security-commits

security-commits@lists.fedoraproject.org

440 discussions

fedora-security/tools/lib/Libexig Fedora.pm, 1.11, 1.12
by fedora-security-commits＠redhat.com 03 Nov '09

03 Nov '09

Author: vdanen Update of /cvs/fedora/fedora-security/tools/lib/Libexig In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv8066/lib/Libexig Modified Files: Fedora.pm Log Message: fully handle the 'all' version type now Index: Fedora.pm =================================================================== RCS file: /cvs/fedora/fedora-security/tools/lib/Libexig/Fedora.pm,v retrieving revision 1.11 retrieving revision 1.12 diff -u -r1.11 -r1.12 --- Fedora.pm 22 Oct 2009 16:37:18 -0000 1.11 +++ Fedora.pm 3 Nov 2009 18:29:25 -0000 1.12 @@ -196,23 +196,14 @@ $bug{'short_desc'} .= " [Fedora $versions{$version}]"; $bug{'version'} = $versions{$version}; - if ($bug{'version'} eq 'all') { - my $allcomps = 1; - } else { - my $allcomps = 0; - } - $bug{'comment'} = $comment_head. $comment_parents. ($bug{'version'} eq 'rawhide' ? $comment_rawhide : $comment_update). ($bug{'version'} eq 'all' ? $comment_all : print '' ). $comment_tail; - if ($bug{'version'} eq 'all') { - $bug{'version'} = 'rawhide'; - } - push @retval, \%bug; + push @retval, \%bug; } return \@retval; @@ -235,11 +226,22 @@ my @created_bugs; my @created_versions; + + my $allcomps; my $comment = "Created Fedora tracking bugs for $component:\n\n"; foreach my $bug (@{$tracking_bugs}) { use Data::Dumper; + + if ($bug->{'version'} eq 'all') + { + $allcomps = 1; + $bug->{'version'} = 'rawhide'; + } else { + $allcomps = 0; + } + my $bug_id = $bugzilla->file_bug ($bug); if (!defined($bug_id)) { @@ -263,30 +265,33 @@ $bugzilla->add_comment ($bug_id, $tr_comment); - push @created_versions, $bug->{'version'}; + push @created_versions, $bug->{'version'}; } else { -# # XXX temporary until F9 BZ component is created XXX -# my $tr_comment = -# 'You can eventually use the following link to '. -# 'create the update request for upcoming Fedora 9: '."\n". -# 'https://admin.fedoraproject.org/updates/new/'. -# '?request=Stable'. -# '&type=security'. -# '&release=Fedora%209'. -# '&bugs='.$bug_id; -# -# foreach my $bug (@{$parent_bugs}) { -# $tr_comment .= ','.$bug; -# } -# -# $bugzilla->add_comment ($bug_id, $tr_comment); +# # This is for an "all" versioned issue so we can have our link + if ($allcomps == 1) + { + my $tr_comment = + 'This issue affects more than one Fedora version.'."\n". + 'You can eventually use the following link to '. + 'create the update request for each affected version: '."\n". + 'https://admin.fedoraproject.org/updates/new/'. + '?request=Stable'. + '&type_=security'. + '&bugs='.$bug_id; + + foreach my $bug (@{$parent_bugs}) { + $tr_comment .= ','.$bug; + } + + $bugzilla->add_comment ($bug_id, $tr_comment); + } push @created_versions, $rawhide_version; } $bugzilla->add_blockers ($bug_id, $parent_bugs); - if (my $allcomps eq 0) + if ($allcomps == 0) { $comment .= $bug->{'version'}.": bug #$bug_id\n"; } else {

1 0

fedora-security/tools/lib/Libexig Fedora.pm, 1.10, 1.11
by fedora-security-commits＠redhat.com 22 Oct '09

22 Oct '09

Author: vdanen Update of /cvs/fedora/fedora-security/tools/lib/Libexig In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv29522/lib/Libexig Modified Files: Fedora.pm Log Message: update to more recent Fedora versions, and add an 'all' version to file one tracker for multiple Fedora releases (still needs a little finesse) Index: Fedora.pm =================================================================== RCS file: /cvs/fedora/fedora-security/tools/lib/Libexig/Fedora.pm,v retrieving revision 1.10 retrieving revision 1.11 diff -u -r1.10 -r1.11 --- Fedora.pm 23 Feb 2009 15:35:14 -0000 1.10 +++ Fedora.pm 22 Oct 2009 16:37:18 -0000 1.11 @@ -112,6 +112,13 @@ 'commit message.'. "\n\n"; +my $comment_all = + "\n". + 'Please note: this issue affects all currently supported versions of '. + 'Fedora. Only one tracking bug has been filed; you should use it for '. + 'all affected versions.'. + "\n\n"; + my %priorities = ( 'urgent', => 4, 'high', => 3, @@ -121,19 +128,20 @@ # Valid versions my %versions = ( - '9', => '9', - 'f9', => '9', - 'fc9', => '9', '10', => '10', 'f10', => '10', 'fc10', => '10', - '11', => 'rawhide', - 'f11', => 'rawhide', - 'fc11', => 'rawhide', + '11', => '11', + 'f11', => '11', + 'fc11', => '11', + '12', => 'rawhide', + 'f12', => 'rawhide', + 'fc12', => 'rawhide', 'devel', => 'rawhide', + 'all', => 'all' ); -my $rawhide_version= '11'; +my $rawhide_version= '12'; sub tracking_bugs { @@ -188,11 +196,21 @@ $bug{'short_desc'} .= " [Fedora $versions{$version}]"; $bug{'version'} = $versions{$version}; + if ($bug{'version'} eq 'all') { + my $allcomps = 1; + } else { + my $allcomps = 0; + } + $bug{'comment'} = $comment_head. $comment_parents. ($bug{'version'} eq 'rawhide' ? $comment_rawhide : $comment_update). + ($bug{'version'} eq 'all' ? $comment_all : print '' ). $comment_tail; + if ($bug{'version'} eq 'all') { + $bug{'version'} = 'rawhide'; + } push @retval, \%bug; } @@ -268,7 +286,12 @@ } $bugzilla->add_blockers ($bug_id, $parent_bugs); - $comment .= $bug->{'version'}.": bug #$bug_id\n"; + if (my $allcomps eq 0) + { + $comment .= $bug->{'version'}.": bug #$bug_id\n"; + } else { + $comment .= "All versions: bug #$bug_id\n"; + } push @created_bugs, $bug_id; }

1 0

fedora-security/tools/scripts add-tracking-bugs, 1.4, 1.5
by fedora-security-commits＠redhat.com 22 Oct '09

22 Oct '09

Author: vdanen Update of /cvs/fedora/fedora-security/tools/scripts In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv29522/scripts Modified Files: add-tracking-bugs Log Message: update to more recent Fedora versions, and add an 'all' version to file one tracker for multiple Fedora releases (still needs a little finesse) Index: add-tracking-bugs =================================================================== RCS file: /cvs/fedora/fedora-security/tools/scripts/add-tracking-bugs,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- add-tracking-bugs 26 Aug 2008 11:31:14 -0000 1.4 +++ add-tracking-bugs 22 Oct 2009 16:37:18 -0000 1.5 @@ -6,7 +6,7 @@ my $usage = 'add-tracking-bugs [options...] --bugs=<bug>[,...] Parent bugs - --versions=<ver>[,...] Affected Fedora versions + --versions=<ver>[,...] Affected Fedora versions (use "all" for all supported releases) --component=<pkg> Affected package, to find owner to CC (mandatory) --username=<username> Bugzilla login (defaults to $LOGNAME(a)redhat.com) --password=<password> Bugzilla passwords (asks for it, if not supplied)

1 0

fedora-security/audit f11,1.8,1.9
by fedora-security-commits＠redhat.com 09 Sep '09

09 Sep '09

Author: vdanen Update of /cvs/fedora/fedora-security/audit In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv10992 Modified Files: f11 Log Message: update Index: f11 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f11,v retrieving revision 1.8 retrieving revision 1.9 diff -u -r1.8 -r1.9 --- f11 26 May 2009 08:01:02 -0000 1.8 +++ f11 9 Sep 2009 16:40:56 -0000 1.9 @@ -1,9 +1,13 @@ # $Id$ # ** are items that need attention -# *CVE are items that need verification for Fedora 10 +# *CVE are items that need verification for Fedora 11 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0922 version (postgresql) [since postgresql-8.3.7-1.fc11] +CVE-2009-0887 version (pam) [since pam-1.0.91-1.fc11] +CVE-2009-0847 backport (krb5) [since krb5-1.6.3-20.fc11] +CVE-2009-0846 backport (krb5) [since krb5-1.6.3-20.fc11] CVE-2009-0845 backport (krb5) [since krb5-1.6.3-19.fc11] CVE-2009-0819 version (mysql) [since mysql-5.1.32-1.fc11] CVE-2009-0749 version (optipng, fixed 0.6.2.1) [since optipng-0.6.2.1-1.fc11] @@ -21,6 +25,7 @@ CVE-2009-0582 VULNERABLE (evolution-data-server, fixed 2.26.0) [since evolution-data-server-2.26.0-1.fc11] CVE-2009-0581 VULNERABLE (lcms, fixed 1.18) #491274 CVE-2009-0578 version (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc11] +CVE-2009-0579 backport (pam) [since pam-1.0.90-4.fc11] CVE-2009-0577 ignore (cups) not affected CVE-2009-0547 VULNERABLE (evolution) CVE-2009-0547 VULNERABLE (evolution-data-server, fixed 2.26.0) [since evolution-data-server-2.26.0-1.fc11]

1 0

fedora-security/audit f10, 1.36, 1.37 f11, 1.7, 1.8 f9, 1.246, 1.247
by fedora-security-commits＠redhat.com 26 May '09

26 May '09

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv30446/audit Modified Files: f10 f11 f9 Log Message: bunch of old changes i failed to commit previously these files are not really maintained any more :-( Index: f10 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f10,v retrieving revision 1.36 retrieving revision 1.37 diff -u -r1.36 -r1.37 --- f10 6 Mar 2009 19:45:04 -0000 1.36 +++ f10 26 May 2009 08:01:02 -0000 1.37 @@ -4,16 +4,26 @@ # *CVE are items that need verification for Fedora 10 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0845 VULNERABLE (krb5) [since krb5-1.6.3-17.fc10] CVE-2009-0819 ignore (mysql) 5.1+ only CVE-2009-0749 fixed (optipng, fixed 0.6.2.1) [since FEDORA-2009-2100] CVE-2009-0737 fixed (mediawiki, fixed 1.13.4) [since FEDORA-2009-2231] +CVE-2009-0733 VULNERABLE (lcms, fixed 1.18) #491273 +CVE-2009-0723 VULNERABLE (lcms, fixed 1.18) #491273 CVE-2009-0671 ignore (uw-imap) rejected, fake report CVE-2009-0601 ignore (wireshark, fixed 1.0.6) not security CVE-2009-0600 fixed (wireshark, fixed 1.0.6) [since FEDORA-2009-1798] CVE-2009-0599 fixed (wireshark, fixed 1.0.6) [since FEDORA-2009-1798] -CVE-2009-0578 VULNERABLE (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc10] +CVE-2009-0587 ignore (evolution-data-server) only old EDS versions affected +CVE-2009-0585 ignore (libsoup) not affected +CVE-2009-0584 fixed (ghostscript) #491277 [since FEDORA-2009-2885] +CVE-2009-0583 fixed (ghostscript) #491277 [since FEDORA-2009-2885] +CVE-2009-0582 fixed (evolution-data-server, fixed 2.26.0) [since FEDORA-2009-2784] +CVE-2009-0581 VULNERABLE (lcms, fixed 1.18) #491273 +CVE-2009-0578 fixed (NetworkManager, 0.7.0.99) [since FEDORA-2009-2419] CVE-2009-0577 ignore (cups) not affected CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0547 fixed (evolution-data-server, fixed 2.26.0) [since FEDORA-2009-2784] CVE-2009-0544 fixed (python-crypto) [since FEDORA-2009-1687] CVE-2009-0543 ignore (proftpd) not affected CVE-2009-0542 VULNERABLE (proftpd) #485130 @@ -22,12 +32,12 @@ CVE-2009-0500 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1699] CVE-2009-0499 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1699] CVE-2009-0490 VULNERABLE (audacity, fixed 1.3.6) #484952 -CVE-2009-0486 VULNERABLE (bugzilla, fixed 3.0.8) #484756 -CVE-2009-0485 VULNERABLE (bugzilla, fixed 3.0.7) #484756 -CVE-2009-0484 VULNERABLE (bugzilla, fixed 3.0.7) #484756 -CVE-2009-0483 VULNERABLE (bugzilla, fixed 3.0.7) #484756 -CVE-2009-0482 VULNERABLE (bugzilla, fixed 3.2.1) #484756 -CVE-2009-0481 VULNERABLE (bugzilla, fixed 3.0.7) #484756 +CVE-2009-0486 fixed (bugzilla, fixed 3.0.8) #484756 [since FEDORA-2009-2417] +CVE-2009-0485 fixed (bugzilla, fixed 3.0.7) #484756 [since FEDORA-2009-2417] +CVE-2009-0484 fixed (bugzilla, fixed 3.0.7) #484756 [since FEDORA-2009-2417] +CVE-2009-0483 fixed (bugzilla, fixed 3.0.7) #484756 [since FEDORA-2009-2417] +CVE-2009-0482 fixed (bugzilla, fixed 3.2.1) #484756 [since FEDORA-2009-2417] +CVE-2009-0481 fixed (bugzilla, fixed 3.0.7) #484756 [since FEDORA-2009-2417] CVE-2009-0415 fixed (trickle) [since FEDORA-2009-1694] CVE-2009-0414 fixed (tor, fixed 0.2.0.33) [since FEDORA-2009-0917] CVE-2009-0413 fixed (roundcubemail) [since FEDORA-2009-1204] @@ -35,8 +45,8 @@ CVE-2009-0397 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1213] CVE-2009-0387 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1213] CVE-2009-0386 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1213] -CVE-2009-0368 VULNERABLE (opensc, fixed 0.11.7) [since opensc-0.11.7-1.fc10] -CVE-2009-0365 VULNERABLE (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc10] +CVE-2009-0368 fixed (opensc, fixed 0.11.7) [since FEDORA-2009-2266] +CVE-2009-0365 fixed (NetworkManager, 0.7.0.99) [since FEDORA-2009-2419] CVE-2009-0362 fixed (fail2ban) [since FEDORA-2009-1737] CVE-2009-0361 ignore (pam_krb5) not affected CVE-2009-0360 ignore (pam_krb5) not affected @@ -57,9 +67,9 @@ CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific CVE-2009-0041 fixed (asterisk, fixed 1.6.0.5) [since FEDORA-2009-0984] AST-2009-001 CVE-2009-0040 fixed (libpng, fixed 1.2.35,1.0.43) [since FEDORA-2009-2112] -CVE-2009-0040 VULNERABLE (libpng10, fixed 1.2.35,1.0.43) [since libpng10-1.0.43-1.fc10] +CVE-2009-0040 fixed (libpng10, fixed 1.2.35,1.0.43) [since FEDORA-2009-1976] CVE-2009-0040 fixed (mingw32-libpng, fixed 1.2.35,1.0.43) [since FEDORA-2009-2131] -CVE-2009-0037 VULNERABLE (curl, fixed 7.19.4) #48870 +CVE-2009-0037 fixed (curl, fixed 7.19.4) #488170 [since FEDORA-2009-2247] CVE-2009-0036 ignore (libvirt) libvirt_proxy not shipped CVE-2009-0034 fixed (sudo) [since FEDORA-2009-1074] CVE-2009-0032 ignore (cups) Mandriva-specific @@ -70,7 +80,7 @@ CVE-2008-6229 fixed (drupal-cck, fixed 6.x.2.0) [since FEDORA-2008-10143] CVE-2008-6125 version (moodle) CVE-2008-6123 fixed (net-snmp) [since FEDORA-2009-1769] -CVE-2008-6098 VULNERABLE (bugzilla, fixed 3.0.6) #484756 +CVE-2008-6098 fixed (bugzilla, fixed 3.0.6) #484756 [since FEDORA-2009-2417] CVE-2008-6059 VULNERABLE (WebKit) [since WebKit-1.1.0-0.14.svn40351.fc10] CVE-2008-6020 fixed (drupal-views, fixed 6.x-2.2) [since FEDORA-2008-11578] CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) @@ -78,7 +88,9 @@ CVE-2008-5906 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] CVE-2008-5905 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7 +CVE-2008-5843 fixed (pdfjam, fixed 1.21) [since FEDORA-2009-2651] CVE-2008-5744 ignore (zaptel) kernel modules not shipped +CVE-2008-5743 fixed (pdfjam, fixed 1.21) [since FEDORA-2009-2651] CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2) CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed CVE-2008-5714 VULNERABLE (kvm) @@ -188,7 +200,7 @@ CVE-2008-4577 version (dovecot, fixed 1.1.14) [since dovecot-1.1.5-1.fc10] CVE-2008-4575 version (jhead, fixed 2.84) [since jhead-2.84-1.fc10] CVE-2008-4474 fixed (freeradius) [since FEDORA-2008-10392] dialupadmin subpackage dropped -CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484756 +CVE-2008-4437 fixed (bugzilla, fixed 3.0.5) #484756 [since FEDORA-2009-2417] CVE-2008-4434 ignore (bittorrent) 6.x only CVE-2008-4422 backport (libxml2, fixed 2.7.2) [since libxml2-2.7.1-2.fc10] CVE-2008-4408 version (mediawiki, fixed 1.13.2) [since mediawiki-1.13.2-41.fc10] @@ -197,6 +209,7 @@ CVE-2008-4359 version (lighttpd, fixed 1.4.20) #465754 [since lighttpd-1.4.20-1.fc10] CVE-2008-4326 version (phpMyAdmin, fixed 2.11.9.2) [since phpMyAdmin-2.11.9.2-1.fc10] CVE-2008-4325 version (viewvc, fixed 1.0.6) [since viewvc-1.0.6-1.fc10] +CVE-2008-4316 VULNERABLE (glib2) [since glib2-2.18.4-2.fc10] CVE-2008-4315 VULNERABLE (tog-pegasus) [since FEDORA-2008-10061] CVE-2008-4314 fixed (samba, fixed 3.0.33,3.2.5) [since FEDORA-2008-10612] CVE-2008-4313 VULNERABLE (tog-pegasus) [since FEDORA-2008-10061] Index: f11 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f11,v retrieving revision 1.7 retrieving revision 1.8 diff -u -r1.7 -r1.8 --- f11 6 Mar 2009 19:45:04 -0000 1.7 +++ f11 26 May 2009 08:01:02 -0000 1.8 @@ -4,16 +4,26 @@ # *CVE are items that need verification for Fedora 10 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0845 backport (krb5) [since krb5-1.6.3-19.fc11] CVE-2009-0819 version (mysql) [since mysql-5.1.32-1.fc11] CVE-2009-0749 version (optipng, fixed 0.6.2.1) [since optipng-0.6.2.1-1.fc11] CVE-2009-0737 version (mediawiki, fixed 1.13.4) [since mediawiki-1.14.0-45.fc11] +CVE-2009-0733 VULNERABLE (lcms, fixed 1.18) #491274 +CVE-2009-0723 VULNERABLE (lcms, fixed 1.18) #491274 CVE-2009-0671 ignore (uw-imap) rejected, fake report CVE-2009-0601 ignore (wireshark, fixed 1.0.6) not security CVE-2009-0600 version (wireshark, fixed 1.0.6) CVE-2009-0599 version (wireshark, fixed 1.0.6) +CVE-2009-0587 ignore (evolution-data-server) only old EDS versions affected +CVE-2009-0585 ignore (libsoup) not affected +CVE-2009-0584 VULNERABLE (ghostscript) #491278 +CVE-2009-0583 VULNERABLE (ghostscript) #491278 +CVE-2009-0582 VULNERABLE (evolution-data-server, fixed 2.26.0) [since evolution-data-server-2.26.0-1.fc11] +CVE-2009-0581 VULNERABLE (lcms, fixed 1.18) #491274 CVE-2009-0578 version (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc11] CVE-2009-0577 ignore (cups) not affected CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0547 VULNERABLE (evolution-data-server, fixed 2.26.0) [since evolution-data-server-2.26.0-1.fc11] CVE-2009-0544 version (python-crypto) [since python-crypto-2.0.1-16.1] CVE-2009-0543 ignore (proftpd) not affected CVE-2009-0542 VULNERABLE (proftpd) #485131 @@ -70,7 +80,9 @@ CVE-2008-5906 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] CVE-2008-5905 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7 +CVE-2008-5843 version (pdfjam, fixed 1.21) [since pdfjam-1.21-1.fc11] CVE-2008-5744 ignore (zaptel) kernel modules not shipped +CVE-2008-5743 version (pdfjam, fixed 1.21) [since pdfjam-1.21-1.fc11] CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2) CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed CVE-2008-5714 VULNERABLE (kvm) @@ -145,6 +157,7 @@ CVE-2008-4640 version (jhead) [since jhead-2.86-1.fc11] CVE-2008-4437 version (bugzilla, fixed 3.0.5) #484758 [since bugzilla-3.0.8-1.fc11] CVE-2008-4405 VULNERABLE (xen) +CVE-2008-4316 VULNERABLE (glib2) [since glib2-2.19.10-2.fc11] CVE-2008-4315 fixed (tog-pegasus) [since tog-pegasus-2.7.2-2.fc11] CVE-2008-4314 version (samba, fixed 3.0.33,3.2.5) [since samba-3.2.5-0.23.fc11] CVE-2008-4313 fixed (tog-pegasus) [since tog-pegasus-2.7.2-2.fc11] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.246 retrieving revision 1.247 diff -u -r1.246 -r1.247 --- f9 6 Mar 2009 19:45:04 -0000 1.246 +++ f9 26 May 2009 08:01:02 -0000 1.247 @@ -5,16 +5,26 @@ # (mozilla) = (gecko-libs dependent stuff) rhbz249840 version (tor, fixed 0.1.2.15) +CVE-2009-0845 VULNERABLE (krb5) [since krb5-1.6.3-15.fc9] CVE-2009-0819 ignore (mysql) 5.1+ only CVE-2009-0749 fixed (optipng, fixed 0.6.2.1) [since FEDORA-2009-2098] CVE-2009-0737 fixed (mediawiki, fixed 1.13.4) [since FEDORA-2009-2237] +CVE-2009-0733 VULNERABLE (lcms, fixed 1.18) #491272 +CVE-2009-0723 VULNERABLE (lcms, fixed 1.18) #491272 CVE-2009-0671 ignore (uw-imap) rejected, fake report CVE-2009-0601 ignore (wireshark, fixed 1.0.6) not security -CVE-2009-0600 VULNERABLE (wireshark, fixed 1.0.6) [since wireshark-1.0.6-1.fc9] -CVE-2009-0599 VULNERABLE (wireshark, fixed 1.0.6) [since wireshark-1.0.6-1.fc9] -CVE-2009-0578 VULNERABLE (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc9] +CVE-2009-0600 fixed (wireshark, fixed 1.0.6) [since FEDORA-2009-1877] +CVE-2009-0599 fixed (wireshark, fixed 1.0.6) [since FEDORA-2009-1877] +CVE-2009-0587 ignore (evolution-data-server) only old EDS versions affected +CVE-2009-0585 ignore (libsoup) not affected +CVE-2009-0584 fixed (ghostscript) #491276 [since FEDORA-2009-2883] +CVE-2009-0583 fixed (ghostscript) #491276 [since FEDORA-2009-2883] +CVE-2009-0582 fixed (evolution-data-server, fixed 2.26.0) [since FEDORA-2009-2792] +CVE-2009-0581 VULNERABLE (lcms, fixed 1.18) #491272 +CVE-2009-0578 fixed (NetworkManager, 0.7.0.99) [since FEDORA-2009-2420] CVE-2009-0577 ignore (cups) not affected CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0547 fixed (evolution-data-server, fixed 2.26.0) [since FEDORA-2009-2792] CVE-2009-0544 fixed (python-crypto) [since FEDORA-2009-1680] CVE-2009-0543 ignore (proftpd) not affected CVE-2009-0542 VULNERABLE (proftpd) #485129 @@ -23,12 +33,12 @@ CVE-2009-0500 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1641] CVE-2009-0499 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1641] CVE-2009-0490 VULNERABLE (audacity, fixed 1.3.6) #484953 -CVE-2009-0486 VULNERABLE (bugzilla, fixed 3.0.8) #484757 -CVE-2009-0485 VULNERABLE (bugzilla, fixed 3.0.7) #484757 -CVE-2009-0484 VULNERABLE (bugzilla, fixed 3.0.7) #484757 -CVE-2009-0483 VULNERABLE (bugzilla, fixed 3.0.7) #484757 -CVE-2009-0482 VULNERABLE (bugzilla, fixed 3.2.1) #484757 -CVE-2009-0481 VULNERABLE (bugzilla, fixed 3.0.7) #484757 +CVE-2009-0486 fixed (bugzilla, fixed 3.0.8) #484757 [since FEDORA-2009-2418] +CVE-2009-0485 fixed (bugzilla, fixed 3.0.7) #484757 [since FEDORA-2009-2418] +CVE-2009-0484 fixed (bugzilla, fixed 3.0.7) #484757 [since FEDORA-2009-2418] +CVE-2009-0483 fixed (bugzilla, fixed 3.0.7) #484757 [since FEDORA-2009-2418] +CVE-2009-0482 fixed (bugzilla, fixed 3.2.1) #484757 [since FEDORA-2009-2418] +CVE-2009-0481 fixed (bugzilla, fixed 3.0.7) #484757 [since FEDORA-2009-2418] CVE-2009-0415 fixed (trickle) [since FEDORA-2009-1675] CVE-2009-0414 fixed (tor, fixed 0.2.0.33) [since FEDORA-2009-0897] CVE-2009-0413 fixed (roundcubemail) [since FEDORA-2009-1256] @@ -36,8 +46,8 @@ CVE-2009-0397 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1343] CVE-2009-0387 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1343] CVE-2009-0386 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1343] -CVE-2009-0368 VULNERABLE (opensc, fixed 0.11.7) [since opensc-0.11.7-1.fc9] -CVE-2009-0365 VULNERABLE (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc9] +CVE-2009-0368 fixed (opensc, fixed 0.11.7) [since FEDORA-2009-2267] +CVE-2009-0365 fixed (NetworkManager, 0.7.0.99) [since FEDORA-2009-2420] CVE-2009-0362 fixed (fail2ban) [since FEDORA-2009-1736] CVE-2009-0361 ignore (pam_krb5) not affected CVE-2009-0360 ignore (pam_krb5) not affected @@ -58,7 +68,7 @@ CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific CVE-2009-0041 fixed (asterisk, fixed 1.6.0.5) [since FEDORA-2009-0973] AST-2009-001 CVE-2009-0040 fixed (libpng, fixed 1.2.35,1.0.43) [since FEDORA-2009-2128] -CVE-2009-0040 VULNERABLE (libpng10, fixed 1.2.35,1.0.43) [since libpng10-1.0.43-1.fc9] +CVE-2009-0040 fixed (libpng10, fixed 1.2.35,1.0.43) [since FEDORA-2009-2045] CVE-2009-0037 fixed (curl, fixed 7.19.4) #488169 [since FEDORA-2009-2265] CVE-2009-0036 ignore (libvirt) libvirt_proxy not shipped CVE-2009-0034 VULNERABLE (sudo) @@ -70,7 +80,7 @@ CVE-2008-6229 fixed (drupal-cck, fixed 6.x.2.0) [since FEDORA-2008-9479] CVE-2008-6125 version (moodle) CVE-2008-6123 ignore (net-snmp) not affected -CVE-2008-6098 VULNERABLE (bugzilla, fixed 3.0.6) #484757 +CVE-2008-6098 fixed (bugzilla, fixed 3.0.6) #484757 [since FEDORA-2009-2418] CVE-2008-6059 VULNERABLE (WebKit) [since WebKit-1.1.0-0.14.svn40351.fc9] CVE-2008-6020 fixed (drupal-views, fixed 6.x-2.2) [since FEDORA-2008-11519] CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) @@ -78,7 +88,9 @@ CVE-2008-5906 fixed (ktorrent, fixed 3.1.4) [since FEDORA-2008-9167] CVE-2008-5905 fixed (ktorrent, fixed 3.1.4) [since FEDORA-2008-9167] CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7 +CVE-2008-5843 fixed (pdfjam, fixed 1.21) [since FEDORA-2009-2655] CVE-2008-5744 ignore (zaptel) kernel modules not shipped +CVE-2008-5743 fixed (pdfjam, fixed 1.21) [since FEDORA-2009-2655] CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2) CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed CVE-2008-5714 VULNERABLE (kvm) @@ -185,7 +197,7 @@ CVE-2008-4577 fixed (dovecot, fixed 1.1.14) [since FEDORA-2008-9202] CVE-2008-4575 fixed (jhead, fixed 2.84) [since FEDORA-2008-8928] CVE-2008-4474 fixed (freeradius) [since FEDORA-2008-10309] dialupadmin subpackage dropped -CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484757 +CVE-2008-4437 fixed (bugzilla, fixed 3.0.5) #484757 [since FEDORA-2009-2418] CVE-2008-4434 ignore (bittorrent) 6.x only CVE-2008-4422 fixed (libxml2, fixed 2.7.2) [since FEDORA-2008-8575] CVE-2008-4408 fixed (mediawiki, fixed 1.13.2) [since FEDORA-2008-8639] @@ -194,6 +206,7 @@ CVE-2008-4359 fixed (lighttpd, fixed 1.4.20) #464639 [since FEDORA-2008-11923] CVE-2008-4326 fixed (phpMyAdmin, fixed 2.11.9.2) [since FEDORA-2008-8335] CVE-2008-4325 fixed (viewvc, fixed 1.0.6) [since FEDORA-2008-8252] +CVE-2008-4316 VULNERABLE (glib2) [since glib2-2.16.6-3.fc9] CVE-2008-4315 VULNERABLE (tog-pegasus) [since FEDORA-2008-9688] CVE-2008-4314 fixed (samba, fixed 3.0.33,3.2.5) [since FEDORA-2008-10518] CVE-2008-4313 VULNERABLE (tog-pegasus) [since FEDORA-2008-9688] @@ -242,7 +255,7 @@ CVE-2008-4059 fixed (seamonkey, fixed 1.1.12) [since FEDORA-2008-8429] CVE-2008-4058 fixed (firefox, fixed 3.0.2) [since FEDORA-2008-8425] CVE-2008-4058 fixed (seamonkey, fixed 1.1.12) [since FEDORA-2008-8429] -CVE-2008-3972 VULNERABLE (opensc, fixed 0.11.6) [since opensc-0.11.7-1.fc9] +CVE-2008-3972 fixed (opensc, fixed 0.11.6) [since FEDORA-2009-2267] CVE-2008-3970 fixed (pam_mount, fixed 0.47) [since FEDORA-2008-7976] CVE-2008-3969 fixed (bitlbee, fixed 1.2.3) [since FEDORA-2008-7830] CVE-2008-3964 ignore (libpng, fixed 1.2.32beta01) not affected @@ -452,7 +465,7 @@ CVE-2008-2266 ignore (perl-Convert-UUlib) embedded uulib copy uses mkstemp CVE-2008-2238 fixed (openoffice.org, fixed 2.4.2) [since FEDORA-2008-9313] CVE-2008-2237 fixed (openoffice.org, fixed 2.4.2) [since FEDORA-2008-9313] -CVE-2008-2235 VULNERABLE (opensc, fixed 0.11.5) [since opensc-0.11.7-1.fc9] +CVE-2008-2235 fixed (opensc, fixed 0.11.5) [since FEDORA-2009-2267] CVE-2008-2168 ignore (httpd) browser issue, not apache CVE-2008-2152 fixed (openoffice.org, fixed 2.4.1) [since FEDORA-2008-5143] CVE-2008-2146 version (wordpress, fixed 2.2.3)

1 0

fedora-security/audit f10, 1.35, 1.36 f11, 1.6, 1.7 f9, 1.245, 1.246
by fedora-security-commits＠redhat.com 06 Mar '09

06 Mar '09

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv18046/audit Modified Files: f10 f11 f9 Log Message: another set of updates Index: f10 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f10,v retrieving revision 1.35 retrieving revision 1.36 diff -u -r1.35 -r1.36 --- f10 16 Feb 2009 08:04:49 -0000 1.35 +++ f10 6 Mar 2009 19:45:04 -0000 1.36 @@ -4,7 +4,17 @@ # *CVE are items that need verification for Fedora 10 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0819 ignore (mysql) 5.1+ only +CVE-2009-0749 fixed (optipng, fixed 0.6.2.1) [since FEDORA-2009-2100] +CVE-2009-0737 fixed (mediawiki, fixed 1.13.4) [since FEDORA-2009-2231] +CVE-2009-0671 ignore (uw-imap) rejected, fake report +CVE-2009-0601 ignore (wireshark, fixed 1.0.6) not security +CVE-2009-0600 fixed (wireshark, fixed 1.0.6) [since FEDORA-2009-1798] +CVE-2009-0599 fixed (wireshark, fixed 1.0.6) [since FEDORA-2009-1798] +CVE-2009-0578 VULNERABLE (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc10] +CVE-2009-0577 ignore (cups) not affected CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0544 fixed (python-crypto) [since FEDORA-2009-1687] CVE-2009-0543 ignore (proftpd) not affected CVE-2009-0542 VULNERABLE (proftpd) #485130 CVE-2009-0502 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1699] @@ -18,14 +28,18 @@ CVE-2009-0483 VULNERABLE (bugzilla, fixed 3.0.7) #484756 CVE-2009-0482 VULNERABLE (bugzilla, fixed 3.2.1) #484756 CVE-2009-0481 VULNERABLE (bugzilla, fixed 3.0.7) #484756 -CVE-2009-0415 VULNERABLE (trickle) [since trickle-1.07-7.fc10] +CVE-2009-0415 fixed (trickle) [since FEDORA-2009-1694] CVE-2009-0414 fixed (tor, fixed 0.2.0.33) [since FEDORA-2009-0917] CVE-2009-0413 fixed (roundcubemail) [since FEDORA-2009-1204] CVE-2009-0398 ignore (gstreamer-plugins) only affected old 0.6.x versions -CVE-2009-0397 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc10] -CVE-2009-0387 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc10] -CVE-2009-0386 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc10] +CVE-2009-0397 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1213] +CVE-2009-0387 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1213] +CVE-2009-0386 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1213] +CVE-2009-0368 VULNERABLE (opensc, fixed 0.11.7) [since opensc-0.11.7-1.fc10] +CVE-2009-0365 VULNERABLE (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc10] CVE-2009-0362 fixed (fail2ban) [since FEDORA-2009-1737] +CVE-2009-0361 ignore (pam_krb5) not affected +CVE-2009-0360 ignore (pam_krb5) not affected CVE-2009-0358 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] CVE-2009-0357 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] CVE-2009-0356 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] @@ -38,18 +52,26 @@ CVE-2009-0260 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0136 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0550] CVE-2009-0135 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0550] +CVE-2009-0129 fixed (perl-Crypt-OpenSSL-DSA) [since FEDORA-2009-2090] CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc10] not security according to upstream CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific CVE-2009-0041 fixed (asterisk, fixed 1.6.0.5) [since FEDORA-2009-0984] AST-2009-001 +CVE-2009-0040 fixed (libpng, fixed 1.2.35,1.0.43) [since FEDORA-2009-2112] +CVE-2009-0040 VULNERABLE (libpng10, fixed 1.2.35,1.0.43) [since libpng10-1.0.43-1.fc10] +CVE-2009-0040 fixed (mingw32-libpng, fixed 1.2.35,1.0.43) [since FEDORA-2009-2131] +CVE-2009-0037 VULNERABLE (curl, fixed 7.19.4) #48870 CVE-2009-0036 ignore (libvirt) libvirt_proxy not shipped CVE-2009-0034 fixed (sudo) [since FEDORA-2009-1074] CVE-2009-0032 ignore (cups) Mandriva-specific CVE-2009-0025 fixed (bind, fixed 9.5.1-P1,9.6.0-P1) [since FEDORA-2009-0451] CVE-2009-0022 fixed (samba, fixed 3.2.7) [since FEDORA-2009-0160] CVE-2009-0021 fixed (ntp, fixed 4.2.4p6) [since FEDORA-2009-0544] +CVE-2008-6393 fixed (psi, 0.12.1) [since FEDORA-2009-2285] +CVE-2008-6229 fixed (drupal-cck, fixed 6.x.2.0) [since FEDORA-2008-10143] CVE-2008-6125 version (moodle) -CVE-2008-6123 VULNERABLE (net-snmp) +CVE-2008-6123 fixed (net-snmp) [since FEDORA-2009-1769] CVE-2008-6098 VULNERABLE (bugzilla, fixed 3.0.6) #484756 +CVE-2008-6059 VULNERABLE (WebKit) [since WebKit-1.1.0-0.14.svn40351.fc10] CVE-2008-6020 fixed (drupal-views, fixed 6.x-2.2) [since FEDORA-2008-11578] CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) CVE-2008-5916 fixed (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since FEDORA-2008-11678] @@ -158,15 +180,15 @@ CVE-2008-4770 fixed (vnc, fixed 4.1.3) [since FEDORA-2009-0991] CVE-2008-4769 version (wordpress) CVE-2008-4690 fixed (lynx) [since FEDORA-2008-9952] -CVE-2008-4641 VULNERABLE (jhead) -CVE-2008-4640 VULNERABLE (jhead) +CVE-2008-4641 fixed (jhead) [since FEDORA-2009-1824] +CVE-2008-4640 fixed (jhead) [since FEDORA-2009-1824] CVE-2008-4639 version (jhead, fixed 2.84) [since jhead-2.84-1.fc10] CVE-2008-4619 backport (libtirpc) [since libtirpc-0.1.9-6.fc10] CVE-2008-4578 version (dovecot, fixed 1.1.14) [since dovecot-1.1.5-1.fc10] CVE-2008-4577 version (dovecot, fixed 1.1.14) [since dovecot-1.1.5-1.fc10] CVE-2008-4575 version (jhead, fixed 2.84) [since jhead-2.84-1.fc10] CVE-2008-4474 fixed (freeradius) [since FEDORA-2008-10392] dialupadmin subpackage dropped -CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484756 +CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484756 CVE-2008-4434 ignore (bittorrent) 6.x only CVE-2008-4422 backport (libxml2, fixed 2.7.2) [since libxml2-2.7.1-2.fc10] CVE-2008-4408 version (mediawiki, fixed 1.13.2) [since mediawiki-1.13.2-41.fc10] Index: f11 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f11,v retrieving revision 1.6 retrieving revision 1.7 diff -u -r1.6 -r1.7 --- f11 16 Feb 2009 08:04:49 -0000 1.6 +++ f11 6 Mar 2009 19:45:04 -0000 1.7 @@ -4,7 +4,17 @@ # *CVE are items that need verification for Fedora 10 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0819 version (mysql) [since mysql-5.1.32-1.fc11] +CVE-2009-0749 version (optipng, fixed 0.6.2.1) [since optipng-0.6.2.1-1.fc11] +CVE-2009-0737 version (mediawiki, fixed 1.13.4) [since mediawiki-1.14.0-45.fc11] +CVE-2009-0671 ignore (uw-imap) rejected, fake report +CVE-2009-0601 ignore (wireshark, fixed 1.0.6) not security +CVE-2009-0600 version (wireshark, fixed 1.0.6) +CVE-2009-0599 version (wireshark, fixed 1.0.6) +CVE-2009-0578 version (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc11] +CVE-2009-0577 ignore (cups) not affected CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0544 version (python-crypto) [since python-crypto-2.0.1-16.1] CVE-2009-0543 ignore (proftpd) not affected CVE-2009-0542 VULNERABLE (proftpd) #485131 CVE-2009-0502 version (moodle, fixed 1.9.4) [since moodle-1.9.4-1.fc11] @@ -12,36 +22,48 @@ CVE-2009-0500 version (moodle, fixed 1.9.4) [since moodle-1.9.4-1.fc11] CVE-2009-0499 version (moodle, fixed 1.9.4) [since moodle-1.9.4-1.fc11] CVE-2009-0490 VULNERABLE (audacity, fixed 1.3.6) #484954 -CVE-2009-0486 VULNERABLE (bugzilla, fixed 3.0.8) #484758 -CVE-2009-0485 VULNERABLE (bugzilla, fixed 3.0.7) #484758 -CVE-2009-0484 VULNERABLE (bugzilla, fixed 3.0.7) #484758 -CVE-2009-0483 VULNERABLE (bugzilla, fixed 3.0.7) #484758 -CVE-2009-0482 VULNERABLE (bugzilla, fixed 3.2.1) #484758 -CVE-2009-0481 VULNERABLE (bugzilla, fixed 3.0.7) #484758 +CVE-2009-0486 version (bugzilla, fixed 3.0.8) #484758 [since bugzilla-3.0.8-1.fc11] +CVE-2009-0485 version (bugzilla, fixed 3.0.7) #484758 [since bugzilla-3.0.8-1.fc11] +CVE-2009-0484 version (bugzilla, fixed 3.0.7) #484758 [since bugzilla-3.0.8-1.fc11] +CVE-2009-0483 version (bugzilla, fixed 3.0.7) #484758 [since bugzilla-3.0.8-1.fc11] +CVE-2009-0482 version (bugzilla, fixed 3.2.1) [since bugzilla-3.2.2-2.fc11] +CVE-2009-0481 version (bugzilla, fixed 3.0.7) #484758 [since bugzilla-3.0.8-1.fc11] CVE-2009-0415 backport (trickle) [since trickle-1.07-6.fc11] CVE-2009-0414 version (tor, fixed 0.2.0.33) [since tor-0.2.0.33-1.fc11] CVE-2009-0413 backport (roundcubemail) [since roundcubemail-0.2-7.stable.fc11] CVE-2009-0397 version (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc11] CVE-2009-0387 version (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc11] CVE-2009-0386 version (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc11] +CVE-2009-0368 VULNERABLE (opensc, fixed 0.11.7) [since opensc-0.11.7-1.fc11] +CVE-2009-0365 version (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc11] CVE-2009-0362 backport (fail2ban) [since fail2ban-0.8.3-18.fc11] +CVE-2009-0361 ignore (pam_krb5) not affected +CVE-2009-0360 ignore (pam_krb5) not affected CVE-2009-0312 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025 CVE-2009-0260 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0136 version (amarok, fixed 2.0.1.1) [since amarok-2.0.1.1-1.fc11] CVE-2009-0135 