[VIM] Fwd: Old CVE ids, public, but still "RESERVED"
Raphael Geissert
geissert at debian.org
Sat Feb 8 05:17:31 CST 2014
Sending a copy to oss-sec, in case there are people interested in this kind
of information.
---------- Forwarded Message ----------
Subject: Old CVE ids, public, but still "RESERVED"
Date: Friday 24 January 2014
From: Raphael Geissert <geissert at debian.org>
To: Vulnerability Information Managers <vim at attrition.org>
Hi,
Attached are a list of CVE ids which are still marked as RESERVED
(i.e. no description/links/etc have been set) yet our security tracker
knows about them. The tracker only containing public data, it means
that the ids are not embargoed.
Hopefully these lists can be useful to MITRE to catch up on those, or
to anyone else.
I can generate these and other reports regularly if desired.
Notes:
* The year in the file name corresponds to the year in the CVE id, not
necessarily the year of assignment.
* The lists only contain the CVE id, probably a short description, and
one line of data from our tracker. The full data can be obtained
either by going to
https://security-tracker.debian.org/tracker/CVE-YYYY-XXXX or by
looking up on our text database.
Cheers,
--
Raphael Geissert - Debian Developer
www.debian.org - get.debian.net
-------------- next part --------------
CVE-2011-4973 [mod_nss FakeBasicAuth authentication bypass]
- libapache2-mod-nss <unfixed> (low; bug #729626)
CVE-2011-4972 [CKEditor module for Drupal access bypass]
NOT-FOR-US: Drupal module
CVE-2011-4970 [Multiple SQL Injection vulnerabilities in Disk Pool Manager (DPM)]
- lcgdm 1.8.6-1 (low; bug #702895)
CVE-2011-4968 [nginx http proxy module does not verify peer identity of https origin server]
- nginx <unfixed> (low; bug #697940)
CVE-2011-4967
NOT-FOR-US: OpenPegasus
CVE-2011-4958 [silverstripe:XSS]
- silverstripe <itp> (bug #528461)
CVE-2011-4955
NOT-FOR-US: wordpress bsuite plugin
CVE-2011-4954
- cobbler <itp> (bug #545583)
CVE-2011-4953
- cobbler <itp> (bug #545583)
CVE-2011-4952
- cobbler <itp> (bug #545583)
CVE-2011-4938
NOT-FOR-US: Ariadne CMS not in Debian
CVE-2011-4937
- joomla <itp> (bug #571794)
CVE-2011-4936
- joomla <itp> (bug #571794)
CVE-2011-4935
- joomla <itp> (bug #571794)
CVE-2011-4934
- joomla <itp> (bug #571794)
CVE-2011-4933
- joomla <itp> (bug #571794)
CVE-2011-4931
- gpw <unfixed> (unimportant; bug #651510)
CVE-2011-4930
- condor <not-affected> (Fixed before initial release)
CVE-2011-4924
- zope2.12 2.12.22-1
CVE-2011-4919 [mpack info disclosure]
- mpack 1.6-8 (low; bug #655971)
CVE-2011-4917
- linux-2.6 <unfixed> (unimportant)
CVE-2011-4915
- linux-2.6 <unfixed> (unimportant)
CVE-2011-4912
NOT-FOR-US: Joomla
CVE-2011-4908
NOT-FOR-US: Joomla
CVE-2011-4907
NOT-FOR-US: Joomla
CVE-2011-4906
NOT-FOR-US: Joomla
CVE-2011-4904
{DSA-2289-1}
CVE-2011-4903
{DSA-2289-1}
CVE-2011-4902
{DSA-2289-1}
CVE-2011-4901
{DSA-2289-1}
CVE-2011-4900
{DSA-2289-1}
CVE-2011-4632
{DSA-2289-1}
CVE-2011-4631
{DSA-2289-1}
CVE-2011-4630
{DSA-2289-1}
CVE-2011-4629
{DSA-2289-1}
CVE-2011-4628
{DSA-2289-1}
CVE-2011-4627
{DSA-2289-1}
CVE-2011-4626
{DSA-2289-1}
CVE-2011-4625 [simplesamlphp xml encryption issues]
{DSA-2330-1}
CVE-2011-4624
NOT-FOR-US: WordPress flash-album-gallery
CVE-2011-4613 [X launcher permission bypass]
{DSA-2364-1}
CVE-2011-4610
- jbossas4 <not-affected> (Only builds a few libraries, not the full application server)
CVE-2011-4600
- libvirt 0.9.9-1 (low)
CVE-2011-4595
NOT-FOR-US: WordPress pretty-link plugin
CVE-2011-4580
NOT-FOR-US: JBoss Enterprise Portal Platform
CVE-2011-4573
NOT-FOR-US: JBoss Operations Network
CVE-2011-4558
- tikiwiki <removed>
CVE-2011-4455
- tikiwiki <removed>
CVE-2011-4454
- tikiwiki <removed>
CVE-2011-4407 [apt-add-repository does not perform ssl verification where it *needs* to]
- software-properties 0.76.7debian2+nmu2
CVE-2011-4406
- accountsservice 0.6.15-3
CVE-2011-4366
NOT-FOR-US: ** REJECT ** duplicate of CVE-2011-4090
CVE-2011-4365
NOTE: duplicate of CVE-2011-4090
CVE-2011-4350
- yaws 1.91-2 (bug #650009)
CVE-2011-4343
NOT-FOR-US: Apache MyFaces
CVE-2011-4338
NOT-FOR-US: Arch-Linux specific tool
CVE-2011-4336
NOT-FOR-US: Tiki Wiki
CVE-2011-4334
NOT-FOR-US: LabWiki
CVE-2011-4333
NOT-FOR-US: LabWiki
CVE-2011-4327
- openssh <not-affected> (Only affects platforms w/o /dev/random)
CVE-2011-4322
NOT-FOR-US: websitebaker
CVE-2011-4310
- cmsms <itp> (bug #608888)
CVE-2011-4195
NOT-FOR-US: Suse kiwi (different from python-kiwi)
CVE-2011-4193
NOT-FOR-US: Suse kiwi (different from python-kiwi)
CVE-2011-4192
NOT-FOR-US: Suse kiwi (different from python-kiwi)
CVE-2011-4121
- ruby1.9.1 <not-affected> (Only affected trunk versions)
CVE-2011-4120 [authentication bypass by pressing ctrl-d]
- yubico-pam 2.10-1
CVE-2011-4117
NOT-FOR-US: perl Batch::BatchRun CPAN module
CVE-2011-4116
- perl <unfixed> (unimportant)
CVE-2011-4115
- libparallel-forkmanager-perl <not-affected> (issue introduced in 0.7.6 upstream, never in Debian)
CVE-2011-4111
- qemu 0.15.1+dfsg-2
CVE-2011-4104
- django-tastypie 0.9.10-1 (bug #647314)
CVE-2011-4103 [YAML deserialization vulnerability in Piston framework]
{DSA-2344-1}
CVE-2011-4099
- libcap2 1:2.22-1 (low)
CVE-2011-4095
NOT-FOR-US: Jara
CVE-2011-4094
NOT-FOR-US: Jara
CVE-2011-4093
- net6 1:1.3.14-1 (low; bug #647318)
CVE-2011-4092
- obby <unfixed> (low; bug #647317)
CVE-2011-4091
[squeeze] - net6 <no-dsa> (Minor issue)
CVE-2011-4090 [serendipity before 1.6 backend XSS in karma plugin]
- serendipity <removed> (bug #650937)
CVE-2011-4089
- bzip2 1.0.6-1 (low; bug #632862)
CVE-2011-4088
NOT-FOR-US: abrt/libreport
CVE-2011-4083
NOT-FOR-US: RedHat sos
CVE-2011-4082
- phpldapadmin 0.9.8-1
CVE-2011-3923
- libstruts1.2-java <not-affected> (Only affects 2.x)
CVE-2011-3642 [flowplayer-core: Arbitrary plugins with remote code execution (XSS)]
- mahara <removed> (low; bug #699230)
CVE-2011-3634
- apt 0.8.11 (low)
CVE-2011-3632 [hardlink has buffer overflows, is unsafe on changing trees]
- hardlink <not-affected> (Only the C version, ours are written in Python)
CVE-2011-3631 [hardlink has buffer overflows, is unsafe on changing trees]
- hardlink <not-affected> (Only the C version, ours are written in Python)
CVE-2011-3630 [hardlink has buffer overflows, is unsafe on changing trees]
- hardlink <not-affected> (Only the C version, ours are written in Python)
CVE-2011-3629
NOT-FOR-US: Joomla
CVE-2011-3628
- pam 1.1.3-7 (low; bug #670076)
CVE-2011-3625 [mplayer SAMI subtitle parsing buffer overflow]
- mplayer 2:1.0~rc4.dfsg1+svn33713-2 (bug #645987)
CVE-2011-3624
- ruby1.8 <unfixed> (low; bug #646020)
CVE-2011-3623 [media-video/vlc-1.0.2: Multiple stack-based buffer overflows in ASF, AVI, MP4 demuxers]
- vlc 1.1.3-1
CVE-2011-3622
NOT-FOR-US: phorum
CVE-2011-3621
NOT-FOR-US: fluxbb
CVE-2011-3618 [atop insecure tempfile handling]
- atop 1.23-1.1 (low; bug #622794)
CVE-2011-3617 [tahoe-lafs: an unauthorized user can delete files]
- tahoe-lafs 1.8.3-1 (bug #641540)
CVE-2011-3614 [vanilla plugin access control]
NOT-FOR-US: Vanilla Forums
CVE-2011-3613 [vanilla forums cookie theft]
NOT-FOR-US: Vanilla Forums
CVE-2011-3612 [HTB22913: Multiple CSRF in UseBB]
NOT-FOR-US: UseBB
CVE-2011-3611 [HTB22914: Local File Inclusion in UseBB]
NOT-FOR-US: UseBB
CVE-2011-3610 [serendipity freetag plugin before 3.30 and probably others]
NOT-FOR-US: Serendipity plugin
CVE-2011-3609 [CSRF in the JBoss AS 7 administration console & HTTP management API]
- jbossas4 <not-affected> (Only builds a few libraries, not the full application server, #581226)
CVE-2011-3606 [DOM based XSS in the JBoss AS 7 administration console]
- jbossas4 <not-affected> (Only builds a few libraries, not the full application server, #581226)
CVE-2011-3605
{DSA-2323-1}
CVE-2011-3604
{DSA-2323-1}
CVE-2011-3603
NOTE: http://seclists.org/oss-sec/2011/q4/30
CVE-2011-3602
{DSA-2323-1}
CVE-2011-3601
{DSA-2323-1}
CVE-2011-3600
- libxmlrpc3-java 3.1.3-1 (low)
CVE-2011-3596
- polipo 1.0.4.1-1.2 (bug #644289)
CVE-2011-3595
- joomla <itp> (bug #571794)
CVE-2011-3592 [phpMyAdmin did not properly sanitize the content of db, table, and column names prior use of their values.]
- phpmyadmin 4:3.4.5-1
CVE-2011-3591 [PMASA-2011-14 XSS]
- phpmyadmin 4:3.4.5-1
CVE-2011-3590 [mkdumprd utility created the final initial ramdisk image with...]
- kexec-tools <not-affected> (The flaw exists in kdump.init and mkdumprd scrits, shipped only with Red Hat and Fedora)
CVE-2011-3589 [mkdumprd utility copied content of certain directories into newly...]
