Bug#384734: debsecan: Fixed Sun java packages still listed as vulnerable (CVE-2006-2426)

2006-08-27 Thread Florian Weimer
* Michel Messerschmidt: On Sat, Aug 26, 2006 at 07:02:54PM +0200, Florian Weimer wrote: I could not find any confirmation that the bug has indeed been fixed in subsequent versions. Have you tested the exploit against a more recent version? Oh, sorry for this badly researched bugreport. I

Bug#384734: debsecan: Fixed Sun java packages still listed as vulnerable (CVE-2006-2426)

2006-08-26 Thread Michel Messerschmidt
Package: debsecan Version: 0.4.2 Severity: normal -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 http://idssi.enyo.de/tracker/CVE-2006-2426 currently states that no fixed Sun Java packages exist and lists even version 1.5.0-08-1 as vulnerable. I think this is wrong because CVE-2006-2426 mentions

Bug#384734: debsecan: Fixed Sun java packages still listed as vulnerable (CVE-2006-2426)

2006-08-26 Thread Florian Weimer
* Michel Messerschmidt: http://idssi.enyo.de/tracker/CVE-2006-2426 currently states that no fixed Sun Java packages exist and lists even version 1.5.0-08-1 as vulnerable. I think this is wrong because CVE-2006-2426 mentions only vulnerabilities in Java up to 1.5.0_06. This is not the way