version (amarok, fixed 2.0.1.1) [since amarok-2.0.1.1-1.fc11] +CVE-2009-0129 VULNERABLE (perl-Crypt-OpenSSL-DSA) CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc11] not security according to upstream CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) AST-2009-001 +CVE-2009-0040 version (libpng, fixed 1.2.35,1.0.43) [since libpng-1.2.35-1.fc11] +CVE-2009-0040 version (libpng10, fixed 1.2.35,1.0.43) [since libpng10-1.0.43-1.fc11] +CVE-2009-0040 version (mingw32-libpng, fixed 1.2.35,1.0.43) [since mingw32-libpng-1.2.35-1.fc11] +CVE-2009-0037 version (curl, fixed 7.19.4) [since curl-7.19.4-1.fc11] CVE-2009-0036 ignore (libvirt) libvirt_proxy not shipped CVE-2009-0034 VULNERABLE (sudo) CVE-2009-0032 ignore (cups) Mandriva-specific CVE-2009-0025 version (bind, fixed 9.5.1-P1,9.6.0-P1) [since bind-9.6.0-2.P1.fc11] CVE-2009-0022 VULNERABLE (samba, fixed 3.2.7) CVE-2009-0021 version (ntp, fixed 4.2.4p6) [since ntp-4.2.4p6-1.fc11] +CVE-2008-6393 VULNERABLE (psi, 0.12.1) [since psi-0.12.1-1.fc11] +CVE-2008-6229 version (drupal-cck, fixed 6.x.2.0) [since drupal-cck-6.x.2.0-4.fc11] CVE-2008-6125 version (moodle) -CVE-2008-6123 VULNERABLE (net-snmp) -CVE-2008-6098 VULNERABLE (bugzilla, fixed 3.0.6) #484758 +CVE-2008-6123 backport (net-snmp) [since net-snmp-5.4.2.1-8.fc11] +CVE-2008-6098 version (bugzilla, fixed 3.0.6) #484758 [since bugzilla-3.0.8-1.fc11] +CVE-2008-6059 VULNERABLE (WebKit) [since WebKit-1.1.0-0.14.svn40351.fc11] CVE-2008-6020 version (drupal-views, fixed 6.x-2.2) [since drupal-views-6.x.2.2-1.fc11] CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) CVE-2008-5916 version (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since git-1.6.0.6-1.fc11] @@ -119,9 +141,9 @@ CVE-2008-4863 backport (blender) [blender-2.48a-4.fc10] CVE-2008-4770 VULNERABLE (vnc, fixed 4.1.3) CVE-2008-4690 backport (lynx) [since lynx-2.8.6-18.fc10] -CVE-2008-4641 VULNERABLE (jhead) -CVE-2008-4640 VULNERABLE (jhead) -CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484758 +CVE-2008-4641 version (jhead) [since jhead-2.86-1.fc11] +CVE-2008-4640 version (jhead) [since jhead-2.86-1.fc11] +CVE-2008-4437 version (bugzilla, fixed 3.0.5) #484758 [since bugzilla-3.0.8-1.fc11] CVE-2008-4405 VULNERABLE (xen) CVE-2008-4315 fixed (tog-pegasus) [since tog-pegasus-2.7.2-2.fc11] CVE-2008-4314 version (samba, fixed 3.0.33,3.2.5) [since samba-3.2.5-0.23.fc11] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.245 retrieving revision 1.246 diff -u -r1.245 -r1.246 --- f9 16 Feb 2009 08:04:49 -0000 1.245 +++ f9 6 Mar 2009 19:45:04 -0000 1.246 @@ -5,7 +5,17 @@ # (mozilla) = (gecko-libs dependent stuff) rhbz249840 version (tor, fixed 0.1.2.15) +CVE-2009-0819 ignore (mysql) 5.1+ only +CVE-2009-0749 fixed (optipng, fixed 0.6.2.1) [since FEDORA-2009-2098] +CVE-2009-0737 fixed (mediawiki, fixed 1.13.4) [since FEDORA-2009-2237] +CVE-2009-0671 ignore (uw-imap) rejected, fake report +CVE-2009-0601 ignore (wireshark, fixed 1.0.6) not security +CVE-2009-0600 VULNERABLE (wireshark, fixed 1.0.6) [since wireshark-1.0.6-1.fc9] +CVE-2009-0599 VULNERABLE (wireshark, fixed 1.0.6) [since wireshark-1.0.6-1.fc9] +CVE-2009-0578 VULNERABLE (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc9] +CVE-2009-0577 ignore (cups) not affected CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0544 fixed (python-crypto) [since FEDORA-2009-1680] CVE-2009-0543 ignore (proftpd) not affected CVE-2009-0542 VULNERABLE (proftpd) #485129 CVE-2009-0502 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1641] @@ -19,14 +29,18 @@ CVE-2009-0483 VULNERABLE (bugzilla, fixed 3.0.7) #484757 CVE-2009-0482 VULNERABLE (bugzilla, fixed 3.2.1) #484757 CVE-2009-0481 VULNERABLE (bugzilla, fixed 3.0.7) #484757 -CVE-2009-0415 VULNERABLE (trickle) [since trickle-1.07-7.fc9] +CVE-2009-0415 fixed (trickle) [since FEDORA-2009-1675] CVE-2009-0414 fixed (tor, fixed 0.2.0.33) [since FEDORA-2009-0897] CVE-2009-0413 fixed (roundcubemail) [since FEDORA-2009-1256] CVE-2009-0398 ignore (gstreamer-plugins) only affected old 0.6.x versions -CVE-2009-0397 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.8-10.fc9] -CVE-2009-0387 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.8-10.fc9] -CVE-2009-0386 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.8-10.fc9] +CVE-2009-0397 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1343] +CVE-2009-0387 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1343] +CVE-2009-0386 fixed (gstreamer-plugins-good, fixed 0.10.13) [since FEDORA-2009-1343] +CVE-2009-0368 VULNERABLE (opensc, fixed 0.11.7) [since opensc-0.11.7-1.fc9] +CVE-2009-0365 VULNERABLE (NetworkManager, 0.7.0.99) [since NetworkManager-0.7.0.99-1.fc9] CVE-2009-0362 fixed (fail2ban) [since FEDORA-2009-1736] +CVE-2009-0361 ignore (pam_krb5) not affected +CVE-2009-0360 ignore (pam_krb5) not affected CVE-2009-0358 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] CVE-2009-0357 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] CVE-2009-0356 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] @@ -39,18 +53,25 @@ CVE-2009-0260 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0136 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0715] CVE-2009-0135 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0715] +CVE-2009-0129 fixed (perl-Crypt-OpenSSL-DSA) [since FEDORA-2009-1914] CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc9] not security according to upstream CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific CVE-2009-0041 fixed (asterisk, fixed 1.6.0.5) [since FEDORA-2009-0973] AST-2009-001 +CVE-2009-0040 fixed (libpng, fixed 1.2.35,1.0.43) [since FEDORA-2009-2128] +CVE-2009-0040 VULNERABLE (libpng10, fixed 1.2.35,1.0.43) [since libpng10-1.0.43-1.fc9] +CVE-2009-0037 fixed (curl, fixed 7.19.4) #488169 [since FEDORA-2009-2265] CVE-2009-0036 ignore (libvirt) libvirt_proxy not shipped CVE-2009-0034 VULNERABLE (sudo) CVE-2009-0032 ignore (cups) Mandriva-specific CVE-2009-0025 fixed (bind, fixed 9.5.1-P1,9.6.0-P1) [since FEDORA-2009-0350] CVE-2009-0022 fixed (samba, fixed 3.2.7) [since FEDORA-2009-0268] CVE-2009-0021 fixed (ntp, fixed 4.2.4p6) [since FEDORA-2009-0547] +CVE-2008-6393 fixed (psi, 0.12.1) [since FEDORA-2009-2295] +CVE-2008-6229 fixed (drupal-cck, fixed 6.x.2.0) [since FEDORA-2008-9479] CVE-2008-6125 version (moodle) -CVE-2008-6123 VULNERABLE (net-snmp) +CVE-2008-6123 ignore (net-snmp) not affected CVE-2008-6098 VULNERABLE (bugzilla, fixed 3.0.6) #484757 +CVE-2008-6059 VULNERABLE (WebKit) [since WebKit-1.1.0-0.14.svn40351.fc9] CVE-2008-6020 fixed (drupal-views, fixed 6.x-2.2) [since FEDORA-2008-11519] CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) CVE-2008-5916 fixed (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since FEDORA-2008-11650] @@ -156,15 +177,15 @@ CVE-2008-4770 fixed (vnc, fixed 4.1.3) [since FEDORA-2009-1001] CVE-2008-4769 version (wordpress) CVE-2008-4690 fixed (lynx) #468550 [since FEDORA-2008-9550] -CVE-2008-4641 VULNERABLE (jhead) -CVE-2008-4640 VULNERABLE (jhead) +CVE-2008-4641 fixed (jhead) [since FEDORA-2009-1776] +CVE-2008-4640 fixed (jhead) [since FEDORA-2009-1776] CVE-2008-4639 fixed (jhead, fixed 2.84) [since FEDORA-2008-8928] CVE-2008-4619 fixed (libtirpc) [since FEDORA-2008-9204] CVE-2008-4578 ignore (dovecot, fixed 1.1.14) wontfix CVE-2008-4577 fixed (dovecot, fixed 1.1.14) [since FEDORA-2008-9202] CVE-2008-4575 fixed (jhead, fixed 2.84) [since FEDORA-2008-8928] CVE-2008-4474 fixed (freeradius) [since FEDORA-2008-10309] dialupadmin subpackage dropped -CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484757 +CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484757 CVE-2008-4434 ignore (bittorrent) 6.x only CVE-2008-4422 fixed (libxml2, fixed 2.7.2) [since FEDORA-2008-8575] CVE-2008-4408 fixed (mediawiki, fixed 1.13.2) [since FEDORA-2008-8639] @@ -221,7 +242,7 @@ CVE-2008-4059 fixed (seamonkey, fixed 1.1.12) [since FEDORA-2008-8429] CVE-2008-4058 fixed (firefox, fixed 3.0.2) [since FEDORA-2008-8425] CVE-2008-4058 fixed (seamonkey, fixed 1.1.12) [since FEDORA-2008-8429] -CVE-2008-3972 VULNERABLE (opensc, fixed 0.11.6) +CVE-2008-3972 VULNERABLE (opensc, fixed 0.11.6) [since opensc-0.11.7-1.fc9] CVE-2008-3970 fixed (pam_mount, fixed 0.47) [since FEDORA-2008-7976] CVE-2008-3969 fixed (bitlbee, fixed 1.2.3) [since FEDORA-2008-7830] CVE-2008-3964 ignore (libpng, fixed 1.2.32beta01) not affected @@ -431,7 +452,7 @@ CVE-2008-2266 ignore (perl-Convert-UUlib) embedded uulib copy uses mkstemp CVE-2008-2238 fixed (openoffice.org, fixed 2.4.2) [since FEDORA-2008-9313] CVE-2008-2237 fixed (openoffice.org, fixed 2.4.2) [since FEDORA-2008-9313] -CVE-2008-2235 VULNERABLE (opensc, fixed 0.11.5) +CVE-2008-2235 VULNERABLE (opensc, fixed 0.11.5) [since opensc-0.11.7-1.fc9] CVE-2008-2168 ignore (httpd) browser issue, not apache CVE-2008-2152 fixed (openoffice.org, fixed 2.4.1) [since FEDORA-2008-5143] CVE-2008-2146 version (wordpress, fixed 2.2.3)

1 0

fedora-security/tools/lib/Libexig Fedora.pm, 1.9, 1.10
by fedora-security-commits＠redhat.com 23 Feb '09

23 Feb '09

Author: thoger Update of /cvs/fedora/fedora-security/tools/lib/Libexig In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv28318/lib/Libexig Modified Files: Fedora.pm Log Message: fix bodhi link - type is now type_, release version is no longer manually selected, rather auto-guessed from brew tags Index: Fedora.pm =================================================================== RCS file: /cvs/fedora/fedora-security/tools/lib/Libexig/Fedora.pm,v retrieving revision 1.9 retrieving revision 1.10 diff -u -r1.9 -r1.10 --- Fedora.pm 15 Jan 2009 13:30:23 -0000 1.9 +++ Fedora.pm 23 Feb 2009 15:35:14 -0000 1.10 @@ -236,8 +236,7 @@ 'create the update request: '."\n". 'https://admin.fedoraproject.org/updates/new/'. '?request=Stable'. - '&type=security'. - '&release=Fedora%20'.$bug->{'version'}. + '&type_=security'. '&bugs='.$bug_id; foreach my $bug (@{$parent_bugs}) {

1 0

fedora-security/audit f10, 1.34, 1.35 f11, 1.5, 1.6 f9, 1.244, 1.245
by fedora-security-commits＠redhat.com 16 Feb '09

16 Feb '09

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv640/audit Modified Files: f10 f11 f9 Log Message: pile of updates Index: f10 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f10,v retrieving revision 1.34 retrieving revision 1.35 diff -u -r1.34 -r1.35 --- f10 27 Jan 2009 14:18:01 -0000 1.34 +++ f10 16 Feb 2009 08:04:49 -0000 1.35 @@ -4,16 +4,53 @@ # *CVE are items that need verification for Fedora 10 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0543 ignore (proftpd) not affected +CVE-2009-0542 VULNERABLE (proftpd) #485130 +CVE-2009-0502 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1699] +CVE-2009-0501 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1699] +CVE-2009-0500 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1699] +CVE-2009-0499 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1699] +CVE-2009-0490 VULNERABLE (audacity, fixed 1.3.6) #484952 +CVE-2009-0486 VULNERABLE (bugzilla, fixed 3.0.8) #484756 +CVE-2009-0485 VULNERABLE (bugzilla, fixed 3.0.7) #484756 +CVE-2009-0484 VULNERABLE (bugzilla, fixed 3.0.7) #484756 +CVE-2009-0483 VULNERABLE (bugzilla, fixed 3.0.7) #484756 +CVE-2009-0482 VULNERABLE (bugzilla, fixed 3.2.1) #484756 +CVE-2009-0481 VULNERABLE (bugzilla, fixed 3.0.7) #484756 +CVE-2009-0415 VULNERABLE (trickle) [since trickle-1.07-7.fc10] +CVE-2009-0414 fixed (tor, fixed 0.2.0.33) [since FEDORA-2009-0917] +CVE-2009-0413 fixed (roundcubemail) [since FEDORA-2009-1204] +CVE-2009-0398 ignore (gstreamer-plugins) only affected old 0.6.x versions +CVE-2009-0397 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc10] +CVE-2009-0387 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc10] +CVE-2009-0386 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc10] +CVE-2009-0362 fixed (fail2ban) [since FEDORA-2009-1737] +CVE-2009-0358 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] +CVE-2009-0357 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] +CVE-2009-0356 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] +CVE-2009-0355 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] +CVE-2009-0354 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] +CVE-2009-0353 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] +CVE-2009-0352 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1398] +CVE-2009-0312 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025 -CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1) +CVE-2009-0260 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0136 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0550] CVE-2009-0135 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0550] CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc10] not security according to upstream CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific -CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) [since asterisk-1.6.0.5-2.fc10] AST-2009-001 +CVE-2009-0041 fixed (asterisk, fixed 1.6.0.5) [since FEDORA-2009-0984] AST-2009-001 +CVE-2009-0036 ignore (libvirt) libvirt_proxy not shipped +CVE-2009-0034 fixed (sudo) [since FEDORA-2009-1074] +CVE-2009-0032 ignore (cups) Mandriva-specific CVE-2009-0025 fixed (bind, fixed 9.5.1-P1,9.6.0-P1) [since FEDORA-2009-0451] CVE-2009-0022 fixed (samba, fixed 3.2.7) [since FEDORA-2009-0160] CVE-2009-0021 fixed (ntp, fixed 4.2.4p6) [since FEDORA-2009-0544] +CVE-2008-6125 version (moodle) +CVE-2008-6123 VULNERABLE (net-snmp) +CVE-2008-6098 VULNERABLE (bugzilla, fixed 3.0.6) #484756 +CVE-2008-6020 fixed (drupal-views, fixed 6.x-2.2) [since FEDORA-2008-11578] CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) CVE-2008-5916 fixed (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since FEDORA-2008-11678] CVE-2008-5906 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] @@ -24,8 +61,8 @@ CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed CVE-2008-5714 VULNERABLE (kvm) CVE-2008-5714 VULNERABLE (qemu) -CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10) -CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5704 ignore (gpsdrive, fixed 2.10) only affected 2.10-pre versions +CVE-2008-5703 fixed (gpsdrive, fixed 2.10) [since FEDORA-2009-1225] CVE-2008-5698 ignore (konqueror) KDE3 and DoS only CVE-2008-5695 version (wordpress, fixed 2.3.3) CVE-2008-5695 version (wordpress-mu, fixed 1.3.3) @@ -70,7 +107,8 @@ CVE-2008-5398 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10991] CVE-2008-5397 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10991] CVE-2008-5396 ignore (zaptel) kernel modules not shipped -CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5380 fixed (gpsdrive, fixed 2.10) [since FEDORA-2009-1225] +CVE-2008-5377 ignore (cups) Debian-specific CVE-2008-5299 VULNERABLE (chm2pdf) #474459 CVE-2008-5298 VULNERABLE (chm2pdf) #474459 CVE-2008-5286 ignore (cups) libpng prevents this @@ -103,7 +141,7 @@ CVE-2008-4985 ignore (vdr) Debian-specific CVE-2008-4982 fixed (rkhunter) [since rkhunter-1.3.2-5.fc10] CVE-2008-4977 ignore (postfix) Debian-specific -CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-4959 fixed (gpsdrive, fixed 2.10) [since FEDORA-2009-1225] CVE-2008-4956 ignore (fwbuilder) fwb_install not shipped CVE-2008-4937 ignore (openoffice.org) not affected CVE-2008-4936 fixed (mgetty) patched for ages @@ -128,7 +166,7 @@ CVE-2008-4577 version (dovecot, fixed 1.1.14) [since dovecot-1.1.5-1.fc10] CVE-2008-4575 version (jhead, fixed 2.84) [since jhead-2.84-1.fc10] CVE-2008-4474 fixed (freeradius) [since FEDORA-2008-10392] dialupadmin subpackage dropped -CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #465959 +CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484756 CVE-2008-4434 ignore (bittorrent) 6.x only CVE-2008-4422 backport (libxml2, fixed 2.7.2) [since libxml2-2.7.1-2.fc10] CVE-2008-4408 version (mediawiki, fixed 1.13.2) [since mediawiki-1.13.2-41.fc10] Index: f11 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f11,v retrieving revision 1.5 retrieving revision 1.6 diff -u -r1.5 -r1.6 --- f11 27 Jan 2009 14:18:01 -0000 1.5 +++ f11 16 Feb 2009 08:04:49 -0000 1.6 @@ -4,16 +4,45 @@ # *CVE are items that need verification for Fedora 10 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0543 ignore (proftpd) not affected +CVE-2009-0542 VULNERABLE (proftpd) #485131 +CVE-2009-0502 version (moodle, fixed 1.9.4) [since moodle-1.9.4-1.fc11] +CVE-2009-0501 version (moodle, fixed 1.9.4) [since moodle-1.9.4-1.fc11] +CVE-2009-0500 version (moodle, fixed 1.9.4) [since moodle-1.9.4-1.fc11] +CVE-2009-0499 version (moodle, fixed 1.9.4) [since moodle-1.9.4-1.fc11] +CVE-2009-0490 VULNERABLE (audacity, fixed 1.3.6) #484954 +CVE-2009-0486 VULNERABLE (bugzilla, fixed 3.0.8) #484758 +CVE-2009-0485 VULNERABLE (bugzilla, fixed 3.0.7) #484758 +CVE-2009-0484 VULNERABLE (bugzilla, fixed 3.0.7) #484758 +CVE-2009-0483 VULNERABLE (bugzilla, fixed 3.0.7) #484758 +CVE-2009-0482 VULNERABLE (bugzilla, fixed 3.2.1) #484758 +CVE-2009-0481 VULNERABLE (bugzilla, fixed 3.0.7) #484758 +CVE-2009-0415 backport (trickle) [since trickle-1.07-6.fc11] +CVE-2009-0414 version (tor, fixed 0.2.0.33) [since tor-0.2.0.33-1.fc11] +CVE-2009-0413 backport (roundcubemail) [since roundcubemail-0.2-7.stable.fc11] +CVE-2009-0397 version (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc11] +CVE-2009-0387 version (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc11] +CVE-2009-0386 version (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.13-1.fc11] +CVE-2009-0362 backport (fail2ban) [since fail2ban-0.8.3-18.fc11] +CVE-2009-0312 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025 -CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1) +CVE-2009-0260 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0136 version (amarok, fixed 2.0.1.1) [since amarok-2.0.1.1-1.fc11] CVE-2009-0135 version (amarok, fixed 2.0.1.1) [since amarok-2.0.1.1-1.fc11] CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc11] not security according to upstream CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) AST-2009-001 +CVE-2009-0036 ignore (libvirt) libvirt_proxy not shipped +CVE-2009-0034 VULNERABLE (sudo) +CVE-2009-0032 ignore (cups) Mandriva-specific CVE-2009-0025 version (bind, fixed 9.5.1-P1,9.6.0-P1) [since bind-9.6.0-2.P1.fc11] CVE-2009-0022 VULNERABLE (samba, fixed 3.2.7) CVE-2009-0021 version (ntp, fixed 4.2.4p6) [since ntp-4.2.4p6-1.fc11] +CVE-2008-6125 version (moodle) +CVE-2008-6123 VULNERABLE (net-snmp) +CVE-2008-6098 VULNERABLE (bugzilla, fixed 3.0.6) #484758 +CVE-2008-6020 version (drupal-views, fixed 6.x-2.2) [since drupal-views-6.x.2.2-1.fc11] CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) CVE-2008-5916 version (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since git-1.6.0.6-1.fc11] CVE-2008-5906 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] @@ -24,8 +53,8 @@ CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed CVE-2008-5714 VULNERABLE (kvm) CVE-2008-5714 VULNERABLE (qemu) -CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10) -CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5704 ignore (gpsdrive, fixed 2.10) only affected 2.10-pre versions +CVE-2008-5703 backport (gpsdrive, fixed 2.10) [since gpsdrive-2.09-7.fc11] CVE-2008-5698 ignore (konqueror) KDE3 and DoS only CVE-2008-5688 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11] CVE-2008-5687 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11] @@ -68,7 +97,8 @@ CVE-2008-5398 version (tor, fixed 0.2.0.32) [since tor-0.2.0.32-1.fc11] CVE-2008-5397 version (tor, fixed 0.2.0.32) [since tor-0.2.0.32-1.fc11] CVE-2008-5396 ignore (zaptel) kernel modules not shipped -CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5380 backport (gpsdrive, fixed 2.10) [since gpsdrive-2.09-7.fc11] +CVE-2008-5377 ignore (cups) Debian-specific CVE-2008-5299 VULNERABLE (chm2pdf) CVE-2008-5298 VULNERABLE (chm2pdf) CVE-2008-5286 ignore (cups) libpng prevents this @@ -85,13 +115,13 @@ CVE-2008-5086 backport (libvirt) [since libvirt-0.5.1-2.fc11] CVE-2008-5081 version (avahi, fixed 0.6.24) [since avahi-0.6.24-1.fc11] CVE-2008-5080 backport (awstats) [since awstats-6.8-3.fc11] -CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-4959 backport (gpsdrive, fixed 2.10) [since gpsdrive-2.09-7.fc11] CVE-2008-4863 backport (blender) [blender-2.48a-4.fc10] CVE-2008-4770 VULNERABLE (vnc, fixed 4.1.3) CVE-2008-4690 backport (lynx) [since lynx-2.8.6-18.fc10] CVE-2008-4641 VULNERABLE (jhead) CVE-2008-4640 VULNERABLE (jhead) -CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) +CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484758 CVE-2008-4405 VULNERABLE (xen) CVE-2008-4315 fixed (tog-pegasus) [since tog-pegasus-2.7.2-2.fc11] CVE-2008-4314 version (samba, fixed 3.0.33,3.2.5) [since samba-3.2.5-0.23.fc11] Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.244 retrieving revision 1.245 diff -u -r1.244 -r1.245 --- f9 27 Jan 2009 14:18:01 -0000 1.244 +++ f9 16 Feb 2009 08:04:49 -0000 1.245 @@ -5,16 +5,53 @@ # (mozilla) = (gecko-libs dependent stuff) rhbz249840 version (tor, fixed 0.1.2.15) +CVE-2009-0547 VULNERABLE (evolution) +CVE-2009-0543 ignore (proftpd) not affected +CVE-2009-0542 VULNERABLE (proftpd) #485129 +CVE-2009-0502 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1641] +CVE-2009-0501 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1641] +CVE-2009-0500 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1641] +CVE-2009-0499 fixed (moodle, fixed 1.9.4) [since FEDORA-2009-1641] +CVE-2009-0490 VULNERABLE (audacity, fixed 1.3.6) #484953 +CVE-2009-0486 VULNERABLE (bugzilla, fixed 3.0.8) #484757 +CVE-2009-0485 VULNERABLE (bugzilla, fixed 3.0.7) #484757 +CVE-2009-0484 VULNERABLE (bugzilla, fixed 3.0.7) #484757 +CVE-2009-0483 VULNERABLE (bugzilla, fixed 3.0.7) #484757 +CVE-2009-0482 VULNERABLE (bugzilla, fixed 3.2.1) #484757 +CVE-2009-0481 VULNERABLE (bugzilla, fixed 3.0.7) #484757 +CVE-2009-0415 VULNERABLE (trickle) [since trickle-1.07-7.fc9] +CVE-2009-0414 fixed (tor, fixed 0.2.0.33) [since FEDORA-2009-0897] +CVE-2009-0413 fixed (roundcubemail) [since FEDORA-2009-1256] +CVE-2009-0398 ignore (gstreamer-plugins) only affected old 0.6.x versions +CVE-2009-0397 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.8-10.fc9] +CVE-2009-0387 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.8-10.fc9] +CVE-2009-0386 VULNERABLE (gstreamer-plugins-good, fixed 0.10.13) [since gstreamer-plugins-good-0.10.8-10.fc9] +CVE-2009-0362 fixed (fail2ban) [since FEDORA-2009-1736] +CVE-2009-0358 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] +CVE-2009-0357 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] +CVE-2009-0356 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] +CVE-2009-0355 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] +CVE-2009-0354 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] +CVE-2009-0353 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] +CVE-2009-0352 fixed (firefox, fixed 3.0.6) [since FEDORA-2009-1399] +CVE-2009-0312 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025 -CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1) +CVE-2009-0260 VULNERABLE (moin, fixed 1.7.4,1.8.2) CVE-2009-0136 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0715] CVE-2009-0135 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0715] CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc9] not security according to upstream CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific -CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) [since asterisk-1.6.0.5-2.fc9] AST-2009-001 +CVE-2009-0041 fixed (asterisk, fixed 1.6.0.5) [since FEDORA-2009-0973] AST-2009-001 +CVE-2009-0036 ignore (libvirt) libvirt_proxy not shipped +CVE-2009-0034 VULNERABLE (sudo) +CVE-2009-0032 ignore (cups) Mandriva-specific CVE-2009-0025 fixed (bind, fixed 9.5.1-P1,9.6.0-P1) [since FEDORA-2009-0350] CVE-2009-0022 fixed (samba, fixed 3.2.7) [since FEDORA-2009-0268] CVE-2009-0021 fixed (ntp, fixed 4.2.4p6) [since FEDORA-2009-0547] +CVE-2008-6125 version (moodle) +CVE-2008-6123 VULNERABLE (net-snmp) +CVE-2008-6098 VULNERABLE (bugzilla, fixed 3.0.6) #484757 +CVE-2008-6020 fixed (drupal-views, fixed 6.x-2.2) [since FEDORA-2008-11519] CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) CVE-2008-5916 fixed (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since FEDORA-2008-11650] CVE-2008-5906 fixed (ktorrent, fixed 3.1.4) [since FEDORA-2008-9167] @@ -25,8 +62,8 @@ CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed CVE-2008-5714 VULNERABLE (kvm) CVE-2008-5714 VULNERABLE (qemu) -CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10) -CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5704 ignore (gpsdrive, fixed 2.10) only affected 2.10-pre versions +CVE-2008-5703 fixed (gpsdrive, fixed 2.10) [since FEDORA-2009-1366] CVE-2008-5698 ignore (konqueror) KDE3 and DoS only CVE-2008-5695 version (wordpress, fixed 2.3.3) CVE-2008-5688 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802] @@ -70,7 +107,8 @@ CVE-2008-5398 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10989] CVE-2008-5397 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10989] CVE-2008-5396 ignore (zaptel) kernel modules not shipped -CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5380 fixed (gpsdrive, fixed 2.10) [since FEDORA-2009-1366] +CVE-2008-5377 ignore (cups) Debian-specific CVE-2008-5286 ignore (cups) libpng prevents this CVE-2008-5262 fixed (DevIL) [since FEDORA-2009-0856] CVE-2008-5252 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802] @@ -101,7 +139,7 @@ CVE-2008-4985 ignore (vdr) Debian-specific CVE-2008-4982 fixed (rkhunter) [since FEDORA-2008-8314] CVE-2008-4977 ignore (postfix) Debian-specific -CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-4959 fixed (gpsdrive, fixed 2.10) [since FEDORA-2009-1366] CVE-2008-4956 ignore (fwbuilder) fwb_install not shipped CVE-2008-4937 fixed (openoffice.org) [since FEDORA-2008-7680] CVE-2008-4936 fixed (mgetty) patched for ages @@ -126,13 +164,13 @@ CVE-2008-4577 fixed (dovecot, fixed 1.1.14) [since FEDORA-2008-9202] CVE-2008-4575 fixed (jhead, fixed 2.84) [since FEDORA-2008-8928] CVE-2008-4474 fixed (freeradius) [since FEDORA-2008-10309] dialupadmin subpackage dropped -CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #465958 +CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) #484757 CVE-2008-4434 ignore (bittorrent) 6.x only CVE-2008-4422 fixed (libxml2, fixed 2.7.2) [since FEDORA-2008-8575] CVE-2008-4408 fixed (mediawiki, fixed 1.13.2) [since FEDORA-2008-8639] CVE-2008-4405 VULNERABLE (xen) -CVE-2008-4360 VULNERABLE (lighttpd, fixed 1.4.20) #464639 -CVE-2008-4359 VULNERABLE (lighttpd, fixed 1.4.20) #464639 +CVE-2008-4360 fixed (lighttpd, fixed 1.4.20) #464639 [since FEDORA-2008-11923] +CVE-2008-4359 fixed (lighttpd, fixed 1.4.20) #464639 [since FEDORA-2008-11923] CVE-2008-4326 fixed (phpMyAdmin, fixed 2.11.9.2) [since FEDORA-2008-8335] CVE-2008-4325 fixed (viewvc, fixed 1.0.6) [since FEDORA-2008-8252] CVE-2008-4315 VULNERABLE (tog-pegasus) [since FEDORA-2008-9688] @@ -141,7 +179,7 @@ CVE-2008-4311 fixed (dbus, fixed 1.2.6) [since FEDORA-2008-10907] CVE-2008-4309 fixed (net-snmp, fixed 5.4.2.1) [since FEDORA-2008-9367] CVE-2008-4306 fixed (enscript) [since FEDORA-2008-9372] -CVE-2008-4298 VULNERABLE (lighttpd, fixed 1.4.20) #464639 +CVE-2008-4298 fixed (lighttpd, fixed 1.4.20) #464639 [since FEDORA-2008-11923] CVE-2008-4297 fixed (mercurial, fixed 1.0.2) [since FEDORA-2008-7490] CVE-2008-4242 fixed (proftpd) #464129 [since FEDORA-2009-0064] CVE-2008-4226 fixed (libxml2) [since FEDORA-2008-9773]

1 0

fedora-security/audit f10, 1.33, 1.34 f11, 1.4, 1.5 f9, 1.243, 1.244
by fedora-security-commits＠redhat.com 27 Jan '09

27 Jan '09

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv19216/audit Modified Files: f10 f11 f9 Log Message: large pile of updates Index: f10 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f10,v retrieving revision 1.33 retrieving revision 1.34 diff -u -r1.33 -r1.34 --- f10 19 Dec 2008 19:22:21 -0000 1.33 +++ f10 27 Jan 2009 14:18:01 -0000 1.34 @@ -4,8 +4,33 @@ # *CVE are items that need verification for Fedora 10 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025 +CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1) +CVE-2009-0136 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0550] +CVE-2009-0135 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0550] +CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc10] not security according to upstream +CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific +CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) [since asterisk-1.6.0.5-2.fc10] AST-2009-001 +CVE-2009-0025 fixed (bind, fixed 9.5.1-P1,9.6.0-P1) [since FEDORA-2009-0451] +CVE-2009-0022 fixed (samba, fixed 3.2.7) [since FEDORA-2009-0160] +CVE-2009-0021 fixed (ntp, fixed 4.2.4p6) [since FEDORA-2009-0544] +CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) +CVE-2008-5916 fixed (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since FEDORA-2008-11678] +CVE-2008-5906 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] +CVE-2008-5905 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] +CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7 +CVE-2008-5744 ignore (zaptel) kernel modules not shipped +CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2) +CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed +CVE-2008-5714 VULNERABLE (kvm) +CVE-2008-5714 VULNERABLE (qemu) +CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5698 ignore (konqueror) KDE3 and DoS only CVE-2008-5695 version (wordpress, fixed 2.3.3) CVE-2008-5695 version (wordpress-mu, fixed 1.3.3) +CVE-2008-5688 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743] +CVE-2008-5687 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743] CVE-2008-5676 version (mod_security, fixed 2.5.6) [since mod_security-2.5.6-1.fc10] CVE-2008-5660 fixed (vinagre, fixed 0.5.2,2.24.2) [since FEDORA-2008-10956] CVE-2008-5657 version (quassel, fixed 0.3.0.3) [since quassel-0.3.0.3-1.fc10] @@ -13,48 +38,57 @@ CVE-2008-5646 VULNERABLE (trac, fixed 0.11.2) CVE-2008-5622 fixed (phpMyAdmin, fixed 3.1.1) [since FEDORA-2008-11257] PMASA-2008-10, same as CVE-2008-5621? CVE-2008-5621 fixed (phpMyAdmin, fixed 3.1.1) [since FEDORA-2008-11257] PMASA-2008-10 -CVE-2008-5620 VULNERABLE (roundcubemail, fixed 0.2-rc) [since roundcubemail-0.2-5.beta.fc10] +CVE-2008-5620 fixed (roundcubemail, fixed 0.2-rc) [since FEDORA-2008-11456] CVE-2008-5619 fixed (roundcubemail, fixed 0.2-rc) [since FEDORA-2008-11247] -CVE-2008-5618 VULNERABLE (rsyslog, fixed 3.20.2,3.21.9) [since rsyslog-3.21.9-1.fc10] -CVE-2008-5617 VULNERABLE (rsyslog, fixed 3.20.1,3.21.8) [since rsyslog-3.21.9-1.fc10] +CVE-2008-5618 fixed (rsyslog, fixed 3.20.2,3.21.9) [since FEDORA-2008-11476] +CVE-2008-5617 fixed (rsyslog, fixed 3.20.1,3.21.8) [since FEDORA-2008-11476] CVE-2008-5587 VULNERABLE (phpPgAdmin, fixed 4.2.2) [phpPgAdmin-4.2.2-1.fc10] CVE-2008-5558 ignore (asterisk) AST-2008-012, not affected -CVE-2008-5513 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5512 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10] -CVE-2008-5512 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5511 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10] -CVE-2008-5511 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5510 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10] -CVE-2008-5510 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5508 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10] -CVE-2008-5508 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5507 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10] -CVE-2008-5507 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5506 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10] -CVE-2008-5506 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5505 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5503 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10] -CVE-2008-5502 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5501 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5500 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc10] -CVE-2008-5500 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5517 version (git, fixed 1.5.6) +CVE-2008-5516 version (git, fixed 1.5.5) +CVE-2008-5514 fixed (uw-imap, fixed 2007e) [since FEDORA-2009-0413] +CVE-2008-5513 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5512 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490] +CVE-2008-5512 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5511 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490] +CVE-2008-5511 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5510 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490] +CVE-2008-5510 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5508 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490] +CVE-2008-5508 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5507 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490] +CVE-2008-5507 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5506 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490] +CVE-2008-5506 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5505 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5503 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490] +CVE-2008-5502 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5501 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] +CVE-2008-5500 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11490] +CVE-2008-5500 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11511] CVE-2008-5432 fixed (moodle, fixed 1.8.7,1.9.3) [since FEDORA-2008-9903] CVE-2008-5398 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10991] CVE-2008-5397 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10991] +CVE-2008-5396 ignore (zaptel) kernel modules not shipped +CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10) CVE-2008-5299 VULNERABLE (chm2pdf) #474459 CVE-2008-5298 VULNERABLE (chm2pdf) #474459 CVE-2008-5286 ignore (cups) libpng prevents this +CVE-2008-5262 fixed (DevIL) [since FEDORA-2009-0867] +CVE-2008-5252 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743] +CVE-2008-5250 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743] +CVE-2008-5249 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11743] CVE-2008-5187 fixed (imlib2) #472579 [since FEDORA-2008-10364] CVE-2008-5184 version (cups, fixed 1.3.8) CVE-2008-5183 fixed (cups, fixed 1.3.10) [since FEDORA-2008-10895] -CVE-2008-5153 VULNERABLE (moodle) #472120 +CVE-2008-5153 fixed (moodle) #472120 [since FEDORA-2009-0819] CVE-2008-5148 fixed (geda-gnetlist) #472116 [since FEDORA-2008-9730] CVE-2008-5138 VULNERABLE (pam_mount) #472112 CVE-2008-5113 VULNERABLE (wordpress) #471992 CVE-2008-5110 fixed (syslog-ng) [since FEDORA-2008-10879] CVE-2008-5101 version (optipng, fixed 0.6.2) [since optipng-0.6.2-1.fc10] -CVE-2008-5086 VULNERABLE (libvirt) [since libvirt-0.5.1-2.fc10] -CVE-2008-5081 VULNERABLE (avahi, fixed 0.6.24) [since avahi-0.6.22-12.fc10] +CVE-2008-5086 fixed (libvirt) [since FEDORA-2008-11443] +CVE-2008-5081 fixed (avahi, fixed 0.6.24) [since FEDORA-2008-11351] CVE-2008-5080 fixed (awstats) [since FEDORA-2008-10950] CVE-2008-5078 ignore (enscript) 1.6.1 only CVE-2008-5076 fixed (htop) [since FEDORA-2008-9944] @@ -69,6 +103,7 @@ CVE-2008-4985 ignore (vdr) Debian-specific CVE-2008-4982 fixed (rkhunter) [since rkhunter-1.3.2-5.fc10] CVE-2008-4977 ignore (postfix) Debian-specific +CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10) CVE-2008-4956 ignore (fwbuilder) fwb_install not shipped CVE-2008-4937 ignore (openoffice.org) not affected CVE-2008-4936 fixed (mgetty) patched for ages @@ -82,6 +117,7 @@ CVE-2008-4789 version (drupal, fixed 6.5) [since drupal-6.5-1.fc10] CVE-2008-4776 version (libgadu, fixed 1.8.2) [since libgadu-1.8.2-1.fc10] CVE-2008-4775 version (phpMyAdmin, fixed 3.0.1.1) [since phpMyAdmin-3.0.1.1-1.fc10] +CVE-2008-4770 fixed (vnc, fixed 4.1.3) [since FEDORA-2009-0991] CVE-2008-4769 version (wordpress) CVE-2008-4690 fixed (lynx) [since FEDORA-2008-9952] CVE-2008-4641 VULNERABLE (jhead) @@ -96,6 +132,7 @@ CVE-2008-4434 ignore (bittorrent) 6.x only CVE-2008-4422 backport (libxml2, fixed 2.7.2) [since libxml2-2.7.1-2.fc10] CVE-2008-4408 version (mediawiki, fixed 1.13.2) [since mediawiki-1.13.2-41.fc10] +CVE-2008-4405 VULNERABLE (xen) CVE-2008-4360 version (lighttpd, fixed 1.4.20) [since lighttpd-1.4.20-0.1.r2303.fc10] CVE-2008-4359 version (lighttpd, fixed 1.4.20) #465754 [since lighttpd-1.4.20-1.fc10] CVE-2008-4326 version (phpMyAdmin, fixed 2.11.9.2) [since phpMyAdmin-2.11.9.2-1.fc10] @@ -108,7 +145,7 @@ CVE-2008-4306 fixed (enscript) [since enscript-1.6.4-11.fc10] CVE-2008-4298 version (lighttpd, fixed 1.4.20) [since lighttpd-1.4.20-0.1.r2303.fc10] CVE-2008-4297 version (mercurial, fixed 1.0.2) [since mercurial-1.0.2-1.fc10] -CVE-2008-4242 VULNERABLE (proftpd) #464130 +CVE-2008-4242 fixed (proftpd) #464130 [since FEDORA-2009-0089] CVE-2008-4226 fixed (libxml2) [since FEDORA-2008-10038] CVE-2008-4225 fixed (libxml2) [since FEDORA-2008-10038] CVE-2008-4191 backport (emacspeak) [since emacspeak-28.0-3.fc10] @@ -181,8 +218,8 @@ CVE-2008-3828 version (condor, fixed 7.0.5) #466076 [since condor-7.0.5-1.fc10] CVE-2008-3826 version (condor, fixed 7.0.5) #466076 [since condor-7.0.5-1.fc10] CVE-2008-3825 version (pam_krb5, 2.3.2) [since pam_krb5-2.3.2-1.fc10] -CVE-2008-3824 VULNERABLE (horde) oCERT-2008-012 -CVE-2008-3823 VULNERABLE (horde) oCERT-2008-012 +CVE-2008-3824 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012 +CVE-2008-3823 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012 CVE-2008-3796 version (swfdec, fixed 0.6.8) [since swfdec-0.7.4-1.fc10] CVE-2008-3790 backport (ruby) [since ruby-1.8.6.287-2.fc10] CVE-2008-3789 version (samba, fixed 3.2.3) [since samba-3.2.4-0.22.fc10] @@ -331,6 +368,9 @@ CVE-2008-2426 backport (imlib2) [since imlib2-1.4.0-7.fc10] CVE-2008-2420 version (stunnel, fixed 4.24) [since stunnel-4.24-2] CVE-2008-2392 ignore (wordpress) issue only in certain deployments, not affected by default +CVE-2008-2383 fixed (xterm, fixed 238) [since FEDORA-2009-0091] +CVE-2008-2382 VULNERABLE (qemu) +CVE-2008-2382 fixed (kvm, fixed 82) [since FEDORA-2008-11727] CVE-2008-2377 version (gnutls, fixed 2.4.1) [since gnutls-2.4.1-1.fc10] CVE-2008-2376 backport (ruby, fixed 1.8.6-p257) [since ruby-1.8.6.230-4.fc10] CVE-2008-2375 ignore (vsftpd) pre-2.0.5 versions only @@ -435,11 +475,12 @@ CVE-2007-5907 version (xen) #390121 CVE-2007-5906 version (xen) #390121 CVE-2007-5803 version (nagios, fixed 2.12) #446383 [since nagios-2.12-3.fc10] +CVE-2007-5729 VULNERABLE (kvm, fixed 82) CVE-2007-5615 backport (jetty) [since jetty-5.1.14-1jpp.2.fc10] CVE-2007-5614 backport (jetty) [since jetty-5.1.14-1jpp.2.fc10] CVE-2007-5613 backport (jetty) [since jetty-5.1.14-1jpp.2.fc10] CVE-2007-5079 VULNERABLE (gdm) #363041 Red Hat specific problem -CVE-2007-4829 VULNERABLE (perl, not fixed upstream) #364291 perl-Archive-Tar directory traversal +CVE-2007-4829 fixed (perl, fixed 1.40) [since FEDORA-2008-11736] #364291 perl-Archive-Tar directory traversal CVE-2007-4559 VULNERABLE (python, not fixed upstream) #315291 Upstream WONTFIX. See where we use the code. CVE-2007-1320 VULNERABLE (qemu) CVE-2007-1320 version (kvm, fixed 70) Index: f11 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f11,v retrieving revision 1.4 retrieving revision 1.5 diff -u -r1.4 -r1.5 --- f11 19 Dec 2008 16:13:54 -0000 1.4 +++ f11 27 Jan 2009 14:18:01 -0000 1.5 @@ -4,6 +4,31 @@ # *CVE are items that need verification for Fedora 10 # (mozilla) = (gecko-libs dependent stuff) +CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025 +CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1) +CVE-2009-0136 version (amarok, fixed 2.0.1.1) [since amarok-2.0.1.1-1.fc11] +CVE-2009-0135 version (amarok, fixed 2.0.1.1) [since amarok-2.0.1.1-1.fc11] +CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc11] not security according to upstream +CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific +CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) AST-2009-001 +CVE-2009-0025 version (bind, fixed 9.5.1-P1,9.6.0-P1) [since bind-9.6.0-2.P1.fc11] +CVE-2009-0022 VULNERABLE (samba, fixed 3.2.7) +CVE-2009-0021 version (ntp, fixed 4.2.4p6) [since ntp-4.2.4p6-1.fc11] +CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) +CVE-2008-5916 version (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since git-1.6.0.6-1.fc11] +CVE-2008-5906 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] +CVE-2008-5905 version (ktorrent, fixed 3.1.4) [since ktorrent-3.1.4-1.fc10] +CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7 +CVE-2008-5744 ignore (zaptel) kernel modules not shipped +CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2) +CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed +CVE-2008-5714 VULNERABLE (kvm) +CVE-2008-5714 VULNERABLE (qemu) +CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5698 ignore (konqueror) KDE3 and DoS only +CVE-2008-5688 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11] +CVE-2008-5687 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11] CVE-2008-5676 version (mod_security, fixed 2.5.6) [since mod_security-2.5.6-1.fc10] CVE-2008-5660 version (vinagre, fixed 0.5.2,2.24.2) [since vinagre-2.25.3-1.fc11] CVE-2008-5657 version (quassel, fixed 0.3.0.3) [since quassel-0.3.0.3-1.fc11] @@ -17,61 +42,76 @@ CVE-2008-5617 version (rsyslog, fixed 3.20.1,3.21.8) [since rsyslog-3.21.9-1.fc11] CVE-2008-5587 version (phpPgAdmin, fixed 4.2.2) [since phpPgAdmin-4.2.2-1.fc11] CVE-2008-5558 ignore (asterisk) AST-2008-012, not affected -CVE-2008-5513 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5517 version (git, fixed 1.5.6) +CVE-2008-5516 version (git, fixed 1.5.5) +CVE-2008-5514 version (uw-imap, fixed 2007e) [since uw-imap-2007e-1.fc11] +CVE-2008-5513 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5512 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11] -CVE-2008-5512 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5512 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5511 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11] -CVE-2008-5511 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5511 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5510 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11] -CVE-2008-5510 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5510 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5508 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11] -CVE-2008-5508 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5508 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5507 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11] -CVE-2008-5507 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5507 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5506 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11] -CVE-2008-5506 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5505 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5506 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] +CVE-2008-5505 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5503 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11] -CVE-2008-5502 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] -CVE-2008-5501 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5502 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] +CVE-2008-5501 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5500 version (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc11] -CVE-2008-5500 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc10] +CVE-2008-5500 version (firefox, fixed 3.0.5) [since firefox-3.1-0.4.beta2.fc11] CVE-2008-5432 version (moodle, fixed 1.8.7,1.9.3) [since moodle-1.9.3-3.fc11] CVE-2008-5398 version (tor, fixed 0.2.0.32) [since tor-0.2.0.32-1.fc11] CVE-2008-5397 version (tor, fixed 0.2.0.32) [since tor-0.2.0.32-1.fc11] +CVE-2008-5396 ignore (zaptel) kernel modules not shipped +CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10) CVE-2008-5299 VULNERABLE (chm2pdf) CVE-2008-5298 VULNERABLE (chm2pdf) CVE-2008-5286 ignore (cups) libpng prevents this +CVE-2008-5262 backport (DevIL) [since DevIL-1.7.5-2.fc11] +CVE-2008-5252 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11] +CVE-2008-5250 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11] +CVE-2008-5249 version (mediawiki, fixed 1.13.3) [since mediawiki-1.13.3-42.fc11] CVE-2008-5184 version (cups, fixed 1.3.8) CVE-2008-5183 VULNERABLE (cups, fixed 1.3.10) [since cups-1.4-0.b1.5.fc11] -CVE-2008-5153 VULNERABLE (moodle) +CVE-2008-5153 backport (moodle) [since moodle-1.9.3-5.fc11] CVE-2008-5138 VULNERABLE (pam_mount) CVE-2008-5113 VULNERABLE (wordpress) #471992 CVE-2008-5110 version (syslog-ng, fixed 2.0.10) [since syslog-ng-2.0.10-1.fc11] CVE-2008-5086 backport (libvirt) [since libvirt-0.5.1-2.fc11] CVE-2008-5081 version (avahi, fixed 0.6.24) [since avahi-0.6.24-1.fc11] CVE-2008-5080 backport (awstats) [since awstats-6.8-3.fc11] +CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10) CVE-2008-4863 backport (blender) [blender-2.48a-4.fc10] +CVE-2008-4770 VULNERABLE (vnc, fixed 4.1.3) CVE-2008-4690 backport (lynx) [since lynx-2.8.6-18.fc10] CVE-2008-4641 VULNERABLE (jhead) CVE-2008-4640 VULNERABLE (jhead) CVE-2008-4437 VULNERABLE (bugzilla, fixed 3.0.5) +CVE-2008-4405 VULNERABLE (xen) CVE-2008-4315 fixed (tog-pegasus) [since tog-pegasus-2.7.2-2.fc11] CVE-2008-4314 version (samba, fixed 3.0.33,3.2.5) [since samba-3.2.5-0.23.fc11] CVE-2008-4313 fixed (tog-pegasus) [since tog-pegasus-2.7.2-2.fc11] CVE-2008-4311 version (dbus, fixed 1.2.6) [since dbus-1.2.6-1.fc11] CVE-2008-4309 version (net-snmp, fixed 5.4.2.1) [since net-snmp-5.4.2.1-1.fc10] -CVE-2008-4242 VULNERABLE (proftpd) #464130 +CVE-2008-4242 version (proftpd, fixed 1.3.2) #464130 [since 1.3.2-0.1.rc3] CVE-2008-4190 VULNERABLE (openswan) -CVE-2008-4130 VULNERABLE (gallery2, fixed 2.2.6) -CVE-2008-4129 VULNERABLE (gallery2, fixed 2.2.6) +CVE-2008-4130 version (gallery2, fixed 2.2.6) [since gallery2-2.3-1.fc11] +CVE-2008-4129 version (gallery2, fixed 2.2.6) [since gallery2-2.3-1.fc11] CVE-2008-4100 VULNERABLE (adns) #462754 upstream design decision CVE-2008-3949 VULNERABLE (emacs, fixed 22.3) CVE-2008-3927 VULNERABLE (tiger) -CVE-2008-3824 VULNERABLE (horde) oCERT-2008-012 -CVE-2008-3823 VULNERABLE (horde) oCERT-2008-012 -CVE-2008-3662 VULNERABLE (gallery2, fixed 2.2.6) +CVE-2008-3824 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012 +CVE-2008-3823 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012 +CVE-2008-3662 version (gallery2, fixed 2.2.6) [since gallery2-2.3-1.fc11] CVE-2008-3381 VULNERABLE (moin) #457364 +CVE-2008-2383 version (xterm, fixed 238) [since xterm-238-1.fc11] +CVE-2008-2382 VULNERABLE (qemu) +CVE-2008-2382 VULNERABLE (kvm, fixed 82) CVE-2008-2363 VULNERABLE (pan) #449335 CVE-2008-2004 VULNERABLE (qemu) fix mostly useless without libvirt changes CVE-2008-2004 VULNERABLE (kvm) fix mostly useless without libvirt changes @@ -79,8 +119,9 @@ CVE-2008-1103 VULNERABLE (blender) not fixed upstream CVE-2007-6318 VULNERABLE (wordpress) #426434 CVE-2007-6131 VULNERABLE (scanbuttond) +CVE-2007-5729 VULNERABLE (kvm, fixed 82) CVE-2007-5079 VULNERABLE (gdm) #363041 Red Hat specific problem -CVE-2007-4829 VULNERABLE (perl, not fixed upstream) #364291 perl-Archive-Tar directory traversal +CVE-2007-4829 version (perl, fixed 1.40) [since perl-5.10.0-52.fc11] #364291 perl-Archive-Tar directory traversal CVE-2007-4559 VULNERABLE (python, not fixed upstream) #315291 Upstream WONTFIX. See where we use the code. CVE-2007-1320 VULNERABLE (qemu) CVE-2006-1390 VULNERABLE (nethack) bz#187353, but requires other access to games group Index: f9 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f9,v retrieving revision 1.243 retrieving revision 1.244 diff -u -r1.243 -r1.244 --- f9 19 Dec 2008 19:22:22 -0000 1.243 +++ f9 27 Jan 2009 14:18:01 -0000 1.244 @@ -5,7 +5,32 @@ # (mozilla) = (gecko-libs dependent stuff) rhbz249840 version (tor, fixed 0.1.2.15) +CVE-2009-0265 ignore (bind) dupe of CVE-2009-0025 +CVE-2009-0260 VULNERABLE (moin, fixed 1.7.3,1.8.1) +CVE-2009-0136 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0715] +CVE-2009-0135 fixed (amarok, fixed 2.0.1.1) [since FEDORA-2009-0715] +CVE-2009-0125 ignore (libnasl) [since libnasl-2.2.11-3.fc9] not security according to upstream +CVE-2009-0122 ignore (hplip) Debian/Ubuntu specific +CVE-2009-0041 VULNERABLE (asterisk, fixed 1.6.0.5) [since asterisk-1.6.0.5-2.fc9] AST-2009-001 +CVE-2009-0025 fixed (bind, fixed 9.5.1-P1,9.6.0-P1) [since FEDORA-2009-0350] +CVE-2009-0022 fixed (samba, fixed 3.2.7) [since FEDORA-2009-0268] +CVE-2009-0021 fixed (ntp, fixed 4.2.4p6) [since FEDORA-2009-0547] +CVE-2008-5917 VULNERABLE (horde, fixed 3.2.3,3.3.1) +CVE-2008-5916 fixed (git, fixed 1.6.0.6,1.5.6.6,1.5.5.6,1.5.4.7) [since FEDORA-2008-11650] +CVE-2008-5906 fixed (ktorrent, fixed 3.1.4) [since FEDORA-2008-9167] +CVE-2008-5905 fixed (ktorrent, fixed 3.1.4) [since FEDORA-2008-9167] +CVE-2008-5844 ignore (php, fixed 5.2.8) only affected 5.2.7 +CVE-2008-5744 ignore (zaptel) kernel modules not shipped +CVE-2008-5718 VULNERABLE (netatalk, fixed 2.0.4-beta2) +CVE-2008-5716 ignore (xen) CVE-2008-4405 was not yet fixed +CVE-2008-5714 VULNERABLE (kvm) +CVE-2008-5714 VULNERABLE (qemu) +CVE-2008-5704 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5703 VULNERABLE (gpsdrive, fixed 2.10) +CVE-2008-5698 ignore (konqueror) KDE3 and DoS only CVE-2008-5695 version (wordpress, fixed 2.3.3) +CVE-2008-5688 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802] +CVE-2008-5687 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802] CVE-2008-5676 version (mod_security, fixed 2.5.6) [since mod_security-2.5.6-1.fc9] CVE-2008-5660 fixed (vinagre, fixed 0.5.2,2.24.2) [since FEDORA-2008-10932] CVE-2008-5657 fixed (quassel, fixed 0.3.0.3) [since FEDORA-2008-9658] @@ -15,43 +40,52 @@ CVE-2008-5621 fixed (phpMyAdmin, fixed 3.1.1) [since FEDORA-2008-11208] PMASA-2008-10 CVE-2008-5620 VULNERABLE (roundcubemail, fixed 0.2-rc) CVE-2008-5619 fixed (roundcubemail, fixed 0.2-rc) [since FEDORA-2008-11234] -CVE-2008-5618 VULNERABLE (rsyslog, fixed 3.20.2,3.21.9) [since rsyslog-3.20.2-2.fc9] -CVE-2008-5617 VULNERABLE (rsyslog, fixed 3.20.1,3.21.8) [since rsyslog-3.20.2-2.fc9] -CVE-2008-5587 VULNERABLE (phpPgAdmin, fixed 4.2.2) [since phpPgAdmin-4.2.2-1.fc9] +CVE-2008-5618 fixed (rsyslog, fixed 3.20.2,3.21.9) [since FEDORA-2008-11538] +CVE-2008-5617 fixed (rsyslog, fixed 3.20.1,3.21.8) [since FEDORA-2008-11538] +CVE-2008-5587 fixed (phpPgAdmin, fixed 4.2.2) [since FEDORA-2008-11602] CVE-2008-5558 ignore (asterisk) AST-2008-012, not affected -CVE-2008-5513 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5512 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9] -CVE-2008-5512 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5511 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9] -CVE-2008-5511 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5510 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9] -CVE-2008-5510 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5508 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9] -CVE-2008-5508 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5507 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9] -CVE-2008-5507 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5506 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9] -CVE-2008-5506 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5505 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5503 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9] -CVE-2008-5502 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5501 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] -CVE-2008-5500 VULNERABLE (seamonkey, fixed 1.1.14) [since seamonkey-1.1.14-1.fc9] -CVE-2008-5500 VULNERABLE (firefox, fixed 3.0.5) [since firefox-3.0.5-1.fc9] +CVE-2008-5517 version (git, fixed 1.5.6) +CVE-2008-5516 version (git, fixed 1.5.5) +CVE-2008-5514 fixed (uw-imap, fixed 2007e) [since FEDORA-2009-0371] +CVE-2008-5513 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5512 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586] +CVE-2008-5512 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5511 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586] +CVE-2008-5511 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5510 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586] +CVE-2008-5510 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5508 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586] +CVE-2008-5508 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5507 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586] +CVE-2008-5507 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5506 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586] +CVE-2008-5506 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5505 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5503 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586] +CVE-2008-5502 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5501 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] +CVE-2008-5500 fixed (seamonkey, fixed 1.1.14) [since FEDORA-2008-11586] +CVE-2008-5500 fixed (firefox, fixed 3.0.5) [since FEDORA-2008-11598] CVE-2008-5432 fixed (moodle, fixed 1.8.7,1.9.3) [since FEDORA-2008-9508] CVE-2008-5398 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10989] CVE-2008-5397 fixed (tor, fixed 0.2.0.32) [since FEDORA-2008-10989] +CVE-2008-5396 ignore (zaptel) kernel modules not shipped +CVE-2008-5380 VULNERABLE (gpsdrive, fixed 2.10) CVE-2008-5286 ignore (cups) libpng prevents this +CVE-2008-5262 fixed (DevIL) [since FEDORA-2009-0856] +CVE-2008-5252 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802] +CVE-2008-5250 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802] +CVE-2008-5249 fixed (mediawiki, fixed 1.13.3) [since FEDORA-2008-11802] CVE-2008-5187 fixed (imlib2) #472578 [since FEDORA-2008-10287] CVE-2008-5184 version (cups, fixed 1.3.8) CVE-2008-5183 fixed (cups, fixed 1.3.10) [since FEDORA-2008-10917] -CVE-2008-5153 VULNERABLE (moodle) #472119 +CVE-2008-5153 fixed (moodle) #472119 [since FEDORA-2009-0814] CVE-2008-5148 fixed (geda-gnetlist) #472115 [since FEDORA-2008-9730] CVE-2008-5138 VULNERABLE (pam_mount) #472111 CVE-2008-5113 VULNERABLE (wordpress) #471991 CVE-2008-5110 fixed (syslog-ng) #471986 [since FEDORA-2008-10752] CVE-2008-5101 fixed (optipng, fixed 0.6.2) [since FEDORA-2008-9633] -CVE-2008-5086 VULNERABLE (libvirt) [since libvirt-0.5.1-2.fc9] +CVE-2008-5086 fixed (libvirt) [since FEDORA-2008-11433] CVE-2008-5081 VULNERABLE (avahi, fixed 0.6.24) CVE-2008-5080 fixed (awstats) [since FEDORA-2008-10962] CVE-2008-5078 ignore (enscript) 1.6.1 only @@ -67,6 +101,7 @@ CVE-2008-4985 ignore (vdr) Debian-specific CVE-2008-4982 fixed (rkhunter) [since FEDORA-2008-8314] CVE-2008-4977 ignore (postfix) Debian-specific +CVE-2008-4959 VULNERABLE (gpsdrive, fixed 2.10) CVE-2008-4956 ignore (fwbuilder) fwb_install not shipped CVE-2008-4937 fixed (openoffice.org) [since FEDORA-2008-7680] CVE-2008-4936 fixed (mgetty) patched for ages @@ -80,6 +115,7 @@ CVE-2008-4789 fixed (drupal, fixed 6.5) [since FEDORA-2008-8852] CVE-2008-4776 fixed (libgadu, fixed 1.8.2) [since FEDORA-2008-9293] CVE-2008-4775 fixed (phpMyAdmin, fixed 3.0.1.1) [since FEDORA-2008-9316] +CVE-2008-4770 fixed (vnc, fixed 4.1.3) [since FEDORA-2009-1001] CVE-2008-4769 version (wordpress) CVE-2008-4690 fixed (lynx) #468550 [since FEDORA-2008-9550] CVE-2008-4641 VULNERABLE (jhead) @@ -94,6 +130,7 @@ CVE-2008-4434 ignore (bittorrent) 6.x only CVE-2008-4422 fixed (libxml2, fixed 2.7.2) [since FEDORA-2008-8575] CVE-2008-4408 fixed (mediawiki, fixed 1.13.2) [since FEDORA-2008-8639] +CVE-2008-4405 VULNERABLE (xen) CVE-2008-4360 VULNERABLE (lighttpd, fixed 1.4.20) #464639 CVE-2008-4359 VULNERABLE (lighttpd, fixed 1.4.20) #464639 CVE-2008-4326 fixed (phpMyAdmin, fixed 2.11.9.2) [since FEDORA-2008-8335] @@ -106,7 +143,7 @@ CVE-2008-4306 fixed (enscript) [since FEDORA-2008-9372] CVE-2008-4298 VULNERABLE (lighttpd, fixed 1.4.20) #464639 CVE-2008-4297 fixed (mercurial, fixed 1.0.2) [since FEDORA-2008-7490] -CVE-2008-4242 VULNERABLE (proftpd) #464129 +CVE-2008-4242 fixed (proftpd) #464129 [since FEDORA-2009-0064] CVE-2008-4226 fixed (libxml2) [since FEDORA-2008-9773] CVE-2008-4225 fixed (libxml2) [since FEDORA-2008-9773] CVE-2008-4191 fixed (emacspeak) [since FEDORA-2008-8379] @@ -179,8 +216,8 @@ CVE-2008-3828 fixed (condor, fixed 7.0.5) #466075 [since FEDORA-2008-8733] CVE-2008-3826 fixed (condor, fixed 7.0.5) #466075 [since FEDORA-2008-8733] CVE-2008-3825 fixed (pam_krb5, 2.3.2) [since FEDORA-2008-8618] -CVE-2008-3824 VULNERABLE (horde) oCERT-2008-012 -CVE-2008-3823 VULNERABLE (horde) oCERT-2008-012 +CVE-2008-3824 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012 +CVE-2008-3823 VULNERABLE (horde, fixed 3.2.2) oCERT-2008-012 CVE-2008-3796 version (swfdec, fixed 0.6.8) [since swfdec-0.6.8-1.fc9] CVE-2008-3790 fixed (ruby) [since FEDORA-2008-8738] CVE-2008-3789 fixed (samba, fixed 3.2.3) [since FEDORA-2008-7243] @@ -329,6 +366,9 @@ CVE-2008-2426 fixed (imlib2) [since FEDORA-2008-4871] CVE-2008-2420 fixed (stunnel, fixed 4.24) [since FEDORA-2008-4531] CVE-2008-2392 ignore (wordpress) issue only in certain deployments, not affected by default +CVE-2008-2383 fixed (xterm, fixed 238) [since FEDORA-2009-0059] +CVE-2008-2382 VULNERABLE (qemu) +CVE-2008-2382 fixed (kvm, fixed 82) [since FEDORA-2008-11705] CVE-2008-2377 ignore (gnutls, fixed 2.4.1) 2.3.5+ only CVE-2008-2376 fixed (ruby, fixed 1.8.6-p257) [since FEDORA-2008-6033] CVE-2008-2375 ignore (vsftpd) pre-2.0.5 versions only @@ -796,6 +836,7 @@ CVE-2007-5746 version (openoffice.org, fixed 2.4) CVE-2007-5745 version (openoffice.org, fixed 2.4) CVE-2007-5742 version (wesnoth, fixed 1.2.8) [since wesnoth-1.2.8-3.fc9] +CVE-2007-5729 VULNERABLE (kvm, fixed 82) CVE-2007-5712 version (Django, fixed 0.96.1) #362781 [since Django-0.96.1-1.fc9] CVE-2007-5708 version (openldap, fixed 2.3.39) #360091 [since openldap-2.3.39-1.fc9] CVE-2007-5707 version (openldap, fixed 2.3.39) #360091 [since openldap-2.3.39-1.fc9]

1 0

fedora-security/audit f8,1.253,1.254
by fedora-security-commits＠redhat.com 15 Jan '09

15 Jan '09

Author: thoger Update of /cvs/fedora/fedora-security/audit In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv8182/audit Modified Files: f8 Log Message: ok, one more typo fix ;) Index: f8 =================================================================== RCS file: /cvs/fedora/fedora-security/audit/f8,v retrieving revision 1.253 retrieving revision 1.254 diff -u -r1.253 -r1.254 --- f8 15 Jan 2009 13:31:50 -0000 1.253 +++ f8 15 Jan 2009 13:39:28 -0000 1.254 @@ -1,6 +1,6 @@ # $Id$ -# F* EOLed on 2009-01-09 +# F8 EOLed on 2009-01-09 # ** are items that need attention # *CVE are items that need verification for Fedora 8

1 0

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

security-commits