[VIM] CORE-2008-0126: Multiple vulnerabilities in iCal

[security curmudgeon]

CORE / SecurityFocus,

The cross-references between BID, CVE and vulnerability seem to be wrong 
in both the advisory and BID database. From the advisory:

: Multiple vulnerabilities in iCal
: 
: Advisory ID: CORE-2008-0126
: Advisory URL: http://www.coresecurity.com/?action=item&id=2219

: Bugtraq ID: 28629 28632 28633	
: CVE Name: CVE-2008-1035 CVE-2008-2006 CVE-2008-2007	

:  1) Null pointer de-reference #1 (Bugtraq ID 28629, CVE-2008-2006)
: 
:  The 'COUNT' value causes an integer overflow, which leads to a null

:  2) Null pointer dereference #2 (Bugtraq ID 28632, CVE-2008-2006)
: 
:  The 'TRIGGER' value causes a null pointer dereference when iCal tries

:  3) Improper resource liberation (Bugtraq ID 28633, CVE-2008-2007)
: 
: ATTACH;VALUE=URI:S=osumi

Yet, looking at the current BID entries:

http://www.securityfocus.com/bid/28632	CVE-2008-2006
Apple iCal 'TRIGGER' Parameter Denial of Service Vulnerability

http://www.securityfocus.com/bid/28633	CVE-2008-2007
Apple iCal 'ATTACH' Parameter Denial Of Service Vulnerability

http://www.securityfocus.com/bid/28629	CVE-2008-2006
Apple iCal 'COUNT' Parameter Integer Overflow Vulnerability

--

No mention of CVE-2008-1035 in the advisory other than the header CVE name 
reference. BID seems to have split the three vulnerabilities, but given 
two of them the same CVE. CVE does not have descriptions open yet.

Could someone from CORE, SecurityFocus or CVE confirm if CVE-2008-1035 is 
supposed to be in the mix, and if CVE-2008-2006 does correspond to two 
of the vulnerabilities listed?

Brian
OSVDB.org