Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1006241208380.19279@faron.mitre.org>
Date: Thu, 24 Jun 2010 12:16:37 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE requests: maradns, freeciv, rbot, gitolite,
 gource, shib, kvirc


On Thu, 10 Jun 2010, Moritz Muehlenhoff wrote:

> Hi,
> Please assign CVE IDs for these issues current present in the Debian
> Security Tracker, but for which no CVE IDs have been assigned so far:
>
> 1. maradns
> http://maradns.org/download/maradns-1.4.02-parse_segfault.patch
> Fixed in 1.4.03

Use CVE-2010-2444

> 2. freeciv
> http://gna.org/bugs/?15624
> Fixed in 2.2.1 and 2.3.0

Use CVE-2010-2445

> 3. rbot (http://ruby-rbot.org/)
> http://www.securityfocus.com/archive/1/509719/30/0/threaded

Use CVE-2010-2446

> 4. gitolite
> http://secunia.com/advisories/39587/
> http://github.com/sitaramc/gitolite/commit/1e06fea3b6959faeb72d8dca46cd4753ada48637
> http://github.com/sitaramc/gitolite/commit/5fd9328c1cd1e7c576b6530b3253061c68b159aa

These two appear to be about "not filtering src/ or hooks/ from pathnames"

Use CVE-2010-2447
> http://github.com/sitaramc/gitolite/commit/5deffee3cff5f9a13c59b8c1e357c5a32487d1c3

This is OS command injection

Use CVE-2010-2448

> 5. gource
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=577958

Use CVE-2010-2449

> 6. Shibboleth:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571631

Use CVE-2010-2450

> 7. kvirc
> http://lists.omnikron.net/pipermail/kvirc/2010-May/000867.html

format strings - CVE-2010-2451

directory traversal - CVE-2010-2452


All will be filled in later.

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.