- kexec-tools <not-affected> (The flaw exists in kdump.init and mkdumprd scrits, shipped only with Red Hat and Fedora)
CVE-2011-3588 [kdump/mkdumprd: the default value of "StrictHostKeyChecking=no"]
- kexec-tools <not-affected> (The flaw exists in kdump.init and mkdumprd scrits, shipped only with Red Hat and Fedora)
CVE-2011-3586
NOTE: Dupe of CVE-2011-3504, to be rejected
CVE-2011-3585
- samba 2:3.4.7~dfsg-2 (low)
CVE-2011-3584 [TYPO3-SA-2011-003]
- typo3-src 4.5.6+dfsg1-1 (low; bug #641683)
CVE-2011-3583 [TYPO3-SA-2011-002]
- typo3-src 4.5.6+dfsg1-1 (low; bug #641682)
CVE-2011-3582
NOT-FOR-US: Advanced Electron Forums
CVE-2011-3350 [masqmail improper privilege dropping]
- masqmail 0.2.30-1 (low; bug #638002)
CVE-2011-3377 [IcedTea browser plugin Same Origin Policy suffix issue]
{DSA-2420-1}
CVE-2011-3374 [apt-key insecure validation]
- apt <unfixed> (unimportant; bug #642480)
CVE-2011-3373
NOT-FOR-US: Views Bulk Operations module for Drupal
CVE-2011-3370
- statusnet <itp> (bug #491723)
CVE-2011-3355
- evolution-data-server3 3.2.1-1 (bug #641052)
CVE-2011-3352
NOT-FOR-US: Zikula
CVE-2011-3351
- openvas-scanner <unfixed> (bug #641327; low)
CVE-2011-3349 [lightdm denial of service]
- lightdm 0.9.6-1 (bug #639151)
CVE-2011-3346
- qemu-kvm 0.15.1+dfsg-1 (bug #646118)
CVE-2011-3344
NOT-FOR-US: Red Hat Network Satellite server
CVE-2011-3203 [Jcow CMS 4.x:4.2 <= , 5.x:5.2 <= | Arbitrary Code Execution]
NOT-FOR-US: Jcow
CVE-2011-3202 [Jcow CMS 4.2 <= | Cross Site Scripting]
NOT-FOR-US: Jcow
CVE-2011-3199
{DSA-2365-1}
CVE-2011-3198
{DSA-2365-1}
CVE-2011-3197
{DSA-2365-1}
CVE-2011-3196
{DSA-2365-1}
CVE-2011-3195
{DSA-2365-1}
CVE-2011-3183
NOT-FOR-US: Concrete CMS
CVE-2011-3180
NOT-FOR-US: Suse kiwi (different from python-kiwi)
CVE-2011-3154
- update-manager <not-affected> (ubuntu-specific issue)
CVE-2011-3153
- lightdm 1.0.6-2
CVE-2011-3152
- update-manager <not-affected> (ubuntu-specific issue)
CVE-2011-3145
{DSA-2382-1}
CVE-2011-2941
NOT-FOR-US: JBoss Enterprise Portal Platform
CVE-2011-2936
- elgg <itp> (bug #526197)
CVE-2011-2935
- elgg <itp> (bug #526197)
CVE-2011-2934
NOT-FOR-US: WebsiteBaker
CVE-2011-2933
NOT-FOR-US: WebsiteBaker
CVE-2011-2927
NOT-FOR-US: Red Hat Network Satellite server
CVE-2011-2924
- foomatic-filters 4.0.12-1 (low)
CVE-2011-2923
- foomatic-filters <unfixed> (unimportant)
CVE-2011-2922
- ktsuss <removed>
CVE-2011-2921
- ktsuss <removed>
CVE-2011-2920
NOT-FOR-US: Red Hat Network Satellite server
CVE-2011-2919
NOT-FOR-US: Red Hat Network Satellite server
CVE-2011-2916
- qtnx <removed> (low; bug #637439)
CVE-2011-2910
- ax25-tools 0.0.8-13.2 (low; bug #638198)
CVE-2011-2909
{DSA-2303-1}
CVE-2011-2902 [xpdf: insecure tempfile usage]
- xpdf 3.02-19 (low; bug #635849)
CVE-2011-2897
- gdk-pixbuf <not-affected> (This only applies to the old standalone copy shipped until Lenny)
CVE-2011-2765 [pyro: insecure use of temporary pid file]
- pyro 1:3.14-1 (low; bug #631912)
CVE-2011-2727
NOT-FOR-US: Tribiq CMS
CVE-2011-2726 [SA-CORE-2011-003]
- drupal7 7.6-1
CVE-2011-2725 [ark directory traversal]
- kdeutils 4:4.6.5-4 (low; bug #635541)
CVE-2011-2717
NOT-FOR-US: udhcp6c
CVE-2011-2715
NOT-FOR-US: Drupal data module
CVE-2011-2714
NOT-FOR-US: Drupal data module
CVE-2011-2706
NOT-FOR-US: sNews
CVE-2011-2702 [eglibc signedness vulnerability in ssse3 optimizations]
- eglibc 2.13-10
CVE-2011-2684
- foo2zjs 20110722dfsg-1 (low; bug #633870)
CVE-2011-2683
- reseed <removed>
CVE-2011-2538
- plone3 <removed>
CVE-2011-2523
- vsftpd <not-affected> (backdoored version was never in the Debian archive)
CVE-2011-2515
- packagekit 0.6.17-1
CVE-2011-2514
- openjdk-6 6b21~pre1-1
CVE-2011-2513
- openjdk-6 6b21~pre1-1
CVE-2011-2500
- nfs-utils 1:1.2.4-1 (bug #633155)
CVE-2011-2499
NOT-FOR-US: Mambo CMS
CVE-2011-2498
- linux-2.6 2.6.39-1 (low)
CVE-2011-2487
NOT-FOR-US: Apache CXF
CVE-2011-2480 [kfreebsd info disclosure]
- kfreebsd-9 9.0~svn223502-1 (bug #631160)
CVE-2011-2207
- dirmngr <unfixed> (unimportant; bug #627377)
CVE-2011-2187
- xscreensaver 5.14-1 (bug #627382)
CVE-2011-2186
NOTE: Disputed gitweb non-issue: https://bugzilla.redhat.com/show_bug.cgi?id=713298
CVE-2011-2177
- libreoffice <undetermined>
CVE-2011-2198 [vte memory exhaustion]
- vte 1:0.28.1-1 (low; bug #629688)
CVE-2011-2054
NOT-FOR-US: ** REJECT ** CVE-2011-2054 misused as CVE-2011-2524
CVE-2011-1939
- zendframework 1.11.6-1 (low)
CVE-2011-1935 [packet truncation in libpcap]
- libpcap 1.1.1-4 (low; bug #623868)
CVE-2011-1934 [lilo: lilo.conf world-readable]
- lilo 23.1-2 (low; bug #615103)
CVE-2011-1933
- libjifty-dbi-perl 0.68-1 (low; bug #622919)
CVE-2011-1930
- klibc 1.5.22-1 (low)
CVE-2011-1837
{DSA-2382-1}
CVE-2011-1836
- ecryptfs-utils 92-1
CVE-2011-1835
{DSA-2382-1}
CVE-2011-1834
{DSA-2382-1}
CVE-2011-1832
{DSA-2382-1}
CVE-2011-1831
{DSA-2382-1}
CVE-2011-1798
- chromium-browser 11.0.696.65~r84435-1
CVE-2011-1796
- chromium-browser 11.0.696.65~r84435-1
CVE-2011-1795
- chromium-browser 11.0.696.65~r84435-1
CVE-2011-1794
- chromium-browser 11.0.696.65~r84435-1
CVE-2011-1793
- chromium-browser 11.0.696.65~r84435-1
CVE-2011-1773
NOT-FOR-US: virt-v2v
CVE-2011-1749 [nfs-utils: mount.nfs fails to anticipate RLIMIT_FSIZE]
- nfs-utils 1:1.2.3-3 (low; bug #629420)
CVE-2011-1597
NOT-FOR-US: OpenVAS Manager
CVE-2011-1596
NOT-FOR-US: ** REJECT ** (regular bug in gnome-screensaver-dialog)
CVE-2011-1594
NOT-FOR-US: Red Hat Network Satellite server
CVE-2011-1588
- thunar <not-affected> (Introduced in 1.2, only in experimental)
CVE-2011-1490
- rsyslog 5.7.6-1 (low)
CVE-2011-1489
- rsyslog 5.7.6-1 (low)
CVE-2011-1488
- rsyslog 5.7.6-1 (low)
CVE-2011-1474
NOT-FOR-US: PaX hardening patch
CVE-2011-1408 [ikiwiki tty hijacking vulnerability]
- ikiwiki 3.20110608 (low)
CVE-2011-1151
NOT-FOR-US: Joomla!
CVE-2011-1150
NOT-FOR-US: bbPress
CVE-2011-1145 [buffer overflow in unixODBC's SQLDriverConnect()]
- unixodbc 2.2.14p2-3 (low; bug #617655)
CVE-2011-1086
NOT-FOR-US: openfiler
CVE-2011-1085
NOT-FOR-US: smoothwall
CVE-2011-1084
NOT-FOR-US: smoothwall
CVE-2011-1070
- v86d 0.1.10-1 (low; bug #619404)
CVE-2011-1069
NOT-FOR-US: PHPShop
CVE-2011-1028
- smarty3 3.0.8-1
CVE-2011-1009
NOT-FOR-US: Vanilla Forums
CVE-2011-1133 [xinha XSS mode param]
- serendipity <removed> (bug #611661)
CVE-2011-1134 [xinha XSS image manager]
- serendipity <removed> (bug #611661)
CVE-2011-1135 [xinha multiple vulns]
- serendipity <removed> (bug #611661)
CVE-2011-1136 [tesseract tempfile]
- tesseract 2.04-2.1 (low; bug #612032)
CVE-2011-0705 [path traversal in SimpleHTTPServer]
NOTE: Will be rejected
CVE-2011-0704
NOT-FOR-US: 389 Directory Server
CVE-2011-0703
- gksu-polkit <removed> (bug #684489)
CVE-2011-0699
- linux-2.6 2.6.37-2
CVE-2011-0544
- phpbb3 3.0.7-PL1-5 (low; bug #612477)
CVE-2011-0529
- weborf 0.12.5-1
CVE-2011-0528
- puppet 2.6.2-3
CVE-2011-0525
NOT-FOR-US: Batavi
CVE-2011-0460
- kbd <not-affected> (SUSE-specific)
CVE-2011-0428
- ikiwiki 3.20110122
CVE-2011-0068
- xulrunner <not-affected> (Only affects Firefox 4.0, not yet in unstable)
-------------- next part --------------
CVE-2012-6619 [MongoDB memory over-read via incorrect BSON object length]
- mongodb 1:2.4.1-1
CVE-2012-6110 [bcron file descriptors not closed]
- bcron 0.09-13 (low; bug #686650)
CVE-2012-6345
NOT-FOR-US: CyberArk Vault
CVE-2012-6344
NOT-FOR-US: CyberArk Vault
CVE-2012-6342
NOT-FOR-US: Atlassian Confluence
CVE-2012-6146 [Backend History Module Information Disclosure]
{DSA-2574-1}
CVE-2012-6143 [Storable::thaw called on untrusted inputs]
- libspoon-perl <unfixed> (bug #715371; low)
CVE-2012-6142 [Storable::thaw called on untrusted inputs]
NOT-FOR-US: HTML-EP CPAN module
CVE-2012-6141 [Storable::thaw called on untrusted inputs]
NOT-FOR-US: App-Context CPAN module
CVE-2012-6136
NOT-FOR-US: tuned (RH-specific powersaving tool)
CVE-2012-6135
- ruby-passenger <not-affected> (Vulnerable code not present; bug #702219)
CVE-2012-6133 [XSS flaws in ok and error messages]
- roundup 1.4.20-1
CVE-2012-6132 [XSS flaw with the otk parameter]
- roundup 1.4.20-1
CVE-2012-6131 [XSS flaw in @action parameter]
- roundup 1.4.20-1
CVE-2012-6130 [XSS vulnerability when usernames contain HTML]
- roundup 1.4.20-1
CVE-2012-6125
- chicken 4.8.0-1 (low; bug #702410)
CVE-2012-6124
- chicken 4.8.0-1 (low; bug #702410)
CVE-2012-6123
- chicken 4.8.0-1 (low; bug #702410)
CVE-2012-6122
- chicken 4.8.0.3-1 (low; bug #702410)
CVE-2012-6114 [temp file vulnerability in git-extras]
- git-extras 1.7.0-1.2 (bug #698490)
CVE-2012-6111 [gnome-keyring does not discard stored secrets in some cases]
- gnome-keyring 3.8.2-1 (low; bug #697896)
CVE-2012-6108 [default permissions for /var/log/hp are too open]
- hplip <not-affected> (permissions are 755 on wheezy, sid and experimental)
CVE-2012-6107 [Does not verify that the server hostname matches a domain name in the subject's CN or subjectAltName field of the x.509 certificate]
- axis2c <unfixed> (bug #697974)
CVE-2012-6094
- cups <not-affected> (systemd patch not applied in Debian, see bug #697584)
CVE-2012-6086 [zabbix insecure curl usage]
- zabbix 1:2.0.7+dfsg-1 (bug #697443)
CVE-2012-6083
- freeciv 2.3.4-1 (low; bug #696306)
CVE-2012-6079
NOT-FOR-US: W3 Total Cache
CVE-2012-6078
NOT-FOR-US: W3 Total Cache
CVE-2012-6077
NOT-FOR-US: W3 Total Cache
CVE-2012-6071 [libnusoap-php: Curl insecure usage]
- nusoap 0.7.3-5 (low; bug #696707)
CVE-2012-6070 [falconpl: Curl insecure usage]
- falconpl 0.9.6.9-git20120606-2 (bug #696681)
CVE-2012-5844
- openjdk-6 <not-affected> (JavaFX not part of OpenJDK)
CVE-2012-5663
NOT-FOR-US: Isearch
CVE-2012-5662
- ibm-3270 <unfixed> (bug #706547)
CVE-2012-5650 [DOM based XSS via Futon UI]
- couchdb 1.2.0-5 (bug #698439)
CVE-2012-5649 [JSONP arbitrary code execution with Adobe Flash]
- couchdb 1.2.0-5 (bug #698439)
CVE-2012-5645
- freeciv 2.3.4-1 (low; bug #696306)
CVE-2012-5644 [(Complete) Information disclosure when moving user's home directory]
- libuser <unfixed> (low; bug #705690)
CVE-2012-5641
- couchdb <not-affected> (Only affects CouchDB on Windows)
CVE-2012-5640 [thttpd: Local DoS vulnerability]
- thttpd <removed> (low)
CVE-2012-5639
- libreoffice <unfixed> (unimportant)
CVE-2012-5631
NOT-FOR-US: FreeIPA
CVE-2012-5630 [TOCTOU race conditions by copying and removing directory trees]
- libuser <unfixed> (low; bug #705690)
CVE-2012-5628
NOT-FOR-US: gofer component of PULP project
CVE-2012-5623
NOT-FOR-US: change_passwd plugin for Squirrelmail
CVE-2012-5621 [Ekiga (x < 4.0.0): DoS (crash) after receiving call from other party with not UTF-8 valid name]
- ekiga 3.2.7-6 (bug #702282; low)
CVE-2012-5620
NOT-FOR-US: Docecot non-issue, see http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=695138#15
CVE-2012-5619
- sleuthkit <unfixed> (unimportant; bug #695097)
CVE-2012-5618
NOT-FOR-US: Ushahidi
CVE-2012-5617 [privilege escalation due to improper authentication settings in policykit configuration file]
- gksu-polkit <removed> (bug #695807)
CVE-2012-5583 [phpcas curl usage]
- php-cas 1.3.1-2
CVE-2012-5582 [opendnssec curl usage]
- opendnssec <not-affected> (eppclient not built in Debian package)
CVE-2012-5580 [libproxy: format string issue]
- libproxy 0.3.1-4 (low)
CVE-2012-5578 [Python keyring insecure permissions on new databases]
- python-keyring 0.9.2-1.1 (bug #696736)
CVE-2012-5577 [Python keyring insecure permissions on migrated files]
- python-keyring 0.9.2-1.1 (bug #696736)
CVE-2012-5572 [Dancer::Cookie: Cookie name CRLF injection]
- libdancer-perl 1.3114+dfsg-1 (low; bug #694279)
CVE-2012-5567
- kronolith2 <not-affected> (Vulnerable code not present in 2.x codebase and later versions not yet packaged in sid)
CVE-2012-5566
- kronolith2 <not-affected> (Vulnerable code not present in 2.x codebase and later versions not yet packaged in sid)
CVE-2012-5565
NOT-FOR-US: This doesn't seem to be packaged in sid's Horde and the imp3 and dimp1 packages from stable do not include the affected code
CVE-2012-5560
NOT-FOR-US: MATE gnome fork
CVE-2012-5535
- gnome-system-log <not-affected> (Fedora-specific issue)
CVE-2012-5527
- claws-mail-extra-plugins 3.8.1-2 (unimportant; bug #693391)
CVE-2012-5524
- gajim 0.15.4-1 (low; bug #693282)
CVE-2012-5521
- quagga <unfixed> (unimportant; bug #693102)
CVE-2012-5518
NOT-FOR-US: ovirt / vsdm
CVE-2012-5508 [ Zope/Plone: PRNG isn't reseeded]
- zope2.12 2.12.26-1 (bug #692899)
CVE-2012-5507 [ Zope/Plone: Timing attack in password validation ]
- zope2.12 2.12.26-1 (bug #692899)
CVE-2012-5506 [ Zope/Plone: DoS through RSS on private folder ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5505 [ Zope/Plone: Attempting to access a view with no name returns an internal data structure ]
- zope2.12 2.12.26-1 (bug #692899)
CVE-2012-5504 [ Zope/Plone: Persistent XSS ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5503 [ Zope/Plone: Users connected through FTP can list hidden folder contents ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5502 [ Zope/Plone: Persistent XSS via filtering bypass ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5501 [ Zope/Plone: Crafted URL allows downloading of BLOBs that are not visible to the user ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5500 [ Zope/Plone: Anonymous users can batch change titles of content items ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5499 [ Zope/Plone: Partial denial of service through internal function ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5498 [ Zope/Plone: Partial denial of service through Collections functionality ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5497 [ Zope/Plone: Anonymous users can list user account names ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5496 [ Zope/Plone: DoS through unsanitised inputs into Kupu ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5495 [ Zope/Plone: Restricted Python injection ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5494 [ Zope/Plone: Reflexive XSS ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5493 [ Zope/Plone: Restricted Python sandbox escape ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5492 [ Zope/Plone: Partial permissions bypass ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5491 [ Zope/Plone: Form detail exposure ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5490 [ Zope/Plone: Reflexive XSS ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5489 [ Zope/Plone: Partial restricted Python sandbox escape ]
- zope2.12 <unfixed> (bug #692899)
CVE-2012-5488 [ Zope/Plone: Restricted Python injection ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5487 [ Zope/Plone: Restricted Python sandbox escape ]
- zope2.12 <unfixed> (unimportant; bug #692899)
CVE-2012-5486 [ Zope/Plone: Reflexive HTTP header injection ]
- zope2.12 2.12.26-1 (bug #692899)
CVE-2012-5485 [ Restricted Python injection ]
NOT-FOR-US: Plone not packaged in Debian, see bug #692899
CVE-2012-5476
- horizon <not-affected> (File is installed with 0700 perms in Debian)
CVE-2012-5474
- horizon 2012.1.1-7
CVE-2012-5395
NOT-FOR-US: Mediawiki extension CentralAuth
CVE-2012-5391
- mediawiki 1:1.19.3-1 (bug #694998)
CVE-2012-5390 [Possible privilege escalation]
- condor <not-affected> (standard universe is disabled in the Debian package, see bug #697936)
CVE-2012-5366
NOT-FOR-US: Mac OS X
CVE-2012-5365
- kfreebsd-8 <removed> (low; bug #690986)
CVE-2012-5364
NOT-FOR-US: Microsoft Windows
CVE-2012-5363
- kfreebsd-8 <removed> (low; bug #690986)
CVE-2012-5362
NOT-FOR-US: Microsoft Windows
CVE-2012-5361
- ffmpeg <removed>
CVE-2012-5360
- ffmpeg <removed>
CVE-2012-5359
- ffmpeg <removed>
CVE-2012-5241
NOT-FOR-US: PEAR module for Twitter
CVE-2012-5236 [Admin can decrypt user files]
- owncloud <unfixed> (low)
CVE-2012-4410
NOTE: to be rejected
CVE-2012-4576 [freebsd privilege escalation]
- kfreebsd-8 8.3-6 (bug #694096)
CVE-2012-4570 [sql injection]
- php-letodms-core 3.3.8-1
CVE-2012-4569 [multiple xss in 3.3.9]
- letodms 3.3.9+dfsg-1
CVE-2012-4568 [csrf]
- letodms 3.3.9+dfsg-1
CVE-2012-4567 [multiple xss in 3.3.8]
- letodms 3.3.9+dfsg-1
CVE-2012-4526 [XSS in password.php, incomplete fix for CVE-2012-4525]
- piwigo <not-affected> (incomplete fix not applied to Debian package)
CVE-2012-4525 [XSS in password.php]
- piwigo <removed>
CVE-2012-4524 [xlockmore bypass]
- xlockmore <removed> (low)
CVE-2012-4519
NOT-FOR-US: Zenphoto
CVE-2012-4512
- kdebase <removed> (unimportant)
CVE-2012-4480
NOT-FOR-US: mom
CVE-2012-4451 [php-ZendFramework: XSS vectors in multiple Zend Framework components ZF2012-03]
- zendframework <not-affected> (Vulnerable code introduced in 2.x, #688946)
CVE-2012-4441 [jenkins XSS in CI game plugin]
- jenkins <not-affected> (Plugin not built in Debian source package)
CVE-2012-4440 [jenkins XSS in Violations plugin]
- jenkins <not-affected> (Plugin not built in Debian source package)
CVE-2012-4439 [jenkins XSS]
- jenkins 1.447.2+dfsg-2 (bug #688298)
CVE-2012-4438 [jenkins remote code execution]
- jenkins 1.447.2+dfsg-2 (bug #688298)
CVE-2012-4434 [fwknop 2.0.3: multiple DoS / code execution flaw]
- fwknop 2.0.3-1 (bug #688151)
CVE-2012-4428
- openslp-dfsg <unfixed> (bug #687597; low)
CVE-2012-4420 [Duplicate of CVE-2012-4416]
NOT-FOR-US: Duplicate of CVE-2012-4416
CVE-2012-4385 [letodms CSRF]
- letodms 3.3.7+dfsg-1 (bug #689664)
CVE-2012-4384 [letodms XSS]
- letodms 3.3.7+dfsg-1 (bug #689664)
CVE-2012-4383
NOT-FOR-US: Contao
CVE-2012-4382 [Info leak in user blocks]
- mediawiki 1:1.19.2-1 (bug #686330)
CVE-2012-4381 [Passwords were stored in local DB even if auth systems like LDAP were used]
- mediawiki 1:1.19.2-1 (bug #686330)
CVE-2012-4380 [Insufficient API for account creation block]
- mediawiki 1:1.19.2-1 (bug #686330)
CVE-2012-4379 [CSRF]
- mediawiki 1:1.19.2-1 (bug #686330)
CVE-2012-4378 [DOM-based XSS]
- mediawiki 1:1.19.2-1 (bug #686330)
CVE-2012-4377 [[mediawiki stored XSS]
- mediawiki 1:1.19.2-1 (bug #686330)
CVE-2012-3543
- mono 2.10.8.1-7 (bug #686562)
CVE-2012-3522 [geshi XSS in contrib/langwiz.php]
- geshi <not-affected> (Vulnerable code not present, see bug #685323)
CVE-2012-3521 [geshi information disclosure in contrib/cssgen.php]
- geshi 1.0.8.4-2 (bug #685324)
CVE-2012-3490
- condor 7.8.2~dfsg.1-1+deb7u1 (bug #688210)
CVE-2012-3427
- jbossas4 <not-affected> (Only builds a few libraries, not the full application server)
CVE-2012-3415
- plpupload <itp> (bug #668396)
CVE-2012-3409
- ecryptfs-utils 99-1 (bug #682220)
CVE-2012-3407
NOT-FOR-US: plow
CVE-2012-3406 [glibc formatted printing vulnerabilities]
- eglibc <unfixed> (low; bug #681888)
CVE-2012-3405 [glibc formatted printing vulnerabilities]
- eglibc 2.13-35 (low; bug #681473)
CVE-2012-3404 [glibc formatted printing vulnerabilities]
- eglibc 2.13-35 (low; bug #681473)
CVE-2012-3359
NOT-FOR-US: Red Hat Conga
CVE-2012-2979 [VU#517036: NSD 3.2.13 emergency release]
- nsd3 <not-affected> (Debian version not affected)
CVE-2012-2945
- hadoop <itp> (bug #535861)
CVE-2012-2736 [NetworkManager: creating new WPA-secured wireless network results in insecure network being created instead]
- network-manager 0.9.4.0-1 (low; bug #655972)
CVE-2012-2724
NOT-FOR-US: Drupal module
CVE-2012-2714
NOT-FOR-US: Drupal module
CVE-2012-2663
- iptables <unfixed> (unimportant; bug #675445)
CVE-2012-2656 [XXE vulnerability in Restlet]
- restlet <itp> (bug #596472)
CVE-2012-2350 [pam_shield default configuration does not take any action]
- pam-shield 0.9.2-3.3 (low; bug #658830)
CVE-2012-2328
NOT-FOR-US: sblim
CVE-2012-2312
- jbossas4 <not-affected> (Only affects JBoss 7)
CVE-2012-2301 [Drupal SA-CONTRIB-2012-064 - Ubercart - Arbitrary PHP Execution]
NOT-FOR-US: Drupal addon not packaged
CVE-2012-2250
- tor 0.2.3.24-rc-1 (low)
CVE-2012-2249
- tor 0.2.3.23-rc-1 (low)
CVE-2012-2248 [build-influenced PATH set in dhclient]
- isc-dhcp 4.2.4-3 (bug #690532)
CVE-2012-2238
- tryton-server <not-affected> (only affected 2.4, in experimental)
CVE-2012-2237
{DSA-2540-1}
CVE-2012-2095 [wicd command execution with root privileges]
- wicd 1.7.2.4-1 (low; bug #668397)
CVE-2012-2148
- jbossas4 <not-affected> (Only builds a few libraries, not the full application server)
CVE-2012-2142 [Insufficient sanitization of escape sequences in the error message]
- xpdf <not-affected> (uses poppler's Error.cc)
CVE-2012-2134
NOT-FOR-US: Dynamic LDAP backend plugin for BIND
CVE-2012-2130
- polarssl 1.1.2-1
CVE-2012-2108
- csound 1:5.17.6~dfsg-1 (low; bug #661197)
CVE-2012-2107
- csound 1:5.17.6~dfsg-1 (bug #661197)
CVE-2012-2106
- csound 1:5.17.6~dfsg-1 (bug #661197)
CVE-2012-2092
- cobbler <itp> (bug #545583)
CVE-2012-2079
NOT-FOR-US: Drupal addon module not packaged in Debian
CVE-2012-2078
NOT-FOR-US: Drupal addon module not packaged in Debian
CVE-2012-1637
NOT-FOR-US: Drupal addon module not packaged in Debian
CVE-2012-1622
NOT-FOR-US: Apache OFBiz
CVE-2012-1621
NOT-FOR-US: Apache OFBiz
CVE-2012-1615 [sectool dbus priv escalation]
NOT-FOR-US: sectool
CVE-2012-1600 [XSS from 5.0.4 release]
- phppgadmin 5.0.4-1
CVE-2012-1592
- libstruts1.2-java <not-affected> (Only applies to Struts 2, see bug #657870)
CVE-2012-1577
- dietlibc 0.33~cvs20120325-1 (unimportant)
CVE-2012-1572
- keystone 2012.1~rc2-1
CVE-2012-1567
NOT-FOR-US: LinuxMint
CVE-2012-1566
NOT-FOR-US: LinuxMint
CVE-2012-1563
- joomla <itp> (bug #571794)
CVE-2012-1562
- joomla <itp> (bug #571794)
CVE-2012-1561
NOT-FOR-US: Drupal Finder
CVE-2012-1102 [XML::Atom Perl module XML entity expansion]
{DSA-2424-1}
CVE-2012-1301
NOT-FOR-US: Umbraco
CVE-2012-1257
- pidgin <unfixed> (unimportant)
CVE-2012-1187
- bitlbee 3.0.4+bzr855-1 (low)
CVE-2012-1171 [safemode bypass after RSHUTDOWN]
- php5 <unfixed> (unimportant)
CVE-2012-1170
- moodle <not-affected> (Only affects 2.2)
CVE-2012-1169
- moodle <not-affected> (Only affects 2.0 to 2.2)
CVE-2012-1168
- moodle <not-affected> (Only affects 2.0 to 2.2)
CVE-2012-1166 [ldm (LTSP display manager)]
- ldm 2:2.2.7-1 (bug #663645)
CVE-2012-1161
- moodle <not-affected> (Only affects 2.1 to 2.2)
CVE-2012-1160
- moodle <not-affected> (Only affects 2.1 to 2.2)
CVE-2012-1159
- moodle <not-affected> (Only affects 2.1 to 2.2)
CVE-2012-1158
- moodle <not-affected> (Only affects 2.1 to 2.2)
CVE-2012-1157
- moodle <not-affected> (Only affects 2.0 to 2.2)
CVE-2012-1156
- moodle <not-affected> (Only affects 2.0 to 2.2)
CVE-2012-1155
- moodle 1.9.9.dfsg2-6 (low; bug #668411)
CVE-2012-1124
NOT-FOR-US: phxEventManager not in Debian
CVE-2012-1115
- phpldapadmin 1.2.2-3 (low; bug #662050)
CVE-2012-1114
- phpldapadmin 1.2.2-3 (low; bug #662050)
CVE-2012-1111
- lightdm 1.0.9-1 (bug #658678)
CVE-2012-1109
NOT-FOR-US: mwlib not in Debian
CVE-2012-1105
- moodle 2.2.7.dfsg-1 (low; bug #662945)
CVE-2012-1104
- moodle 2.2.7.dfsg-1 (low; bug #662945)
CVE-2012-1101
- systemd 43-1 (bug #662029)
CVE-2012-1100
NOT-FOR-US: JBoss Operations Network
CVE-2012-1096
- network-manager <unfixed> (low; bug #684259)
CVE-2012-1095
- osc <unfixed> (unimportant)
CVE-2012-1094
NOT-FOR-US: mod_cluster
CVE-2012-1093 [init script x11-common creates directories in insecure manner]
- xorg 1:7.6+12 (bug #661627)
CVE-2012-1088
- iproute 20120319-1 (unimportant)
CVE-2012-0943
- lightdm <not-affected> (Ubuntu-specific script)
CVE-2012-0875 [systemtap invalid read leading to kernel DoS]
- systemtap 1.7-1 (low; bug #660929; bug #660886)
CVE-2012-0871
- systemd 43-1
CVE-2012-0844
- netsurf 2.8-2 (bug #659376)
CVE-2012-0843
- uzbl 0.0.0~git.20111128-2 (bug #659379)
CVE-2012-0842 [surf info leak]
- surf 0.4.1-6 (bug #659296)
CVE-2012-0828
- xchat <not-affected> (Only affects Xchat on Windows and Maemo)
CVE-2012-0824
- gnusound <removed> (low; bug #654270)
CVE-2012-0812 [PostfixAdmin 2.3.4 multiple XSS vulnerabilities]
- postfixadmin 2.3.5-1
CVE-2012-0811 [PostfixAdmin 2.3.4 multiple SQL vulnerabilities]
- postfixadmin 2.3.5-1
CVE-2012-0810
- linux-2.6 3.2.16-1 (bug #672660)
CVE-2012-0803
NOT-FOR-US: Apache CXF
CVE-2012-0694 [SugarCRM CE unserialize PHP code execution in multiple files]
- sugarcrm-ce-5.0 <itp> (bug #457876)
CVE-2012-0270 [csound buffer overflows]
- csound 1:5.16.6~dfsg-1 (low; bug #661197)
CVE-2012-0214 [apt would still trust repository when old InRelease file present]
- apt 0.8.15.10
CVE-2012-0153
NOT-FOR-US: Microsoft
CVE-2012-0140
NOT-FOR-US: Microsoft
CVE-2012-0139
NOT-FOR-US: Microsoft
CVE-2012-0785 [Jenkins and hash collision attack]
- jenkins-winstone 0.9.10-jenkins-31+dfsg-1 (bug #655553)
CVE-2012-0070
NOT-FOR-US: spamdyke not in Debian
CVE-2012-0064 [xorg screen lockers bypassed via key combo]
- xorg-server 2:1.11.3.901-2 (high; bug #656410)
CVE-2012-0063
- tucan <unfixed> (bug #656388)
CVE-2012-0062
NOT-FOR-US: JBoss Operations Network
CVE-2012-0059
NOT-FOR-US: RHN Satellite
CVE-2012-0055
NOT-FOR-US: overlayfs is not (yet) in the Debian kernel
CVE-2012-0052
NOT-FOR-US: JBoss Operations Network
CVE-2012-0051
- tahoe-lafs <not-affected> (Only affects 1.9.0, not uploaded to the archive)
CVE-2012-0049
{DSA-2524-1}
CVE-2012-0046 [mediawiki info leak]
- mediawiki 1:1.15.5-6 (low; bug #655694)
CVE-2012-0033 [znc bouncedcc DoS]
- znc 0.202-2
CVE-2012-0032
NOT-FOR-US: JBoss Operations Network
-------------- next part --------------
CVE-2013-7303 [cross-site scripting]
- spip 3.0.13-1 (bug #736170)
CVE-2013-7302
NOT-FOR-US: Drupal contrib
CVE-2013-7301 [external network interface is used with no access control for reading queued music files]
- cantata <not-affected> (Vulnerable code introduced with 1.2.0; bug #736154)
CVE-2013-7300 [absolute path traversal vulnerability]
- cantata <not-affected> (Vulnerable code introduced with 1.2.0; bug #736154)
CVE-2013-7299 [tntnet: denial of service]
- tntnet <unfixed> (low; bug #735881)
CVE-2013-7298 [cxxtools: denial of service]
- cxxtools 2.2.1-1 (low; bug #735880)
CVE-2013-7296 [DoS]
- poppler <not-affected> (Introduced in a3cee0e7e9dd292c70fe1fa19a92e70bbc1e1b41)
CVE-2013-7285 [remote code execution via deserialization in XStream]
- libxstream-java <unfixed> (bug #734821)
CVE-2013-7284 [libplrpc-perl remote code execution due to Storable]
- libplrpc-perl <unfixed> (high; bug #734789)
CVE-2013-7273 [no prompt anymore after login cancel using disable_user_list]
- gdm3 <unfixed> (low; bug #683338)
CVE-2013-7259
- neo4j-community <itp> (bug #685615)
CVE-2013-7252 [kwallet crypto misuse]
- kde-runtime <unfixed>
CVE-2013-7172
- libiodbc2 <not-affected> (RPATH issue slackware specific)
CVE-2013-7171
- llvm-2.9 <not-affected> (RPATH issue slackware specific)
CVE-2013-7236
NOT-FOR-US: Simple Machines Forum
CVE-2013-7235
NOT-FOR-US: Simple Machines Forum
CVE-2013-7234
NOT-FOR-US: Simple Machines Forum
CVE-2013-7221 [run command dialog visible above screen locker]
- gnome-shell <unfixed>
CVE-2013-7220 [blind command execution via activities search keyboard focus]
- gnome-shell <unfixed>
CVE-2013-7203
- gitolite3 3.5.3.1-1
CVE-2013-7143
- open-xchange <itp> (bug #269329)
CVE-2013-7142
- open-xchange <itp> (bug #269329)
CVE-2013-7141
- open-xchange <itp> (bug #269329)
CVE-2013-7140
- open-xchange <itp> (bug #269329)
CVE-2013-7137
NOT-FOR-US: Burden
CVE-2013-7135
- libproc-daemon-perl 0.14-2 (low; bug #732283)
CVE-2013-7134
NOT-FOR-US: Juvia
CVE-2013-7130 [Live migration can leak root disk into ephemeral storage]
- nova <unfixed> (bug #736465)
CVE-2013-7111
NOT-FOR-US: Bio Basespace SDK Ruby Gem
CVE-2013-7110
- transifex-client <unfixed> (low)
CVE-2013-7066
NOT-FOR-US: Drupal module
CVE-2013-7065
NOT-FOR-US: Drupal module
CVE-2013-7064
NOT-FOR-US: Drupal module
CVE-2013-7063
NOT-FOR-US: Drupal module
CVE-2013-7034
NOT-FOR-US: LiveZilla
CVE-2013-7033
NOT-FOR-US: LiveZilla
CVE-2013-7032
NOT-FOR-US: LiveZilla
CVE-2013-7089 [dbg_printhex possible information leak]
- clamav 0.97.7+dfsg-1
CVE-2013-7088 [buffer overflow]
- clamav 0.97.7+dfsg-1
CVE-2013-7087 [[clamav: WWPack corrupt heap memory]
- clamav 0.97.7+dfsg-1
CVE-2013-7072
NOT-FOR-US: Monitorix
CVE-2013-7071
NOT-FOR-US: Monitorix
CVE-2013-7070
NOT-FOR-US: Monitorix
CVE-2013-7062 [XSS]
- zope2.12 <removed> (low)
CVE-2013-7061 [Privilege escalation through exposed underlying API]
NOT-FOR-US: Plone
CVE-2013-7060 [Filesystem path information leak]
NOT-FOR-US: Plone
CVE-2013-7048 [Nova live snapshots use an insecure local directory]
- nova 2013.2.1-1 (bug #732022)
CVE-2013-7003
NOT-FOR-US: LiveZilla
CVE-2013-7041 [pam_userdb: password hashes aren't compared case-sensitively]
- pam <unfixed> (low; bug #731368)
CVE-2013-7040
- python2.5 <removed> (low)
CVE-2013-6891 [lppasswd vulnerability]
- cups 1.7.1-1
CVE-2013-6889 [Allows reading arbitrary files]
- rush <unfixed> (bug #733505)
CVE-2013-6887
- openjpeg <not-affected> (only affects 1.5, in experimental, see #731237)
CVE-2013-6880
NOT-FOR-US: FlashCanvas
CVE-2013-6879
NOT-FOR-US: MijoSearch
CVE-2013-6878
NOT-FOR-US: MijoSearch
CVE-2013-6838
NOT-FOR-US: IVR Pro/Contact Center (VIP2000)
CVE-2013-6806
NOT-FOR-US: OpenText Exceed onDemand
CVE-2013-6788
NOT-FOR-US: Bitrix Site Manager
CVE-2013-6766
NOT-FOR-US: OpenVAS Administrator (only uploaded to exp 2.5 years ago)
CVE-2013-6765
NOT-FOR-US: OpenVAS Manager (only uploaded to experimental 2.5 years ago)
CVE-2013-6472
- mediawiki 1:1.19.10+dfsg-1
CVE-2013-6461 [DoS while parsing XML entities]
- ruby-nokogiri 1.6.1+ds-1 (bug #734836)
CVE-2013-6460 [DoS while parsing XML documents]
- ruby-nokogiri 1.6.1+ds-1 (bug #734836)
CVE-2013-6458 [job usage issue in several APIs leading to libvirtd crash]
{DSA-2846-1}
CVE-2013-6457 [avoid crashing if calling `virsh numatune' on inactive domain]
- libvirt 1.2.1-1
CVE-2013-6456 [virsh shutdown does not handle symlinks correctly for LXC]
- libvirt <unfixed> (bug #732394)
CVE-2013-6455
- mediawiki <unfixed>
CVE-2013-6454
- mediawiki 1:1.19.10+dfsg-1
CVE-2013-6453
- mediawiki 1:1.19.10+dfsg-1
CVE-2013-6452
- mediawiki 1:1.19.10+dfsg-1
CVE-2013-6451
- mediawiki 1:1.19.10+dfsg-1
CVE-2013-6444 [failure to check certificate hostname]
- pywbem <unfixed> (bug #732594)
CVE-2013-6441 [lxc: sshd template allow privilege escalation on host]
- lxc <unfixed> (unimportant)
CVE-2013-6440 [XML eXternal Entity (XXE) flaw in ParserPool and Decrypter]
- opensaml2 <not-affected> (Debian provides the C-based Shibboleth implementation)
CVE-2013-6437 [DoS through ephemeral disk backing files]
- nova <unfixed>
CVE-2013-6430
- libspring-java <unfixed> (bug #735420)
CVE-2013-6429
- libspring-java <unfixed> (bug #735420)
CVE-2013-6418 [TOCTOU vulnerability in certificate validation]
- pywbem <unfixed> (low; bug #732594)
CVE-2013-6413 [unrealircd: DoS, use after free]
- unrealircd <itp> (bug #515130)
CVE-2013-6396 [does not properly verify the server SSL certificates]
- python-swiftclient <unfixed> (bug #730626)
CVE-2013-6372
- jenkins <not-affected> (Affected plugins are not shipped in Debian, bug #730457)
CVE-2013-6365 [CSRF edit.php]
- php-horde 5.1.5+debian0-1 (bug #730110)
CVE-2013-6364 [XSS and CSRF search.php]
- php-horde <not-affected> (Vulnerable code in turba)
CVE-2013-6275 [CSRF]
- php-horde-ingo 3.1.3-1 (bug #727669)
CVE-2013-6242
- open-xchange <itp> (bug #269329)
CVE-2013-6241
- open-xchange <itp> (bug #269329)
CVE-2013-6236
NOT-FOR-US: Stem Innovations IZON
CVE-2013-6223
NOT-FOR-US: Livezilla
CVE-2013-6117
NOT-FOR-US: Dahua DVR
CVE-2013-6167
- iceweasel <unfixed> (unimportant)
CVE-2013-6166
- chromium-browser 31.0.1650.57-1 (low)
CVE-2013-6053
- openjpeg <not-affected> (only affects 1.5, in experimental, see #731237)
CVE-2013-6049 [insecure temporary file creation]
- apt-listbugs 0.1.10 (low)
CVE-2013-6047 [XSS in site creation interface]
- ikiwiki-hosting 0.20131025
CVE-2013-5984
NOT-FOR-US: Microweber
CVE-2013-5983
NOT-FOR-US: GuppY
CVE-2013-5916
NOT-FOR-US: WordPress plugin wp-e-commerce
CVE-2013-5749
NOT-FOR-US: SimpleRisk
CVE-2013-5748
NOT-FOR-US: SimpleRisk
CVE-2013-5743
- zabbix 1:2.0.8+dfsg-2
CVE-2013-5680 [heap overflow]
- hylafax <not-affected> (Not built with LDAP support)
CVE-2013-5661 [DNS response rate limiting can simplify cache poisoning attacks]
NOTE: DNS protocol flaw
CVE-2013-5675
NOT-FOR-US: Symantec Endpoint Protection
CVE-2013-5671 [Remote Command Injection]
NOT-FOR-US: fog-dragonfly Ruby Gem
CVE-2013-5655
NOT-FOR-US: YingZhi Python for iOS
CVE-2013-5654
NOT-FOR-US: YingZhi Python for iOS
CVE-2013-5640
NOT-FOR-US: Gnew
CVE-2013-5639
NOT-FOR-US: Gnew
CVE-2013-5582
NOT-FOR-US: Ammyy Admin
CVE-2013-5581
NOT-FOR-US: Ammyy Admin
CVE-2013-5350
NOT-FOR-US: OpenPNE
CVE-2013-5212
NOT-FOR-US: easyXDM
CVE-2013-5123 [insecure mirroring]
- python-pip 1.4.1-1 (unimportant)
CVE-2013-4985
NOT-FOR-US: Vivotek IP Cameras
CVE-2013-4982
NOT-FOR-US: AVTECH DVR
CVE-2013-4981
NOT-FOR-US: AVTECH DVR
CVE-2013-4980
NOT-FOR-US: AVTECH DVR
CVE-2013-4979 [Buffer Overflow]
NOT-FOR-US: EPS Viewer
CVE-2013-4978 [Buffer Overflow]
NOT-FOR-US: Aloaha PDF Suite
CVE-2013-4968
- puppet <not-affected> (Only affects Puppet Enterprise)
CVE-2013-4772
NOT-FOR-US: D-Link
CVE-2013-4752
NOT-FOR-US: Symfony HttpFoundation component
CVE-2013-4751
NOT-FOR-US: Symfony Validator component
CVE-2013-4739
- linux <not-affected> (Android-specific camera drivers)
CVE-2013-4738
- linux <not-affected> (Android-specific camera drivers)
CVE-2013-4730
NOT-FOR-US: PCMan FTP Server
CVE-2013-4718 [XSS]
NOT-FOR-US: OTRS ITSM
CVE-2013-4717 [SQL injection]
{DSA-2733-1}
CVE-2013-4593
- ruby-omniauth-facebook <itp> (bug #705766)
CVE-2013-4584 [ssl_outgoing_ciphers not applied to STARTTLS connections]
- perdition <unfixed> (low; bug #729028)
CVE-2013-4583
- gitlab <itp> (bug #651606)
CVE-2013-4582 [Local file inclusion vulnerability]
- gitlab <itp> (bug #651606)
CVE-2013-4581 [Remote code execution vulnerability via Git SSH access]
- gitlab <itp> (bug #651606)
CVE-2013-4580 [Unauthenticated API access to GitLab when using MySQL]
- gitlab <itp> (bug #651606)
CVE-2013-4577 [should set safer permissions even when hashed passwords are found]
- grub2 2.00-20 (unimportant; bug #632598)
CVE-2013-4574
- mediawiki <unfixed>
CVE-2013-4572
- mediawiki 1:1.19.8+dfsg-2.2 (bug #729629)
CVE-2013-4571
- mediawiki <unfixed>
CVE-2013-4570
- mediawiki <unfixed>
CVE-2013-4565 [heap-based buffer overflow]
- xlhtml <unfixed> (bug #729279)
CVE-2013-4562
- ruby-omniauth-facebook <itp> (bug #705766)
CVE-2013-4561
NOT-FOR-US: OpenShift
CVE-2013-4552
NOT-FOR-US: drupalauth module for simpleSAMLphp
CVE-2013-4546 [remote command execution]
- gitlab <itp> (bug #651606)
CVE-2013-4521
NOT-FOR-US: Nuxeo
CVE-2013-4504
NOT-FOR-US: Drupal contrib module
CVE-2013-4503
NOT-FOR-US: Drupal contrib module
CVE-2013-4502
NOT-FOR-US: Drupal contrib module
CVE-2013-4501
NOT-FOR-US: Drupal contrib module
CVE-2013-4500
NOT-FOR-US: Drupal contrib module
CVE-2013-4499
NOT-FOR-US: Drupal contrib module
CVE-2013-4498
NOT-FOR-US: Drupal contrib module
CVE-2013-4490 [Remote code execution vulnerability in the SSH key upload feature]
- gitlab <itp> (bug #651606)
CVE-2013-4489 [Remote code execution vulnerability in the code search feature]
- gitlab <itp> (bug #651606)
CVE-2013-4488
- libgadu <unfixed> (unimportant)
CVE-2013-4472 [Race condition on temporary file]
- poppler <unfixed> (unimportant)
CVE-2013-4471 [password reset vulnerability]
- horizon 2013.2-1
CVE-2013-4468
NOT-FOR-US: VICIDIAL
CVE-2013-4467
NOT-FOR-US: VICIDIAL
CVE-2013-4463 [Compressed disk image DoS]
- nova 2013.2-3 (bug #728605)
CVE-2013-4462
NOT-FOR-US: WordPress plugin
CVE-2013-4455
NOT-FOR-US: Katello
CVE-2013-4454
NOT-FOR-US: WordPress plugin
CVE-2013-4451 [world writable files]
- gitolite <not-affected> (vulnerable code introduced for v3.5.3)
CVE-2013-4449 [slapd segfaults on certain queries with rwm overlay enabled]
- openldap <unfixed> (low; bug #729367)
CVE-2013-4442 [Silent fallback to insecure entropy]
- pwgen <unfixed> (unimportant; bug #726578)
CVE-2013-4441 [Phonemes mode has heavy bias and is enabled by default]
- pwgen <unfixed> (unimportant; bug #726578)
CVE-2013-4440 [non-tty passwords are trivially weak by default]
- pwgen <unfixed> (unimportant; bug #726578)
CVE-2013-4433 [xhprof: unspecified XSS]
- xhprof 0.9.4-1 (bug #726284)
CVE-2013-4432 [a group member with no access rights to folder can still view it]
- mahara <removed> (low; bug #727539)
CVE-2013-4431 [Not checking ownership of blocks before editing them]
- mahara <removed> (low; bug #727552)
CVE-2013-4430
- mahara <removed> (unimportant; bug #727548)
CVE-2013-4429 [Arbitrary image download]
- mahara <removed> (low; bug #727545)
CVE-2013-4427 [pyxtrlock Incorrect return value checking]
NOT-FOR-US: pyxtrlock
CVE-2013-4426 [pyxtrlock mis-spelled variable name]
NOT-FOR-US: pyxtrlock
CVE-2013-4420 [tar_extract_glob and tar_extract_all path prefix directory traversal]
- libtar <unfixed> (bug #731860)
CVE-2013-4413 [arbitrary files read]
NOT-FOR-US: Wicked Ruby Gem
CVE-2013-4412 [NULL ptr dereference]
- slim <unfixed> (bug #725902)
CVE-2013-4411
- reviewboard <itp> (bug #653113)
CVE-2013-4410
- reviewboard <itp> (bug #653113)
CVE-2013-4409 [unsanitized eval() vulnerability]
- djblets <removed> (low; bug #726039)
CVE-2013-4406
NOT-FOR-US: Quick Tabs Drupal contributed module
CVE-2013-4399 [unprivileged user can crash libvirtd when ACLs are enabled]
- libvirt 1.1.4-1
CVE-2013-4395
NOT-FOR-US: Simple Machines Forum
CVE-2013-4383
NOT-FOR-US: Drupal module
CVE-2013-4380
NOT-FOR-US: Drupal module
CVE-2013-4367
NOT-FOR-US: ovirt
CVE-2013-4357 [getaddrinfo() stack overflow]
- eglibc <unfixed>
CVE-2013-4347 [Uses poor PRNG]
- python-oauth2 <unfixed> (low; bug #722657)
CVE-2013-4346 [_check_signature() ignores the nonce value when validating signed urls]
- python-oauth2 <unfixed> (low; bug #722656)
CVE-2013-4337
NOT-FOR-US: Drupal module
CVE-2013-4336
NOT-FOR-US: Drupal module
CVE-2013-4335
NOT-FOR-US: opOpenSocialPlugin
CVE-2013-4334
NOT-FOR-US: opWebAPIPlugin
CVE-2013-4333
NOT-FOR-US: OpenPNE
CVE-2013-4331 [incorrect .Xauthority permissions]
- lightdm 1.6.2-1 (bug #721744)
CVE-2013-4321 [TYPO3 File Abstraction Layer: Remote Code Execution]
- typo3-src <not-affected> (All versions from 6.0.0 up to the development branch of 6.2)
CVE-2013-4320 [TYPO3 Core: Cross-Site Scripting, Remote Code Execution]
- typo3-src <not-affected> (All versions from 6.0.0 up to the development branch of 6.2)
CVE-2013-4318
NOT-FOR-US: Ruby gem Features
CVE-2013-4304 [mediawiki CentralAuth auth bypass]
NOT-FOR-US: Mediawiki CentralAuth extension
CVE-2013-4303 [mediawiki XSS with IE6]
- mediawiki 1:1.19.8+dfsg-1 (unimportant)
CVE-2013-4290 [stack-based buffer overflows]
- openjpeg <unfixed> (bug #722540)
CVE-2013-4289 [heap-based buffer overflows]
- openjpeg <unfixed> (bug #722540)
CVE-2013-4279
- imapsync <removed>
CVE-2013-4275
NOT-FOR-US: Drupal contributed module Zen
CVE-2013-4273
NOT-FOR-US: Drupal contributed module Entity API
CVE-2013-4269
- ajaxplorer <itp> (bug #668381)
CVE-2013-4268
- ajaxplorer <itp> (bug #668381)
CVE-2013-4267
- ajaxplorer <itp> (bug #668381)
CVE-2013-4262 [svnwcsub.py and irkerbridge.py are vulnerable to symlink attack]
- subversion <not-affected> (Optional admin-side utilities in Subversion 1.8.x)
CVE-2013-4251 [weave /tmp and current directory issues]
- python-scipy 0.12.0-3 (bug #726093)
CVE-2013-4250 [Vulnerable subcomponent: Backend File Upload / File Abstraction Layer]
- typo3-src <not-affected> (All versions from 6.0.0 up to the development branch of 6.2)
CVE-2013-4246 [FSFS repository corruption due to editing packed revision properties]
- subversion <not-affected> (only affects 1.8.0 and 1.8.1)
CVE-2013-4241
NOT-FOR-US: WordPress plugin HMS Testimonials
CVE-2013-4240
NOT-FOR-US: WordPress plugin HMS Testimonials
CVE-2013-4228
NOT-FOR-US: Organic Group Drupal contributed module
CVE-2013-4227
NOT-FOR-US: Persona Drupal contributed module
CVE-2013-4226
NOT-FOR-US: Authenticated User Page Caching Drupal contributed module
CVE-2013-4225
NOT-FOR-US: RESTful Web Services (RESTWS) Drupal cotributed module
CVE-2013-4224
NOTE: Dublicate of CVE-2013-4187, thus rejected
CVE-2013-4223 [nullmailer world readable /etc/nullmailer/remotes]
- nullmailer 1:1.11-2 (low; bug #684619)
CVE-2013-4215 [IPXPING_COMMAND uses fixed location in /tmp]
- nagios-plugins <unfixed> (unimportant)
CVE-2013-4211
NOT-FOR-US: OpenX
CVE-2013-4209 [ABRT: (substantially) limited leak of unauthorized information]
NOT-FOR-US: NOT-FOR-US: abrt is Red Hat / Fedora specific
CVE-2013-4201 [Katello: CLI - user without access can call "system remove_deletion" command]
NOT-FOR-US: Katello
CVE-2013-4199 [plone: DoS by decompressing large zip archives (cb_decode.py, linkintegrity.py)]
NOT-FOR-US: Plone
CVE-2013-4198 [plone: Authenticated users able to alter their password despite of policy definition / setting prohibiting it (mail_password.py)]
NOT-FOR-US: Plone
CVE-2013-4197 [plone: Authenticated users able to modify / delete portraits of other users (member_portrait.py)]
NOT-FOR-US: Plone
CVE-2013-4196 [plone: Multiple information exposure flaws via certain object methods (objectmanager.py)]
NOT-FOR-US: Plone
CVE-2013-4195 [plone: Open redirect in the HTTP server implementation (marmoset_patch.py, publish.py, principiaredirect.py)]
NOT-FOR-US: Plone
CVE-2013-4194 [plone: File system path exposure (wysiwyg.py)]
NOT-FOR-US: Plone
CVE-2013-4193 [plone: Anonymous users capable to hide certain fields from content edit forms (typeswidget.py)]
NOT-FOR-US: Plone
CVE-2013-4192 [plone: Ability to spoof emails (sendto.py)]
NOT-FOR-US: Plone
CVE-2013-4191 [plone: Information exposure due improper access control enforcement when generating zip archives (zip.py)]
NOT-FOR-US: Plone
CVE-2013-4190 [plone: Multiple cross-site scripting (XSS) flaws (spamProtect.py, pts.py, request.py)]
NOT-FOR-US: Plone
CVE-2013-4189 [plone: Privilege escalation due improper authorization (dataitems.py, get.py, traverseName.py)]
NOT-FOR-US: Plone
CVE-2013-4188 [plone: DoS (infinite loop) by administrator privilege users when retrieving information for certain resources (traverser.py)]
NOT-FOR-US: Plone
CVE-2013-4187 [Access Bypass]
NOT-FOR-US: Flippy Contributed Drupal module
CVE-2013-4184 [symlink attacks]
- libdata-uuid-perl <unfixed> (low; bug #718949)
CVE-2013-4178
NOT-FOR-US: GA Login Drupal contributed module
CVE-2013-4177
NOT-FOR-US: GA Login Drupal contributed module
CVE-2013-4176 [information disclosure]
NOT-FOR-US: MySecureShell
CVE-2013-4175 [local denial of service]
NOT-FOR-US: MySecureShell
CVE-2013-4168 [start and end time fields not filtered]
- smokeping 2.6.8-2
CVE-2013-4166 [problem in GPG key selection when encrypting mail]
- evolution <unfixed> (unimportant)
CVE-2013-4161
- gksu-polkit <not-affected> (CVE for improperly applied fix for CVE-2012-5617 on Red Hat)
CVE-2013-4158
- smokeping <not-affected> (fix for CVE-2012-0790/DSA-2651-1 uses regexp from 2.6.9 upstream release)
CVE-2013-4152 [XML External Entity (XXE) injection flaw]
{DSA-2842-1}
CVE-2013-4143
NOT-FOR-US: xlockmore
CVE-2013-4133 [memory leak]
- kde-workspace 4:4.10.5-3 (unimportant; bug #717180)
CVE-2013-4119
- freerdp <not-affected> (The server part is not build)
CVE-2013-4118
- freerdp <not-affected> (The server part is not build)
CVE-2013-4116 [npm: predictable temporary filenames when unpacking tarballs]
- npm 1.3.10~dfsg-1 (bug #715325)
CVE-2013-4110
NOT-FOR-US: Cryptocat
CVE-2013-4109
NOT-FOR-US: Cryptocat
CVE-2013-4108
NOT-FOR-US: Cryptocat
CVE-2013-4107
NOT-FOR-US: Cryptocat
CVE-2013-4106
NOT-FOR-US: Cryptocat
CVE-2013-4105
NOT-FOR-US: Cryptocat
CVE-2013-4104
NOT-FOR-US: Cryptocat
CVE-2013-4103
NOT-FOR-US: Cryptocat
CVE-2013-4102
NOT-FOR-US: Cryptocat
CVE-2013-4101
NOT-FOR-US: Cryptocat
CVE-2013-4100
NOT-FOR-US: Cryptocat
CVE-2013-4088 [Information Disclosure]
{DSA-2712-1}
CVE-2013-3843
- monkey <removed>
CVE-2013-3734 [Datasource password visible to administrator]
NOT-FOR-US: Embedded Jopr
CVE-2013-3729
NOT-FOR-US: Kasseler CMS
CVE-2013-3728
NOT-FOR-US: Kasseler CMS
CVE-2013-3727
NOT-FOR-US: Kasseler CMS
CVE-2013-3718 [evince missing check on number of pages]
- evince 3.10.0-1
CVE-2013-3703
NOT-FOR-US: Open Build Service
CVE-2013-3685
NOT-FOR-US: Sprite Software's backup softare for Android
CVE-2013-3587 [BREACH attack against HTTP compression]
TODO: check
CVE-2013-3571 [FD leak]
- socat 1.7.1.3-1.5 (low; bug #709931)
CVE-2013-3565 [XSS in HTTP Interface]
- vlc 2.0.7-1 (unimportant)
CVE-2013-3551
{DSA-2696-1}
CVE-2013-3514
NOT-FOR-US: OpenX
CVE-2013-2764
NOT-FOR-US: Secure Entry Server
CVE-2013-2758
NOT-FOR-US: CloudStack
CVE-2013-2756
NOT-FOR-US: CloudStack
CVE-2013-2745 [SQL Injection]
- minidlna <unfixed> (low; bug #717131)
CVE-2013-2739 [heap-based buffer overflow]
- minidlna <unfixed> (low; bug #717131)
CVE-2013-2738 [SQL Injection]
- minidlna <unfixed> (low; bug #717131)
CVE-2013-2625
- otrs2 3.1.7+dfsg1-8
CVE-2013-2623
NOT-FOR-US: Uebimiau Webmail
CVE-2013-2622
NOT-FOR-US: Uebimiau Webmail
CVE-2013-2621
NOT-FOR-US: Uebimiau Webmail
CVE-2013-2600 [MiniUPnPd information disclosure]
- miniupnpd 1.8.20130730-1 (bug #716936)
CVE-2013-2595
NOT-FOR-US: Qualcomm MSM Camera driver
CVE-2013-2574
NOT-FOR-US: Foscam
CVE-2013-2565
NOT-FOR-US: Mambo CMS
CVE-2013-2564
NOT-FOR-US: Mambo CMS
CVE-2013-2563
NOT-FOR-US: Mambo CMS
CVE-2013-2562
NOT-FOR-US: Mambo CMS
CVE-2013-2298
- boinc 7.0.65+dfsg-1 (low)
CVE-2013-2294
NOT-FOR-US: ViewGit
CVE-2013-2262
NOT-FOR-US: Cryptocat
CVE-2013-2261
NOT-FOR-US: Cryptocat
CVE-2013-2260
NOT-FOR-US: Cryptocat
CVE-2013-2259
NOT-FOR-US: Cryptocat
CVE-2013-2258
NOT-FOR-US: Cryptocat
CVE-2013-2257
NOT-FOR-US: Cryptocat
CVE-2013-2255 [Inconsistent and non-validating HTTPS client]
- cinder <unfixed>
CVE-2013-2233 [not caching SSH host keys]
- ansible 1.3.4+dfsg-1 (bug #714822)
CVE-2013-2228 [RSA exponent of 1]
- salt 0.15.1-1
CVE-2013-2227 [local file inclusion]
- glpi 0.83.91-1 (bug #714720; unimportant)
CVE-2013-2226 [Multiple SQL injections]
- glpi 0.83.91-1 (bug #714720; unimportant)
CVE-2013-2225
- glpi 0.83.91-1 (bug #714720; unimportant)
CVE-2013-2214 [nagios3: information leak]
- nagios3 3.4.1-4 (low)
CVE-2013-2213 [KRandom::random() Small Space of Random Values]
- kdeplasma-addons <not-affected> (only affects if incomplete patch for CVE-2013-2120 is applied)
CVE-2013-2198
NOT-FOR-US: Login Security Drupal contributed module
CVE-2013-2193 [Apache HBase Man in the Middle Vulnerability]
NOT-FOR-US: Apache HBase
CVE-2013-2192 [Apache Hadoop Man in the Middle Vulnerability]
NOT-FOR-US: Apache Hadoop
CVE-2013-2191
NOT-FOR-US: python-bugzilla
CVE-2013-2184 [unsafe use of Storable::thaw]
- movabletype-opensource 5.2.7+dfsg-1 (bug #712602)
CVE-2013-2183
- monkey <removed> (low)
CVE-2013-2182 [monkey security rules bypass]
- monkey <removed> (low)
CVE-2013-2180
NOT-FOR-US: uk-cookie Wordpress plugin, not in Debian
CVE-2013-2167 [middleware memcache signing bypass]
- python-keystoneclient 1:0.2.5-2 (bug #713819)
CVE-2013-2166 [middleware memcache encryption bypass]
- python-keystoneclient 1:0.2.5-2 (bug #713819)
CVE-2013-2163 [monkey denial of service]
- monkey <removed> (low)
CVE-2013-2159 [monkey broken authentication]
- monkey <removed>
CVE-2013-2150 [XSS vulnerability in js/viewer.js]
- owncloud <not-affected> (affects only experimental version)
CVE-2013-2149 [XSS vulnerability in core/js/oc-dialogs.js]
- owncloud 4.0.16debian-1 (bug #711517)
CVE-2013-2131 [format string vulnerability]
- rrdtool <unfixed> (unimportant; bug #708866)
CVE-2013-2130 [null pointer dereference in webadmin]
- znc 1.0-5 (bug #720632)
CVE-2013-2125 [DoS in TLS Support]
- opensmtpd 5.3.3p1-1
CVE-2013-2124 [libguestfs: DoS due to a double-free when inspecting certain guest files]
- libguestfs 1:1.20.8-1 (bug #710290)
CVE-2013-2120 [weak generated passwords]
- kdeplasma-addons <unfixed> (low; bug #710497)
CVE-2013-2111 [DoS (daemon hang) when parsing invalid IMAP APPEND command parameters]
- dovecot <not-affected> (vulnerable code appeared in 2.2)
CVE-2013-2109
NOT-FOR-US: WordPress plugin wp-cleanfix
CVE-2013-2108
NOT-FOR-US: WordPress plugin wp-cleanfix
CVE-2013-2107
NOT-FOR-US: WordPress plugin mail-on-update
CVE-2013-2106 [Authentication credential disclosure]
- webauth <not-affected> (vulnerable code only in 4.4.1 up to 4.5.2)
CVE-2013-2105
NOT-FOR-US: Show In Browser Ruby Gem
CVE-2013-2100
NOT-FOR-US: Gentoo Portage binary package installer
CVE-2013-2097 [zPanel themes remote command execution as root]
NOT-FOR-US: zPanel
CVE-2013-2093
- dolibarr 3.3.4-1 (high)
CVE-2013-2092
- dolibarr 3.3.4-1
CVE-2013-2091
- dolibarr 3.3.4-1
CVE-2013-2090 [Remote command Injection]
NOT-FOR-US: Creme Fraiche Ruby Gem
CVE-2013-2089 [owncloud: oC-SA-2013-026]
- owncloud <not-affected> (Only affects 5.0.x)
CVE-2013-2087 [gallery: multiple xss]
- gallery <not-affected> (Vulnerable code not present)
CVE-2013-2086 [owncloud: oC-SA-2013-027]
- owncloud <not-affected> (Only owncloud 5.0.x)
CVE-2013-2085 [owncloud: oC-SA-2013-020]
- owncloud <not-affected> (Only affects 5.0.x)
CVE-2013-2075
- chicken <not-affected> (Incomplete fix was never applied)
CVE-2013-2074 [prints passwords contained in HTTP URLs in error messages]
- kde4libs 4:4.10.5-1 (low; bug #707776)
CVE-2013-2073 [Does not validate HTTPS server certificate]
- transifex-client 0.9-1 (low)
CVE-2013-2060
NOT-FOR-US: OpenShift
CVE-2013-2057
NOT-FOR-US: YaBB
CVE-2013-2049
NOT-FOR-US: CloudForms Management Engine
CVE-2013-2048 [owncloud: oC-SA-2013-025]
- owncloud <not-affected> (Only affects 5.0.x)
CVE-2013-2047 [owncloud: oC-SA-2013-023]
- owncloud <not-affected> (Only 5.0.x)
CVE-2013-2046 [owncloud: oC-SA-2013-019]
- owncloud <not-affected> (Only affects 4.5.x)
CVE-2013-2045 [owncloud: oC-SA-2013-019]
- owncloud <not-affected> (Only affects 5.0.x)
CVE-2013-2044 [owncloud: oC-SA-2013-022]
- owncloud <not-affected> (Only 5.0.x)
CVE-2013-2043 [owncloud: oC-SA-2013-024]
- owncloud <not-affected> (Only 5.0.x and 4.5.x)
CVE-2013-2042 [owncloud: oC-SA-2013-021]
- owncloud 4.0.15debian-1
CVE-2013-2041 [owncloud: oC-SA-2013-021]
- owncloud <not-affected> (Only affects 5.0.x)
CVE-2013-2040 [owncloud: oC-SA-2013-021]
- owncloud 4.0.15debian-1
CVE-2013-2039 [owncloud: oC-SA-2013-020]
- owncloud 4.0.15debian-1
CVE-2013-2038 [DoS (packet parser crash) in the AIS driver when processing malformed packet]
- gpsd 3.6-5 (bug #706665)
CVE-2013-2034 [jenkins CSRF]
- jenkins 1.509.2+dfsg-1 (bug #706725)
CVE-2013-2033 [jenkins XSS]
- jenkins 1.509.2+dfsg-1 (bug #706725)
CVE-2013-2025
NOT-FOR-US: Ushahidi
CVE-2013-2024 [OS command injection vulnerability in Chicken Scheme]
- chicken 4.8.0.3-1 (bug #706525)
CVE-2013-2019 [stack overflow vulnerabilities in the XML parser]
- boinc 6.13.6+dfsg-1 (low)
CVE-2013-2018 [SQL injections in the server-side scheduler code]
- boinc 7.0.65+dfsg-1 (low)
CVE-2013-2016 [qemu: virtio: out-of-bounds config space access]
- qemu 1.5.0+dfsg-1 (bug #710822)
CVE-2013-2014 [no limitation for requests and headers size which can cause a crash]
- keystone 2013.1.1-2 (bug #708515)
CVE-2013-2012 [autojump profile will load random stuff from a directory called custom_install]
- autojump <not-affected> (vulnerable code not present for unstable)
CVE-2013-2011
NOT-FOR-US: WP Super Cache
CVE-2013-2010
NOT-FOR-US: W3 Total Cache
CVE-2013-2009
NOT-FOR-US: WP Super Cache
CVE-2013-2008
NOT-FOR-US: WP Super Cache
CVE-2013-1980
- xmp 3.4.0-3 (low; bug #706667)
CVE-2013-1973
NOT-FOR-US: Drupal contributed module
CVE-2013-1967 [mediaelement flashmediaelement XSS]
- owncloud <not-affected> (Vulnerable code not present)
CVE-2013-1963
- owncloud <not-affected> (Vulnerable code not present)
CVE-2013-1951
- mediawiki 1:1.19.5-1
CVE-2013-1946
NOT-FOR-US: RESTful Web Services (RESTWS) Drupal cotributed module
CVE-2013-1941 [Postgre: Insecure database password generator]
- owncloud 5.0.4~rc1+dfsg-1
CVE-2013-1939 [Windows: Local file disclosure]
- owncloud <not-affected> (Windows version only)
CVE-2013-1938
NOT-FOR-US: Zimbra
CVE-2013-1934 [mantis: XSS issue in adm_config_report.php when displaying complex value]
- mantis <removed> (low; bug #717482)
CVE-2013-1932 [mantis: XSS vulnerability on Configuration Report page]
- mantis <not-affected> (affects Mantis 1.2.13 only)
CVE-2013-1931 [mantis: XSS vulnerability when deleting a version]
- mantis <not-affected> (affects Mantis 1.2.14 only)
CVE-2013-1930 [mantis: Close button available to users despite workflow restrictions]
- mantis <not-affected> (affects only Mantis 1.2.12 and later)
CVE-2013-1924
NOT-FOR-US: Commerce Skrill Drupal module
CVE-2013-1916
NOT-FOR-US: WordPress plugin
CVE-2013-1910 [Not removing bad metadata and using it in next run]
- yum <unfixed> (unimportant)
CVE-2013-1904 [roundcube variable overwrite]
- roundcube 0.7.2-9
CVE-2013-1895 [concurrency issue leading to auth bypass]
- python-bcrypt <removed> (bug #704030)
CVE-2013-1893
- owncloud <not-affected> (only affecting 5.0 branch)
CVE-2013-1890
- owncloud <not-affected> (only affecting 5.0 branch)
CVE-2013-1889
- libapache2-mod-ruid2 0.9.8-1 (low; bug #704066)
CVE-2013-1886
NOT-FOR-US: Red Hat Certificate System
CVE-2013-1885
NOT-FOR-US: Red Hat Certificate System
CVE-2013-1883 [mantis: remote DoS]
- mantis <not-affected> (only affects 1.2.12 to 1.2.14)
CVE-2013-1880 [XSS vulnerability in portfolioPublish demo application]
- activemq <not-affected> (portfolio demo app not shipped in Debian package)
CVE-2013-1874 [Chicken Scheme: code execution]
- chicken 4.8.0.3-1 (low; bug #702410)
CVE-2013-1864 [Ekiga billion laughs flaw in ptlib]
NOTE: http://www.openwall.com/lists/oss-security/2013/03/15/6
CVE-2013-1853 [Almanah doesn't encrypt the database]
- almanah 0.9.1-1 (bug #702905)
CVE-2013-1851 [user_migrate: Local file disclosure]
- owncloud 4.0.8debian-1.6 (bug #703094)
CVE-2013-1850 [Contacts: Bypass of file blacklist]
- owncloud 4.0.8debian-1.6 (bug #703094)
CVE-2013-1841 [Reverse lookup issue in Net::Server]
- libnet-server-perl <unfixed> (low; bug #702914)
CVE-2013-1822
- owncloud <not-affected> (owncloud stable4 (4.0.x) is not affected)
CVE-2013-1820
NOT-FOR-US: tuned (RH-specific powersaving tool)
CVE-2013-1818 [mediawiki mwdoc-filter.php information disclosure]
- mediawiki <not-affected> (mwdoc-filter.php introduced in 1.20)
CVE-2013-1817 [mediawiki information disclosure in unblock API]
- mediawiki 1:1.19.4-1 (bug #702305)
CVE-2013-1816 [mediawiki insecure curl usage]
- mediawiki 1:1.19.4-1
CVE-2013-1811 [Reporter can change issue status to 'new']
- mantis <removed> (low; bug #698481)
CVE-2013-1810 [summary.php category/project names XSS vulnerability]
- mantis <not-affected> (only affects MantisBT 1.2.12)
CVE-2013-1809 [Gambas creates hijackable directory in /tmp]
- gambas3 3.5.1-1 (low; bug #702184)
CVE-2013-1771 [monkey: world-readable logdir]
- monkey <removed> (low)
CVE-2013-1770 [XSS issues in views_view.php]
- ganglia <unfixed> (low; bug #700158)
CVE-2013-1764
- packagekit <not-affected> (Zypp backend specific to SuSE)
CVE-2013-1753
- python2.5 <removed> (low)
CVE-2013-1752
- python2.5 <removed> (low)
CVE-2013-1751
- twiki <removed>
CVE-2013-1689
[wheezy] - iceape <end-of-life>
CVE-2013-1666
- foswiki <itp> (bug #509864)
CVE-2013-1470 [XSS in geeklog]
NOTE: There was a RFP long time ago, bug #203818
CVE-2013-1437 [Code execution when gathering version metadata]
- perl 5.18.1-2
CVE-2013-1436 [code injection]
- xmonad-contrib 0.11.2-1 (low)
CVE-2013-1429 [Lintian unsafe symlinks]
- lintian 2.5.10.5 (bug #705553; unimportant)
CVE-2013-1426 [mahara: stored XSS in tinyMCE editor]
- mahara <removed>
CVE-2013-1425 [ldap-git-backup: Incorrect directory permissions exposes password hashes]
- ldap-git-backup 1.0.4-1 (bug #699227)
CVE-2013-0243 [Basic constraints vulnerability]
- haskell-tls-extra 0.4.6.1-1 (bug #698545)
CVE-2013-1376
NOT-FOR-US: Adobe Reader
CVE-2013-0870 [libavcodec/vp3.c: 14c8ee00ffd9d45e6e0c6f11a957ce7e56f7eb3a]
- ffmpeg <not-affected> (No threading support in vp3 from ffmpeg 0.5)
CVE-2013-0350 [writes content from TCP streams to public readable file /tmp/smtp.log]
- pktstat 1.8.5-3 (bug #701211)
CVE-2013-0347 [webfs world-readable logdir]
- webfs 1.21+ds1-9 (low; bug #701638)
CVE-2013-0346 [tomcat world-readable logdir]
- tomcat6 <not-affected> (Log files are owned by tomcat:tomcat)
CVE-2013-0345 [varnish world-readable logdir]
- varnish <not-affected> (Logfiles are owned by varnishlog:varnishlog)
CVE-2013-0342 [CreateID() creates serialized packet IDs for RADIUS]
- pyrad <unfixed> (low; bug #701151)
CVE-2013-0336 [DoS when connecting with a missing username/dn]
- 389-ds-base <unfixed> (bug #704077)
CVE-2013-0326
- nova <unfixed> (low)
CVE-2013-0307 [XSS vulnerability]
- owncloud 4.0.8debian-1.5 (bug #701115)
CVE-2013-0303 [Multiple code executions]
- owncloud 4.0.8debian-1.5 (bug #701115)
CVE-2013-0301 [Multiple CSRF vulnerabilities]
- owncloud 4.0.8debian-1.5 (bug #701115)
CVE-2013-0300 [Multiple CSRF vulnerabilities]
- owncloud <not-affected> (Vulnerably code not present, only affects 4.5 branch)
CVE-2013-0299 [Multiple CSRF vulnerabilities]
- owncloud 4.0.8debian-1.5 (bug #701115)
CVE-2013-0298 [XSS vulnerability]
- owncloud <not-affected> (Vulnerably code not present, only affects 4.5 branch)
CVE-2013-0297 [XSS vulnerability]
- owncloud 4.0.8debian-1.5 (bug #701115)
CVE-2013-0296 [creates temp files with too wide permissions]
- pigz 2.2.4-2 (low; bug #700608)
CVE-2013-0294 [potentially predictable password hashing]
- pyrad 2.0-2 (low; bug #700669)
CVE-2013-0293 [Lock screen accepts F2 to drop to shell]
- ovirt-node <itp> (bug #502024)
CVE-2013-0289 [missing SSL subject verification]
- isync 1.0.4-2.2 (low; bug #701052)
CVE-2013-0267
NOT-FOR-US: Apache VCL
CVE-2013-0264
NOT-FOR-US: Cumin
CVE-2013-0250 [corosync: Remote DoS due improper HMAC initialization]
- corosync <not-affected> (Introduced in v1.99.8-2-ge925f42; bug #699615)
CVE-2013-0234
- elgg <itp> (bug #526197)
CVE-2013-0204 [Code execution in external storage]
- owncloud <not-affected> (Vulnerably code not present, only affects 4.5 branch)
CVE-2013-0203 [XSS vulnerabilities]
- owncloud 4.0.8debian-1.4 (bug #698737)
CVE-2013-0202 [XSS vulnerabilities]
- owncloud 4.0.8debian-1.4 (bug #698737)
CVE-2013-0201 [XSS vulnerabilities]
- owncloud 4.0.8debian-1.4 (bug #698737)
CVE-2013-0199
NOT-FOR-US: FreeIPA
CVE-2013-0197 [XSS vulnerability with match_type filter]
- mantis <not-affected> (This only affects the 1.2.12 version, which isn't present in Debian, bug #698481)
CVE-2013-0195 [Unspecified XSS]
- piwik <itp> (bug #506933)
CVE-2013-0194 [Unspecified XSS]
- piwik <itp> (bug #506933)
CVE-2013-0193 [Unspecified XSS]
- piwik <itp> (bug #506933)
CVE-2013-0192
NOT-FOR-US: Simple Machines Forum
CVE-2013-0191 [pam-pgsql NULL password handling issue]
- pam-pgsql 0.7.3.1-4 (bug #698241)
CVE-2013-0185
NOT-FOR-US: ManageIQ EVM (CloudForms)
CVE-2013-0178 [redis 2.4: Insecure temporary flaw use for redis service's vm swap file]
- redis 2:2.6.0-1 (low)
CVE-2013-0177
NOT-FOR-US: OFBiz
CVE-2013-0161
NOT-FOR-US: Havalite CMS
CVE-2013-0159
NOT-FOR-US: Fedora build script
More information about the VIM
mailing list