Skip to content
GitLab
Projects
Groups
Snippets
/
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
codegouv
open-software-base-yaml
Commits
ec9aaec7
Commit
ec9aaec7
authored
Dec 27, 2015
by
Emmanuel Raviart
Browse files
Add Debian security issues.
parent
5dd50dc7
Changes
27
Expand all
Hide whitespace changes
Inline
Side-by-side
audacity.yaml
View file @
ec9aaec7
...
...
@@ -93,4 +93,115 @@ debian:
large_image_url
:
http://screenshots.debian.net/screenshots/a/audacity/10821_large.png
screenshot_url
:
http://screenshots.debian.net/package/audacity
small_image_url
:
http://screenshots.debian.net/screenshots/a/audacity/10821_small.png
security_issues
:
CVE-2007-6061
:
bug
:
453283
description
:
'
Audacity
1.3.2
creates
a
temporary
directory
with
a
predictable
name
without
checking
for
previous
existence
of
that
directory,
which
allows
local
users
to
cause
a
denial
of
service
(recording
deadlock)
by
creating
the
directory
before
Audacity
is
run.
NOTE:
this
issue
can
be
leveraged
to
delete
arbitrary
files
or
directories
via
a
symlink
attack.'
releases
:
jessie
:
fixed_version
:
1.3.4-1.1
status
:
resolved
urgency
:
low
sid
:
fixed_version
:
1.3.4-1.1
status
:
resolved
urgency
:
low
squeeze
:
fixed_version
:
1.3.4-1.1
status
:
resolved
urgency
:
low
stretch
:
fixed_version
:
1.3.4-1.1
status
:
resolved
urgency
:
low
wheezy
:
fixed_version
:
1.3.4-1.1
status
:
resolved
urgency
:
low
scope
:
remote
CVE-2009-0490
:
bug
:
514138
description
:
Stack-based buffer overflow in the String_parse::get_nonspace_quoted function in lib-src/allegro/strparse.cpp
in Audacity 1.2.6 and other versions before 1.3.6 allows remote attackers to cause a denial of service (crash) and
possibly execute arbitrary code via a .gro file containing a long string.
releases
:
jessie
:
fixed_version
:
1.3.6-1
status
:
resolved
urgency
:
high**
sid
:
fixed_version
:
1.3.6-1
status
:
resolved
urgency
:
high**
squeeze
:
fixed_version
:
1.3.6-1
status
:
resolved
urgency
:
high**
stretch
:
fixed_version
:
1.3.6-1
status
:
resolved
urgency
:
high**
wheezy
:
fixed_version
:
1.3.6-1
status
:
resolved
urgency
:
high**
scope
:
remote
CVE-2009-3560
:
bug
:
560901
description
:
The big2_toUtf8 function in lib/xmltok.c in libexpat in Expat 2.0.1, as used in the XML-Twig module for
Perl, allows context-dependent attackers to cause a denial of service (application crash) via an XML document with
malformed UTF-8 sequences that trigger a buffer over-read, related to the doProlog function in lib/xmlparse.c, a different
vulnerability than CVE-2009-2625 and CVE-2009-3720.
releases
:
jessie
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
sid
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
squeeze
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
stretch
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
wheezy
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
scope
:
remote
CVE-2009-3720
:
bug
:
551936
description
:
The updatePosition function in lib/xmltok_impl.c in libexpat in Expat 2.0.1, as used in Python, PyXML,
w3c-libwww, and other software, allows context-dependent attackers to cause a denial of service (application crash)
via an XML document with crafted UTF-8 sequences that trigger a buffer over-read, a different vulnerability than CVE-2009-2625.
releases
:
jessie
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
sid
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
squeeze
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
stretch
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
wheezy
:
fixed_version
:
1.3.2-1
status
:
resolved
urgency
:
unimportant
scope
:
remote
name
:
audacity
backuppc.yaml
View file @
ec9aaec7
...
...
@@ -219,4 +219,135 @@ debian:
large_image_url
:
http://screenshots.debian.net/screenshots/b/backuppc/322_large.png
screenshot_url
:
http://screenshots.debian.net/package/backuppc
small_image_url
:
http://screenshots.debian.net/screenshots/b/backuppc/322_small.png
security_issues
:
CVE-2009-3369
:
bug
:
542218
description
:
CgiUserConfigEdit in BackupPC 3.1.0, when SSH keys and Rsync are in use in a multi-user environment, does
not restrict users from the ClientNameAlias function, which allows remote authenticated users to read and write sensitive
files by modifying ClientNameAlias to match another system, then initiating a backup or restore.
releases
:
jessie
:
fixed_version
:
3.1.0-8
status
:
resolved
urgency
:
low
sid
:
fixed_version
:
3.1.0-8
status
:
resolved
urgency
:
low
squeeze
:
fixed_version
:
3.1.0-8
status
:
resolved
urgency
:
low
stretch
:
fixed_version
:
3.1.0-8
status
:
resolved
urgency
:
low
wheezy
:
fixed_version
:
3.1.0-8
status
:
resolved
urgency
:
low
scope
:
remote
CVE-2011-3361
:
bug
:
641450
description
:
Cross-site scripting (XSS) vulnerability in CGI/Browse.pm in BackupPC 3.2.0 and possibly other versions
before 3.2.1 allows remote attackers to inject arbitrary web script or HTML via the num parameter in a browse action
to index.cgi.
releases
:
jessie
:
fixed_version
:
3.2.1-2
status
:
resolved
urgency
:
medium**
sid
:
fixed_version
:
3.2.1-2
status
:
resolved
urgency
:
medium**
squeeze
:
fixed_version
:
3.1.0-9.1
status
:
resolved
urgency
:
medium**
stretch
:
fixed_version
:
3.2.1-2
status
:
resolved
urgency
:
medium**
wheezy
:
fixed_version
:
3.2.1-2
status
:
resolved
urgency
:
medium**
scope
:
remote
CVE-2011-4923
:
bug
:
646865
description
:
Cross-site scripting (XSS) vulnerability in View.pm in BackupPC 3.0.0, 3.1.0, 3.2.0, 3.2.1, and possibly
earlier allows remote attackers to inject arbitrary web script or HTML via the num parameter in a view action to index.cgi,
related to the log file viewer, a different vulnerability than CVE-2011-3361.
releases
:
jessie
:
fixed_version
:
3.2.1-2
status
:
resolved
urgency
:
medium**
sid
:
fixed_version
:
3.2.1-2
status
:
resolved
urgency
:
medium**
squeeze
:
fixed_version
:
3.1.0-9.1
status
:
resolved
urgency
:
medium**
stretch
:
fixed_version
:
3.2.1-2
status
:
resolved
urgency
:
medium**
wheezy
:
fixed_version
:
3.2.1-2
status
:
resolved
urgency
:
medium**
scope
:
remote
CVE-2011-5081
:
bug
:
661011
description
:
Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other
earlier versions allows remote attackers to inject arbitrary web script or HTML via the share parameter in a RestoreFile
action to index.cgi.
releases
:
jessie
:
fixed_version
:
3.1.0-9.1
status
:
resolved
urgency
:
low
sid
:
fixed_version
:
3.1.0-9.1
status
:
resolved
urgency
:
low
squeeze
:
fixed_version
:
3.1.0-9.1
status
:
resolved
urgency
:
medium**
stretch
:
fixed_version
:
3.1.0-9.1
status
:
resolved
urgency
:
low
wheezy
:
fixed_version
:
3.1.0-9.1
status
:
resolved
urgency
:
low
scope
:
remote
TEMP-0000000-B5C878
:
releases
:
jessie
:
fixed_version
:
3.1.0-6
status
:
resolved
urgency
:
not yet assigned
sid
:
fixed_version
:
3.1.0-6
status
:
resolved
urgency
:
not yet assigned
squeeze
:
fixed_version
:
3.1.0-6
status
:
resolved
urgency
:
not yet assigned
stretch
:
fixed_version
:
3.1.0-6
status
:
resolved
urgency
:
not yet assigned
wheezy
:
fixed_version
:
3.1.0-6
status
:
resolved
urgency
:
not yet assigned
name
:
backuppc
clamav.yaml
View file @
ec9aaec7
This diff is collapsed.
Click to expand it.
cups.yaml
View file @
ec9aaec7
This diff is collapsed.
Click to expand it.
dia.yaml
View file @
ec9aaec7
...
...
@@ -89,4 +89,164 @@ debian:
large_image_url
:
http://screenshots.debian.net/screenshots/d/dia/5127_large.png
screenshot_url
:
http://screenshots.debian.net/package/dia
small_image_url
:
http://screenshots.debian.net/screenshots/d/dia/5127_small.png
security_issues
:
CVE-2005-2966
:
bug
:
330890
description
:
The Python SVG import plugin (diasvg_import.py) for DIA 0.94 and earlier allows user-assisted attackers
to execute arbitrary commands via a crafted SVG file.
releases
:
jessie
:
fixed_version
:
0.94.0-15
status
:
resolved
urgency
:
medium
sid
:
fixed_version
:
0.94.0-15
status
:
resolved
urgency
:
medium
squeeze
:
fixed_version
:
0.94.0-15
status
:
resolved
urgency
:
medium
stretch
:
fixed_version
:
0.94.0-15
status
:
resolved
urgency
:
medium
wheezy
:
fixed_version
:
0.94.0-15
status
:
resolved
urgency
:
medium
scope
:
remote
CVE-2006-1550
:
bug
:
360566
description
:
Multiple buffer overflows in the xfig import code (xfig-import.c) in Dia 0.87 and later before 0.95-pre6
allow user-assisted attackers to have an unknown impact via a crafted xfig file, possibly involving an invalid (1)
color index, (2) number of points, or (3) depth.
