[Secure-testing-commits] r29369 - data/CVE

[Moritz Muehlenhoff]

Author: jmm
Date: 2014-10-12 15:54:37 + (Sun, 12 Oct 2014)
New Revision: 29369

Modified:
   data/CVE/list
Log:
memcached fixed


Modified: data/CVE/list
===
--- data/CVE/list   2014-10-12 06:52:36 UTC (rev 29368)
+++ data/CVE/list   2014-10-12 15:54:37 UTC (rev 29369)
@@ -17143,7 +17143,7 @@
 CVE-2013-7292 (VASCO IDENTIKEY Authentication Server (IAS) 3.4.x allows remote 
...)
NOT-FOR-US: VASCO IAS
 CVE-2013-7291 (memcached before 1.4.17, when running in verbose mode, allows 
remote ...)
-   - memcached  (low; bug #735314)
+   - memcached 1.4.20-1 (low; bug #735314)
[squeeze] - memcached  (Minor issue)
[wheezy] - memcached  (Minor issue)
NOTE: 
https://github.com/memcached/memcached/commit/fbe823d9a61b5149cd6e3b5e17bd28dd3b8dd760


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r29370 - data/CVE

[Michael Gilbert]

Author: mgilbert
Date: 2014-10-12 18:32:32 + (Sun, 12 Oct 2014)
New Revision: 29370

Modified:
   data/CVE/list
Log:
nfu

Modified: data/CVE/list
===
--- data/CVE/list   2014-10-12 15:54:37 UTC (rev 29369)
+++ data/CVE/list   2014-10-12 18:32:32 UTC (rev 29370)
@@ -31941,7 +31941,7 @@
 CVE-2013-2587
RESERVED
 CVE-2013-2586 (XAMPP 1.8.1 does not properly restrict access to 
xampp/lang.php, which ...)
-   TODO: check
+   NOT-FOR-US: XAMPPP
 CVE-2013-2585 (Cross-site scripting (XSS) vulnerability in Atmail Webmail 
Server ...)
NOT-FOR-US: AtMail
 CVE-2013-2584


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r29371 - data/CVE

[Michael Gilbert]

Author: mgilbert
Date: 2014-10-12 18:50:41 + (Sun, 12 Oct 2014)
New Revision: 29371

Modified:
   data/CVE/list
Log:
fix chromium entries

Modified: data/CVE/list
===
--- data/CVE/list   2014-10-12 18:32:32 UTC (rev 29370)
+++ data/CVE/list   2014-10-12 18:50:41 UTC (rev 29371)
@@ -454,8 +454,9 @@
[wheezy] - libv8  (Minor issue, Chromium in Wheezy uses its own 
fixed copy)
[squeeze] - libv8  (Unsupported in squeeze-lts)
- libv8-3.14 
-   - chromium-browser 
+   - chromium-browser 
[squeeze] - chromium-browser 
+   TODO: CVE description indicates upsteam 38.0.2125.101 fixed this, but 
there isn't enough information available to check yet
 CVE-2014-7960 [Swift metadata constraints are not correctly enforced]
RESERVED
- swift 
@@ -11393,18 +11394,20 @@
 CVE-2014-3201
RESERVED
 CVE-2014-3200 (Multiple unspecified vulnerabilities in Google Chrome before 
...)
-   - chromium-browser 
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3199 (The wrap function in bindings/core/v8/custom/V8EventCustom.cpp 
in the ...)
- libv8 
[wheezy] - libv8  (Minor issue, Chromium in Wheezy uses its own 
fixed copy)
[squeeze] - libv8  (Unsupported in squeeze-lts)
- libv8-3.14 
+   - chromium-browser 38.0.2125.101-1
+   [squeeze] - chromium-browser 
 CVE-2014-3198 (The Instance::HandleInputEvent function in pdf/instance.cc in 
the ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3197 (The NavigationScheduler::schedulePageBlock function in ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3196 (base/memory/shared_memory_win.cc in Google Chrome before 
38.0.2125.101 ...)
- chromium-browser  (Only affects Windows)
@@ -11413,33 +11416,35 @@
[wheezy] - libv8  (Minor issue, Chromium in Wheezy uses its own 
fixed copy)
[squeeze] - libv8  (Unsupported in squeeze-lts)
- libv8-3.14 
+   - chromium-browser 38.0.2125.101-1
+   [squeeze] - chromium-browser 
 CVE-2014-3194 (Use-after-free vulnerability in the Web Workers implementation 
in ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3193 (The SessionService::GetLastSession function in ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3192 (Use-after-free vulnerability in the ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3191 (Use-after-free vulnerability in Blink, as used in Google Chrome 
before ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3190 (Use-after-free vulnerability in the Event::currentTarget 
function in ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3189 (The chrome_pdf::CopyImage function in pdf/draw_utils.cc in the 
PDFium ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
 CVE-2014-3188 (Google Chrome before 38.0.2125.101 and Chrome OS before 
38.0.2125.101 ...)
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 38.0.2125.101-1
[squeeze] - chromium-browser 
- libv8 
[wheezy] - libv8  (Minor issue, Chromium in Wheezy uses its own 
fixed copy)
[squeeze] - libv8  (Unsupported in squeeze-lts)
- libv8-3.14 
-CVE-2014-3187 (Google Chrome before 37.0.2062.60 and 38.x before 38.0.2125.59 
on iOS ...)
-   TODO: check
+CVE-2014-3187 (Google Chrome before 37.0.2062.120.60 and 38.x before 
38.0.2125.59 on iOS ...)
+   - chromium-browser  (only affects versions supporting 
Apple's facetime)
 CVE-2014-3186 (Buffer overflow in the picolcd_raw_event function in ...)
- linux 
[wheezy] - linux  (Will be fixed in next point release)
@@ -11480,63 +11485,63 @@
RESERVED
 CVE-2014-3179 (Multiple unspecified vulnerabilities in Google Chrome before 
...)
{DSA-3039-1}
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 
 CVE-2014-3178 (Use-after-free vulnerability in core/dom/Node.cpp in Blink, as 
used in ...)
{DSA-3039-1}
-   - chromium-browser 37.0.2062-1
+   - chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 
-CVE-2014-3177 (Google Chrome before 37.0.2062.94 does not properly handle the 
...)
+CVE-2014-3177 (Google Chrome before 37.0.2062.120.94 does not properly handl

[Secure-testing-commits] r29372 - data/CVE

[Moritz Muehlenhoff]

Author: jmm
Date: 2014-10-12 19:12:26 + (Sun, 12 Oct 2014)
New Revision: 29372

Modified:
   data/CVE/list
Log:
enigmail n/a


Modified: data/CVE/list
===
--- data/CVE/list   2014-10-12 18:50:41 UTC (rev 29371)
+++ data/CVE/list   2014-10-12 19:12:26 UTC (rev 29372)
@@ -5817,8 +5817,8 @@
RESERVED
 CVE-2014-5369 (Enigmail 1.7.x before 1.7.2 sends emails in plaintext when 
encryption ...)
- enigmail 2:1.7.2-1
-   [wheezy] - enigmail  (Minor issue)
-   [squeeze] - enigmail  (Icedove EOLed in squeeze)
+   [wheezy] - enigmail  (Introduced in 1.7)
+   [squeeze] - enigmail  (Introduced in 1.7)
NOTE: 
http://sourceforge.net/p/enigmail/forum/support/thread/3e7268a4/#b315
NOTE: and http://sourceforge.net/p/enigmail/bugs/294/
NOTE: fixed in 1.7.1 and 1.8.0 upstream (not yet released)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r29373 - hardening

[Moritz Muehlenhoff]

Author: jmm
Date: 2014-10-12 19:45:09 + (Sun, 12 Oct 2014)
New Revision: 29373

Modified:
   hardening/subgoal-dsa.txt
Log:
two packages moved to standard dpkg-buildflags


Modified: hardening/subgoal-dsa.txt
===
--- hardening/subgoal-dsa.txt   2014-10-12 19:12:26 UTC (rev 29372)
+++ hardening/subgoal-dsa.txt   2014-10-12 19:45:09 UTC (rev 29373)
@@ -436,10 +436,11 @@
 globus-gridftp-server (734920) (7.11-1)
 pcre3 (656008) (1:8.35-3.1)
 netpbm-free (655737) (2:10.0-15.1)
+sendmail (8.14.4-4.1)
+strongswan (5.0.4-1)
 
 
 Packages, which use hardened build flags manually, but not yet dpkg-buildflags:
-sendmail
 eglibc (657528)
 pcp
 
@@ -447,7 +448,6 @@
 
 Packages using hardening-wrapper/-includes (these are considered fixed, 
although
switching them over to dpkg-buildflags might be worthwhile later on):
-strongswan (already uses dh)
 evolution
 tor
 mysql-5.5
@@ -462,3 +462,4 @@
 ldns (needed)
 nsd3
 virtualbox (736459) (4.3.6-dfsg-1)
+


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r29374 - hardening

[Moritz Muehlenhoff]

Author: jmm
Date: 2014-10-12 19:58:20 + (Sun, 12 Oct 2014)
New Revision: 29374

Modified:
   hardening/subgoal-dsa.txt
Log:
evolution,cyrus-sasl2,nsd3 use dpkg-buildflags
nagios-plugins has been renamed to monitoring-plugins


Modified: hardening/subgoal-dsa.txt
===
--- hardening/subgoal-dsa.txt   2014-10-12 19:45:09 UTC (rev 29373)
+++ hardening/subgoal-dsa.txt   2014-10-12 19:58:20 UTC (rev 29374)
@@ -28,6 +28,7 @@
 pygresql (needed)
 python-pam (needed)
 zodb (needed)
+pcp
 
 
 
@@ -438,17 +439,18 @@
 netpbm-free (655737) (2:10.0-15.1)
 sendmail (8.14.4-4.1)
 strongswan (5.0.4-1)
+evolution (3.4.2-1)
+cyrus-sasl2 (2.1.24~rc1.dfsg1+cvs2011-05-23-5)
+nsd3 (3.2.9-3)
 
 
 Packages, which use hardened build flags manually, but not yet dpkg-buildflags:
 eglibc (657528)
-pcp
 
 
 
 Packages using hardening-wrapper/-includes (these are considered fixed, 
although
switching them over to dpkg-buildflags might be worthwhile later on):
-evolution
 tor
 mysql-5.5
 ipsec-tools
@@ -456,10 +458,8 @@
 bind9
 postfix
 pidgin (needed)
-nagios-plugins
+monitoring-plugins
 znc
-cyrus-sasl2
 ldns (needed)
-nsd3
 virtualbox (736459) (4.3.6-dfsg-1)
 


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r29375 - data/CVE

[Moritz Muehlenhoff]

Author: jmm
Date: 2014-10-12 19:58:55 + (Sun, 12 Oct 2014)
New Revision: 29375

Modified:
   data/CVE/list
Log:
node-qs fixed


Modified: data/CVE/list
===
--- data/CVE/list   2014-10-12 19:58:20 UTC (rev 29374)
+++ data/CVE/list   2014-10-12 19:58:55 UTC (rev 29375)
@@ -1877,7 +1877,7 @@
RESERVED
 CVE-2014-7191 [qs Denial-of-Service Memory Exhaustion]
RESERVED
-   - node-qs 
+   - node-qs 2.2.4-1
NOTE: 
https://github.com/raymondfeng/node-querystring/commit/43a604b7847e56bba49d0ce3e222fe89569354d8
NOTE: https://nodesecurity.io/advisories/qs_dos_memory_exhaustion
 CVE-2014-7188 (The hvm_msr_read_intercept function in arch/x86/hvm/hvm.c in 
Xen 4.1 ...)


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r29376 - data/CVE

[Joey Hess]

Author: joeyh
Date: 2014-10-12 21:14:12 + (Sun, 12 Oct 2014)
New Revision: 29376

Modified:
   data/CVE/list
Log:
automatic update

Modified: data/CVE/list
===
--- data/CVE/list   2014-10-12 19:58:55 UTC (rev 29375)
+++ data/CVE/list   2014-10-12 21:14:12 UTC (rev 29376)
@@ -11443,7 +11443,7 @@
[wheezy] - libv8  (Minor issue, Chromium in Wheezy uses its own 
fixed copy)
[squeeze] - libv8  (Unsupported in squeeze-lts)
- libv8-3.14 
-CVE-2014-3187 (Google Chrome before 37.0.2062.120.60 and 38.x before 
38.0.2125.59 on iOS ...)
+CVE-2014-3187 (Google Chrome before 37.0.2062.60 and 38.x before 38.0.2125.59 
on iOS ...)
- chromium-browser  (only affects versions supporting 
Apple's facetime)
 CVE-2014-3186 (Buffer overflow in the picolcd_raw_event function in ...)
- linux 
@@ -11491,11 +11491,11 @@
{DSA-3039-1}
- chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 
-CVE-2014-3177 (Google Chrome before 37.0.2062.120.94 does not properly handle 
the ...)
+CVE-2014-3177 (Google Chrome before 37.0.2062.94 does not properly handle the 
...)
{DSA-3039-1}
- chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 
-CVE-2014-3176 (Google Chrome before 37.0.2062.120.94 does not properly handle 
the ...)
+CVE-2014-3176 (Google Chrome before 37.0.2062.94 does not properly handle the 
...)
{DSA-3039-1}
- chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 
@@ -11507,7 +11507,7 @@
{DSA-3039-1}
- chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 
-CVE-2014-3173 (The WebGL implementation in Google Chrome before 
37.0.2062.120.94 does not ...)
+CVE-2014-3173 (The WebGL implementation in Google Chrome before 37.0.2062.94 
does not ...)
{DSA-3039-1}
- chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 
@@ -11519,7 +11519,7 @@
{DSA-3039-1}
- chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 
-CVE-2014-3170 (extensions/common/url_pattern.cc in Google Chrome before 
37.0.2062.120.94 ...)
+CVE-2014-3170 (extensions/common/url_pattern.cc in Google Chrome before 
37.0.2062.94 ...)
{DSA-3039-1}
- chromium-browser 37.0.2062.120-1
[squeeze] - chromium-browser 


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits

[Secure-testing-commits] r29377 - data

[Andrew Bartlett]

Author: abartlet-guest
Date: 2014-10-13 04:37:01 + (Mon, 13 Oct 2014)
New Revision: 29377

Modified:
   data/dla-needed.txt
Log:
I'll take ppp


Modified: data/dla-needed.txt
===
--- data/dla-needed.txt 2014-10-12 21:14:12 UTC (rev 29376)
+++ data/dla-needed.txt 2014-10-13 04:37:01 UTC (rev 29377)
@@ -52,7 +52,7 @@
 --
 openjdk-6
 --
-ppp
+ppp (Andrew Bartlett)
 --
 qt4-x11
 --


___
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits