07 -0000 1.197 +++ f9 25 Apr 2008 09:07:57 -0000 1.198 @@ -252,8 +252,8 @@ CVE-2007-6601 version (postgresql, fixed 8.2.6) #427774 [since postgresql-8.2.6-1.fc9] CVE-2007-6600 version (postgresql, fixed 8.2.6) #427774 [since postgresql-8.2.6-1.fc9] CVE-2007-6598 ignore (dovecot) Needs knowledge of victim's password -CVE-2007-6596 VULNERABLE (clamav) #427289 Might be considered a mail client flaw -CVE-2007-6595 VULNERABLE (clamav) #427289 +CVE-2007-6596 ignore (clamav) Might be considered a mail client flaw, not security for upstream +CVE-2007-6595 version (clamav, fixed 0.92.1) #427289 issue (2) not security for upstream CVE-2007-6465 version (ganglia, fixed 3.0.6) [since ganglia-3.0.6-1.fc9] CVE-2007-6451 version (wireshark, fixed 0.99.7) [since wireshark-0.99.7-1.fc9] CVE-2007-6450 version (wireshark, fixed 0.99.7) [since wireshark-0.99.7-1.fc9] @@ -317,6 +317,7 @@ CVE-2007-6067 version (postgresql, fixed 8.2.6) #427774 [since postgresql-8.2.6-1.fc9] CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 version (cacti, fixed 0.8.7a) #392001 [since cacti-0.8.7a-1.fc9] +CVE-2007-6029 ignore (clamav) insufficient information about the issue CVE-2007-6018 version (horde, fixed 3.1.6) #428630 [since horde-3.1.6-1.fc9] CVE-2007-6018 version (imp, fixed 4.1.6) #428634 [since imp-4.1.6-1.fc9] CVE-2007-6018 VULNERABLE (wordpress) #426434 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.363 retrieving revision 1.364 diff -u -r1.363 -r1.364 --- fc7 25 Apr 2008 08:01:07 -0000 1.363 +++ fc7 25 Apr 2008 09:07:57 -0000 1.364 @@ -252,8 +252,8 @@ CVE-2007-6601 fixed (postgresql, fixed 8.2.6) #427772 [since FEDORA-2008-0552] CVE-2007-6600 fixed (postgresql, fixed 8.2.6) #427772 [since FEDORA-2008-0552] CVE-2007-6598 ignore (dovecot) Needs knowledge of victim's password -CVE-2007-6596 VULNERABLE (clamav) #427288 Might be considered a mail client flaw -CVE-2007-6595 VULNERABLE (clamav) #427288 +CVE-2007-6596 ignore (clamav) Might be considered a mail client flaw, not security for upstream +CVE-2007-6595 version (clamav, fixed 0.92.1) #427287 issue (2) not security for upstream CVE-2007-6532 version (libxfcegui4) #412751 [since FEDORA-2007-4385] CVE-2007-6531 version (xfce-panel) #412751 [since FEDORA-2007-4385] CVE-2007-6465 version (ganglia, fixed 3.0.6) [since FEDORA-2007-4584] @@ -319,6 +319,7 @@ CVE-2007-6067 fixed (postgresql, fixed 8.2.6) #427772 [since FEDORA-2008-0552] CVE-2007-6061 VULNERABLE (audacity) #393251 CVE-2007-6035 version (cacti, fixed 0.8.7a) #391981 [since FEDORA-2007-3683] +CVE-2007-6029 ignore (clamav) insufficient information about the issue CVE-2007-6018 fixed (horde) #428629 [since FEDORA-2008-2087] CVE-2007-6018 fixed (imp) #428633 [since FEDORA-2008-2087] CVE-2007-6018 fixed (wordpress) #426432 [since FEDORA-2008-0126]

1 0

fedora-security/audit f8, 1.206, 1.207 f9, 1.196, 1.197 fc7, 1.362, 1.363
by fedora-security-commits＠redhat.com 25 Apr '08

25 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv6184/audit Modified Files: f8 f9 fc7 Log Message: note one moin CVE id Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.206 retrieving revision 1.207 diff -u -r1.206 -r1.207 --- f8 24 Apr 2008 18:18:18 -0000 1.206 +++ f8 25 Apr 2008 08:01:07 -0000 1.207 @@ -6,6 +6,7 @@ rhbz293031 fixed (nx) #293031 [since FEDORA-2008-2258] rhbz249840 VULNERABLE (tor) +CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443940 CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-2.fc8] CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc8] PMASA-2008-3 Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.196 retrieving revision 1.197 diff -u -r1.196 -r1.197 --- f9 24 Apr 2008 18:18:18 -0000 1.196 +++ f9 25 Apr 2008 08:01:07 -0000 1.197 @@ -5,6 +5,7 @@ # (mozilla) = (gecko-libs dependent stuff) rhbz249840 VULNERABLE (tor) +CVE-2008-1937 VULNERABLE (moin, fixed 1.6.3) [since moin-1.6.3-1.fc9] CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443941 CVE-2008-1926 VULNERABLE (util-linux-ng) [since util-linux-ng-2.13.1-8.1.fc9] CVE-2008-1924 version (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc9] PMASA-2008-3 Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.362 retrieving revision 1.363 diff -u -r1.362 -r1.363 --- fc7 24 Apr 2008 18:18:18 -0000 1.362 +++ fc7 25 Apr 2008 08:01:07 -0000 1.363 @@ -7,6 +7,7 @@ rhbz293031 fixed (nx) #293031 [since FEDORA-2008-2258] rhbz249840 version (tor, fixed 0.1.2.15) #249840 [since FEDORA-2007-1674] +CVE-2008-1937 ignore (moin, fixed 1.6.3) 1.6.x only CVE-2008-1928 VULNERABLE (perl-Imager, fixed 0.64) #443939 CVE-2008-1926 VULNERABLE (util-linux) CVE-2008-1924 VULNERABLE (phpMyAdmin, fixed 2.11.5.2) [since phpMyAdmin-2.11.5.2-1.fc7] PMASA-2008-3

1 0

fedora-security/audit f8, 1.205, 1.206 f9, 1.195, 1.196 fc7, 1.361, 1.362
by fedora-security-commits＠redhat.com 24 Apr '08

24 Apr '08

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv22448/audit Modified Files: f8 f9 fc7 Log Message: update on clamav, note mksh in F9 Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.205 retrieving revision 1.206 diff -u -r1.205 -r1.206 --- f8 24 Apr 2008 15:12:04 -0000 1.205 +++ f8 24 Apr 2008 18:18:18 -0000 1.206 @@ -14,7 +14,7 @@ CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443055 nsf demuxer overflow CVE-2008-1845 version (mksh, fixed 33d) [since FEDORA-2008-3174] CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped -CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442363 +CVE-2008-1836 ignore (clamav, fixed 0.93) affected code introduced after 0.92.1 CVE-2008-1835 ignore (clamav, fixed 0.93) unrar code not shipped CVE-2008-1833 VULNERABLE (clamav, fixed 0.93-rc1) #442363 CVE-2008-1796 fixed (comix) [since FEDORA-2008-2981] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.195 retrieving revision 1.196 diff -u -r1.195 -r1.196 --- f9 24 Apr 2008 15:12:04 -0000 1.195 +++ f9 24 Apr 2008 18:18:18 -0000 1.196 @@ -11,7 +11,7 @@ CVE-2008-1923 version (asterisk) upstream fix incomplete, resulting in CVE-2008-1897 CVE-2008-1897 version (asterisk, fixed 1.6.0.beta3) [since asterisk-1.6.0-0.13.beta8.fc9] CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443056 nsf demuxer overflow -CVE-2008-1845 VULNERABLE (mksh, fixed 33d) [since mksh-33d-1.fc9] what is real impact on fedora? +CVE-2008-1845 version (mksh, fixed 33d) [since mksh-33d-1.fc9] what is real impact on fedora? CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442364 CVE-2008-1835 ignore (clamav, fixed 0.93) unrar code not shipped Index: fc7 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/fc7,v retrieving revision 1.361 retrieving revision 1.362 diff -u -r1.361 -r1.362 --- fc7 24 Apr 2008 15:12:04 -0000 1.361 +++ fc7 24 Apr 2008 18:18:18 -0000 1.362 @@ -15,7 +15,7 @@ CVE-2008-1878 VULNERABLE (xine-lib, fixed 1.1.12.1) #443054 nsf demuxer overflow CVE-2008-1845 version (mksh, fixed 33d) [since FEDORA-2008-3070] CVE-2008-1837 ignore (clamav, fixed 0.93) unrar code not shipped -CVE-2008-1836 VULNERABLE (clamav, fixed 0.93) #442362 +CVE-2008-1836 ignore (clamav, fixed 0.93) affected code introduced after 0.92.1 CVE-2008-1835 ignore (clamav, fixed 0.93) unrar code not shipped CVE-2008-1833 VULNERABLE (clamav, fixed 0.93-rc1) #442362 CVE-2008-1796 fixed (comix) [since FEDORA-2008-2993]

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

security-commits April 2008