releases
:
jessie
:
fixed_version
:
0.94.0-18
status
:
resolved
urgency
:
high**
sid
:
fixed_version
:
0.94.0-18
status
:
resolved
urgency
:
high**
squeeze
:
fixed_version
:
0.94.0-18
status
:
resolved
urgency
:
high**
stretch
:
fixed_version
:
0.94.0-18
status
:
resolved
urgency
:
high**
wheezy
:
fixed_version
:
0.94.0-18
status
:
resolved
urgency
:
high**
scope
:
remote
CVE-2006-2453
:
bug
:
368202
description
:
Multiple unspecified format string vulnerabilities in Dia have unspecified impact and attack vectors, a
different set of issues than CVE-2006-2480.
releases
:
jessie
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
medium
sid
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
medium
squeeze
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
medium
stretch
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
medium
wheezy
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
medium
scope
:
remote
CVE-2006-2480
:
bug
:
368202
description
:
'
Format
string
vulnerability
in
Dia
0.94
allows
user-assisted
attackers
to
cause
a
denial
of
service
(crash)
and
possibly
execute
arbitrary
code
by
triggering
errors
or
warnings,
as
demonstrated
via
format
string
specifiers
in
a
.bmp
filename.
NOTE:
the
original
exploit
was
demonstrated
through
a
command
line
argument,
but
there
are
other
mechanisms
for
input
that
are
automatically
processed
by
Dia,
such
as
a
crafted
.dia
file.'
releases
:
jessie
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
low
sid
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
low
squeeze
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
low
stretch
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
low
wheezy
:
fixed_version
:
0.95.0-4
status
:
resolved
urgency
:
low
scope
:
remote
CVE-2007-3408
:
description
:
Multiple unspecified vulnerabilities in Dia before 0.96.1-6 have unspecified attack vectors and impact,
probably involving the use of vulnerable FreeType libraries that contain CVE-2007-2754 and/or CVE-2007-1351.
releases
:
jessie
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
sid
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
squeeze
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
stretch
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
wheezy
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
scope
:
remote
CVE-2008-5984
:
bug
:
504251
description
:
Untrusted search path vulnerability in the Python plugin in Dia 0.96.1, and possibly other versions, allows
local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to
a vulnerability in the PySys_SetArgv function (CVE-2008-5983).
releases
:
jessie
:
fixed_version
:
0.96.1-7.1
status
:
resolved
urgency
:
low
sid
:
fixed_version
:
0.96.1-7.1
status
:
resolved
urgency
:
low
squeeze
:
fixed_version
:
0.96.1-7.1
status
:
resolved
urgency
:
low
stretch
:
fixed_version
:
0.96.1-7.1
status
:
resolved
urgency
:
low
wheezy
:
fixed_version
:
0.96.1-7.1
status
:
resolved
urgency
:
low
scope
:
local
name
:
dia
eclipse.yaml
View file @
ec9aaec7
...
...
@@ -53,4 +53,59 @@ debian:
large_image_url
:
http://screenshots.debian.net/screenshots/e/eclipse/9130_large.png
screenshot_url
:
http://screenshots.debian.net/package/eclipse
small_image_url
:
http://screenshots.debian.net/screenshots/e/eclipse/9130_small.png
security_issues
:
CVE-2008-7271
:
description
:
Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help
Server) in Eclipse IDE, possibly 3.3.2, allow remote attackers to inject arbitrary web script or HTML via (1) the
searchWord parameter to help/advanced/searchView.jsp or (2) the workingSet parameter in an add action to help/advanced/workingSetManager.jsp,
a different issue than CVE-2010-4647.
releases
:
jessie
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
sid
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
squeeze
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
stretch
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
wheezy
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
scope
:
remote
CVE-2010-4647
:
bug
:
611849
description
:
Multiple cross-site scripting (XSS) vulnerabilities in the Help Contents web application (aka the Help
Server) in Eclipse IDE before 3.6.2 allow remote attackers to inject arbitrary web script or HTML via the query string
to (1) help/index.jsp or (2) help/advanced/content.jsp.
releases
:
jessie
:
fixed_version
:
3.5.2-9
status
:
resolved
urgency
:
low
sid
:
fixed_version
:
3.5.2-9
status
:
resolved
urgency
:
low
squeeze
:
fixed_version
:
3.5.2-6squeeze2
status
:
resolved
urgency
:
medium**
stretch
:
fixed_version
:
3.5.2-9
status
:
resolved
urgency
:
low
wheezy
:
fixed_version
:
3.5.2-9
status
:
resolved
urgency
:
low
scope
:
remote
name
:
eclipse
elasticsearch.yaml
View file @
ec9aaec7
...
...
@@ -55,4 +55,121 @@ debian:
\
index
Lucene
\n
-
možnosti
Lucene
jednoducho
vystavené
prostredníctvom
jednoduchej
\n
konfigurácie
a
zásuvných
\
\
modulov
\n
*
konzistencia
na
úrovni
jednotlivých
operácií
\n
-
operácie
na
úrovni
jedného
dokumentu
sú
atomické,
\
\
konzistentné,
\n
izolované
a
pretrvávajúce
(ACID)
\n
"
security_issues
:
CVE-2014-3120
:
bug
:
759736
description
:
'
The
default
configuration
in
Elasticsearch
before
1.2
enables
dynamic
scripting,
which
allows
remote
attackers
to
execute
arbitrary
MVEL
expressions
and
Java
code
via
the
source
parameter
to
_search.
NOTE:
this
only
violates
the
vendor'
'
s
intended
security
policy
if
the
user
does
not
run
Elasticsearch
in
its
own
independent
virtual
machine.'
releases
:
jessie
:
fixed_version
:
1.0.3+dfsg-3
status
:
resolved
urgency
:
medium**
sid
:
fixed_version
:
1.0.3+dfsg-3
status
:
resolved
urgency
:
medium**
stretch
:
fixed_version
:
1.0.3+dfsg-3
status
:
resolved
urgency
:
medium**
scope
:
remote
CVE-2014-6439
:
bug
:
763958
description
:
Cross-site scripting (XSS) vulnerability in the CORS functionality in Elasticsearch before 1.4.0.Beta1
allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
releases
:
jessie
:
fixed_version
:
1.0.3+dfsg-4
status
:
resolved
urgency
:
low
sid
:
fixed_version
:
1.0.3+dfsg-4
status
:
resolved
urgency
:
low
stretch
:
fixed_version
:
1.0.3+dfsg-4
status
:
resolved
urgency
:
low
scope
:
remote
CVE-2015-1427
:
description
:
The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers
to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
releases
:
jessie
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
sid
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
stretch
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
scope
:
remote
CVE-2015-3337
:
description
:
Directory traversal vulnerability in Elasticsearch before 1.4.5 and 1.5.x before 1.5.2, when a site plugin
is enabled, allows remote attackers to read arbitrary files via unspecified vectors.
releases
:
jessie
:
fixed_version
:
1.0.3+dfsg-5+deb8u1
status
:
resolved
urgency
:
medium**
sid
:
fixed_version
:
1.0.3+dfsg-7
status
:
resolved
urgency
:
medium**
stretch
:
fixed_version
:
1.0.3+dfsg-7
status
:
resolved
urgency
:
medium**
scope
:
remote
CVE-2015-4165
:
bug
:
788471
releases
:
jessie
:
status
:
open
urgency
:
end-of-life
sid
:
fixed_version
:
1.6.0+dfsg-1
status
:
resolved
urgency
:
not yet assigned
stretch
:
fixed_version
:
1.6.0+dfsg-1
status
:
resolved
urgency
:
not yet assigned
CVE-2015-5377
:
bug
:
792617
releases
:
jessie
:
status
:
open
urgency
:
end-of-life
sid
:
fixed_version
:
1.6.1+dfsg-1
status
:
resolved
urgency
:
not yet assigned
stretch
:
fixed_version
:
1.6.1+dfsg-1
status
:
resolved
urgency
:
not yet assigned
CVE-2015-5531
:
bug
:
792617
description
:
Directory traversal vulnerability in Elasticsearch before 1.6.1 allows remote attackers to read arbitrary
files via unspecified vectors related to snapshot API calls.
releases
:
jessie
:
status
:
open
urgency
:
end-of-life
sid
:
fixed_version
:
1.6.1+dfsg-1
status
:
resolved
urgency
:
medium**
stretch
:
fixed_version
:
1.6.1+dfsg-1
status
:
resolved
urgency
:
medium**
scope
:
remote
name
:
elasticsearch
filezilla.yaml
View file @
ec9aaec7
...
...
@@ -115,4 +115,188 @@ debian:
large_image_url
:
http://screenshots.debian.net/screenshots/f/filezilla/13704_large.png
screenshot_url
:
http://screenshots.debian.net/package/filezilla
small_image_url
:
http://screenshots.debian.net/screenshots/f/filezilla/13704_small.png
security_issues
:
CVE-2006-2403
:
description
:
Buffer overflow in FileZilla before 2.2.23 allows remote attackers to execute arbitrary commands via unknown
attack vectors.
releases
:
jessie
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
sid
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
squeeze
:
fixed_version
:
'
0'
status
:
resolved
urgency
:
unimportant
wheezy
: